docs(pda-rent-payer): caution note on the unrestricted caller of create_new_account

[devtechedge]

What and why

create_new_account spends from a shared rent_vault PDA and the only signer is the newly created account itself, so anyone can drain the vault one rent-exempt minimum at a time. That is intentional here - the example exists to show a PDA signing for itself - but it is exactly the kind of helper that gets copied into real programs, per the discussion in #671.

This adds the suggested caution comment above the instruction in all three flavors (anchor, native, pinocchio) so the note travels with whatever version a reader copies. No behavior changes; the example keeps teaching what it teaches.

Fixes #671

AI disclosure

Check exactly one. See CONTRIBUTING.md.

• No AI tooling was used beyond editor autocomplete.
• AI tooling was used. Tool and extent: drafted the comment text with Claude; I reviewed the diff across the three flavors and matched each file's style before opening.

Testing

Comment-only change, no code touched.

[greptile-apps]

Confidence Score: 4/5

The comment-only change is non-blocking, but the mitigation guidance should explicitly tie the selected vault to an authenticated signer before readers copy it.

Findings

1.  Incomplete authority guidance ▶

Summary

• Adds equivalent warnings to the Anchor, native, and Pinocchio variants.
• Leaves executable behavior unchanged.
• The proposed mitigation examples should more explicitly require an authenticated signer tied to the selected vault.

_{Reviews (1) · Last reviewed commit: "pda-rent-payer: note that create_new_acc..."}

[greptile-apps]

Incomplete authority guidance

The caution presents funder-bound PDA seeds, has_one, and per-caller limits as standalone authority checks. However, an attacker can still pass another funder’s PDA unless the related funder or admin must also sign, and disposable keypairs can bypass per-caller limits. Since readers may copy this example, clarify that the selected vault must be tied to an authenticated signer. The native and Pinocchio comments contain the same guidance.

Knowledge Base Used:

• Program-derived address design
• Instruction processing and cross-program invocation