fix: delegated transfers in deposits (#752)

* fix: delegated transfers in deposits

Signed-off-by: Reinis Martinsons <[email protected]>

* fix: delegate in deposit scripts

Signed-off-by: Reinis Martinsons <[email protected]>

* fix: delegated transfers in fills

Signed-off-by: Reinis Martinsons <[email protected]>

* fix: update slow fill test

Signed-off-by: Reinis Martinsons <[email protected]>

* fix: update fill script

Signed-off-by: Reinis Martinsons <[email protected]>

* test: unapproved deposits

Signed-off-by: Reinis Martinsons <[email protected]>

---------

Signed-off-by: Reinis Martinsons <[email protected]>

Author: Reinis-FRP

programs/svm-spoke/src/instructions/deposit.rs

@@ -1,11 +1,12 @@
 use anchor_lang::prelude::*;
-use anchor_spl::token_interface::{transfer_checked, Mint, TokenAccount, TokenInterface, TransferChecked};
+use anchor_spl::token_interface::{Mint, TokenAccount, TokenInterface};
 
 use crate::{
     error::{CommonError, SvmError},
     event::V3FundsDeposited,
     get_current_time,
     state::{Route, State},
+    utils::transfer_from,
 };
 
 #[event_cpi]
@@ -89,14 +90,16 @@ pub fn deposit_v3(
         return err!(CommonError::InvalidFillDeadline);
     }
 
-    let transfer_accounts = TransferChecked {
-        from: ctx.accounts.depositor_token_account.to_account_info(),
-        mint: ctx.accounts.mint.to_account_info(),
-        to: ctx.accounts.vault.to_account_info(),
-        authority: ctx.accounts.signer.to_account_info(),
-    };
-    let cpi_context = CpiContext::new(ctx.accounts.token_program.to_account_info(), transfer_accounts);
-    transfer_checked(cpi_context, input_amount, ctx.accounts.mint.decimals)?;
+    // Depositor must have delegated input_amount to the state PDA.
+    transfer_from(
+        &ctx.accounts.depositor_token_account,
+        &ctx.accounts.vault,
+        input_amount,
+        state,
+        ctx.bumps.state,
+        &ctx.accounts.mint,
+        &ctx.accounts.token_program,
+    )?;
 
     state.number_of_deposits += 1; // Increment number of deposits
 

programs/svm-spoke/src/instructions/fill.rs

@@ -1,7 +1,7 @@
 use anchor_lang::prelude::*;
 use anchor_spl::{
     associated_token::AssociatedToken,
-    token_interface::{transfer_checked, Mint, TokenAccount, TokenInterface, TransferChecked},
+    token_interface::{Mint, TokenAccount, TokenInterface},
 };
 
 use crate::{
@@ -12,6 +12,7 @@ use crate::{
     event::{FillType, FilledV3Relay, V3RelayExecutionEventInfo},
     get_current_time,
     state::{FillStatus, FillStatusAccount, State},
+    utils::transfer_from,
 };
 
 #[event_cpi]
@@ -101,17 +102,15 @@ pub fn fill_v3_relay(
     // If relayer and receiver are the same, there is no need to do the transfer. This might be a case when relayers
     // intentionally self-relay in a capital efficient way (no need to have funds on the destination).
     if ctx.accounts.relayer_token_account.key() != ctx.accounts.recipient_token_account.key() {
-        let transfer_accounts = TransferChecked {
-            from: ctx.accounts.relayer_token_account.to_account_info(),
-            mint: ctx.accounts.mint_account.to_account_info(),
-            to: ctx.accounts.recipient_token_account.to_account_info(),
-            authority: ctx.accounts.signer.to_account_info(),
-        };
-        let cpi_context = CpiContext::new(ctx.accounts.token_program.to_account_info(), transfer_accounts);
-        transfer_checked(
-            cpi_context,
+        // Relayer must have delegated output_amount to the state PDA (but only if not self-relaying)
+        transfer_from(
+            &ctx.accounts.relayer_token_account,
+            &ctx.accounts.recipient_token_account,
             relay_data.output_amount,
-            ctx.accounts.mint_account.decimals,
+            state,
+            ctx.bumps.state,
+            &ctx.accounts.mint_account,
+            &ctx.accounts.token_program,
         )?;
     }
 

