Skip to content

SWAP-410 feat: add transfer check validation when receiver is different than taker - #77

Merged
ioanSL merged 2 commits into
mainfrom
chore/validate-transfer-to-receiver-account
May 7, 2026
Merged

SWAP-410 feat: add transfer check validation when receiver is different than taker#77
ioanSL merged 2 commits into
mainfrom
chore/validate-transfer-to-receiver-account

Conversation

@ioanSL

@ioanSL ioanSL commented May 5, 2026

Copy link
Copy Markdown
Collaborator

Summary

Short summary of the change and impact.

Audit Status

  • Required — Audit completed and artifacts attached
  • Not Required — Justification below (3–5 lines)

If Required

  • Audit report link:
  • Scope:
  • Key findings + fixes:

If Not Required (Justification)

Deployment Intent

  • No deploy
  • Deploy new program
  • Upgrade existing program

@ioanSL
ioanSL requested a review from yan-wl May 5, 2026 09:27
@ioanSL ioanSL self-assigned this May 5, 2026
@github-actions

github-actions Bot commented May 5, 2026

Copy link
Copy Markdown
Coverage report
Filename Lines Covered (%) Functions Covered (%)
order-engine-sdk/src/fill.rs 94.71 81.82
order-engine-sdk/src/lib.rs 0 0
order-engine-sdk/src/transaction.rs 0 0
programs/order-engine/src/error.rs 100 100
programs/order-engine/src/instructions/fill.rs 98.29 80
programs/order-engine/src/lib.rs 90.91 75
server-example/src/config.rs 0 0
server-example/src/server.rs 0 0
squads-sdk/src/accounts.rs 93.51 100
squads-sdk/src/config.rs 29.03 25
squads-sdk/src/error.rs 0 0
squads-sdk/src/lib.rs 100 100
squads-sdk/src/pda.rs 98.04 100
squads-sdk/src/serialize.rs 70.83 60
squads-sdk/src/settings.rs 94.02 100
squads-sdk/src/transaction.rs 35.87 25
squads-sdk/src/unwrap.rs 86.99 81.25
squads-sdk/src/wrap.rs 78.06 75
webhook-api/src/enums.rs 88.75 18.18
webhook-api/src/requests.rs 0 0
webhook-api/src/responses.rs 0 0

@github-actions

github-actions Bot commented May 5, 2026

Copy link
Copy Markdown
Coverage report
Filename Lines Covered (%) Functions Covered (%)
order-engine-sdk/src/fill.rs 93.82 81.82
order-engine-sdk/src/lib.rs 0 0
order-engine-sdk/src/transaction.rs 0 0
programs/order-engine/src/error.rs 100 100
programs/order-engine/src/instructions/fill.rs 98.29 80
programs/order-engine/src/lib.rs 90.91 75
server-example/src/config.rs 0 0
server-example/src/server.rs 0 0
squads-sdk/src/accounts.rs 93.51 100
squads-sdk/src/config.rs 29.03 25
squads-sdk/src/error.rs 0 0
squads-sdk/src/lib.rs 100 100
squads-sdk/src/pda.rs 98.04 100
squads-sdk/src/serialize.rs 70.83 60
squads-sdk/src/settings.rs 94.02 100
squads-sdk/src/transaction.rs 35.87 25
squads-sdk/src/unwrap.rs 86.99 81.25
squads-sdk/src/wrap.rs 78.06 75
webhook-api/src/enums.rs 88.75 18.18
webhook-api/src/requests.rs 0 0
webhook-api/src/responses.rs 0 0

@ioanSL

ioanSL commented May 5, 2026

Copy link
Copy Markdown
Collaborator Author

/bot review

@jupbot

jupbot Bot commented May 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Bot Agent progress: /bot review

Progress:

  • Repo checks (5 ok, 1 failed)
  • Context build
  • Codex review (1 pass)
  • Parallel review (parallel fallback to Codex)
  • Post review

jupbot[bot]
jupbot Bot reviewed May 5, 2026
View reviewed changes

@jupbot jupbot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verdict

Comment

Review coverage

Findings: P0:0 P1:1 P2:1 P3:0
Reviewed by: Codex single reviewer + Codex

Summary

⚠️ Limited-confidence review: check failed: cargo clippy --workspace --all-targets -- -D warnings.

