Anchor V2 Proposal

[mixy1-osec]

Anchor v2

Notes

1. Specifics will be in the issues for each of the below mentioned Features
2. We're very open to proposals for new syntax

Design Goals

1. Decrease the user burden.
2. Secure defaults.
3. Escape hatches for performance should be clear.
4. Compile-time diagnostics should be used as much as possible.
5. IDLs should be a first-tier citizen.

User-facing changes:

Language:

• Pinocchio runtime + lifetime elimination: Account<'info, T> -> Account<T>. Context<'a, 'b, 'c, 'info, T> → Context<T>. Falls out naturally from the Pinocchio migration; AccountView has no lifetime parameter.
• Unified account type: Account, AccountLoader, LazyAccount, InterfaceAccount, Signer, Program all collapse into one Account<T>. zero-copy by default inheriting from Pinocchio.
  • We might add sugar via AccountChecks, where it impls Account<System> which would have the id check on AccountView.
• Support for custom de/serializers. Looking for comments on what the API should look like here.
• removal of AccountInfo.
• CPI to become Pinocchio-like, with the implementation focusing on users no longer having to deal with runtime errors at CPI boundary.
  • Statically avoiding double-mutable-borrow errors
• make declare_id! optional
• Support legacy Accounts under anchor::legacy::{BorshAccount, LazyAccount} to ease migration.
• Introduce a performance section into the docs which documents patterns developers can use:
  For example:

  #[cfg(not(feature = "no-entrypoint"))]
  solana_program::entrypoint!(custom_entry);

  pub fn custom_entry(
      program_id: &Pubkey,
      accounts: &[AccountInfo],
      data: &[u8],
  ) -> solana_program::entrypoint::ProgramResult {
      entry(program_id, accounts, data)

      // match data[..8] {
      //     MY_DISCRIMINATOR => my_custom_handler(program_id, accounts, &data[8..]),
      //     _ => entry(program_id, accounts, data),  // fallback to Anchor
      // }
  }

  #[program]
  pub mod my_program {
      use super::*;

      pub fn normal_ix(ctx: Context<Normal>) -> Result<()> {
          Ok(())
      }
  }

Tooling:

• LiteSVM + Rust as default test framework
• node no longer packaged as a dependency with anchor

Mantainer-facing changes:

• #[derive(Accounts)] is to be reworked and broken into per-constraint-family modules with a single shared evaluation interface instead of the current spaghetti.
  • Consider splitting the #[account] helper attribute into #[deserialize], #[validate], #[cleanup]
• #[account] is to be collapsed into a single codegen path from the current 3.
• #[program] IDL generation is to be implemented as a separate pass, no longer using stdout parsing but should be properly implemented.
• All macro crates should no longer use panic! unwrap(), unimplemented!() But rather using syn::Error with proper compile-time errors.

I want to particularly emphasise the big changes here being:

• folding Account types into one
• Fixing CPI
• zero-copy by default with support for (custom?) de/serializers

Also adding two niche examples here to showcase how doing custom stuff will look like in Anchor, specifically addressing concerns during the 11th February Anchor community meetup:

Migrating Anchor V1 to V2

#[derive(Accounts)]
  pub struct MigrateV1V2 {
      #[account(mut, owner = crate::ID)]
      pub account: Account<()>,

      #[account(mut)]
      pub payer: Account<Wallet>,
      pub system_program: Account<System>,
  }

  pub fn migrate(ctx: Context<MigrateV1V2>) -> Result<()> {
      let view = ctx.accounts.account.view();
      let data = view.data();

      require!(data[..8] == AccountV1::DISCRIMINATOR, MyError::AlreadyMigrated);

      // Read old Borsh format
      let old = AccountV1::deserialize(&mut &data[8..])?;

      // Realloc if layout sizes differ
      view.realloc(8 + size_of::<AccountV2>(), false)?;

      // Write new format directly into the buffer
      view.write_as(&AccountV2 {
          authority: old.authority,
          counter: old.counter,
          label: convert_label(&old.label),
          is_active: old.is_active as u8,
          _padding: [0u8; 6],
      });

      Ok(())
  }

  and write_as is a small helper on AccountView implemented in the anchor lang:

  impl AccountView {
      /// Write a discriminator + #[repr(C)] value into the account data.
      pub fn write_as<T: AccountData>(&self, value: &T) {
          let data = self.try_borrow_mut_data().unwrap();
          data[..8].copy_from_slice(T::DISCRIMINATOR);
          unsafe {
              core::ptr::copy_nonoverlapping(
                  value as *const T as *const u8,
                  data[8..].as_mut_ptr(),
                  core::mem::size_of::<T>(),
              );
          }
      }
  }

implementing custom serde for an account

pub struct CustomAccount<T: CustomCodec> {
      view: AccountView,
      data: T,
  }

  impl<T: CustomCodec> Accounts for CustomAccount<T> {
      fn try_accounts(
          _program_id: &Pubkey,
          accounts: &mut &[AccountView],
          _ix_data: &[u8],
          _bumps: &mut B,
      ) -> Result<Self> {
          if accounts.is_empty() {
              return Err(ErrorCode::AccountNotEnoughKeys.into());
          }
          let view = accounts[0];
          *accounts = &accounts[1..];

