`StakeStakeV2` zero copy api [wincode] by grod220 · Pull Request #222 · solana-program/stake

grod220 · 2025-12-19T15:33:14Z

Adds a new zero‑copy state API backed by wincode.

Key Changes

Adds p-stake-interface crate (#![no_std] compatible)
Introduces alignment-1 POD types (PodU32, PodU64, PodI64, PodAddress) for safe zero-copy from
unaligned slices
New API via StakeStateV2:
- StakeStateV2::from_bytes(&[u8]) -> Result<&StakeStateV2, StakeStateError> for read-only access
- StakeStateV2::from_bytes_mut(&mut [u8]) -> Result<&mut StakeStateV2, StakeStateError> for
  mutations
- Tag-checked accessors: meta(), stake(), meta_mut(), stake_mut()
- State transitions: initialize(), delegate()
Maintains full ABI compatibility with legacy bincode-encoded stake accounts

Motivation

Deserialization via bincode/borsh is computationally expensive for programs that only need to access specific fields or verify the state. This zero-copy approach allows for significantly lower compute unit (CU) usage when interacting with stake accounts.

febo · 2026-01-15T10:28:56Z

pinocchio/interface/src/state/layout.rs

+        }
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, StakeStateError> {


This could be zero-copy if you do a transmute instead of StakeStateV2Tag::deserialize, but not sure if there is any benefit in doing that.

Would we lose some safety though? What do you think about this instead?

pub fn from_bytes(bytes: &[u8]) -> Result<Self, StakeStateError> { if bytes.len() < 4 { return Err(StakeStateError::UnexpectedEof); } let raw = u32::from_le_bytes(bytes[..4].try_into().unwrap()); Self::from_u32(raw) }

pinocchio/interface/src/state/layout.rs

pinocchio/interface/src/pod.rs

pinocchio/interface/src/state/pod.rs

pinocchio/interface/src/pod.rs

pinocchio/interface/src/state/pod.rs

febo · 2026-01-15T10:43:45Z

pinocchio/interface/src/pod.rs

+#[repr(transparent)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default, SchemaWrite, SchemaRead)]
+#[wincode(assert_zero_copy)]
+pub struct PodAddress(pub [u8; 32]);


We should add wincode support to Address, then this type is not needed.

And it's done! https://github.com/anza-xyz/solana-sdk/blob/54449336c03ae8a99bc37745ac97ab90a77eb24b/address/Cargo.toml#L45

febo · 2026-01-15T11:49:09Z

pinocchio/interface/src/state/view.rs

+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StakeStateV2View<'a> {


Since this is a breaking change, could we stop using the enum? Seems like all we need is already in StakeStateV2Layout, so that one could become the state "account". One benefit is that we won't need to have the *View and *Write type. The fields not applicable for a variant can be optional.

(Discussed offline)

Going to revise the API, but ensure a private-field pattern to ensure only methods can make state transitions to prevent invalidate state.

pinocchio/interface/src/state/writer.rs

joncinque

Looks great overall! Mostly small things on my side

joncinque · 2026-02-20T14:13:42Z

.github/workflows/main.yml

+  miri:
+    needs: set_env
+    runs-on: ubuntu-latest
+    env:
+      RUST_TOOLCHAIN: ${{ needs.set_env.outputs.RUST_TOOLCHAIN_NIGHTLY }}
+    steps:
+      - name: Git Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@nightly
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+          components: miri
+
+      - name: Setup Miri
+        run: cargo +"$RUST_TOOLCHAIN" miri setup
+
+      - name: Run Miri (pinocchio/interface)
+        run: make miri-pinocchio-interface


Let's integrate this directly as a new variable in the reusable action, ie https://github.com/solana-program/actions/blob/287c6068cc3b672ec4ce9dc6acb75757d477fd2b/.github/workflows/main.yml#L39

Then it's easy for any repo to add a miri check

joncinque · 2026-02-20T14:15:17Z

pinocchio/interface/src/error.rs

+    /// Wincode deserialization error.
    Read(wincode::ReadError),
-    /// Input buffer is shorter than 200 bytes.
+    /// Buffer shorter than 200 bytes.
    UnexpectedEof,
-    /// Pass-through for wincode write errors when serializing layout structs.
+    /// Wincode serialization error.
    Write(wincode::WriteError),


nit: I missed the PR that introduced these, but unless we have a really good reason, it's more annoying than helpful to expose external types in a public API. Let's not have wincode::ReadError or wincode::WriteError there directly, and instead use our own variants

joncinque · 2026-02-20T14:16:00Z

pinocchio/interface/src/pod.rs

+#[repr(transparent)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default, SchemaWrite, SchemaRead)]
+#[wincode(assert_zero_copy)]
+pub struct PodAddress(pub [u8; 32]);


And it's done! https://github.com/anza-xyz/solana-sdk/blob/54449336c03ae8a99bc37745ac97ab90a77eb24b/address/Cargo.toml#L45

joncinque · 2026-02-20T14:21:57Z

pinocchio/interface/src/pod.rs

@febo discussed updating spl-pod to contain these types, which would probably simplify things.