programs/svm-spoke/src/utils/mod.rs

@@ -1,7 +1,9 @@
 pub mod bitmap_utils;
 pub mod cctp_utils;
 pub mod merkle_proof_utils;
+pub mod transfer_utils;
 
 pub use bitmap_utils::*;
 pub use cctp_utils::*;
 pub use merkle_proof_utils::*;
+pub use transfer_utils::*;

programs/svm-spoke/src/utils/transfer_utils.rs

@@ -0,0 +1,29 @@
+use anchor_lang::prelude::*;
+use anchor_spl::token_interface::{transfer_checked, Mint, TokenAccount, TokenInterface, TransferChecked};
+
+use crate::State;
+
+pub fn transfer_from<'info>(
+    from: &InterfaceAccount<'info, TokenAccount>,
+    to: &InterfaceAccount<'info, TokenAccount>,
+    amount: u64,
+    state: &Account<'info, State>,
+    state_bump: u8,
+    mint: &InterfaceAccount<'info, Mint>,
+    token_program: &Interface<'info, TokenInterface>,
+) -> Result<()> {
+    let transfer_accounts = TransferChecked {
+        from: from.to_account_info(),
+        mint: mint.to_account_info(),
+        to: to.to_account_info(),
+        authority: state.to_account_info(),
+    };
+
+    let state_seed_bytes = state.seed.to_le_bytes();
+    let seeds = &[b"state", state_seed_bytes.as_ref(), &[state_bump]];
+    let signer_seeds = &[&seeds[..]];
+
+    let cpi_context = CpiContext::new_with_signer(token_program.to_account_info(), transfer_accounts, signer_seeds);
+
+    transfer_checked(cpi_context, amount, mint.decimals)
+}

scripts/svm/simpleDeposit.ts

@@ -2,8 +2,14 @@
 
 import * as anchor from "@coral-xyz/anchor";
 import { BN, Program, AnchorProvider } from "@coral-xyz/anchor";
-import { PublicKey } from "@solana/web3.js";
-import { ASSOCIATED_TOKEN_PROGRAM_ID, TOKEN_PROGRAM_ID, getAssociatedTokenAddressSync } from "@solana/spl-token";
+import { PublicKey, Transaction, sendAndConfirmTransaction } from "@solana/web3.js";
+import {
+  ASSOCIATED_TOKEN_PROGRAM_ID,
+  TOKEN_PROGRAM_ID,
+  createApproveCheckedInstruction,
+  getAssociatedTokenAddressSync,
+  getMint,
+} from "@solana/spl-token";
 import { SvmSpoke } from "../../target/types/svm_spoke";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
@@ -53,7 +59,7 @@ async function depositV3(): Promise<void> {
   );
 
   // Define the signer (replace with your actual signer)
-  const signer = provider.wallet.publicKey;
+  const signer = (provider.wallet as anchor.Wallet).payer;
 
   // Find ATA for the input token to be stored by state (vault). This was created when the route was enabled.
   const vault = getAssociatedTokenAddressSync(
@@ -83,9 +89,25 @@ async function depositV3(): Promise<void> {
     { property: "vault", value: vault.toString() },
   ]);
 
-  const tx = await (
+  const userTokenAccount = getAssociatedTokenAddressSync(inputToken, signer.publicKey);
+
+  const tokenDecimals = (await getMint(provider.connection, inputToken, undefined, TOKEN_PROGRAM_ID)).decimals;
+
+  // Delegate state PDA to pull depositor tokens.
+  const approveIx = await createApproveCheckedInstruction(
+    userTokenAccount,
+    inputToken,
+    statePda,
+    signer.publicKey,
+    BigInt(inputAmount.toString()),
+    tokenDecimals,
+    undefined,
+    TOKEN_PROGRAM_ID
+  );
+
+  const depositIx = await (
     program.methods.depositV3(
-      signer,
+      signer.publicKey,
       recipient,
       inputToken,
       outputToken,
@@ -102,13 +124,15 @@ async function depositV3(): Promise<void> {
     .accounts({
       state: statePda,
       route: routePda,
-      signer: signer,
-      userTokenAccount: getAssociatedTokenAddressSync(inputToken, signer),
+      signer: signer.publicKey,
+      userTokenAccount,
       vault: vault,
       tokenProgram: TOKEN_PROGRAM_ID,
       mint: inputToken,
     })
-    .rpc();
+    .instruction();
+  const depositTx = new Transaction().add(approveIx, depositIx);
+  const tx = await sendAndConfirmTransaction(provider.connection, depositTx, [signer]);
 