          // Your checks
          require!(view.is_owned_by(&crate::ID));
          require!(view.data()[..8] == T::DISCRIMINATOR);

          // Your deserialization
          let data = T::decode(&view.data()[8..])?;

          Ok(Self { view, data })
      }
  }

  impl<T: CustomCodec> Deref for CustomAccount<T> {
      type Target = T;
      fn deref(&self) -> &T { &self.data }
  }

  impl<T: CustomCodec> DerefMut for CustomAccount<T> {
      fn deref_mut(&mut self) -> &mut T { &mut self.data }
  }

  impl<T: CustomCodec> AccountsExit for CustomAccount<T> {
      fn exit(&self, _program_id: &Pubkey) -> Result<()> {
          let mut buf = self.view.try_borrow_mut_data()?;
          self.data.encode(&mut buf[8..])?;
          Ok(())
      }
  }

There's some specific details here not really shown like how does Account<System> or Account<()> work or how omitting #[account] looks like. We're still looking into this and this will probably change, but currently we're considering something like:

pub struct Account<T: AccountChecks = ()> {
    view: AccountView,
    _marker: PhantomData<T>,
}

impl<T: AccountChecks> Account<T> {
    pub fn try_from(view: AccountView) -> Result<Self> {
        T::check(&view)?;
        Ok(Self { view, _marker: PhantomData })
    }

    pub fn key(&self) -> &Address { self.view.key() }
    pub fn view(&self) -> &AccountView { &self.view }
    pub fn lamports(&self) -> u64 { self.view.lamports() }
    pub fn is_writable(&self) -> bool { self.view.is_writable() }
}

impl<T: AccountChecks + AccountData> Deref for Account<T> {
    type Target = T;
    fn deref(&self) -> &T {
        unsafe { &*(self.view.data().as_ptr().add(8) as *const T) }
    }
}

impl<T: AccountChecks + AccountData> DerefMut for Account<T> {
    fn deref_mut(&mut self) -> &mut T {
        unsafe { &mut *(self.view.data().as_ptr().add(8) as *mut T) }
    }
}

[stegaBOB]

• I'm a bit conflicted on the single account type here. I'm concerned this might limit blanket trait impls and potentially cause some issues down the line. For example, with dedicated Program/Sysvar types it enables blanket AccountChecks impls, which while are still probably possible, can cause problems down the line with conflicting trait implementations.
• Having separate program/accountinfo/Account types also visually has been useful for me when looking through Accounts structs. With this change, I'm concerned about the lack of visual difference for those special account types.

Additional Questions

• CPI design elaboration? how will "Statically avoiding double-mutable-borrow errors" be done?
• Is the IDL plan with traits?
• Will the #[deserialize] and #[validate] end up merging in to TryAccounts somehow, or will that trait be split up?
• Opportunity for mut/signer/seed as traits/wrapper types to allow some of those checks at compile time. (something along the lines of https://github.com/Buzzec/anchor_traits/tree/master/traits/src?)

[jamie-osec]

Regarding the 'statically avoiding duplicate borrow error' point:

I sketched out an API like this

struct CpiAccountMut<'a, T> { key: Pubkey, _p: PhantomData<&'a mut T> }
fn for_cpi_mut(&mut self) -> CpiAccountMut<Self> {
  CpiAccountMut { key: self.pubkey, _p: PhantomData }
}

Then we provide access to the account's data via another method that takes &mut self. This ensures that you can't do

let account_data = account.borrow_mut();  // borrows account mutably
do_cpi(account.for_cpi_mut());   // second mutable borrow, requires the `account_data` borrow to be dropped
*account_data[0] = 1;   // holding this mutable borrow over the CPI will cause a borrow check error

[mixy1-osec]

Move metadata, etc.... out of anchor into packages

[mixy1-osec]

consider codama for idl due to custom account types

[mixy1-osec]

/* lib.rs */

use anchor_lang::prelude::*;
use anchor_lang::legacy::BorshAccount;
use anchor_spl::token::{Interface, Token, TokenAccount, cpi::Transfer};

pub unsafe extern "C" fn entrypoint(mut input: *mut u8) -> u64 {
    // asm handler for posting oracle update
    core::arch::asm!( ... );

    prop_amm::entry(input);
}

// alternatively..

