Merge branch 'ar-audit-staging' into kurtis/fix-m-mint-create

Oighty · Oighty · commit 16773ae86307 · 2025-08-29T11:08:15.000-05:00
diff --git a/programs/earn/src/instructions/admin/initialize.rs b/programs/earn/src/instructions/admin/initialize.rs
@@ -20,7 +20,7 @@ use crate::{
     constants::{ANCHOR_DISCRIMINATOR_SIZE, PORTAL_PROGRAM},
     errors::EarnError,
     state::{EarnGlobal, GLOBAL_SEED, TOKEN_AUTHORITY_SEED},
-    utils::{conversion::update_multiplier, token::thaw_token_account},
+    utils::{conversion::{update_multiplier, index_to_multiplier}, token::thaw_token_account},
 };
 
 cfg_if::cfg_if!(
@@ -177,20 +177,20 @@ impl Initialize<'_> {
 
                 // Set the multiplier on the m_mint to the current index and timestamp on the old earn program
                 update_multiplier(
-                    &mut ctx.accounts.m_mint,                         // mint
-                    &ctx.accounts.global_account.to_account_info(),   // authority
-                    &[&[GLOBAL_SEED, &[ctx.bumps.global_account]]],   // authority seeds
-                    &ctx.accounts.token_program,                      // token program
-                    ctx.accounts.old_global_account.index,            // index
-                    ctx.accounts.old_global_account.timestamp as i64, // timestamp
+                    &mut ctx.accounts.m_mint,                                       // mint
+                    &ctx.accounts.global_account.to_account_info(),                 // authority
+                    &[&[GLOBAL_SEED, &[ctx.bumps.global_account]]],                 // authority seeds
+                    &ctx.accounts.token_program,                                    // token program
+                    index_to_multiplier(ctx.accounts.old_global_account.index)?,    // index
+                    ctx.accounts.old_global_account.timestamp as i64,               // timestamp
                 )?;
             } else {
                 update_multiplier(
                     &mut ctx.accounts.m_mint,                       // mint
                     &ctx.accounts.global_account.to_account_info(), // authority
                     &[&[GLOBAL_SEED, &[ctx.bumps.global_account]]], // authority seeds
                     &ctx.accounts.token_program,                    // token program
-                    _current_index,                                 // index
+                    index_to_multiplier(_current_index)?,            // index
                     Clock::get()?.unix_timestamp,                   // timestamp
                 )?;
             }
diff --git a/programs/earn/src/instructions/portal/propagate_index.rs b/programs/earn/src/instructions/portal/propagate_index.rs
@@ -4,10 +4,9 @@ use anchor_spl::token_interface::{Mint, Token2022};
 
 // local dependencies
 use crate::{
-    constants::INDEX_SCALE_F64,
     errors::EarnError,
     state::{EarnGlobal, GLOBAL_SEED},
-    utils::conversion::{get_scaled_ui_config, update_multiplier},
+    utils::conversion::{get_scaled_ui_config, update_multiplier, index_to_multiplier},
 };
 
 #[derive(Accounts)]
@@ -40,10 +39,10 @@ impl PropagateIndex<'_> {
     ) -> Result<()> {
         let scaled_ui_config = get_scaled_ui_config(&ctx.accounts.m_mint)?;
         let current_multiplier: f64 = scaled_ui_config.new_multiplier.into();
-        let current_index = (INDEX_SCALE_F64 * current_multiplier).trunc() as u64;
+        let new_multiplier = index_to_multiplier(new_index)?;
 
-        // Check if the new index is greater than or equal to the previously seen index.
-        if new_index >= current_index {
+        // Check if the new multiplier is greater than or equal to the previously seen multiplier.
+        if new_multiplier >= current_multiplier {
             // If so, update the merkle root if it is non-zero.
             // We don't necessarily need the second check if we know updates only come
             // from mainnet. However, it provides some protection against staleness
@@ -52,16 +51,16 @@ impl PropagateIndex<'_> {
                 ctx.accounts.global_account.earner_merkle_root = earner_merkle_root;
             }
 
