docs(solana): extend documentation of cpi validation

[mariuszzak]

Description

closes: #XXXX

---

Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.

• Linked to GitHub issue with discussion and accepted design, OR link to spec that describes this work.
• Wrote unit and integration tests.
• Added relevant natspec and godoc comments.
• Provide a conventional commit message to follow the repository standards.
• Re-reviewed Files changed in the GitHub PR explorer.
• Review SonarCloud Report in the comment section below once CI passes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (feat/solana@92d5cb8). Learn more about missing BASE report.

Additional details and impacted files

@@              Coverage Diff               @@
##             feat/solana     #851   +/-   ##
==============================================
  Coverage               ?   99.87%           
==============================================
  Files                  ?       18           
  Lines                  ?      779           
  Branches               ?        0           
==============================================
  Hits                   ?      778           
  Misses                 ?        1           
  Partials               ?        0           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[frenzox]

In general, this makes sense. I do see some comments like this though:

/// Validates that this instruction is called directly (NOT via CPI)

And then the check is basically current_ix.program_id == Instruction 0.program_id. The comment is misleading in this case, because what we are really checking is whether or not the current program is the same as the program executed by the entrypoint. Solana allows for recursion, for instance (self CPI). Also, the CPI depth limit is 4, thus also allowing things like Program A -> Program B -> Program C -> Program A (-> for CPI here). If Program A calls reject_cpi in the last step, what the comment is saying is not true anymore.

[mariuszzak]

@frenzox it makes sense! Good catch! 🙏

[mariuszzak]

Closing it since it will be included in #857