Governance: Constrain active proposals (#2268)

* wip: add unresolved_proposal_count to Proposal

* chore: update create_proposal test

* chore: bump version

* feat: decrease unresolved proposal count for Cancel ix

* chore: rename unresolved to outstanding

* feat: decrease outstanding proposal count for CastVote ix

* feat: decrease outstanding proposal count for FinalizeVote ix

* feat: Prevent withdrawals with outstanding proposals

* chore: fix unit test

* chore: make clippy happy

* chore: update instructions comments

* chore: temp. exclude tests with slots wrapping

Author: SebastianBor

.gitignore

@@ -10,3 +10,4 @@ hfuzz_workspace
 **/*.so
 **/.DS_Store
 test-ledger
+docker-target

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "spl-governance"
-version = "1.0.9"
+version = "1.1.0"
 description = "Solana Program Library Governance Program"
 authors = ["Solana Maintainers <[email protected]>"]
 repository = "https://github.com/solana-labs/solana-program-library"

governance/program/Cargo.toml

@@ -315,6 +315,14 @@ pub enum GovernanceError {
     /// Owner doesn't have enough governing tokens to create Governance
     #[error("Owner doesn't have enough governing tokens to create Governance")]
     NotEnoughTokensToCreateGovernance,
+
+    /// Too many outstanding proposals
+    #[error("Too many outstanding proposals")]
+    TooManyOutstandingProposals,
+
+    /// All proposals must be finalized to withdraw governing tokens
+    #[error("All proposals must be finalized to withdraw governing tokens")]
+    AllProposalsMustBeFinalisedToWithdrawGoverningTokens,
 }
 
 impl PrintProgramError for GovernanceError {

governance/program/src/error.rs

@@ -149,7 +149,7 @@ pub enum GovernanceInstruction {
     ///   0. `[]` Realm account the created Proposal belongs to
     ///   1. `[writable]` Proposal account. PDA seeds ['governance',governance, governing_token_mint, proposal_index]
     ///   2. `[writable]` Governance account
-    ///   3. `[]` TokenOwnerRecord account for Proposal owner
+    ///   3. `[writable]` TokenOwnerRecord account of the Proposal owner
     ///   4. `[signer]` Governance Authority (Token Owner or Governance Delegate)
     ///   5. `[signer]` Payer
     ///   6. `[]` System program
@@ -172,7 +172,7 @@ pub enum GovernanceInstruction {
     /// Adds a signatory to the Proposal which means this Proposal can't leave Draft state until yet another Signatory signs
     ///
     ///   0. `[writable]` Proposal account
-    ///   1. `[]` TokenOwnerRecord account for Proposal owner
+    ///   1. `[]` TokenOwnerRecord account of the Proposal owner
     ///   2. `[signer]` Governance Authority (Token Owner or Governance Delegate)
     ///   3. `[writable]` Signatory Record Account
     ///   4. `[signer]` Payer
@@ -187,7 +187,7 @@ pub enum GovernanceInstruction {
     /// Removes a Signatory from the Proposal
     ///
     ///   0. `[writable]` Proposal account
-    ///   1. `[]` TokenOwnerRecord account for Proposal owner
+    ///   1. `[]` TokenOwnerRecord account of the Proposal owner
     ///   2. `[signer]` Governance Authority (Token Owner or Governance Delegate)
     ///   3. `[writable]` Signatory Record Account
     ///   4. `[writable]` Beneficiary Account which would receive lamports from the disposed Signatory Record Account
@@ -203,7 +203,7 @@ pub enum GovernanceInstruction {
 