-            // If the new index is strictly greater than the current one, update the multiplier.
-            if new_index > current_index {
+            // If the new multiplier is strictly greater than the current one, update the multiplier.
+            if new_multiplier > current_multiplier {
                 let timestamp = Clock::get()?.unix_timestamp;
 
                 update_multiplier(
                     &mut ctx.accounts.m_mint,
                     &ctx.accounts.global_account.to_account_info(),
                     &[&[GLOBAL_SEED, &[ctx.accounts.global_account.bump]]],
                     &ctx.accounts.token_program,
-                    new_index,
+                    new_multiplier,
                     timestamp,
                 )?;
 
diff --git a/programs/earn/src/utils/conversion.rs b/programs/earn/src/utils/conversion.rs
@@ -14,11 +14,9 @@ pub fn update_multiplier<'info>(
     authority: &AccountInfo<'info>,
     authority_seeds: &[&[&[u8]]],
     token_program: &Program<'info, Token2022>,
-    index: u64,
+    multiplier: f64,
     timestamp: i64,
 ) -> Result<()> {
-    let multiplier = (index as f64) / INDEX_SCALE_F64;
-
     // Only update multiplier if the new multiplier is greater than the current multiplier
     // Indices in the M protocol are monotonically increasing, but we may receive a stale update
     // from another chain.
@@ -137,6 +135,23 @@ pub fn principal_to_amount_up(principal: u64, multiplier: f64) -> Result<u64> {
     Ok(amount)
 }
 
+pub fn multiplier_to_index(multiplier: f64) -> Result<u64> {
+    let index: f64 = (INDEX_SCALE_F64 * multiplier).trunc();
+
+    if index < 0.0 {
+        err!(EarnError::MathUnderflow)
+    } else if index > u64::MAX as f64 {
+        err!(EarnError::MathOverflow)
+    } else {
+        // Convert the f64 index to u64
+        Ok(index as u64)
+    }
+}
+
+pub fn index_to_multiplier(index: u64) -> Result<f64> {
+    Ok(index as f64 / INDEX_SCALE_F64)
+}
+
 pub fn get_mint_extensions<'info>(
     mint: &InterfaceAccount<'info, Mint>,
 ) -> Result<Vec<spl_token_2022::extension::ExtensionType>> {
diff --git a/programs/portal/src/instructions/admin.rs b/programs/portal/src/instructions/admin.rs
@@ -1,5 +1,8 @@
 use anchor_lang::prelude::*;
-use anchor_spl::{token_2022::spl_token_2022::instruction::AuthorityType, token_interface};
+use anchor_spl::{
+    token_2022::{spl_token_2022::instruction::AuthorityType, Token2022},
+    token_interface,
+};
 
 use crate::{
     config::Config,
@@ -9,6 +12,7 @@ use crate::{
     pending_token_authority::PendingTokenAuthority,
     queue::{inbox::InboxRateLimit, outbox::OutboxRateLimit, rate_limit::RateLimitState},
     registered_transceiver::RegisteredTransceiver,
+    TOKEN_AUTHORITY_SEED,
 };
 
 // * Transfer ownership
@@ -625,3 +629,38 @@ pub fn set_threshold(ctx: Context<SetThreshold>, threshold: u8) -> Result<()> {
     ctx.accounts.config.threshold = threshold;
     Ok(())
 }
+
+// * Set Mint
+#[derive(Accounts)]
+pub struct SetMint<'info> {
+    pub owner: Signer<'info>,
+
+    #[account(
+        mut,
+        has_one = owner,
+        constraint = config.paused @ NTTError::NotPaused,
+    )]
+    pub config: Account<'info, Config>,
+
+    pub mint: InterfaceAccount<'info, token_interface::Mint>,
+
+    /// CHECK: This account is validated by its seeds
+    #[account(
+        seeds = [TOKEN_AUTHORITY_SEED],
+        bump,
+    )]
+    pub token_authority: UncheckedAccount<'info>,
+
+    #[account(
+        associated_token::mint = mint,
+        associated_token::authority = token_authority,
+        associated_token::token_program = Token2022::id(),
+    )]
+    pub custody: InterfaceAccount<'info, token_interface::TokenAccount>,
+}
+
+pub fn set_mint(ctx: Context<SetMint>) -> Result<()> {
+    ctx.accounts.config.mint = ctx.accounts.mint.key();
+    ctx.accounts.config.custody = ctx.accounts.custody.key();
+    Ok(())
+}
diff --git a/programs/portal/src/lib.rs b/programs/portal/src/lib.rs
@@ -160,6 +160,10 @@ pub mod portal {
         instructions::claim_token_authority(ctx)
     }
 