Receiver-transfer validation was added, but the patch introduces a clippy-blocking test helper and leaves native SOL receiver transfers order-insensitive relative to the fill instruction.

Findings
  • [P1] order-engine-sdk/src/fill.rs:643 New test helper fails clippy with too many arguments
  • [P2] order-engine-sdk/src/fill.rs:161 Native receiver transfer can be validated before the fill (via Codex)
Repo checks

Repo Checks

  • rustup component add --toolchain 1.87.0-x86_64-unknown-linux-gnu rustfmt: ok
info: component rustfmt is up to date
  • rustup component add --toolchain 1.87.0-x86_64-unknown-linux-gnu clippy: ok
info: component clippy is up to date
  • cargo fetch --locked: ok
p-table-program v2.2.7
  Downloaded solana-tls-utils v2.2.7
  Downloaded solana-type-overrides v2.2.7
  Downloaded solana-program-runtime v2.2.7
  Downloaded solana-account-decoder-client-types v2.2.7
  Downloaded arbitrary v1.4.1
  Downloaded utoipa-gen v5.3.1
  Downloaded solana-vote v2.2.7
  Downloaded solana-builtins-default-costs v2.2.7
  Downloaded solana-thin-client v2.2.7
  Downloaded solana-zk-token-sdk v2.2.7
  Downloaded solana-zk-sdk v2.2.7
  Downloaded solana-rpc-client-api v2.2.7
  Downloaded solana-tpu-client v2.2.7
  Downloaded solana-transaction-metrics-tracker v2.2.7
  Downloaded solana-sdk v2.2.2
  Downloaded solana-metrics v2.2.7
  Downloaded solana-ed25519-program v2.2.2
  Downloaded derive_arbitrary v1.4.1
  Downloaded solana-cost-model v2.2.7
  Downloaded solana-stake-program v2.2.7
  Downloaded solana-quic-client v2.2.7
  Downloaded solana-pubsub-client v2.2.7
  Downloaded solana-rpc-client v2.2.7
  Downloaded solana-inline-spl v2.2.7
  Downloaded solana-version v2.2.7
  Downloaded solana-rayon-threadlimit v2.2.7
  Downloaded solana-perf v2.2.7
  Downloaded solana-streamer v2.2.7
  Downloaded solana-udp-client v2.2.7
  Downloaded solana-client v2.2.7
  Downloaded tracing-core v0.1.33
  Downloaded solana-precompile-error v2.2.1
  Downloaded solana-vote-interface v2.2.3
  Downloaded toml_edit v0.22.26
  Downloaded bytemuck_derive v1.9.3
  Downloaded miniz_oxide v0.8.8
  Downloaded tokio v1.45.0
  Downloaded errno v0.3.12
  Downloaded solana-compute-budget-program v2.2.7
  Downloaded solana-svm-rent-collector v2.2.7
  Downloaded solana-svm-transaction v2.2.7
  Downloaded spl-token-confidential-transfer-proof-extraction v0.4.0
  Downloaded tracing-attributes v0.1.28
  Downloaded icu_properties_data v2.0.0
  Downloaded solana-transaction-status v2.2.7
  Downloaded toml_write v0.1.1
  Downloaded agave-transaction-view v2.2.7
  Downloaded agave-reserved-account-keys v2.2.7
  Downloaded agave-precompiles v2.2.7
  Downloaded openssl-src v300.5.0+3.5.0
  • cargo check --workspace: ok
 nu-ansi-term v0.46.0
    Checking indicatif v0.17.11
    Checking clap_builder v4.5.38
    Checking matchers v0.1.0
    Checking solana-account-decoder-client-types v2.2.7
    Checking spl-elgamal-registry v0.3.0
    Checking async-channel v1.9.0
   Compiling utoipauto-macro v0.2.0
    Checking async-global-executor v2.4.1
    Checking spl-transfer-hook-interface v0.10.0
    Checking rust-embed v8.7.2
    Checking spl-token-metadata-interface v0.7.0
   Compiling clap_derive v4.5.32
    Checking agave-reserved-account-keys v2.2.7
    Checking spl-token v8.0.0
    Checking spl-token-group-interface v0.6.0
    Checking spl-token-confidential-transfer-ciphertext-arithmetic v0.3.0
    Checking solana-transaction-status-client-types v2.2.7
    Checking spl-token-confidential-transfer-proof-generation v0.4.0
    Checking tracing-log v0.2.0
   Compiling async-attributes v1.1.2
    Checking kv-log-macro v1.0.7
    Checking sharded-slab v0.1.7
    Checking utoipa v5.3.1
    Checking uuid v1.16.0
    Checking thread_local v1.1.8
    Checking tower-http v0.6.4
    Checking async-std v1.13.1
    Checking strum v0.26.3
    Checking spl-token-2022 v9.0.0
    Checking tracing-subscriber v0.3.19
    Checking solana-rpc-client-api v2.2.7
    Checking utoipauto v0.2.0
    Checking order-engine-sdk v0.1.0 (/data/workdir/2803415/jup-ag/rfq-webhook-toolkit/order-engine-sdk)
    Checking axum-extra v0.10.1
    Checking dotenvy v0.15.7
    Checking clap v4.5.38
    Checking squads-sdk v0.1.0 (/data/workdir/2803415/jup-ag/rfq-webhook-toolkit/squads-sdk)
    Checking utoipa-axum v0.2.0
    Checking webhook-api v0.1.0 (/data/workdir/2803415/jup-ag/rfq-webhook-toolkit/webhook-api)
    Checking solana-rpc-client v2.2.7
    Checking order-engine v0.1.0 (/data/workdir/2803415/jup-ag/rfq-webhook-toolkit/programs/order-engine)
    Checking server-example v0.1.0 (/data/workdir/2803415/jup-ag/rfq-webhook-toolkit/server-example)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 47.62s
  • cargo fmt --check: ok
  • cargo clippy --workspace --all-targets -- -D warnings: failed