     ///   0. `[]` Governance account
     ///   1. `[writable]` Proposal account
-    ///   2. `[]` TokenOwnerRecord account for Proposal owner
+    ///   2. `[]` TokenOwnerRecord account of the Proposal owner
     ///   3. `[signer]` Governance Authority (Token Owner or Governance Delegate)
     ///   4. `[writable]` ProposalInstruction account. PDA seeds: ['governance',proposal,index]
     ///   5. `[signer]` Payer
@@ -225,7 +225,7 @@ pub enum GovernanceInstruction {
     /// Removes instruction from the Proposal
     ///
     ///   0. `[writable]` Proposal account
-    ///   1. `[]` TokenOwnerRecord account for Proposal owner
+    ///   1. `[]` TokenOwnerRecord account of the Proposal owner
     ///   2. `[signer]` Governance Authority (Token Owner or Governance Delegate)
     ///   3. `[writable]` ProposalInstruction account
     ///   4. `[writable]` Beneficiary Account which would receive lamports from the disposed ProposalInstruction account
@@ -234,7 +234,7 @@ pub enum GovernanceInstruction {
     /// Cancels Proposal by changing its state to Canceled
     ///
     ///   0. `[writable]` Proposal account
-    ///   1. `[]`  TokenOwnerRecord account for Proposal owner
+    ///   1. `[writable]`  TokenOwnerRecord account of the  Proposal owner
     ///   2 `[signer]` Governance Authority (Token Owner or Governance Delegate)
     ///   3. `[]` Clock sysvar
     CancelProposal,
@@ -255,7 +255,8 @@ pub enum GovernanceInstruction {
     ///   0. `[]` Realm account
     ///   1. `[]` Governance account
     ///   2. `[writable]` Proposal account
-    ///   3. `[writable]` Token Owner Record account. PDA seeds: ['governance',realm, governing_token_mint, governing_token_owner]
+    ///   4. `[writable]` TokenOwnerRecord of the Proposal owner    
+    ///   3. `[writable]` TokenOwnerRecord of the voter. PDA seeds: ['governance',realm, governing_token_mint, governing_token_owner]
     ///   4. `[signer]` Governance Authority (Token Owner or Governance Delegate)
     ///   5. `[writable]` Proposal VoteRecord account. PDA seeds: ['governance',proposal,governing_token_owner_record]
     ///   6. `[]` Governing Token Mint
@@ -274,8 +275,9 @@ pub enum GovernanceInstruction {
     ///   0. `[]` Realm account    
     ///   1. `[]` Governance account
     ///   2. `[writable]` Proposal account
-    ///   3. `[]` Governing Token Mint
-    ///   4. `[]` Clock sysvar
+    ///   3. `[writable]` TokenOwnerRecord of the Proposal owner        
+    ///   4. `[]` Governing Token Mint
+    ///   5. `[]` Clock sysvar
     FinalizeVote {},
 
     ///  Relinquish Vote removes voter weight from a Proposal and removes it from voter's active votes
@@ -368,7 +370,7 @@ pub enum GovernanceInstruction {
     ///       and the Governance program has no way to know when instruction failed and flag it automatically
     ///
     ///   0. `[writable]` Proposal account
-    ///   1. `[]` TokenOwnerRecord account for Proposal owner
+    ///   1. `[]` TokenOwnerRecord account of the Proposal owner
     ///   2. `[signer]` Governance Authority (Token Owner or Governance Delegate)    
     ///   3. `[writable]` ProposalInstruction account to flag
     ///   4. `[]` Clock sysvar
@@ -735,7 +737,7 @@ pub fn create_proposal(
     program_id: &Pubkey,
     // Accounts
     governance: &Pubkey,
-    governing_token_owner_record: &Pubkey,
+    proposal_owner_record: &Pubkey,
     governance_authority: &Pubkey,
     payer: &Pubkey,
     // Args
@@ -756,7 +758,7 @@ pub fn create_proposal(
         AccountMeta::new_readonly(*realm, false),
         AccountMeta::new(proposal_address, false),
         AccountMeta::new(*governance, false),
-        AccountMeta::new_readonly(*governing_token_owner_record, false),
+        AccountMeta::new(*proposal_owner_record, false),
         AccountMeta::new_readonly(*governance_authority, true),
         AccountMeta::new_readonly(*payer, true),
         AccountMeta::new_readonly(system_program::id(), false),
@@ -875,20 +877,23 @@ pub fn cast_vote(
     realm: &Pubkey,
     governance: &Pubkey,
     proposal: &Pubkey,
-    token_owner_record: &Pubkey,
+    proposal_owner_record: &Pubkey,
+    voter_token_owner_record: &Pubkey,
     governance_authority: &Pubkey,
     governing_token_mint: &Pubkey,
     payer: &Pubkey,
     // Args
     vote: Vote,
 ) -> Instruction {
-    let vote_record_address = get_vote_record_address(program_id, proposal, token_owner_record);
+    let vote_record_address =
+        get_vote_record_address(program_id, proposal, voter_token_owner_record);
 
