fix: 🐛 Components CPI caller check

[iamnamananand996]

Status	Type	⚠️ Core Change	Issue
Ready	Bug	Yes	#29

Problem

• Components make use of solana_program::sysvar::instructions::get_instruction_relative to enforce that they are called from CPI and the identify of the caller, This may contains a bug, since a transaction could contain a valid instruction at index [0], but be malicious.

Full description is available: #29 (comment)

Solution

To correctly determine if your program was called via CPI, you should:

• Use get_instruction_relative(-1, ...): This will attempt to retrieve the instruction that called the currently executing instruction. If the program was called directly, there will be no instruction at index -1, and the function will return an error.

• Check for Errors: If get_instruction_relative(-1, ...) returns an Err, it means the program was called directly. If it returns Ok, you can proceed, knowing it was called via CPI.

• Closes: [Bug/Investigation] Components CPI caller check #29

cc - @GabrielePicco

[GabrielePicco]

@iamnamananand996 the PR looks good to me, but we should enforce that the check is now correct. There are 2 integration tests for the CPI check that were passing with the previous implementation. Is there a case where prev check fails and this pass that we can add>

[iamnamananand996]

Hi @GabrielePicco , thanks for pointing out, this a valid check we should add before merging it, I will check for the above suggestion and update this accordingly.

[iamnamananand996]

Hi @GabrielePicco, I check all the test, and regarding the test case you mention 2 integration tests for the CPI check, that are passing.

---

and there where 2 test which where failing, that I have updated. failed test

[GabrielePicco]

Thanks @iamnamananand996 ,
What I meant is that we should add a test to verify that this implementation is actually solving a problem. The two integration tests for the CPI check also pass in the current version of the master branch, which means they don't cover the issue this PR is trying to address