// pub fn custom_entry(
//     program_id: &Address,
//     accounts: &[AccountView],
//     data: &[u8],
// ) -> solana_program::entrypoint::ProgramResult {
//     match data[..8] {
//         POST_ORACLE_UPDATE => post_oracle_update(program_id, accounts, &data[8..]),
//         _ => entry(program_id, accounts, data),  // fallback to Anchor
//     }
//
//     prop_amm::entry(program_id, accounts, data)
// }

#[derive(Accounts)]
pub struct Swap {
  #[account(mut, signer)]
  pub swapper: UncheckedAccount,

  #[account(mut, seeds = [b"market", market.id.as_ref()], bump = market.bump,
            has_one = base_vault, has_one = quote_vault)]
  pub market: BorshAccount<Market>, // legacy borsh path
  pub metadata: Account<Metadata>,  // zerocopy by default

  #[account(mut)] pub base_vault: Account<TokenAccount>,
  #[account(mut)] pub quote_vault: Account<TokenAccount>,
  #[account(mut)] pub swapper_base: Account<TokenAccount>,
  #[account(mut)] pub swapper_quote: Account<TokenAccount>,

  pub system_program: Program<System>,
  pub token_program: Interface<Token>,
}

#[program]
pub mod prop_amm {
  use super::*;

  pub fn swap(ctx: Context<Swap>, amount_in: u64) -> Result<()> {
      let now = Clock::get()?.slot;
      require!(now - ctx.accounts.market.last_oracle_slot <= 5, ErrorCode::StaleOracle);

      let out = amount_in * ctx.accounts.market.oracle_price / 1_000_000;

      // CPI: pinnochio style!
      Transfer {
          from: &ctx.accounts.swapper_base,
          to: &ctx.accounts.base_vault,
          authority: &ctx.accounts.swapper,
          amount: amount_in,
      }.invoke(&ctx.accounts.token_program)?;

      // PDA-signed CPI
      let bump = [ctx.accounts.market.bump];
      let id = ctx.accounts.market.id;
      let seeds: &[&[u8]] = &[b"market", id.as_ref(), &bump];

      Transfer {
          from: &ctx.accounts.quote_vault,
          to: &ctx.accounts.swapper_quote,
          authority: &ctx.accounts.market,
          amount: out,
      }.invoke_signed(&ctx.accounts.token_program, &[seeds])?;

      // view is refreshed post-CPI
      ctx.accounts.market.base_reserve += amount_in;
      ctx.accounts.market.quote_reserve -= out;

      emit!(Swapped { market: *ctx.accounts.market.key(), amount_in, out });
      Ok(())
  }
}

#[event]
pub struct Swapped {
  pub market: Pubkey,
  pub amount_in: u64,
  pub out: u64,
}

/* anchor_lang/legacy.rs — shipped as anchor::legacy::BorshAccount */
// Example impl for custom account

impl<T> AnchorAccount for BorshAccount<T>
where
    T: BorshSerialize + BorshDeserialize + Discriminator,
{
    type Data = T;

    fn load(view: AccountView) -> Result<Self> {
        let data = view.data();

        require!(data.len() >= 8, ErrorCode::AccountDiscriminatorNotFound);
        require!(
            &data[..8] == T::DISCRIMINATOR,
            ErrorCode::DiscriminatorMismatch
        );

        let data = T::try_deserialize(&mut &data[8..])?;
        Ok(Self { view, data })
    }

    fn account(&self) -> &AccountView {
        &self.view
    }

    fn try_data(&self) -> Result<&T> {
        Ok(&self.data)
    }

    fn try_data_mut(&mut self) -> Result<&mut T> {
        Ok(&mut self.data)
    }

    fn exit(&self) -> Result<()> {
        let mut buf = self.view.try_borrow_mut_data()?;

        require!(buf.len() >= 8, ErrorCode::AccountDidNotSerialize);

        self.data.serialize(&mut &mut buf[8..])?;
        Ok(())
    }
}

impl<T> Deref for BorshAccount<T>
where
    T: BorshSerialize + BorshDeserialize,
{
    type Target = T;

    fn deref(&self) -> &T {
        &self.data
    }
}

impl<T> DerefMut for BorshAccount<T>
where
    T: BorshSerialize + BorshDeserialize,
{
    fn deref_mut(&mut self) -> &mut T {
        &mut self.data
    }
}

This is what we're currently considering for the syntax changes for Anchor V2 (Including how to implement a Custom Account. Important to note that custom accounts don't necessarily need deref/derefMut implemented, the constraints work by just Implementing AnchorAccount (name subject to change)

We'll also support old Anchor V1 CPIs as well as the new Anchor V2 pinocchio style CPI.

The only thing that we're not fond of in the current syntax is

Program and Interface. We don't think it's great for interface to move ids to the constraint, for things like token. So it would be nice to get feedback for this.