     let accounts = vec![
         AccountMeta::new_readonly(*realm, false),
         AccountMeta::new_readonly(*governance, false),
         AccountMeta::new(*proposal, false),
-        AccountMeta::new(*token_owner_record, false),
+        AccountMeta::new(*proposal_owner_record, false),
+        AccountMeta::new(*voter_token_owner_record, false),
         AccountMeta::new_readonly(*governance_authority, true),
         AccountMeta::new(vote_record_address, false),
         AccountMeta::new_readonly(*governing_token_mint, false),
@@ -914,12 +919,14 @@ pub fn finalize_vote(
     realm: &Pubkey,
     governance: &Pubkey,
     proposal: &Pubkey,
+    proposal_owner_record: &Pubkey,
     governing_token_mint: &Pubkey,
 ) -> Instruction {
     let accounts = vec![
         AccountMeta::new_readonly(*realm, false),
         AccountMeta::new_readonly(*governance, false),
         AccountMeta::new(*proposal, false),
+        AccountMeta::new(*proposal_owner_record, false),
         AccountMeta::new_readonly(*governing_token_mint, false),
         AccountMeta::new_readonly(sysvar::clock::id(), false),
     ];
@@ -973,12 +980,12 @@ pub fn cancel_proposal(
     program_id: &Pubkey,
     // Accounts
     proposal: &Pubkey,
-    token_owner_record: &Pubkey,
+    proposal_owner_record: &Pubkey,
     governance_authority: &Pubkey,
 ) -> Instruction {
     let accounts = vec![
         AccountMeta::new(*proposal, false),
-        AccountMeta::new_readonly(*token_owner_record, false),
+        AccountMeta::new(*proposal_owner_record, false),
         AccountMeta::new_readonly(*governance_authority, true),
         AccountMeta::new_readonly(sysvar::clock::id(), false),
     ];

governance/program/src/instruction.rs

@@ -19,7 +19,7 @@ pub fn process_cancel_proposal(program_id: &Pubkey, accounts: &[AccountInfo]) ->
     let account_info_iter = &mut accounts.iter();
 
     let proposal_info = next_account_info(account_info_iter)?; // 0
-    let token_owner_record_info = next_account_info(account_info_iter)?; // 1
+    let proposal_owner_record_info = next_account_info(account_info_iter)?; // 1
     let governance_authority_info = next_account_info(account_info_iter)?; // 2
 
     let clock_info = next_account_info(account_info_iter)?; // 3
@@ -28,13 +28,17 @@ pub fn process_cancel_proposal(program_id: &Pubkey, accounts: &[AccountInfo]) ->
     let mut proposal_data = get_proposal_data(program_id, proposal_info)?;
     proposal_data.assert_can_cancel()?;
 
-    let token_owner_record_data = get_token_owner_record_data_for_proposal_owner(
+    let mut proposal_owner_record_data = get_token_owner_record_data_for_proposal_owner(
         program_id,
-        token_owner_record_info,
+        proposal_owner_record_info,
         &proposal_data.token_owner_record,
     )?;
 
-    token_owner_record_data.assert_token_owner_or_delegate_is_signer(governance_authority_info)?;
+    proposal_owner_record_data
+        .assert_token_owner_or_delegate_is_signer(governance_authority_info)?;
+
+    proposal_owner_record_data.decrease_outstanding_proposal_count();
+    proposal_owner_record_data.serialize(&mut *proposal_owner_record_info.data.borrow_mut())?;
 
     proposal_data.state = ProposalState::Cancelled;
     proposal_data.closed_at = Some(clock.unix_timestamp);

governance/program/src/processor/process_cancel_proposal.rs

@@ -17,7 +17,10 @@ use crate::{
         governance::get_governance_data_for_realm,
         proposal::get_proposal_data_for_governance_and_governing_mint,
         realm::get_realm_data_for_governing_token_mint,
-        token_owner_record::get_token_owner_record_data_for_realm_and_governing_mint,
+        token_owner_record::{
+            get_token_owner_record_data_for_proposal_owner,
+            get_token_owner_record_data_for_realm_and_governing_mint,
+        },
         vote_record::{get_vote_record_address_seeds, VoteRecord},
     },
     tools::{account::create_and_serialize_account_signed, spl_token::get_spl_token_mint_supply},
@@ -35,20 +38,23 @@ pub fn process_cast_vote(
 
     let realm_info = next_account_info(account_info_iter)?; // 0
     let governance_info = next_account_info(account_info_iter)?; // 1
+
     let proposal_info = next_account_info(account_info_iter)?; // 2
-    let token_owner_record_info = next_account_info(account_info_iter)?; // 3
-    let governance_authority_info = next_account_info(account_info_iter)?; // 4
+    let proposal_owner_record_info = next_account_info(account_info_iter)?; // 3
+
+    let voter_token_owner_record_info = next_account_info(account_info_iter)?; // 4
+    let governance_authority_info = next_account_info(account_info_iter)?; // 5
 
-    let vote_record_info = next_account_info(account_info_iter)?; // 5
-    let governing_token_mint_info = next_account_info(account_info_iter)?; // 6
+    let vote_record_info = next_account_info(account_info_iter)?; // 6
+    let governing_token_mint_info = next_account_info(account_info_iter)?; // 7
 
