From d952d2458a5a32fa9fabb938e0be4f91a0ddf1bb Mon Sep 17 00:00:00 2001
From: SyedAsadKazmi <syed.asadkazmi@smartcontract.com>
Date: Mon, 16 Feb 2026 07:32:49 +0530
Subject: [PATCH] Clarify token receiver security pattern for PTT to Solana

---
 src/content/ccip/llms-full.txt                     | 14 +++++++++++---
 .../tutorials/svm/destination/build-messages.mdx   | 14 +++++++++++---
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/src/content/ccip/llms-full.txt b/src/content/ccip/llms-full.txt
index dad081bb007..96703efe290 100644
--- a/src/content/ccip/llms-full.txt
+++ b/src/content/ccip/llms-full.txt
@@ -18539,9 +18539,17 @@ Use this configuration when sending only data messages to SVM:
 Use this configuration when sending both tokens and data in a single message:
 
 <Aside type="note" title="Key Requirements">
-  - `tokenReceiver` must be a PDA the program has authority over
-  - `accounts` must include all accounts required by the receiver program
-  - The program must contain logic to handle the received data and tokens
+  - **Token Security**: The `tokenReceiver` must be an Associated Token Account (ATA) that the receiver program has authority over. Since the program cannot verify that tokens were sent to a specific address, it should validate it received the expected tokens at its own ATA, then forward them to the final destination.
+
+  - **Account References**: The `accounts` array must include:
+    - The program's own ATA (for validation that tokens were received)
+    - The final token destination ATA (to forward tokens to)
+    - Any other accounts required by the receiver program's `ccip_receive` instruction
+
+  - **Validation Pattern**: The receiver program should:
+    1. Check that it received the expected tokens at its controlled ATA
+    2. Forward the tokens to the final destination
+
   - `allowOutOfOrderExecution` **MUST** be set to `true`
 </Aside>
 
diff --git a/src/content/ccip/tutorials/svm/destination/build-messages.mdx b/src/content/ccip/tutorials/svm/destination/build-messages.mdx
index 61404befcac..f6584f61889 100644
--- a/src/content/ccip/tutorials/svm/destination/build-messages.mdx
+++ b/src/content/ccip/tutorials/svm/destination/build-messages.mdx
@@ -476,9 +476,17 @@ Use this configuration when sending both tokens and data in a single message:
 
 <Aside type="note" title="Key Requirements">
 
-- `tokenReceiver` must be a PDA the program has authority over
-- `accounts` must include all accounts required by the receiver program
-- The program must contain logic to handle the received data and tokens
+- **Token Security**: The `tokenReceiver` must be an Associated Token Account (ATA) that the receiver program has authority over. Since the program cannot verify that tokens were sent to a specific address, it should validate it received the expected tokens at its own ATA, then forward them to the final destination.
+
+- **Account References**: The `accounts` array must include:
+  - The program's own ATA (for validation that tokens were received)
+  - The final token destination ATA (to forward tokens to)
+  - Any other accounts required by the receiver program's `ccip_receive` instruction
+
+- **Validation Pattern**: The receiver program should:
+  1. Check that it received the expected tokens at its controlled ATA
+  2. Forward the tokens to the final destination
+
 - `allowOutOfOrderExecution` **MUST** be set to `true`
 
 </Aside>