Program ID Verification (CPI)
Security · Abyss
A mandatory security check where a program verifies that a program account passed for a Cross-Program Invocation matches the expected hard-coded program ID before executing the CPI. Without this check, an attacker can substitute a malicious program that mimics the expected interface (e.g., a fake Token Program that silently approves all transfers). In native Solana programs, this requires asserting program_account.key() == &expected_program::ID; in Anchor, the Program<'info, T> type wrapper enforces this automatically by comparing the account's key against T's declared program ID.