-    let payer_info = next_account_info(account_info_iter)?; // 7
-    let system_info = next_account_info(account_info_iter)?; // 8
+    let payer_info = next_account_info(account_info_iter)?; // 8
+    let system_info = next_account_info(account_info_iter)?; // 9
 
-    let rent_sysvar_info = next_account_info(account_info_iter)?; // 9
+    let rent_sysvar_info = next_account_info(account_info_iter)?; // 10
     let rent = &Rent::from_account_info(rent_sysvar_info)?;
 
-    let clock_info = next_account_info(account_info_iter)?; // 10
+    let clock_info = next_account_info(account_info_iter)?; // 11
     let clock = Clock::from_account_info(clock_info)?;
 
     if !vote_record_info.data_is_empty() {
@@ -71,28 +77,28 @@ pub fn process_cast_vote(
     )?;
     proposal_data.assert_can_cast_vote(&governance_data.config, clock.unix_timestamp)?;
 
-    let mut token_owner_record_data = get_token_owner_record_data_for_realm_and_governing_mint(
-        program_id,
-        token_owner_record_info,
-        &governance_data.realm,
-        governing_token_mint_info.key,
-    )?;
-    token_owner_record_data.assert_token_owner_or_delegate_is_signer(governance_authority_info)?;
+    let mut voter_token_owner_record_data =
+        get_token_owner_record_data_for_realm_and_governing_mint(
+            program_id,
+            voter_token_owner_record_info,
+            &governance_data.realm,
+            governing_token_mint_info.key,
+        )?;
+    voter_token_owner_record_data
+        .assert_token_owner_or_delegate_is_signer(governance_authority_info)?;
 
     // Update TokenOwnerRecord vote counts
-    token_owner_record_data.unrelinquished_votes_count = token_owner_record_data
+    voter_token_owner_record_data.unrelinquished_votes_count = voter_token_owner_record_data
         .unrelinquished_votes_count
         .checked_add(1)
         .unwrap();
 
-    token_owner_record_data.total_votes_count = token_owner_record_data
+    voter_token_owner_record_data.total_votes_count = voter_token_owner_record_data
         .total_votes_count
         .checked_add(1)
         .unwrap();
 
-    token_owner_record_data.serialize(&mut *token_owner_record_info.data.borrow_mut())?;
-
-    let vote_amount = token_owner_record_data.governing_token_deposit_amount;
+    let vote_amount = voter_token_owner_record_data.governing_token_deposit_amount;
 
     // Calculate Proposal voting weights
     let vote_weight = match vote {
@@ -113,20 +119,36 @@ pub fn process_cast_vote(
     };
 
     let governing_token_mint_supply = get_spl_token_mint_supply(governing_token_mint_info)?;
-    proposal_data.try_tip_vote(
+    if proposal_data.try_tip_vote(
         governing_token_mint_supply,
         &governance_data.config,
         &realm_data,
         clock.unix_timestamp,
-    )?;
+    )? {
+        if proposal_owner_record_info.key == voter_token_owner_record_info.key {
+            voter_token_owner_record_data.decrease_outstanding_proposal_count();
+        } else {
+            let mut proposal_owner_record_data = get_token_owner_record_data_for_proposal_owner(
+                program_id,
+                proposal_owner_record_info,
+                &proposal_data.token_owner_record,
+            )?;
+            proposal_owner_record_data.decrease_outstanding_proposal_count();
+            proposal_owner_record_data
+                .serialize(&mut *proposal_owner_record_info.data.borrow_mut())?;
+        };
+    }
+
+    voter_token_owner_record_data
+        .serialize(&mut *voter_token_owner_record_info.data.borrow_mut())?;
 
     proposal_data.serialize(&mut *proposal_info.data.borrow_mut())?;
 
     // Create and serialize VoteRecord
     let vote_record_data = VoteRecord {
         account_type: GovernanceAccountType::VoteRecord,
         proposal: *proposal_info.key,
-        governing_token_owner: token_owner_record_data.governing_token_owner,
+        governing_token_owner: voter_token_owner_record_data.governing_token_owner,
         vote_weight,
         is_relinquished: false,
     };
@@ -135,7 +157,7 @@ pub fn process_cast_vote(
         payer_info,
         vote_record_info,
         &vote_record_data,
-        &get_vote_record_address_seeds(proposal_info.key, token_owner_record_info.key),
+        &get_vote_record_address_seeds(proposal_info.key, voter_token_owner_record_info.key),
         program_id,
         system_info,
         rent,