fix(lazer): allow caller to verify instruction index and message offset

Author: Riateche

lazer/contracts/solana/programs/pyth-lazer-solana-contract/src/lib.rs

@@ -1,7 +1,6 @@
 mod signature;
 
 use {
-    crate::signature::VerifiedMessage,
     anchor_lang::{
         prelude::*, solana_program::pubkey::PUBKEY_BYTES, system_program, Discriminator,
     },
@@ -189,11 +188,17 @@ pub mod pyth_lazer_solana_contract {
     /// - `ed25519_instruction_index` is the index of the `ed25519_program` instruction
     ///   within the transaction. This instruction must precede the current instruction.
     /// - `signature_index` is the index of the signature within the inputs to the `ed25519_program`.
+    /// - `message_instruction_index` is the index of the instruction that receives the message data
+    ///   within the transaction.
+    /// - `message_offset` is the offset of the signed message within the
+    ///   input data for that instruction.
     pub fn verify_message(
         ctx: Context<VerifyMessage>,
         ed25519_instruction_index: u16,
         signature_index: u8,
-    ) -> Result<VerifiedMessage> {
+        message_instruction_index: u16,
+        message_offset: u16,
+    ) -> Result<()> {
         system_program::transfer(
             CpiContext::new(
                 ctx.accounts.system_program.to_account_info(),
@@ -210,11 +215,15 @@ pub mod pyth_lazer_solana_contract {
             &ctx.accounts.instructions_sysvar,
             ed25519_instruction_index,
             signature_index,
+            message_instruction_index,
+            message_offset,
         )
         .map_err(|err| {
             msg!("signature verification error: {:?}", err);
-            err.into()
-        })
+            err
+        })?;
+
+        Ok(())
     }
 }
 

lazer/contracts/solana/programs/pyth-lazer-solana-contract/src/signature.rs

@@ -154,11 +154,17 @@ impl From<SignatureVerificationError> for anchor_lang::error::Error {
 /// - `ed25519_instruction_index` is the index of the `ed25519_program` instruction
 ///   within the transaction. This instruction must precede the current instruction.
 /// - `signature_index` is the index of the signature within the inputs to the `ed25519_program`.
+/// - `message_instruction_index` is the index of the instruction that receives the message data
+///   within the transaction.
+/// - `message_offset` is the offset of the signed message within the
+///   input data for that instruction.
 pub fn verify_message(
     storage: &Storage,
     instructions_sysvar: &AccountInfo,
     ed25519_instruction_index: u16,
     signature_index: u8,
+    message_instruction_index: u16,
+    message_offset: u16,
 ) -> Result<VerifiedMessage, SignatureVerificationError> {
     const SOLANA_FORMAT_MAGIC_LE: u32 = 2182742457;
 
@@ -200,6 +206,10 @@ pub fn verify_message(
     }
     let offsets = &args[usize::from(signature_index)];
 
+    if offsets.message_instruction_index != message_instruction_index {
+        return Err(SignatureVerificationError::InvalidInstructionIndex);
+    }
+
     if offsets.signature_instruction_index != offsets.message_instruction_index
         || offsets.public_key_instruction_index != offsets.message_instruction_index
     {
@@ -215,10 +225,15 @@ pub fn verify_message(
     )
     .map_err(SignatureVerificationError::LoadInstructionAtFailed)?;
 
-    let message_offset = offsets
+    let derived_message_offset = offsets
         .signature_offset
         .checked_sub(MAGIC_LEN)
         .ok_or(SignatureVerificationError::MessageOffsetOverflow)?;
+
+    if message_offset != derived_message_offset {
+        return Err(SignatureVerificationError::InvalidMessageOffset);
+    }
+
     let message_end_offset = offsets
         .message_data_offset
         .checked_add(offsets.message_data_size)

lazer/contracts/solana/programs/pyth-lazer-solana-contract/tests/test1.rs

@@ -148,6 +148,8 @@ impl Setup {
                     &pyth_lazer_solana_contract::instruction::VerifyMessage {
                         ed25519_instruction_index: 0,
                         signature_index: 0,
+                        message_instruction_index: instruction_index,
+                        message_offset,
                     }
                     .data(),
                     vec![