Merge pull request #163 from m0-foundation/proto-337-adevar-anyone-can-redeem-bridge-to-portal-m-token-account

PROTO-337: HAL-01 (H): anyone can redeem bridge to portal m token account

Author: Oighty

programs/portal/src/instructions/release_inbound.rs

@@ -74,13 +74,22 @@ pub struct ReleaseInboundArgs {
 pub fn release_inbound_mint<'info>(
     ctx: Context<'_, '_, '_, 'info, ReleaseInboundMint<'info>>,
     args: ReleaseInboundArgs,
+) -> Result<()> {
+    release_inbound_mint_common(ctx, args, false)
+}
+
+pub fn release_inbound_mint_common<'info>(
+    ctx: Context<'_, '_, '_, 'info, ReleaseInboundMint<'info>>,
+    args: ReleaseInboundArgs,
+    release_extension: bool,
 ) -> Result<()> {
     let inbox_item = &mut ctx.accounts.inbox_item;
 
     // Validate token account depending on call context
     validate_recipient_token_account(
         &ctx.accounts.recipient.key(),
         &inbox_item,
+        release_extension,
         &ctx.accounts.token_authority.key(),
         &ctx.accounts.mint.key(),
         &ctx.accounts.token_program.key(),
@@ -179,13 +188,14 @@ pub fn release_inbound_mint<'info>(
 fn validate_recipient_token_account(
     recipient: &Pubkey,
     inbox_item: &InboxItem,
+    is_extension: bool,
     token_authority: &Pubkey,
     m_mint: &Pubkey,
     token_program: &Pubkey,
 ) -> Result<()> {
     let expected = get_inbox_recipient_token_account(
         &inbox_item.transfer.recipient,
-        &inbox_item.destination_mint,
+        is_extension,
         inbox_item.transfer.amount,
         token_authority,
         m_mint,
@@ -201,7 +211,7 @@ fn validate_recipient_token_account(
 
 pub fn get_inbox_recipient_token_account(
     recipient: &Pubkey,
-    destination_mint: &Pubkey,
+    is_extension: bool,
     amount: u64,
     token_authority: &Pubkey,
     m_mint: &Pubkey,
@@ -212,18 +222,16 @@ pub fn get_inbox_recipient_token_account(
         return None;
     }
 
-    // Bridging to extension, require intermediate portal token account
-    if !destination_mint.eq(m_mint) {
-        return Some(get_associated_token_address_with_program_id(
-            token_authority,
-            m_mint,
-            token_program,
-        ));
-    }
+    let authority = if is_extension {
+        // Bridging to extension, require intermediate portal token account
+        token_authority
+    } else {
+        // Bridging $M, require user token account
+        recipient
+    };
 
-    // Bridging $M, require user token account
     Some(get_associated_token_address_with_program_id(
-        &recipient,
+        &authority,
         m_mint,
         token_program,
     ))

programs/portal/src/instructions/release_inbound_extension.rs

@@ -4,7 +4,7 @@ use earn::state::GLOBAL_SEED;
 use ext_swap::accounts::SwapGlobal;
 use ext_swap::program::ExtSwap;
 
-use crate::instructions::{ext_swap, release_inbound_mint};
+use crate::instructions::{ext_swap, release_inbound_mint_common};
 use crate::instructions::{ReleaseInboundArgs, ReleaseInboundMint};
 use crate::ReleaseInboundMintBumps;
 use crate::__client_accounts_release_inbound_mint;
@@ -94,7 +94,7 @@ pub fn release_inbound_mint_extension<'info>(
     let token_auth_bump = ctx.bumps.common.token_authority;
 
     // Release bridged $M
-    release_inbound_mint(
+    release_inbound_mint_common(
         Context::new(
             ctx.program_id,
             &mut ctx.accounts.common,
@@ -108,6 +108,7 @@ pub fn release_inbound_mint_extension<'info>(
             // always revert on delay or wrap will fail
             revert_when_not_ready: true,
         },
+        true,
     )?;
 
     ctx.accounts.common.recipient.reload()?;

programs/portal/src/instructions/resolve_execute.rs

@@ -312,7 +312,7 @@ pub fn resolve_execute_vaa_v1<'a>(
 
     let recipient = get_inbox_recipient_token_account(
         &ntt_recipient,
-        &destination_mint,
+        !destination_mint.eq(&config_data.mint),
         amount,
         &token_auth,
         &config_data.mint,

tests/unit/portal.test.ts

@@ -1114,6 +1114,51 @@ describe('Portal unit tests', () => {
       expect(extParsedTokenAccount.amount).toBe(9198n);
     });
 
+    it('extension tokens - redeem to portal authority', async () => {
+      const [portalAuth] = PublicKey.findProgramAddressSync([Buffer.from('token_authority')], config.PORTAL_PROGRAM_ID);
+
+      const getRedeemTxns = redeem(
+        [],
+        undefined,
+        true,
+        undefined,
+        true, // skip release ix
+      );
+
+      await ssw(ctx, getRedeemTxns(), signer);
+
+      // try to release to portal authority
+      const ix = await NTT.createReleaseInboundMintInstruction(ntt.program, await ntt.getConfig(), {
+        payer: payer.publicKey,
+        nttMessage: payload,
+        recipient: portalAuth,
+        chain: 'Ethereum',
+        revertOnDelay: false,
+      });
+
+      // add additional keys required for portal CPI
+      ix.keys.push(
+        {
+          pubkey: config.EARN_PROGRAM,
+          isSigner: false,
+          isWritable: false,
+        },
+        {
+          pubkey: config.EARN_GLOBAL_ACCOUNT,
+          isSigner: false,
+          isWritable: true,
+        },
+      );
+
+      const tx = new Transaction().add(ix);
+      tx.feePayer = payer.publicKey;
+      tx.recentBlockhash = svm.latestBlockhash();
+      tx.sign(payer);
+
+      const result = svm.sendTransaction!(tx) as FailedTransactionMetadata;
+      expect(result.meta().logs()[2]).toContain('Error Code: InvalidRecipientAddress');
+    });
+
     it('tokens with merkle roots', async () => {
       const additionalPayload = Buffer.concat([
         new BN(123456).toArrayLike(Buffer, 'be', 8), // index