    Checking solana-address-lookup-table-program v2.2.7
    Checking solana-zk-token-proof-program v2.2.7
    Checking solana-zk-elgamal-proof-program v2.2.7
    Checking solana-banks-client v2.2.7
    Checking solana-account-decoder v2.2.7
    Checking squads-sdk v0.1.0 (/data/workdir/2803415/jup-ag/rfq-webhook-toolkit/squads-sdk)
    Checking solana-rpc-client-api v2.2.7
error: used `unwrap_or()` on `Some` value
   --> order-engine-sdk/src/fill.rs:517:45
    |
517 |               taker_input_mint_token_account: taker_input_mint_token_account
    |  _____________________________________________^
518 | |                 .unwrap_or(order_engine::ID),
    | |____________________________________________^
    |
help: remove the `Some` and `unwrap_or()`
   --> order-engine-sdk/src/fill.rs:483:46
    |
483 |         let taker_input_mint_token_account = Some(Pubkey::new_unique());
    |                                              ^^^^^^^^^^^^^^^^^^^^^^^^^^
    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_literal_unwrap
    = note: `-D clippy::unnecessary-literal-unwrap` implied by `-D warnings`
    = help: to override `-D warnings` add `#[allow(clippy::unnecessary_literal_unwrap)]`

error: this function has too many arguments (9/7)
   --> order-engine-sdk/src/fill.rs:643:5
    |
643 | /     fn build_fill_ix(
644 | |         taker: Pubkey,
645 | |         maker: Pubkey,
646 | |         input_mint: Pubkey,
...   |
652 | |         expire_at: i64,
653 | |     ) -> Instruction {
    | |____________________^
    |
    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#too_many_arguments
    = note: `-D clippy::too-many-arguments` implied by `-D warnings`
    = help: to override `-D warnings` add `#[allow(clippy::too_many_arguments)]`

error: could not compile `order-engine-sdk` (lib test) due to 2 previous errors
warning: build failed, waiting for other jobs to finish...

@ioanSL ioanSL changed the title feat: add transfer check validation when receiver is different than taker SWAP-410 feat: add transfer check validation when receiver is different than taker May 5, 2026
@ioanSL
ioanSL merged commit 72c1450 into main May 7, 2026
7 checks passed
@ioanSL
ioanSL deleted the chore/validate-transfer-to-receiver-account branch May 7, 2026 06:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yan-wl yan-wl yan-wl approved these changes
+1 more reviewer
@jupbot jupbot[bot] jupbot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@ioanSL ioanSL

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ioanSL @yan-wl