Skip to content

fix: sdk audit fixes (#STRE-21, #STRE-13, #STRE-4) #360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Yolley merged 6 commits into from
May 21, 2026
Merged

fix: sdk audit fixes (#STRE-21, #STRE-13, #STRE-4) #360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2d7bcd3
fix: set correct owner for transfer hook account addition
Yolley May 21, 2026
564a8b2
fix: use immutable fee percentages from the Contract for fee derivati…
Yolley May 21, 2026
74e2973
fix tests
Yolley May 21, 2026
1e38e84
fix: pop prepare tx from batch since it's added to the end of the array
Yolley May 21, 2026
64ccc54
bump
Yolley May 21, 2026
f3d9ad9
chore: run prettier
Yolley May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lerna.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"packages": ["packages/*"],
"version": "12.2.0",
"version": "12.2.1",
"$schema": "node_modules/lerna/schemas/lerna-schema.json",
"command": {
"run": {
Expand Down
2 changes: 1 addition & 1 deletion packages/common/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@streamflow/common",
"version": "12.2.0",
"version": "12.2.1",
"description": "Common utilities and types used by streamflow packages.",
"homepage": "https://github.com/streamflow-finance/js-sdk/",
"type": "module",
Expand Down
2 changes: 1 addition & 1 deletion packages/distributor/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@streamflow/distributor",
"version": "12.2.0",
"version": "12.2.1",
"description": "JavaScript SDK to interact with Streamflow Airdrop protocol.",
"homepage": "https://github.com/streamflow-finance/js-sdk/",
"main": "./dist/cjs/index.cjs",
Expand Down
2 changes: 1 addition & 1 deletion packages/eslint-config/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@streamflow/eslint-config",
"version": "12.2.0",
"version": "12.2.1",
"description": "ESLint configuration for Streamflow protocol.",
"homepage": "https://github.com/streamflow-finance/js-sdk/",
"engines": {
Expand Down
2 changes: 1 addition & 1 deletion packages/launchpad/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@streamflow/launchpad",
"version": "12.2.0",
"version": "12.2.1",
"description": "JavaScript SDK to interact with Streamflow Launchpad protocol.",
"homepage": "https://github.com/streamflow-finance/js-sdk/",
"main": "./dist/cjs/index.cjs",
Expand Down
2 changes: 1 addition & 1 deletion packages/staking/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@streamflow/staking",
"version": "12.2.0",
"version": "12.2.1",
"description": "JavaScript SDK to interact with Streamflow Staking protocol.",
"homepage": "https://github.com/streamflow-finance/js-sdk/",
"main": "./dist/cjs/index.cjs",
Expand Down
22 changes: 11 additions & 11 deletions packages/stream/__tests__/solana/streamClient.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -507,17 +507,17 @@ describe("SolanaStreamClient Transaction Builders", async () => {
{
source: decodedStream.escrowTokens,
destination: decodedStream.recipientTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: decodedStream.escrowTokens,
destination: publicKeys.streamflowTreasuryTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: decodedStream.escrowTokens,
destination: publicKeys.partnerTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
]);
});
Expand All @@ -540,22 +540,22 @@ describe("SolanaStreamClient Transaction Builders", async () => {
{
source: decodedStream.escrowTokens,
destination: decodedStream.recipientTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: decodedStream.escrowTokens,
destination: publicKeys.streamflowTreasuryTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: decodedStream.escrowTokens,
destination: publicKeys.partnerTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: decodedStream.escrowTokens,
destination: decodedStream.senderTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
]);
});
Expand Down Expand Up @@ -652,22 +652,22 @@ describe("SolanaStreamClient Transaction Builders", async () => {
{
source: decodedStream.escrowTokens,
destination: publicKeys.recipientTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: decodedStream.escrowTokens,
destination: publicKeys.streamflowTreasuryTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: decodedStream.escrowTokens,
destination: publicKeys.partnerTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: decodedStream.escrowTokens,
destination: publicKeys.proxyTokens,
owner: publicKeys.stream,
owner: decodedStream.escrowTokens,
},
{
source: publicKeys.proxyTokens,
Expand Down
2 changes: 1 addition & 1 deletion packages/stream/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@streamflow/stream",
"version": "12.2.0",
"version": "12.2.1",
"description": "JavaScript SDK to interact with Streamflow protocol.",
"homepage": "https://github.com/streamflow-finance/js-sdk/",
"main": "./dist/cjs/index.cjs",
Expand Down
30 changes: 16 additions & 14 deletions packages/stream/solana/StreamClient.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1187,7 +1187,7 @@ export class SolanaStreamClient {
const signedBatch: BatchItem[] = await signAllTransactionWithRecipients(sender, batch);

