refactor(ton-vault): Removed admin address from state init, fixed security issue when forwarding user's payload

sources/contracts/vaults/ton-vault.tact

@@ -27,9 +27,7 @@ message(0x7362d09c) UnexpectedJettonNotification {
     forwardPayload: Slice as remaining;
 }
 
-contract TonVault(
-    admin: Address,
-) with VaultInterface {
+contract TonVault() with VaultInterface {
     override fun handlePayout(msg: PayoutFromPool) {
         let sortedAddresses = sortAddresses(myAddress(), msg.otherVault);
         let poolInit = initOf AmmPool(sortedAddresses.lower, sortedAddresses.higher, 0, 0, 0, null);
@@ -41,7 +39,9 @@ contract TonVault(
             value: msg.amount,
             mode: SendRemainingValue,
             bounce: false,
-            body: msg.payloadToForward,
+            body: PayoutFromTonVault {
+                body: msg.payloadToForward,
+            }.toCell(),
         });
     }
 

sources/contracts/vaults/vault-interface.tact

@@ -51,6 +51,10 @@ extends inline fun numberOfHops(self: SwapParameters): Int {
     }
 }
 
+message(0x2d8b123a) PayoutFromTonVault {
+    body: Cell?;
+}
+
 struct LiquidityDepositInitData {
     otherVault: Address;
     otherAmount: Int as coins;

sources/scripts/deploy.ts

@@ -72,7 +72,7 @@ const main = async () => {
     // )
     console.log("Minted Token A", jettonMinterA.address.toString())
 
-    const tonVaultContract = await TonVault.fromInit(randomAddress())
+    const tonVaultContract = await TonVault.fromInit()
     const _tonVault = client.open(tonVaultContract)
     // const deployResult = await tonVault.send(
     //     deployerWallet.sender(keyPair.secretKey),

sources/tests/ton-vault.spec.ts

@@ -1,12 +1,14 @@
 //  SPDX-License-Identifier: MIT
 //  Copyright © 2025 TON Studio
 
-import {Blockchain} from "@ton/sandbox"
+import {Blockchain, internal} from "@ton/sandbox"
 import {createJetton, createTonVault} from "../utils/environment"
-import {beginCell} from "@ton/core"
-import {findTransactionRequired, flattenTransaction} from "@ton/test-utils"
+import {beginCell, toNano} from "@ton/core"
+import {findTransactionRequired, flattenTransaction, randomAddress} from "@ton/test-utils"
 import {randomInt} from "node:crypto"
-import {TonVault} from "../output/DEX_TonVault"
+import {loadPayoutFromTonVault, storePayoutFromPool, TonVault} from "../output/DEX_TonVault"
+import {AmmPool} from "../output/DEX_AmmPool"
+import {sortAddresses} from "../utils/deployUtils"
 
 describe("TON Vault", () => {
     test("Jettons are returned if sent to TON Vault", async () => {
@@ -46,4 +48,65 @@ describe("TON Vault", () => {
         const finalJettonBalance = await jetton.wallet.getJettonBalance()
         expect(finalJettonBalance).toEqual(initialBalance)
     })
+    test("TON Vault successfully transfers swap payload", async () => {
+        const blockchain = await Blockchain.create()
+
+        const tonVaultContract = await TonVault.fromInit()
+        const openedTonVault = blockchain.openContract(tonVaultContract)
+        const deployer = await blockchain.treasury("deployer")
+        // Deploy contract
+        const deployRes = await openedTonVault.send(
+            deployer.getSender(),
+            {value: toNano(0.1)},
+            null,
+        )
+        expect(deployRes.transactions).toHaveTransaction({
+            on: tonVaultContract.address,
+            deploy: true,
+        })
+
+        const otherVaultAddress = randomAddress(0)
+        const sortedAddresses = sortAddresses(tonVaultContract.address, otherVaultAddress, 0n, 0n)
+        const randomAmmPool = await AmmPool.fromInit(
+            sortedAddresses.lower,
+            sortedAddresses.higher,
+            0n,
+            0n,
+            0n,
+            null,
+        )
+        const tonVaultObject = await blockchain.getContract(tonVaultContract.address)
+
+        const randomReceiver = randomAddress(0)
+        const payloadToForward = beginCell()
+            .storeStringTail("Random quite big payload. User can encode anything here")
+            .endCell()
+        const res = await tonVaultObject.receiveMessage(
+            internal({
+                from: randomAmmPool.address,
+                to: tonVaultContract.address,
+                value: toNano(0.1),
+                body: beginCell()
+                    .store(
+                        storePayoutFromPool({
+                            $$type: "PayoutFromPool",
+                            amount: 0n,
+                            otherVault: otherVaultAddress,
+                            receiver: randomReceiver,
+                            payloadToForward: payloadToForward,
+                        }),
+                    )
+                    .endCell(),
+            }),
+        )
+        const flatTx = flattenTransaction(res)
+        expect(flatTx.exitCode).toEqual(0)
+        expect(flatTx.actionResultCode).toEqual(0)
+        expect(res.outMessagesCount).toEqual(1)
+        const payoutBody = res.outMessages.get(0)?.body
+        expect(payoutBody).toBeDefined()
+        const parsedPayout = loadPayoutFromTonVault(payoutBody!.beginParse())
+        expect(parsedPayout.$$type).toEqual("PayoutFromTonVault")
+        expect(parsedPayout.body).toEqualCell(payloadToForward)
+    })
 })

sources/utils/environment.ts

@@ -267,9 +267,7 @@ export const createJettonVault: Create<VaultInterface<JettonTreasury>> = async (
 export const createTonVault: Create<VaultInterface<TonTreasury>> = async (
     blockchain: Blockchain,
 ) => {
-    const vaultOwner = await blockchain.treasury("vault-owner")
-
-    const vault = blockchain.openContract(await TonVault.fromInit(vaultOwner.address))
+    const vault = blockchain.openContract(await TonVault.fromInit())
 
     const wallet = await blockchain.treasury("wallet-owner")