init_if_needed on mint (lz_receive)

[Rhovian]

No description provided.

[greptile-apps]

Greptile Summary

This PR implements a mix of cosmetic formatting improvements and critical security fixes for the LayerZero share mover functionality in the boring-vault-svm project. The changes fall into two main categories:

Formatting Changes: The PR applies code style improvements to the OracleSource enum in state.rs and the read_oracle function in teller.rs. These changes add trailing commas, improve spacing, and use multi-line destructuring patterns for better readability. While cosmetic, these changes align with Rust formatting conventions and improve code maintainability.

LayerZero Security Refactoring: The more substantial changes focus on fixing the LayerZero message reception flow in the share mover program. The key architectural improvement moves from runtime validation of remaining accounts to compile-time validation through explicit named accounts in the instruction context. This includes:

• Adding explicit accounts (executor, share_mint, recipient, recipient_ata) to the LzReceive struct with proper Anchor constraints
• Implementing init_if_needed pattern for recipient ATA creation to ensure accounts exist before minting
• Fixing account ordering in lz_receive_types.rs to match LayerZero's expected layout for CPI operations
• Adding a vault field to ShareMoverData struct for better state validation
• Reducing MINT_ACCOUNTS_LEN from 6 to 3 as mint-related accounts are now explicitly defined

The refactoring leverages Anchor's account validation framework instead of manual runtime checks, making the LayerZero integration more secure and maintainable. The changes ensure proper account ordering for both the LayerZero endpoint clear operation and the boring-vault mint operation, which is critical for cross-program invocation success.

Important Files Changed

File Changes

Filename	Score	Overview
programs/boring-vault-svm/src/state.rs	5/5	Cosmetic formatting fixes to OracleSource enum - trailing commas and spacing improvements
programs/boring-vault-svm/src/utils/teller.rs	5/5	Formatting changes to use multi-line destructuring in read_oracle function pattern matching
programs/layer-zero-share-mover/src/processor/lz_receive_types.rs	2/5	Critical account ordering fix with hardcoded executor pubkey and reorganized accounts vector
programs/layer-zero-share-mover/src/processor/lz_receive.rs	4/5	Major security refactoring moving from remaining accounts to explicit named accounts with constraints

Confidence score: 3/5

• This PR contains both safe cosmetic changes and critical security fixes, with some concerning elements that require attention
• Score reflects the mix of low-risk formatting changes and higher-risk LayerZero integration fixes with a hardcoded pubkey
• Pay close attention to programs/layer-zero-share-mover/src/processor/lz_receive_types.rs due to the hardcoded executor pubkey

Sequence Diagram

sequenceDiagram
    participant User
    participant Executor
    participant ShareMover
    participant LayerZero
    participant BoringVault
    participant TokenProgram

    User->>LayerZero: "Send cross-chain message"
    LayerZero->>Executor: "Deliver message for processing"
    Executor->>ShareMover: "lz_receive(params)"
    
    ShareMover->>ShareMover: "Validate not paused"
    ShareMover->>ShareMover: "Validate peer authorization"
    ShareMover->>ShareMover: "Decode message"
    ShareMover->>ShareMover: "Validate recipient and amount"
    ShareMover->>ShareMover: "Check inbound rate limit"
    
    ShareMover->>LayerZero: "execute_clear(clear_accounts)"
    LayerZero-->>ShareMover: "Clear operation completed"
    
    ShareMover->>TokenProgram: "Initialize recipient ATA if needed"
    TokenProgram-->>ShareMover: "ATA ready"
    
    ShareMover->>BoringVault: "execute_mint(mint_accounts)"
    BoringVault->>TokenProgram: "Mint shares to recipient"
    TokenProgram-->>BoringVault: "Shares minted"
    BoringVault-->>ShareMover: "Mint completed"
    
    ShareMover-->>Executor: "lz_receive completed"
    Executor-->>User: "Cross-chain transfer completed"

Loading

_{4 files reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}