Fix/zenith audit 0.2.0 1 - #197
Merged
Merged
Conversation
…ok CPIs - drop pool/config account before transfer CPI
bangyro
marked this pull request as ready for review
May 28, 2026 06:40
| ] | ||
| } else { | ||
| &[AccountsType::TransferHookBase] | ||
| }; |
Contributor
There was a problem hiding this comment.
We dont need the if/else here
can just use: remaining_account_slice_types = &[
AccountsType::TransferHookBase,
AccountsType::TransferHookBaseReferral,
]
Collaborator
Author
There was a problem hiding this comment.
@andrewsource147 it will be less strict. User can pass TransferHookBaseReferral when there's no referral. So it won't be consumed.
| parsed_transfer_hook_accounts.transfer_hook_base, | ||
| )?; | ||
| // avoid invoking transfer hook if no base token to transfer | ||
| if token_base_amount > 0 { |
Contributor
There was a problem hiding this comment.
Why not apply same for token_quote_amount?
…nt base hook - follow up
…counts - follow up
andrewsource147
pushed a commit
that referenced
this pull request
Jun 3, 2026
* chore: initial commit for release * Feat/claim protocol fee2 (#186) * feat: implement claim_protocol_fee2 * refactor: move test into dedicated file * fix: test * feat: get protocol claim amount along with surplus * feat: address comments - consistent account order - remove unnecessary drop - remove event_cpi * chore: bump anchor to v1 (#189) * chore: bump anchor to v1 * fix: rebase * chore: update changelog * chore: formatter remove trailing new line * fix: comments * fix: use UncheckedAccount * fix: deprecated build warning * fix: rebase * fix: cargo fmt * fix: use official anchor despite of emit_cpi warning * chore: fix script name (#190) * feat: revoke token mint authority after minting initial base supply (#191) * bump version * feat/transfer hook support (#192) * feat: add transfer_hook_support * feat: fully isolated events * feat: error if transfer hook not revoked * feat: update changelog * fix: remove unused * fix: remove unused events * fix: explicitly reject in deprecated method - address bot comments * fix: revert zap_protocol_fee and claim_protocol_fee lifecycles changes * docs: add comment * docs: add comment * feat: address comments * feat: use different pool discriminator * feat: config with transfer_hook * fix: create_locker * feat: bump version and update changelog * fix: add padding * refactor: minor refactor * refactor: move process create_config into its own file * fix: don't use account loader when not needed * docs: add comment * fix: anti snipe * fix: address comments * docs: add comment * feat: add docs * docs: update chaneglog * feat: address comments * feat: use macro instead of duplicating event * refactor: move macros to macros file * fix: address comments * feat: aadd mint authority option for transfer hook mint * fix: remove unused transfer hook events * feat: update changelog * fix: use PoolState instead of VirtualPool * fix: address comments * fix: move test assertions to last swap * refactor: move check from process to handler * feat: rename ix and restrict existing to just VirtualPool * feat: use transfer_hook_accounts_info instead * feat: bump anchor to v1.0.2 * feat: merge 0.1.11 into 0.2.0 changelog * fix: explicitly specify solana image for solana-verify to use (#194) * Fix/zenith audit 0.2.0 (#195) * fix: QuoteToBase trade direction documentation is incorrect * fix: Mint-authority comments misstate transfer-hook support * fix: Config loader panics on short config account data * fix: remove define_event_pair since it interferred with IDL generation (#196) * Fix/zenith audit 0.2.0 1 (#197) * fix: Transfer-hook handlers accept unconsumed or unused remaining accounts * fix: Fee claim and swap handlers hold pool borrows across transfer-hook CPIs - drop pool/config account before transfer CPI * fix: README omits the transfer-hook-only restriction for mint-authority options * fix: Creator quote-fee claims can be blocked by a malicious zero-amount base hook * fix: SDK quote helpers require VirtualPool instead of PoolState * fix: Protocol surplus is not capped by the maximum quote claim amount * fix: Creator quote-fee claims can be blocked by a malicious zero-amount base hook - follow up * fix: Transfer-hook handlers accept unconsumed or unused remaining accounts - follow up * fix: add anchor dup constraint on referral (#198) * fix: dup constraint on referral * feat: add test * fix: Zero Amount Base Transfers Can Be Blocked By Base Transfer Hooks (#201) - addressed on the swap referral path * fix: Transfer Hook Signer De Escalation Relies On A Transitive Dependency Version (#200) --------- Co-authored-by: codewithgun <codewithgun@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.