@exodus/solana-api 3.20.0 → 3.20.1

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.20.1](https://github.com/ExodusMovement/assets/compare/@exodus/solana-api@3.20.0...@exodus/solana-api@3.20.1) (2025-06-11)
+
+
+### Bug Fixes
+
+
+* fix: SOL owner changed check (#5805)
+
+
+
 ## [3.20.0](https://github.com/ExodusMovement/assets/compare/@exodus/solana-api@3.19.0...@exodus/solana-api@3.20.0) (2025-06-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/solana-api",
-  "version": "3.20.0",
+  "version": "3.20.1",
   "description": "Transaction monitors, fee monitors, RPC with the blockchain node, and other networking code for Solana",
   "type": "module",
   "main": "src/index.js",
@@ -46,7 +46,7 @@
     "@exodus/assets-testing": "^1.0.0",
     "@exodus/solana-web3.js": "^1.63.1-exodus.9-rc3"
   },
-  "gitHead": "a11096f37c71032ca704876059c11b2e55cc592a",
+  "gitHead": "8302af88cf085350c4c0149ab5e581e8297c548b",
   "bugs": {
     "url": "https://github.com/ExodusMovement/assets/issues?q=is%3Aissue+is%3Aopen+label%3Asolana-api"
   },

package/src/account-state.js

@@ -21,6 +21,7 @@ export const createAccountState = ({ assetList }) => {
       tokenBalances: Object.create(null),
       rentExemptAmount: asset.currency.ZERO,
       accountSize: 0,
+      ownerChanged: false,
       stakingInfo: {
         loaded: false,
         staking: {

package/src/api.js

@@ -953,6 +953,19 @@ export class Api {
     return owner && owner !== address
   }
 
+  async ownerChanged(address, accountInfo) {
+    // method to check if the owner of the account has changed, compared to standard programs.
+    // as there could be malicious dapps that reassign the ownership of the account (see https://github.com/coinspect/solana-assign-test)
+    const value = accountInfo || (await this.getAccountInfo(address))
+    const owner = value?.owner // program owner
+    if (!owner) return false // not initialized account (or purged)
+    return ![
+      SYSTEM_PROGRAM_ID.toBase58(),
+      TOKEN_PROGRAM_ID.toBase58(),
+      TOKEN_2022_PROGRAM_ID.toBase58(),
+    ].includes(owner)
+  }
+
   ataOwnershipChangedCached = memoizeLruCache(
     (...args) => this.ataOwnershipChanged(...args),
     (address, tokenAddress) => `${address}:${tokenAddress}`,

package/src/tx-log/solana-monitor.js

@@ -305,6 +305,8 @@ export class SolanaMonitor extends BaseMonitor {
       await this.api.getMinimumBalanceForRentExemption(accountSize)
     )
 
+    const ownerChanged = await this.api.ownerChanged(address, accountInfo)
+
     const tokenBalances = _.mapValues(splBalances, (balance, name) =>
       this.assets[name].currency.baseUnit(balance)
     )
@@ -343,6 +345,7 @@ export class SolanaMonitor extends BaseMonitor {
         tokenBalances,
         rentExemptAmount,
         accountSize,
+        ownerChanged,
       },
       staking,
       tokenAccounts,
@@ -350,11 +353,12 @@ export class SolanaMonitor extends BaseMonitor {
   }
 
   async updateState({ account, cursorState, walletAccount, staking }) {
-    const { balance, tokenBalances, rentExemptAmount, accountSize } = account
+    const { balance, tokenBalances, rentExemptAmount, accountSize, ownerChanged } = account
     const newData = {
       balance,
       rentExemptAmount,
       accountSize,
+      ownerChanged,
       tokenBalances,
       stakingInfo: staking,
       ...cursorState,