@exodus/solana-api 3.20.0 → 3.20.2

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.20.2](https://github.com/ExodusMovement/assets/compare/@exodus/solana-api@3.20.1...@exodus/solana-api@3.20.2) (2025-06-17)
+
+**Note:** Version bump only for package @exodus/solana-api
+
+
+
+
+
+## [3.20.1](https://github.com/ExodusMovement/assets/compare/@exodus/solana-api@3.20.0...@exodus/solana-api@3.20.1) (2025-06-11)
+
+
+### Bug Fixes
+
+
+* fix: SOL owner changed check (#5805)
+
+
+
 ## [3.20.0](https://github.com/ExodusMovement/assets/compare/@exodus/solana-api@3.19.0...@exodus/solana-api@3.20.0) (2025-06-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/solana-api",
-  "version": "3.20.0",
+  "version": "3.20.2",
   "description": "Transaction monitors, fee monitors, RPC with the blockchain node, and other networking code for Solana",
   "type": "module",
   "main": "src/index.js",
@@ -46,7 +46,7 @@
     "@exodus/assets-testing": "^1.0.0",
     "@exodus/solana-web3.js": "^1.63.1-exodus.9-rc3"
   },
-  "gitHead": "a11096f37c71032ca704876059c11b2e55cc592a",
+  "gitHead": "e2dffb7c0eaca3832d0cccae123955903071bb36",
   "bugs": {
     "url": "https://github.com/ExodusMovement/assets/issues?q=is%3Aissue+is%3Aopen+label%3Asolana-api"
   },

package/src/account-state.js

@@ -21,6 +21,7 @@ export const createAccountState = ({ assetList }) => {
       tokenBalances: Object.create(null),
       rentExemptAmount: asset.currency.ZERO,
       accountSize: 0,
+      ownerChanged: false,
       stakingInfo: {
         loaded: false,
         staking: {

package/src/api.js

@@ -953,6 +953,19 @@ export class Api {
     return owner && owner !== address
   }
 
+  async ownerChanged(address, accountInfo) {
+    // method to check if the owner of the account has changed, compared to standard programs.
+    // as there could be malicious dapps that reassign the ownership of the account (see https://github.com/coinspect/solana-assign-test)
+    const value = accountInfo || (await this.getAccountInfo(address))
+    const owner = value?.owner // program owner
+    if (!owner) return false // not initialized account (or purged)
+    return ![
+      SYSTEM_PROGRAM_ID.toBase58(),
+      TOKEN_PROGRAM_ID.toBase58(),
+      TOKEN_2022_PROGRAM_ID.toBase58(),
+    ].includes(owner)
+  }
+
   ataOwnershipChangedCached = memoizeLruCache(
     (...args) => this.ataOwnershipChanged(...args),
     (address, tokenAddress) => `${address}:${tokenAddress}`,
@@ -1092,20 +1105,16 @@ export class Api {
     return { accounts, totalStake, locked, withdrawable, pending, activating }
   }
 
-  async getRewards(stakingAddresses = []) {
-    if (stakingAddresses.length === 0) return 0
+  async getRewards(address) {
+    if (Array.isArray(address)) throw new Error('getRewards does not support multiple addresses')
 
     // custom endpoint!
-    const rewards = await this.request('rewards')
-      .post({ addresses: stakingAddresses })
-      .error(500, () => ({})) // addresses not found
-      .error(400, () => ({}))
+    const { rewards } = await this.request('everstake-rewards') // proxied
+      .post({ address })
       .json()
 
-    // sum rewards for all addresses
-    return Object.values(rewards).reduce((total, x) => {
-      return total + x
-    }, 0)
+    // sum rewards for all epochs
+    return rewards || 0
   }
 
   async getProgramAccounts(programId, config) {

package/src/tx-log/solana-monitor.js

@@ -305,6 +305,8 @@ export class SolanaMonitor extends BaseMonitor {
       await this.api.getMinimumBalanceForRentExemption(accountSize)
     )
 
+    const ownerChanged = await this.api.ownerChanged(address, accountInfo)
+
     const tokenBalances = _.mapValues(splBalances, (balance, name) =>
       this.assets[name].currency.baseUnit(balance)
     )
@@ -343,6 +345,7 @@ export class SolanaMonitor extends BaseMonitor {
         tokenBalances,
         rentExemptAmount,
         accountSize,
+        ownerChanged,
       },
       staking,
       tokenAccounts,
@@ -350,11 +353,12 @@ export class SolanaMonitor extends BaseMonitor {
   }
 
   async updateState({ account, cursorState, walletAccount, staking }) {
-    const { balance, tokenBalances, rentExemptAmount, accountSize } = account
+    const { balance, tokenBalances, rentExemptAmount, accountSize, ownerChanged } = account
     const newData = {
       balance,
       rentExemptAmount,
       accountSize,
+      ownerChanged,
       tokenBalances,
       stakingInfo: staking,
       ...cursorState,
@@ -364,13 +368,7 @@ export class SolanaMonitor extends BaseMonitor {
 
   async getStakingInfo({ address, walletAccount }) {
     const stakingInfo = await this.api.getStakeAccountsInfo(address)
-    const stakingAddresses = await this.getStakingAddressesFromTxLog({
-      assetName: this.asset.name,
-      walletAccount,
-    })
-    // merge current and old staking addresses
-    const allStakingAddresses = _.uniq([...Object.keys(stakingInfo.accounts), ...stakingAddresses])
-    const rewards = await this.api.getRewards(allStakingAddresses)
+    const rewards = await this.api.getRewards(address)
 
     return {
       loaded: true,