From 1abd009bc3352eb282de9392eea2e62dd0046099 Mon Sep 17 00:00:00 2001 From: ananas-block Date: Mon, 9 Feb 2026 08:01:29 +0100 Subject: [PATCH] fix: enforce restricted extension checks for Compress mode with CToken-only outputs (H-01) Previously, all compression modes bypassed check_mint_extensions() when no_compressed_outputs was true. This allowed Compress-mode operations with CToken-only outputs to skip restricted extension enforcement. Now only CompressAndClose and Decompress-with-no-outputs bypass the check. --- .../src/compressed_token/transfer2/check_extensions.rs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/programs/compressed-token/program/src/compressed_token/transfer2/check_extensions.rs b/programs/compressed-token/program/src/compressed_token/transfer2/check_extensions.rs index 083489c32b..6e31d4fd33 100644 --- a/programs/compressed-token/program/src/compressed_token/transfer2/check_extensions.rs +++ b/programs/compressed-token/program/src/compressed_token/transfer2/check_extensions.rs @@ -106,9 +106,12 @@ pub fn build_mint_extension_cache<'a>( let mint_index = compression.mint; if cache.get_by_key(&mint_index).is_none() { let mint_account = packed_accounts.get_u8(mint_index, "mint cache: compression")?; - let checks = if compression.mode.is_compress_and_close() || no_compressed_outputs { + let checks = if compression.mode.is_compress_and_close() + || (compression.mode.is_decompress() && no_compressed_outputs) + { // Bypass extension state checks (paused, non-zero fees, non-nil transfer hook) - // when CompressAndClose, full Decompress, or CToken→SPL (compress and full decompress) + // when CompressAndClose or full Decompress (no compressed outputs). + // Compress must always enforce restrictions even with CToken-only outputs. parse_mint_extensions(mint_account)? } else { check_mint_extensions(mint_account, deny_restricted_extensions)?