PR #591's ATA Create parser guard requires num_acct_indices >= 3, then reads the mint from account index 3 (the fourth account) and sets has_mint only when num_acct_indices >= 4.
With exactly three accounts:
- the instruction remains SOL_INSTR_ATA_CREATE / VERIFIED;
- copy_account() cannot supply index 3, so mint remains zero-filled;
- has_mint is false;
- solana_confirmInstruction() conditionally skips the mint screen.
This defeats the PR's stated remediation that payer, associated address, owner, and mint are all disclosed. The new AtaCreateShortAccountsIsOpaque test only supplies two accounts, so it does not exercise the exact off-by-one case.
Required fix:
- require num_acct_indices >= 4 before classifying ATA Create/CreateIdempotent as verified;
- set has_mint=true after that guard;
- add a regression proving exactly three accounts is opaque and four accounts preserves/discloses indices 0,1,2,3.
Independent PR #587 already implements the four-account guard and the exact 3-vs-4 regression. Do not merge #591 at the current head d7a9da0.
PR #591's ATA Create parser guard requires num_acct_indices >= 3, then reads the mint from account index 3 (the fourth account) and sets has_mint only when num_acct_indices >= 4.
With exactly three accounts:
This defeats the PR's stated remediation that payer, associated address, owner, and mint are all disclosed. The new AtaCreateShortAccountsIsOpaque test only supplies two accounts, so it does not exercise the exact off-by-one case.
Required fix:
Independent PR #587 already implements the four-account guard and the exact 3-vs-4 regression. Do not merge #591 at the current head d7a9da0.