Wallet identity and authorization
A trader, transfer authority, and final recipient are different identities.
Design contract. The core must pass authenticated operation context to a pool hook. Identity in a frontend payload is not sufficient. Actual core enforcement is described in the instruction reference.
Identify each role
| Role | Meaning |
|---|---|
| Trader | Wallet whose authorization is verified for this operation |
| Transfer authority | Owner, delegate, or PDA permitted to spend the input account |
| Source owner | Owner of the local hop's input token account |
| Destination owner | Owner of the local hop's output account |
| Final beneficiary | End recipient, only known if the route explicitly binds it |
| Fee payer | Account paying transaction fees; not automatically the trader |
Direct execution
The simple path requires the trader as a signer, validates authority over the actual source, and binds the market, mints, destination, amount, and user limits. The runtime enforces signer privileges. The core authenticates its callback separately so a policy cannot be invoked with fabricated core context.
Routed execution
A router may hold intermediate tokens or invoke the pool through a PDA. The input owner is then not necessarily the original wallet. The router must preserve the expected user signer or support a separately verified authorization with nonce, expiry, assets, market, limits, and beneficiary.
An authenticated signer at one hop does not prove who receives the final route output. Holder-based or recipient-based policies require the appropriate route binding.
Quote is not eligibility
An anonymous quote can describe pool math while the eventual wallet fails an allowlist. A wallet-specific fee changes the quote itself and needs contextual quote support. Do not treat SwapParams.user, hook bytes, transaction fee payer, or a router address as proof of authorization.
The Solana CPI documentation explains how signer and writable privileges pass between programs. grapl still needs explicit validation of what those privileges mean for each operation.