   console.log("Transaction signature:", tx);
 }

scripts/svm/simpleFakeRelayerRepayment.ts

@@ -10,12 +10,16 @@ import {
   AddressLookupTableProgram,
   VersionedTransaction,
   TransactionMessage,
+  sendAndConfirmTransaction,
+  Transaction,
 } from "@solana/web3.js";
 import {
   ASSOCIATED_TOKEN_PROGRAM_ID,
   TOKEN_PROGRAM_ID,
   getAssociatedTokenAddressSync,
   createAssociatedTokenAccount,
+  getMint,
+  createApproveCheckedInstruction,
 } from "@solana/spl-token";
 import { SvmSpoke } from "../../target/types/svm_spoke";
 import yargs from "yargs";
@@ -49,8 +53,8 @@ async function testBundleLogic(): Promise<void> {
   const amounts = Array.from({ length: numberOfRelayersToRepay }, (_, i) => new BN(i + 1));
   const inputToken = new PublicKey(resolvedArgv.inputToken);
 
-  const signer = provider.wallet.publicKey;
-  console.log("Running from signer: ", signer.toString());
+  const signer = (provider.wallet as anchor.Wallet).payer;
+  console.log("Running from signer: ", signer.publicKey.toString());
 
   const [statePda, _] = PublicKey.findProgramAddressSync(
     [Buffer.from("state"), seed.toArrayLike(Buffer, "le", 8)],
@@ -76,21 +80,38 @@ async function testBundleLogic(): Promise<void> {
     { property: "seed", value: seed.toString() },
     { property: "numberOfRelayersToRepay", value: numberOfRelayersToRepay },
     { property: "inputToken", value: inputToken.toString() },
-    { property: "signer", value: signer.toString() },
+    { property: "signer", value: signer.publicKey.toString() },
     { property: "statePda", value: statePda.toString() },
     { property: "routePda", value: routePda.toString() },
     { property: "vault", value: vault.toString() },
   ]);
 
+  const userTokenAccount = getAssociatedTokenAddressSync(inputToken, signer.publicKey);
+
+  const tokenDecimals = (await getMint(provider.connection, inputToken, undefined, TOKEN_PROGRAM_ID)).decimals;
+
   // Use program.methods.depositV3 to send tokens to the spoke. note this is NOT a valid deposit, we just want to
   // seed tokens into the spoke to test repayment.
-  const depositTx = await (
+
+  // Delegate state PDA to pull depositor tokens.
+  const inputAmount = amounts.reduce((acc, amount) => acc.add(amount), new BN(0));
+  const approveIx = await createApproveCheckedInstruction(
+    userTokenAccount,
+    inputToken,
+    statePda,
+    signer.publicKey,
+    BigInt(inputAmount.toString()),
+    tokenDecimals,
+    undefined,
+    TOKEN_PROGRAM_ID
+  );
+  const depositIx = await (
     program.methods.depositV3(
-      signer,
-      signer, // recipient is the signer for this example
+      signer.publicKey,
+      signer.publicKey, // recipient is the signer for this example
       inputToken,
       inputToken, // Re-use inputToken as outputToken. does not matter for this deposit.
-      amounts.reduce((acc, amount) => acc.add(amount), new BN(0)),
+      inputAmount,
       new BN(0),
       new BN(11155111), // destinationChainId. assumed to be enabled, as with routePDA
       PublicKey.default, // exclusiveRelayer
@@ -103,13 +124,17 @@ async function testBundleLogic(): Promise<void> {
     .accounts({
       state: statePda,
       route: routePda,
-      signer: signer,
-      userTokenAccount: getAssociatedTokenAddressSync(inputToken, signer),
+      signer: signer.publicKey,
+      userTokenAccount: getAssociatedTokenAddressSync(inputToken, signer.publicKey),
       vault: vault,
       tokenProgram: TOKEN_PROGRAM_ID,
       mint: inputToken,
     })
-    .rpc();
+    .instruction();
+  const depositTx = await sendAndConfirmTransaction(provider.connection, new Transaction().add(approveIx, depositIx), [
+    signer,
+  ]);
+
   console.log(`Deposit transaction sent: ${depositTx}`);
 
