Definition
An address derived deterministically from seeds and a program ID that has no private key, so only that program can sign for it. PDAs are used to store program-owned state and hold assets.
Why it matters
PDAs are how Solana programs own state and assets without private keys. A poor seed design can let users collide with each other’s accounts, or let an attacker substitute an account they control.
What to check
- Ask how seeds are chosen and whether the canonical bump is stored and checked.
- Ask how PDAs are validated in every instruction that uses them.
Related terms
- AccountThe unit of storage on Solana.
- CPI (cross-program invocation)A call from one Solana program to another within the same transaction, for example a DeFi program calling the Token Program to move tokens.
- ProgramSolana’s term for a smart contract: executable code deployed to an account.
Get an indicative price range and timeline for auditing your Solana programs, then compare verified auditors.
Estimate your audit cost →