fix: 🐛 Components CPI caller check

[iamnamananand996]

Status	Type	⚠️ Core Change	Issue
Ready	Bug	Yes	#29

Problem

• Components make use of solana_program::sysvar::instructions::get_instruction_relative to enforce that they are called from CPI and the identify of the caller, This may contains a bug, since a transaction could contain a valid instruction at index [0], but be malicious.

Full description is available: #29 (comment)

Solution

To correctly determine if your program was called via CPI, you should:

• Use get_instruction_relative(-1, ...): This will attempt to retrieve the instruction that called the currently executing instruction. If the program was called directly, there will be no instruction at index -1, and the function will return an error.

• Check for Errors: If get_instruction_relative(-1, ...) returns an Err, it means the program was called directly. If it returns Ok, you can proceed, knowing it was called via CPI.

• Closes: [Bug/Investigation] Components CPI caller check #29

cc - @GabrielePicco

[GabrielePicco]

@iamnamananand996 the PR looks good to me, but we should enforce that the check is now correct. There are 2 integration tests for the CPI check that were passing with the previous implementation. Is there a case where prev check fails and this pass that we can add>

[iamnamananand996]

Hi @GabrielePicco , thanks for pointing out, this a valid check we should add before merging it, I will check for the above suggestion and update this accordingly.

[iamnamananand996]

Hi @GabrielePicco, I check all the test, and regarding the test case you mention 2 integration tests for the CPI check, that are passing.

---

and there where 2 test which where failing, that I have updated. failed test