Swen dev v4 cli pt 1/x by SwenSchaeferjohann · Pull Request #15 · Lightprotocol/light-protocol

SwenSchaeferjohann · 2023-02-12T01:54:45Z

will open up new cli-subtask branch after this is merged ( cli needs be extended, spl,relayer etc)
tests(functional_tests) and cli (user class, all cmds) are all running.

edit:

Summary of changes

Added relayer dir (wie)
Added CLI (tested)
Sdk:
- Extended user class
- Added provider class
- Transaction class and tx params working with node/browsercontext
- keypair class -> account class

Qs:

Verifiers0,1: need check for payer/wallet still?

…cipient or do a lookup)

…xosel, inutxos, oututxos removed lib

…ansfer., SPL, 10-inUtxos

…ing new Tx class

…nges

…r; import issue w mock-app-verifier persists on mac, need test on linux

…global cli installation

…(swen)

light-system-programs/programs/merkle_tree_program/src/lib.rs

ananas-block · 2023-02-17T21:49:36Z

light-system-programs/tests/verifier_tests.ts

@@ -19,7 +19,6 @@ import {
  merkleTreeProgramId,


this file impossible to review

…ocol-onchain into swen-dev_v4-cli

…ms/functional_tests

ananas-block · 2023-02-18T13:21:58Z

the js files are still in the tests folder ...

Swen dev v4 cli pt 1/x

Audit issue #15 (HIGH): verify_pda used derive_address which accepts any bump seed, allowing non-canonical bumps for ATAs. Switch to find_program_address to derive the canonical bump and reject any non-canonical bump with InvalidSeeds error.

…on-chain Remove client-provided bump from CreateAssociatedTokenAccountInstructionData and all SDK/test callers. The on-chain program now derives the canonical bump via find_program_address, preventing non-canonical bump attacks (audit #15). - Remove bump field from instruction data structs - Update verify_pda to derive canonical bump and return it - Update validate_ata_derivation and decompress_mint callers - Remove _with_bump SDK variants and ATA2 dead code - Remove associated_token::bump from macro attribute support - Update derive_associated_token_account to return Pubkey only - Update all 100+ call sites across SDK, tests, and TypeScript

Audit issue #15 (HIGH): verify_pda used derive_address which accepts any bump seed, allowing non-canonical bumps for ATAs. Switch to find_program_address to derive the canonical bump and reject any non-canonical bump with InvalidSeeds error.

…on-chain Remove client-provided bump from CreateAssociatedTokenAccountInstructionData and all SDK/test callers. The on-chain program now derives the canonical bump via find_program_address, preventing non-canonical bump attacks (audit #15). - Remove bump field from instruction data structs - Update verify_pda to derive canonical bump and return it - Update validate_ata_derivation and decompress_mint callers - Remove _with_bump SDK variants and ATA2 dead code - Remove associated_token::bump from macro attribute support - Update derive_associated_token_account to return Pubkey only - Update all 100+ call sites across SDK, tests, and TypeScript

* fix: enforce canonical bump in PDA verification Audit issue #15 (HIGH): verify_pda used derive_address which accepts any bump seed, allowing non-canonical bumps for ATAs. Switch to find_program_address to derive the canonical bump and reject any non-canonical bump with InvalidSeeds error. * fix: use pinocchio::pubkey::find_program_address instead of pinocchio_pubkey * fix: remove bump from ATA instruction data and derive canonical bump on-chain Remove client-provided bump from CreateAssociatedTokenAccountInstructionData and all SDK/test callers. The on-chain program now derives the canonical bump via find_program_address, preventing non-canonical bump attacks (audit #15). - Remove bump field from instruction data structs - Update verify_pda to derive canonical bump and return it - Update validate_ata_derivation and decompress_mint callers - Remove _with_bump SDK variants and ATA2 dead code - Remove associated_token::bump from macro attribute support - Update derive_associated_token_account to return Pubkey only - Update all 100+ call sites across SDK, tests, and TypeScript * fix: update wrong bump test for canonical bump derivation With canonical bumps, the program derives the bump internally so providing a wrong bump is no longer possible. Replace with a test that passes a wrong ATA address to verify PDA validation. * fix test * fix lint