+    pub fn set_mint(ctx: Context<SetMint>) -> Result<()> {
+        instructions::set_mint(ctx)
+    }
+
     pub fn set_paused(ctx: Context<SetPaused>, pause: bool) -> Result<()> {
         instructions::set_paused(ctx, pause)
     }
diff --git a/services/cli/main.ts b/services/cli/main.ts
@@ -50,7 +50,7 @@ import {
 } from '../../sdk/src';
 import { createInitializeConfidentialTransferMintInstruction } from './confidential-transfers';
 import { Program, BN } from '@coral-xyz/anchor';
-import { anchorProvider, keysFromEnv, NttManager } from './utils';
+import { anchorProvider, keysFromEnv, NttManager, updatePortalMint } from './utils';
 import { MerkleTree } from '../../sdk/src/merkle';
 import { bs58 } from '@coral-xyz/anchor/dist/cjs/utils/bytes';
 import { sha256 } from '@noble/hashes/sha2';
@@ -84,7 +84,7 @@ async function main() {
     .command('print-addresses')
     .description('Print the addresses of all the relevant programs and accounts')
     .action(() => {
-      const [mMint, wmMint, multisig] = keysFromEnv(['M_MINT_KEYPAIR', 'WM_MINT_KEYPAIR', 'M_MINT_MULTISIG_KEYPAIR']);
+      const [mMint, wmMint] = keysFromEnv(['M_MINT_KEYPAIR', 'WM_MINT_KEYPAIR']);
       const [portalTokenAuthPda] = PublicKey.findProgramAddressSync([Buffer.from('token_authority')], PROGRAMS.portal);
       const [earnTokenAuthPda] = PublicKey.findProgramAddressSync([Buffer.from('token_authority')], PROGRAMS.earn);
       const [portalEmitter] = PublicKey.findProgramAddressSync([Buffer.from('emitter')], PROGRAMS.portal);
@@ -100,7 +100,6 @@ async function main() {
         'Earn Program': PROGRAMS.earn,
         'Swap Program': PROGRAMS.swap,
         'M Mint': mMint.publicKey,
-        'M Mint Multisig': multisig.publicKey,
         'Portal Token Authority': portalTokenAuthPda,
         'Earn Token Authority': earnTokenAuthPda,
         'wM Mint': wmMint.publicKey,
@@ -367,92 +366,14 @@ async function main() {
 
   program.command('update-portal-mint').action(async () => {
     const [payer, mint] = keysFromEnv(['PAYER_KEYPAIR', 'M_MINT_KEYPAIR']);
-    const admin = process.env.SQUADS_VAULT ? new PublicKey(process.env.SQUADS_VAULT) : payer.publicKey;
     const { ntt } = NttManager(connection, payer, mint.publicKey);
 
-    const tx = new Transaction().add(
-      new TransactionInstruction({
-        programId: PROGRAMS.portal,
-        keys: [
-          {
-            pubkey: admin,
-            isSigner: true,
-            isWritable: false,
-          },
-          {
-            pubkey: ntt.pdas.configAccount(),
-            isSigner: false,
-            isWritable: true,
-          },
-          {
-            pubkey: mint.publicKey,
-            isSigner: false,
-            isWritable: false,
-          },
-        ],
-        data: Buffer.concat([Buffer.from(sha256('global:set_mint').subarray(0, 8))]),
-      }),
-    );
-
-    tx.feePayer = admin;
-    tx.recentBlockhash = (await connection.getLatestBlockhash()).blockhash;
-
+    let owner = payer.publicKey;
     if (process.env.SQUADS_VAULT) {
-      const b = tx.serialize({ verifySignatures: false });
-      console.log('Transaction:', {
-        b64: b.toString('base64'),
-        b58: bs58.encode(b),
-      });
-    } else {
-      const sig = await connection.sendTransaction(tx, [payer]);
-      console.log(`Updated mint: ${sig}`);
+      owner = new PublicKey(process.env.SQUADS_VAULT);
     }
-  });
-
-  program.command('initialize-portal-resolver').action(async () => {
-    const [payer, mint] = keysFromEnv(['PAYER_KEYPAIR', 'M_MINT_KEYPAIR']);
-    const admin = process.env.SQUADS_VAULT ? new PublicKey(process.env.SQUADS_VAULT) : payer.publicKey;
-    const { ntt } = NttManager(connection, payer, mint.publicKey);
-    const swapLUT = new PublicKey('9JLRqBqkznKiSoNfotA4ywSRdnWb2fE76SiFrAfkaRCD');
-
-    const tx = new Transaction().add(
-      new TransactionInstruction({
-        programId: PROGRAMS.portal,
-        keys: [
-          {
-            pubkey: admin,
-            isSigner: true,
-            isWritable: true,
-          },
-          {
-            pubkey: ntt.pdas.configAccount(),
-            isSigner: false,
-            isWritable: true,
-          },
-          {
-            pubkey: PublicKey.findProgramAddressSync(
-              [Buffer.from('executor-account-resolver:result')],
-              PROGRAMS.portal,
-            )[0],
-            isSigner: false,
-            isWritable: true,
-          },
-          {
-            pubkey: SystemProgram.programId,
-            isSigner: false,
-            isWritable: false,
-          },
-        ],
-        data: Buffer.concat([
-          Buffer.from(sha256('global:initialize_resolver_accounts').subarray(0, 8)),
-          Buffer.from([1]),
-          swapLUT.toBuffer(),
-        ]),
-      }),
-    );
 