   // Create a single repayment leaf with the array of amounts and corresponding refund addresses
@@ -161,15 +186,15 @@ async function testBundleLogic(): Promise<void> {
     { property: "State PDA", value: statePda.toString() },
     { property: "Route PDA", value: routePda.toString() },
     { property: "Root Bundle PDA", value: rootBundle.toString() },
-    { property: "Signer", value: signer.toString() },
+    { property: "Signer", value: signer.publicKey.toString() },
   ]);
 
   const relayRootBundleTx = await (program.methods.relayRootBundle(Array.from(root), Array.from(root)) as any)
     .accounts({
       state: statePda,
       rootBundle: rootBundle,
-      signer: signer,
-      payer: signer,
+      signer: signer.publicKey,
+      payer: signer.publicKey,
       systemProgram: SystemProgram.programId,
     })
     .rpc();
@@ -190,15 +215,15 @@ async function testBundleLogic(): Promise<void> {
   console.log("loading execute relayer refund leaf params...");
 
   const [instructionParams] = PublicKey.findProgramAddressSync(
-    [Buffer.from("instruction_params"), signer.toBuffer()],
+    [Buffer.from("instruction_params"), signer.publicKey.toBuffer()],
     program.programId
   );
 
   const staticAccounts = {
     instructionParams,
     state: statePda,
     rootBundle: rootBundle,
-    signer: signer,
+    signer: signer.publicKey,
     vault: vault,
     tokenProgram: TOKEN_PROGRAM_ID,
     mint: inputToken,
@@ -213,8 +238,8 @@ async function testBundleLogic(): Promise<void> {
 
   // Consolidate all above addresses into a single array for the  Address Lookup Table (ALT).
   const [lookupTableInstruction, lookupTableAddress] = await AddressLookupTableProgram.createLookupTable({
-    authority: signer,
-    payer: signer,
+    authority: signer.publicKey,
+    payer: signer.publicKey,
     recentSlot: await provider.connection.getSlot(),
   });
 
@@ -235,8 +260,8 @@ async function testBundleLogic(): Promise<void> {
   for (let i = 0; i < lookupAddresses.length; i += maxExtendedAccounts) {
     const extendInstruction = AddressLookupTableProgram.extendLookupTable({
       lookupTable: lookupTableAddress,
-      authority: signer,
-      payer: signer,
+      authority: signer.publicKey,
+      payer: signer.publicKey,
       addresses: lookupAddresses.slice(i, i + maxExtendedAccounts),
     });
 
@@ -253,7 +278,7 @@ async function testBundleLogic(): Promise<void> {
     throw new Error("AddressLookupTableAccount not fetched");
   }
 
-  await loadExecuteRelayerRefundLeafParams(program, signer, rootBundleId, leaf, proofAsNumbers);
+  await loadExecuteRelayerRefundLeafParams(program, signer.publicKey, rootBundleId, leaf, proofAsNumbers);
 
   console.log(`loaded execute relayer refund leaf params ${instructionParams}. \nExecuting relayer refund leaf...`);
 
@@ -267,7 +292,7 @@ async function testBundleLogic(): Promise<void> {
   const computeBudgetInstruction = ComputeBudgetProgram.setComputeUnitLimit({ units: 500_000 });
   const versionedTx = new VersionedTransaction(
     new TransactionMessage({
-      payerKey: signer,
+      payerKey: signer.publicKey,
       recentBlockhash: (await provider.connection.getLatestBlockhash()).blockhash,
       instructions: [computeBudgetInstruction, executeInstruction],
     }).compileToV0Message([lookupTableAccount])
@@ -280,8 +305,9 @@ async function testBundleLogic(): Promise<void> {
 
   // Close the instruction parameters account
   console.log("Closing instruction params...");
+  await new Promise((resolve) => setTimeout(resolve, 15000)); // Wait for the previous transaction to be processed.
   const closeInstructionParamsTx = await (program.methods.closeInstructionParams() as any)
-    .accounts({ signer: signer, instructionParams: instructionParams })
+    .accounts({ signer: signer.publicKey, instructionParams: instructionParams })
     .rpc();
   console.log(`Close instruction params transaction sent: ${closeInstructionParamsTx}`);
   // Note we cant close the lookup table account as it needs to be both deactivated and expired at to do this.