require owner signature when creating registry account

Author: samkim-crypto

token/confidential-transfer/elgamal-registry/src/instruction.rs

@@ -19,7 +19,7 @@ pub enum RegistryInstruction {
     ///
     /// 0. `[writable, signer]` The funding account (must be a system account)
     /// 1. `[writable]` The account to be created
-    /// 2. `[]` The wallet address (will also be the owner address for the
+    /// 2. `[signer]` The wallet address (will also be the owner address for the
     ///    registry account)
     /// 3. `[]` System program
     /// 4. `[]` Instructions sysvar if `VerifyPubkeyValidity` is included in the
@@ -110,7 +110,7 @@ pub fn create_registry(
     let mut accounts = vec![
         AccountMeta::new(*funding_address, true),
         AccountMeta::new(elgamal_registry_address, false),
-        AccountMeta::new_readonly(*owner_address, false),
+        AccountMeta::new_readonly(*owner_address, true),
         AccountMeta::new_readonly(system_program::id(), false),
     ];
     let proof_instruction_offset = proof_instruction_offset(&mut accounts, proof_location);

token/confidential-transfer/elgamal-registry/src/processor.rs

@@ -35,6 +35,10 @@ pub fn process_create_registry_account(
     let wallet_account_info = next_account_info(account_info_iter)?;
     let system_program_info = next_account_info(account_info_iter)?;
 
+    if !wallet_account_info.is_signer {
+        return Err(ProgramError::MissingRequiredSignature);
+    }
+
     // zero-knowledge proof certifies that the supplied ElGamal public key is valid
     let proof_context = verify_and_extract_context::<
         PubkeyValidityProofData,

token/program-2022-test/tests/confidential_transfer.rs

@@ -2862,7 +2862,7 @@ async fn confidential_transfer_configure_token_account_with_registry() {
     let tx = Transaction::new_signed_with_payer(
         &instructions,
         Some(&ctx.payer.pubkey()),
-        &[&ctx.payer],
+        &[&ctx.payer, &alice],
         ctx.last_blockhash,
     );
     ctx.banks_client.process_transaction(tx).await.unwrap();