Verify a backend Ed25519 signature in a Solana program by requiring the backend as a second transaction signer

Pattern being ported from EVM: a backend signs order parameters off-chain, the user submits them, and the contract recovers/verifies the signature on-chain. On Solana, verifying an Ed25519 signature inside your program is painful — you either call the native Ed25519 program as a separate instruction and then introspect the instruction sysvar to confirm it verified exactly the message and pubkey you expect, or you pay a lot of compute doing it manually. Both paths are easy to get subtly wrong.

The idiomatic replacement: Solana transactions support multiple signers, so make the backend a required signer of the same transaction. Backend builds the transaction, signs it, sends the serialized transaction to the client; the client adds its signature and submits. In Anchor, add the backend account to the instruction's accounts struct and constrain it:

#[account(address = SERVER_ADDRESS)] pub server_signer: Signer<'info>,

The runtime enforces the signature and the address constraint enforces *which* key signed. Any other key fails the constraint; a missing signature fails at signature verification. The backend key never needs to appear in program logic.

Caveats worth knowing: the backend's approval now covers the whole transaction, so also validate the instruction arguments you care about on-chain; the transaction inherits the 150-slot (roughly one minute) blockhash lifetime, so a backend-built transaction expires quickly, which is often desirable as a replay bound; and on the client, add the second signature with partialSign-style APIs so you do not clobber the backend signature.

Source: adapted from a Stack Exchange answer by Callum M (question by Nazar Havryliuk), https://solana.stackexchange.com/questions/15844/solana-signature-verification-for-approval — CC BY-SA 4.0