ananas-block and others added 30 commits June 2, 2022 00:24

added closing tmp account

57cffca

removed warning

8280e9d

merged pull without fast-forward. updated gitignore, added cli/ dir

be69f83

Merge branch 'main' of github.com:Lightprotocol/light-protocol-onchain

c09f1f6

added base cli layout

4f29d40

olved merge conflicts in lockfiles taging

9e63294

removed sdk-ts/lib folder, added cli staging

a6926aa

added: newwallet, register, login, todo: fetchutxos

ce92bac

again removed light-sdk-ts/lib staging: built ts

bcd48b1

rm n Please enter the commit message for your changes. Lines starting

92635ff

rmd lib li cleanup, refactor

36fa655

cli done: shield,unshield,etc. (TODO: transfer add shielded pubkey re…

e3abd68

…cipient or do a lookup)

rm

6c15ea6

commands working, layout wise done TODO: debug onchain, debug: getut…

07e0ef7

…xosel, inutxos, oututxos removed lib

removed lookuptable.txt

ad7d685

upd to yarn, debugging version mismatch - took current pckjsons (HEAD)

44379f1

added verifiertests

4ccbf53

shield, unshield non-SPL working. resolved merkletree build. TODO: tr…

5cd4bae

…ansfer., SPL, 10-inUtxos

applied transaction rebase

7560a63

rebased tx

0fba8b6

extended readme, log cleanup, rm some repeated calls

dac67a2

readme: /relayer wip

0600b1c

latest

023f712

cleanup

f148882

tmp merge tx

d838219

removed keypair import in buildbalance.ts

b87a29f

merged: .relayer -> .params.relayer ++ instance -> provider

e104221

added verif0 -> provider.browserwallet err (is this required?)

48187a1

added verif1: wallet check (still required?) + functional_tests -> us…

43b3352

…ing new Tx class

cli and onchain tests all running.

77618c7

Swen added 6 commits February 15, 2023 17:48

build-sdk.sh script: no rm just overwrite with npm i; other minor cha…

d20a1cd

…nges

added mockProvider static method, tests running without test validato…

61020e5

…r; import issue w mock-app-verifier persists on mac, need test on linux

cli: rename /cache/ to /light-test-cache/ for less ambigous use with …

3894e6f

…global cli installation

renamed util (cli) to utils for naming consistency, upd readme todos …

35dfdbe

…(swen)

adding: error throw /disable spl

fea0bee

upd todos remove relayerrecipient airdrops

77751a1

ananas-block reviewed Feb 17, 2023

View reviewed changes

light-system-programs/programs/merkle_tree_program/src/lib.rs Outdated Show resolved Hide resolved

ananas-block reviewed Feb 17, 2023

View reviewed changes

ananas-block and others added 4 commits February 17, 2023 22:01

Merge branch 'main' into swen-dev_v4-cli

a236f87

added: prettier config files

57083bd

Merge branch 'swen-dev_v4-cli' of github.com:Lightprotocol/light-prot…

79f847b

…ocol-onchain into swen-dev_v4-cli

added: userclass tests (shield, transfer, unshield) into systemprogra…

be23003

…ms/functional_tests

Swen and others added 6 commits February 18, 2023 14:36

rm js files from tests

9d41b6f

updated gitignore to exclude js ext in light-system-programs/tests/

a1bb821

Delete package.json

e98de58

Delete lookUpTable.txt

53ea66e

Delete package-lock.json

502fccc

Update .gitignore

03c3fb0

ananas-block merged commit 9c405a2 into main Feb 18, 2023

vadorovsky deleted the swen-dev_v4-cli branch November 12, 2023 20:36

vadorovsky pushed a commit to vadorovsky/light-protocol that referenced this pull request May 1, 2024

Merge pull request Lightprotocol#15 from Lightprotocol/swen-dev_v4-cli

f01452b

Swen dev v4 cli pt 1/x

This was referenced Feb 6, 2026

fix: enforce canonical bump in ata verification #2249

Merged

fix: validate ATA derivation in both idempotent and non-idempotent paths #2250

Closed

fix: verify mint and owner in idempotent ATA early return #2255

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Swen dev v4 cli pt 1/x#15

Swen dev v4 cli pt 1/x#15
ananas-block merged 62 commits intomainfrom
swen-dev_v4-cli

SwenSchaeferjohann commented Feb 12, 2023 •

edited

Loading

Uh oh!

Uh oh!

ananas-block Feb 17, 2023

Uh oh!

ananas-block commented Feb 18, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

SwenSchaeferjohann commented Feb 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

ananas-block Feb 17, 2023

Choose a reason for hiding this comment

Uh oh!

ananas-block commented Feb 18, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SwenSchaeferjohann commented Feb 12, 2023 •

edited

Loading