CPIs and PDA Signers: What I Built and What Actually Clicked

Short summary

Cross-Program Invocations (CPIs) let Solana programs call other programs, similar to backend APIs in Web2. User wallets sign external calls directly through signature propagation, while PDAs sign on behalf of the program using derived seeds. This pattern secures vaults, AMMs, lending protocols, and DAO treasuries by encoding authorization rules in program logic rather than centralized key management.

• •CPI: program-to-program calls with accounts and instructions
• •User signing: wallet signature propagates to authorize external CPIs
• •PDA signing: program derives an account from seeds and signs on its behalf

Generated with AI, which can make mistakes.