Validate genesis account authority matches asset signer PDA#10
Draft
Validate genesis account authority matches asset signer PDA#10
Conversation
…enV1 The SetAgentTokenV1 instruction now verifies that the authority field stored in the genesis account matches the asset signer PDA (the agent's core execute wallet). This ensures only the agent that launched the token can claim it. https://claude.ai/code/session_018YKqGETfvvpdvHm8tVc85j
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
The mpl-core execute() helper doesn't propagate signers from inner TransactionBuilder items. This caused "Transaction signature verification failure" when wrapping initializeV2 in execute() because baseMint's Signer object was lost. Fix by manually extracting inner signers and adding them to the execute builder items. https://claude.ai/code/session_018YKqGETfvvpdvHm8tVc85j
…client The generated Rust client code triggers non_local_definitions (from num_derive's FromPrimitive), clippy::new_without_default, and unexpected_cfgs lints. These are pre-existing issues not caused by our changes. https://claude.ai/code/session_018YKqGETfvvpdvHm8tVc85j
Extract context.payer.pubkey() into a local variable before passing &mut context to avoid simultaneous mutable and immutable borrows, which fails on Rust 1.88.0 used in CI. https://claude.ai/code/session_018YKqGETfvvpdvHm8tVc85j
nhanphan
commented
Apr 10, 2026
| // Allow lints from generated code (num_derive, kinobi codegen). | ||
| #![allow(non_local_definitions)] | ||
| #![allow(clippy::new_without_default)] | ||
| #![allow(unexpected_cfgs)] |
Contributor
Author
There was a problem hiding this comment.
why was this added
CI runs clippy without -D warnings so these lints are just warnings, not errors. The actual CI failure was the borrow checker error fixed in the previous commit. https://claude.ai/code/session_018YKqGETfvvpdvHm8tVc85j
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds validation to ensure that the genesis account authority matches the asset signer PDA when setting an agent token. This prevents unauthorized parties from using genesis accounts with mismatched authorities.
Key Changes
New Error Type: Added
GenesisAuthorityMismatcherror (code 0xC) to indicate when a genesis account's authority doesn't match the expected asset signer PDAValidation Logic: Added authority check in
set_agent_token_v1processorGenesisAuthorityMismatcherror if they don't matchTest Updates: Updated test suite to properly set genesis account authorities
create_genesis_accounthelper to accept anauthorityparametercannot_set_agent_token_with_wrong_genesis_authorityto verify the validation workscreateGenesisAccountViaExecutehelper that creates genesis accounts with the asset signer as authorityImplementation Details
https://claude.ai/code/session_018YKqGETfvvpdvHm8tVc85j