fix(native): bind mm-oracle kill switch to State PDA

[SashaMIT]

Summary

handle_update_mm_oracle_native (reached via the [0xFF;4] native entry in lib.rs) reads the MM-oracle feature enable bit from accounts[3].data[982] without verifying that account is the canonical drift_state PDA.

Owner-only hardening (see also open #2110) is necessary but not sufficient: any sufficiently large Drift-owned account could still spoof the enable bit. This PR binds accounts[3] to Pubkey::find_program_address(&[b"drift_state"], program_id) and requires program ownership + length before the feature-bit check.

Complementary to #2110 (owner/len/clock) — this change is intentionally additive and focused on PDA identity.

Test plan

• Existing native mm-oracle crank path with correct State PDA still succeeds when the feature bit is set
• Substituting a non-drift_state Drift-owned account in slot 3 fails the new assert
• Review alongside Hardening: validate owners and data lengths in native admin handlers #2110 for merge ordering / conflict resolution

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • Improved validation when updating the market-making oracle.
  • Prevented invalid or incorrectly configured state accounts from being processed.
  • Added safeguards to ensure required account data is present before use.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ec267b8a-08c6-4a5a-8b04-fc1d3ca5fa3d

📥 Commits

Reviewing files that changed from the base of the PR and between 13e8e9b and cc750ac.

📒 Files selected for processing (1)

• programs/drift/src/instructions/admin.rs

---

Walkthrough

The native MM oracle update handler now validates required accounts, confirms the canonical program-owned drift_state PDA, and checks the state account size before reading feature_bit_flags.

Changes

Native MM Oracle Validation

Layer / File(s)	Summary
Validate native MM oracle accounts programs/drift/src/instructions/admin.rs	The handler requires the market, signer, clock, and state accounts. It verifies the canonical drift_state PDA, checks program ownership, and rejects undersized state accounts before reading the feature flag.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checked the state with care,
Four accounts stood in proper pair.
The PDA matched, the flags were sound,
No tiny state could sneak around.
“Hop approved!” the rabbit found.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes binding the MM-oracle kill switch to the canonical State PDA.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}