fix: accumulate delegated amount at decompression

[ananas-block]

Summary by CodeRabbit

• Bug Fixes

  • Unified decompression amount validation to prevent mismatches and related failures.
  • Fixed delegate handling so delegated balances now correctly accumulate when delegates match or are newly assigned; removes erroneous error paths when no delegate is present.
  • Strengthened destination ownership checks during decompression to reduce invalid restores.

• Documentation

  • Updated extension docs with clarified decompression rules, state-preservation matrix, and new error codes.

[coderabbitai]

Warning

Rate limit exceeded

@ananas-block has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 6 minutes and 25 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📝 Walkthrough

Walkthrough

Reworked decompression delegate and amount validation paths: always validate compression_amount equals input_amount; apply_delegate now sets a delegate if absent, accumulates delegated_amount when a delegate is present and matches (or was just set), and no longer errors when delegated_amount > 0 without an input delegate.

Changes

Cohort / File(s)	Summary
Decompress logic programs/compressed-token/program/src/compressed_token/transfer2/compression/ctoken/decompress.rs	Made compression amount vs input amount check unconditional; refactored apply_delegate to assign delegate if missing, accumulate delegated_amount with overflow checks when a delegate is present, and require an input delegate to proceed. Removed old error path for delegated_amount without delegate.
Documentation programs/compressed-token/program/docs/EXTENSIONS.md	Updated Decompress and CompressedOnly validation flow, clarified destination ownership checks, documented three-case delegate handling (no delegate → set & accumulate; match → accumulate; mismatch → skip), updated state-preservation matrix and error codes, and marked two open questions as implemented.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix: decompress compress_only amount check #2235 — similar change making compression_amount vs input_amount check unconditional in the decompression path.

Suggested labels

ai-review

Suggested reviewers

• sergeytimoshin
• SwenSchaeferjohann

A patch that tends the ledger's seam,
Sets delegates where none had been,
Adds amounts up, with careful eyes—
No orphaned sums, no silent sighs. ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: implementing logic to accumulate delegated amounts during decompression, which aligns with the core modifications in the decompress.rs file.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 70.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch jorrit/fix-accumulate-delegate-amount-at-decompression

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In
`@programs/compressed-token/program/src/compressed_token/transfer2/compression/ctoken/decompress.rs`:
- Around line 134-141: Extract the duplicated delegated_amount accumulation into
a small helper function (e.g., fn accumulate_delegated_amount(ctoken: &mut
ZTokenMut, amount: u64) -> Result<(), ProgramError>) that checks amount > 0,
reads current via ctoken.base.delegated_amount.get(), performs
current.checked_add(amount).ok_or(ProgramError::ArithmeticOverflow) and sets the
field, returning Ok(()); then replace both existing blocks that update
delegated_amount with calls to accumulate_delegated_amount(ctoken,
delegated_amount)? to eliminate the repeated code.
- Around line 125-145: The existing branch that handles when ctoken.delegate()
returns Some(...) currently ignores delegated_amount when input_delegate is
None, causing delegated amounts to be dropped; update the branch in
decompress.rs to validate that if delegated_amount > 0 and
input_delegate.is_none() you return the same error used elsewhere
(DecompressDelegatedAmountWithoutDelegate), otherwise proceed with the existing
delegate-matching logic (using pubkey_eq on existing_delegate.array_ref() and
delegate_acc.key()) and the accumulation into ctoken.base.delegated_amount with
checked_add as currently implemented.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Missing validation: delegated_amount > 0 with existing delegate but no input delegate

There's an inconsistency in how you handle delegated_amount > 0 without an input delegate:

• When no existing delegate (lines 160-162): You correctly return DecompressDelegatedAmountWithoutDelegate error
• When existing delegate is present (lines 142-144): You silently return Ok(), ignoring the delegated_amount

This means if a compressed account is decompressed with delegated_amount = 100 but no input_delegate, and the CToken already has a delegate, that 100 just vanishes into the void.