On the other hand, there's no harm in redefining them if needed, since they're just used internally to convert to normal types.

joncinque · 2026-02-20T23:36:52Z

pinocchio/interface/src/state.rs

+    #[inline]
+    pub(crate) fn from_u32(v: u32) -> Result<Self, StakeStateError> {
+        match v {
+            0 => Ok(Self::Uninitialized),
+            1 => Ok(Self::Initialized),
+            2 => Ok(Self::Stake),
+            3 => Ok(Self::RewardsPool),
+            other => Err(StakeStateError::InvalidTag(other)),
+        }
+    }


nit: up to you, but it would be more idiomatic rust to impl TryFrom<u32> instead of this function

joncinque · 2026-02-20T23:42:17Z

pinocchio/interface/src/state.rs

+    /// Returns a reference to `Meta` if in the `Initialized` or `Stake` state.
+    #[inline]
+    pub fn meta(&self) -> Option<&Meta> {
+        match self.tag() {


nit: Since this function is called a lot, I wonder if we'd get some performance gains from something like StakeStateV2Tag::from_u32_unchecked to be used from inside the function

joncinque · 2026-02-20T23:43:12Z

pinocchio/interface/src/state.rs

+    /// Returns a mutable reference to `Meta` if in the `Initialized` or `Stake` state.
+    #[inline]
+    pub fn meta_mut(&mut self) -> Result<&mut Meta, StakeStateError> {
+        match self.tag() {
+            StakeStateV2Tag::Initialized | StakeStateV2Tag::Stake => Ok(&mut self.meta),
+            tag => Err(StakeStateError::InvalidStateAccess(tag)),
+        }
+    }


nit: is there a reason for the mutable ones to return a Result and the immutable ones to return an Option? Probably better to be consistent

joncinque · 2026-02-20T23:46:15Z

pinocchio/interface/src/state.rs

+        if from == StakeStateV2Tag::Initialized {
+            self.stake_flags = 0;
+            self.padding.fill(0);
+        }


Sorry if I'm being dense, but why is this done only for Initialized?

joncinque · 2026-02-20T23:48:29Z

pinocchio/interface/Cargo.toml

 [dependencies]
-# TODO: Waiting on 0.3.0 to be released
-wincode = { git = "https://github.com/anza-xyz/wincode.git", rev = "fa70c7c7c13885085f743e4f01deb1a4de0b64fb", default-features = false, features = ["derive"] }
+wincode = { git = "https://github.com/anza-xyz/wincode.git", rev = "6feb75ff4c5b26275b0ee8bc4a12ea906d996a02", default-features = false, features = ["derive"] }


Since we're now on v0.4, let's use that published version!

joncinque · 2026-02-21T00:01:54Z

pinocchio/interface/tests/helpers/layout.rs

 pub const META_OFF: usize = TAG_LEN;
 pub const STAKE_OFF: usize = TAG_LEN + size_of::<Meta>();
 pub const FLAGS_OFF: usize = TAG_LEN + size_of::<Meta>() + size_of::<Stake>();
 pub const PADDING_OFF: usize = FLAGS_OFF + 1;


nit: doesn't need to be done here, but let's spell out OFFSET fully

grod220 force-pushed the wincode-state branch from 0a11281 to 6ed8c9d Compare January 9, 2026 17:52

grod220 changed the title ~~Wincode spike~~ StakeStakeV2 zero copy api [wincode] Jan 12, 2026

grod220 added 3 commits January 12, 2026 19:08

Wincode spike

2c6a054

Updated patterns + deps

04d5879

Tests pt.1

8f34c20

grod220 force-pushed the wincode-state branch from 9c65372 to e0471c2 Compare January 12, 2026 18:08

proptest rewrite

3b7d1b1

grod220 force-pushed the wincode-state branch from e0471c2 to 3b7d1b1 Compare January 12, 2026 18:11

grod220 marked this pull request as ready for review January 12, 2026 18:27

grod220 requested review from febo and joncinque January 12, 2026 18:27