-    tx.feePayer = admin;
-    tx.recentBlockhash = (await connection.getLatestBlockhash()).blockhash;
+    const tx = new Transaction().add(updatePortalMint(owner, ntt.pdas.configAccount(), mint.publicKey));
 
     if (process.env.SQUADS_VAULT) {
       const b = tx.serialize({ verifySignatures: false });
@@ -462,7 +383,7 @@ async function main() {
       });
     } else {
       const sig = await connection.sendTransaction(tx, [payer]);
-      console.log(`Initialized resolver: ${sig}`);
+      console.log(`Paused: ${sig}`);
     }
   });
 
@@ -588,6 +509,25 @@ async function main() {
       }
     });
 
+  program.command('pause-bridging').action(async () => {
+    const [payer, mint] = keysFromEnv(['PAYER_KEYPAIR', 'M_MINT_KEYPAIR']);
+    const { ntt, sender } = NttManager(connection, payer, mint.publicKey);
+
+    const pauseTxn = (await ntt.pause(sender).next()).value as SolanaUnsignedTransaction<'Mainnet', 'Solana'>;
+    const tx = pauseTxn.transaction.transaction as Transaction;
+
+    if (process.env.SQUADS_VAULT) {
+      const b = tx.serialize({ verifySignatures: false });
+      console.log('Transaction:', {
+        b64: b.toString('base64'),
+        b58: bs58.encode(b),
+      });
+    } else {
+      const sig = await connection.sendTransaction(tx, [payer]);
+      console.log(`Paused: ${sig}`);
+    }
+  });
+
   program
     .command('pause-bridging')
     .option('-u, --unpause', 'Unpause if already paused')
diff --git a/services/cli/utils.ts b/services/cli/utils.ts
@@ -1,8 +1,9 @@
-import { Keypair, Connection, PublicKey } from '@solana/web3.js';
+import { Keypair, Connection, PublicKey, TransactionInstruction } from '@solana/web3.js';
 import { SolanaNtt } from '@wormhole-foundation/sdk-solana-ntt';
 import { SolanaPlatform, SolanaSendSigner } from '@wormhole-foundation/sdk-solana';
-import { AccountAddress, Wormhole } from '@wormhole-foundation/sdk';
+import { AccountAddress, sha256, Wormhole } from '@wormhole-foundation/sdk';
 import { AnchorProvider, Wallet } from '@coral-xyz/anchor';
+import { getAssociatedTokenAddressSync, TOKEN_2022_PROGRAM_ID } from '@solana/spl-token';
 
 const PORTAL = new PublicKey('mzp1q2j5Hr1QuLC3KFBCAUz5aUckT6qyuZKZ3WJnMmY');
 
@@ -45,3 +46,42 @@ export function anchorProvider(connection: Connection, owner: Keypair) {
     skipPreflight: false,
   });
 }
+
+export function updatePortalMint(owner: PublicKey, config: PublicKey, mMint: PublicKey): TransactionInstruction {
+  return new TransactionInstruction({
+    programId: PORTAL,
+    keys: [
+      {
+        pubkey: owner,
+        isSigner: true,
+        isWritable: false,
+      },
+      {
+        pubkey: config,
+        isSigner: false,
+        isWritable: true,
+      },
+      {
+        pubkey: mMint,
+        isSigner: false,
+        isWritable: false,
+      },
+      {
+        pubkey: PublicKey.findProgramAddressSync([Buffer.from('token_authority')], PORTAL)[0],
+        isSigner: false,
+        isWritable: false,
+      },
+      {
+        pubkey: getAssociatedTokenAddressSync(
+          mMint,
+          PublicKey.findProgramAddressSync([Buffer.from('token_authority')], PORTAL)[0],
+          true,
+          TOKEN_2022_PROGRAM_ID,
+        ),
+        isSigner: false,
+        isWritable: false,
+      },
+    ],
+    data: Buffer.concat([Buffer.from(sha256('global:set_mint').subarray(0, 8))]),
+  });
+}

Original file line number	Diff line number	Diff line change
`@@ -160,6 +160,10 @@ pub mod portal {`
`160`	`160`	`instructions::claim_token_authority(ctx)`
`161`	`161`	`}`
`162`	`162`
	`163`	`+ pub fn set_mint(ctx: Context<SetMint>) -> Result<()> {`
	`164`	`+ instructions::set_mint(ctx)`
	`165`	`+ }`
	`166`	`+`
`163`	`167`	`pub fn set_paused(ctx: Context<SetPaused>, pause: bool) -> Result<()> {`
`164`	`168`	`instructions::set_paused(ctx, pause)`
`165`	`169`	`}`