if (prepareInstructions.length > 0) {
const prepareTx = signedBatch.shift();
const prepareTx = signedBatch.pop();
await sendAndConfirmStreamRawTransaction(this.connection, prepareTx!, { hash, context }, this.schedulingParams);
}

Expand Down Expand Up @@ -1304,9 +1304,9 @@ export class SolanaStreamClient {
mintAccount,
tokenProgramId,
potentialTransfers: [
{ source: escrowTokens, destination: recipientTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: streamflowTreasuryTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: partnerTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: recipientTokens, owner: escrowTokens },
{ source: escrowTokens, destination: streamflowTreasuryTokens, owner: escrowTokens },
{ source: escrowTokens, destination: partnerTokens, owner: escrowTokens },
],
});

Expand Down Expand Up @@ -1418,10 +1418,10 @@ export class SolanaStreamClient {
mintAccount,
tokenProgramId,
potentialTransfers: [
{ source: escrowTokens, destination: recipientTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: streamflowTreasuryTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: partnerTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: proxyTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: recipientTokens, owner: escrowTokens },
{ source: escrowTokens, destination: streamflowTreasuryTokens, owner: escrowTokens },
{ source: escrowTokens, destination: partnerTokens, owner: escrowTokens },
{ source: escrowTokens, destination: proxyTokens, owner: escrowTokens },
{ source: proxyTokens, destination: senderTokens, owner: proxyMetadata },
],
});
Expand Down Expand Up @@ -1486,10 +1486,10 @@ export class SolanaStreamClient {
mintAccount,
tokenProgramId,
potentialTransfers: [
{ source: escrowTokens, destination: recipientTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: streamflowTreasuryTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: partnerTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: senderTokens, owner: streamPublicKey },
{ source: escrowTokens, destination: recipientTokens, owner: escrowTokens },
{ source: escrowTokens, destination: streamflowTreasuryTokens, owner: escrowTokens },
{ source: escrowTokens, destination: partnerTokens, owner: escrowTokens },
{ source: escrowTokens, destination: senderTokens, owner: escrowTokens },
],
});

Expand Down Expand Up @@ -1723,12 +1723,14 @@ export class SolanaStreamClient {
if (!escrow?.data) {
throw new Error("Couldn't get account info");
}
const { mint, partner, senderTokens, escrowTokens } = decodeStream(escrow?.data);
const { mint, partner, senderTokens, escrowTokens, partnerFeePercent, streamflowFeePercent } = decodeStream(
escrow?.data,
);

const { mint: mintAccount, tokenProgramId } = await getMintAndProgram(this.connection, mint);
const streamflowTreasuryTokens = await ata(mint, STREAMFLOW_TREASURY_PUBLIC_KEY, tokenProgramId);
const partnerTokens = await ata(mint, partner, tokenProgramId);
const totalFee = await this.getTotalFee({ address: partner.toBase58() });
const totalFee = partnerFeePercent + streamflowFeePercent;
const totalAmountToTransfer = calculateTotalAmountToDeposit(amount, totalFee);

if (isNative) {
Expand Down
Loading