interface: Demote all signers during onchain invoke

interface/Cargo.toml

@@ -30,7 +30,7 @@ spl-pod = "0.7.1"
 thiserror = "2.0"
 
 [lib]
-crate-type = ["cdylib", "lib"]
+crate-type = ["lib"]
 
 [lints]
 workspace = true

interface/src/onchain.rs

@@ -51,6 +51,12 @@ pub fn invoke_execute<'a>(
         )?;
     }
 
+    // Demote all signers
+    cpi_instruction
+        .accounts
+        .iter_mut()
+        .for_each(|a| a.is_signer = false);
+
     invoke(&cpi_instruction, &cpi_account_infos)
 }
 
@@ -508,4 +514,26 @@ mod tests {
             assert_eq!(a.is_writable, b.is_writable);
         }
     }
+
+    #[test]
+    fn test_signer_demotion_sanity() {
+        // This test doesn't actually run any functions in this file, but checks
+        // that demotion works as expected.
+        let mut instruction = instruction::execute(
+            &Pubkey::new_unique(),
+            &Pubkey::new_unique(),
+            &Pubkey::new_unique(),
+            &Pubkey::new_unique(),
+            &Pubkey::new_unique(),
+            100,
+        );
+        instruction
+            .accounts
+            .push(AccountMeta::new(Pubkey::new_unique(), true));
+        instruction
+            .accounts
+            .iter_mut()
+            .for_each(|a| a.is_signer = false);
+        assert!(instruction.accounts.iter().all(|a| !a.is_signer));
+    }
 }