Consider adding the same validation check:

🐛 Proposed fix to add missing validation

         }
-        // If no input delegate or delegates don't match, nothing to do
+        // No input delegate provided
+        if delegated_amount > 0 {
+            msg!("Decompress: delegated_amount > 0 but no delegate");
+            return Err(TokenError::DecompressDelegatedAmountWithoutDelegate.into());
+        }
         return Ok(());
     }

🤖 Prompt for AI Agents

In
`@programs/compressed-token/program/src/compressed_token/transfer2/compression/ctoken/decompress.rs`
around lines 125 - 145, The existing branch that handles when ctoken.delegate()
returns Some(...) currently ignores delegated_amount when input_delegate is
None, causing delegated amounts to be dropped; update the branch in
decompress.rs to validate that if delegated_amount > 0 and
input_delegate.is_none() you return the same error used elsewhere
(DecompressDelegatedAmountWithoutDelegate), otherwise proceed with the existing
delegate-matching logic (using pubkey_eq on existing_delegate.array_ref() and
delegate_acc.key()) and the accumulation into ctoken.base.delegated_amount with
checked_add as currently implemented.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Duplicated checked_add logic for delegated_amount accumulation

The accumulation logic appears twice with identical structure. Consider extracting to a helper:

♻️ Proposed helper extraction

#[inline(always)]
fn accumulate_delegated_amount(ctoken: &mut ZTokenMut, amount: u64) -> Result<(), ProgramError> {
    if amount > 0 {
        let current = ctoken.base.delegated_amount.get();
        ctoken.base.delegated_amount.set(
            current
                .checked_add(amount)
                .ok_or(ProgramError::ArithmeticOverflow)?,
        );
    }
    Ok(())
}

Then both call sites simplify to:

accumulate_delegated_amount(ctoken, delegated_amount)?;

Also applies to: 152-159

🤖 Prompt for AI Agents

In
`@programs/compressed-token/program/src/compressed_token/transfer2/compression/ctoken/decompress.rs`
around lines 134 - 141, Extract the duplicated delegated_amount accumulation
into a small helper function (e.g., fn accumulate_delegated_amount(ctoken: &mut
ZTokenMut, amount: u64) -> Result<(), ProgramError>) that checks amount > 0,
reads current via ctoken.base.delegated_amount.get(), performs
current.checked_add(amount).ok_or(ProgramError::ArithmeticOverflow) and sets the
field, returning Ok(()); then replace both existing blocks that update
delegated_amount with calls to accumulate_delegated_amount(ctoken,
delegated_amount)? to eliminate the repeated code.

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@programs/compressed-token/program/docs/EXTENSIONS.md`:
- Around line 295-304: Update the documentation for
validate_and_apply_compressed_only to note the precondition that the delegate
three-case handling only runs when an input delegate is present: explicitly
state that apply_delegate returns early (no-op) if
input_token_data.has_delegate() is false, so delegate state is not modified when
no input delegate is provided; reference validate_and_apply_compressed_only,
apply_delegate, and input_token_data.has_delegate to guide readers to the
relevant code paths.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Documentation accurately reflects the code — one small gap to consider.

I cross-referenced each step against decompress.rs and everything checks out: the amount validation, destination ownership, delegate three-case handling, withheld fee, and frozen state restoration all match the implementation.

One gap: the docs describe the three delegate sub-cases (lines 300–302) but don't mention the precondition that all three cases only apply when input_token_data.has_delegate() is true. When no input delegate is provided, apply_delegate returns Ok(()) early (line 118–120 in code). Consider adding a brief note like:

If no input delegate is present, delegate state is not modified.

This makes the docs self-contained for someone who hasn't read the code.

🤖 Prompt for AI Agents

In `@programs/compressed-token/program/docs/EXTENSIONS.md` around lines 295 - 304,
Update the documentation for validate_and_apply_compressed_only to note the
precondition that the delegate three-case handling only runs when an input
delegate is present: explicitly state that apply_delegate returns early (no-op)
if input_token_data.has_delegate() is false, so delegate state is not modified
when no input delegate is provided; reference
validate_and_apply_compressed_only, apply_delegate, and
input_token_data.has_delegate to guide readers to the relevant code paths.

[SwenSchaeferjohann]

rebase and check if this goes away