check that the owners of registry accounts are system accounts

token/confidential-transfer/elgamal-registry/src/processor.rs

@@ -13,7 +13,7 @@ use {
         program_error::ProgramError,
         pubkey::Pubkey,
         rent::Rent,
-        system_instruction,
+        system_instruction, system_program,
         sysvar::Sysvar,
     },
     solana_zk_sdk::zk_elgamal_proof_program::proof_data::pubkey_validity::{
@@ -35,6 +35,10 @@ pub fn process_create_registry_account(
     let wallet_account_info = next_account_info(account_info_iter)?;
     let system_program_info = next_account_info(account_info_iter)?;
 
+    if wallet_account_info.owner != &system_program::id() {
+        return Err(ProgramError::IncorrectProgramId);
+    }
+
     if !wallet_account_info.is_signer {
         return Err(ProgramError::MissingRequiredSignature);
     }