CPI — CROSS-PROGRAM INVOCATION

Programs call programs: invoke passes your signer privileges down the call. That means the program_id you invoke decides who inherits your authority. Pin it to the expected address or an attacker supplies a program that says "transfer succeeded" while pocketing the tokens. CPI is composability — and the trust boundary where composability gets exploited.