@exodus/solana-lib 3.21.1 → 3.22.0

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.22.0](https://github.com/ExodusMovement/assets/compare/@exodus/solana-lib@3.21.1...@exodus/solana-lib@3.22.0) (2026-03-13)
+
+
+### Features
+
+
+* feat: solana add instruction shape validation (#7575)
+
+
+
 ## [3.21.1](https://github.com/ExodusMovement/assets/compare/@exodus/solana-lib@3.21.0...@exodus/solana-lib@3.21.1) (2026-03-12)
 
 **Note:** Version bump only for package @exodus/solana-lib

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/solana-lib",
-  "version": "3.21.1",
+  "version": "3.22.0",
   "description": "Solana utils, such as for cryptography, address encoding/decoding, transaction building, etc.",
   "type": "module",
   "main": "src/index.js",
@@ -48,5 +48,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "1c57290eed9f84bfd28f25948796f52f94e8a52f"
+  "gitHead": "cf39bddd95d88ea2e99809810172368a5d4adc97"
 }

package/src/tx/instruction-utils.js

@@ -4,9 +4,64 @@ import {
   TOKEN_2022_PROGRAM_ID,
   TOKEN_PROGRAM_ID,
 } from '../constants.js'
-import { TOKEN_INSTRUCTION_LAYOUTS, TRANSFER_FEE_SUB_INSTRUCTIONS } from '../vendor/index.js'
+import {
+  SYSTEM_INSTRUCTION_LAYOUTS,
+  TOKEN_INSTRUCTION_LAYOUTS,
+  TRANSFER_FEE_SUB_INSTRUCTIONS,
+} from '../vendor/index.js'
 import { toBuffer } from '../vendor/utils/to-buffer.js'
 
+/** Token instruction type index → { minBytes, minAccounts } for hasValidShape. Uses TOKEN_INSTRUCTION_LAYOUTS indices. */
+export const TOKEN_INSTRUCTION_REQUIREMENTS = Object.freeze({
+  [TOKEN_INSTRUCTION_LAYOUTS.InitializeAccount.index]: { minBytes: 1, minAccounts: 4 },
+  [TOKEN_INSTRUCTION_LAYOUTS.InitializeAccount2.index]: { minBytes: 33, minAccounts: 3 },
+  [TOKEN_INSTRUCTION_LAYOUTS.InitializeAccount3.index]: { minBytes: 33, minAccounts: 2 },
+  [TOKEN_INSTRUCTION_LAYOUTS.Transfer.index]: { minBytes: 9, minAccounts: 3 },
+  [TOKEN_INSTRUCTION_LAYOUTS.TransferChecked.index]: { minBytes: 10, minAccounts: 4 },
+  [TOKEN_INSTRUCTION_LAYOUTS.TransferFeeExtension.index]: { minBytes: 19, minAccounts: 4 },
+  [TOKEN_INSTRUCTION_LAYOUTS.CloseAccount.index]: { minBytes: 1, minAccounts: 3 },
+  [TOKEN_INSTRUCTION_LAYOUTS.Approve.index]: { minBytes: 9, minAccounts: 3 },
+  [TOKEN_INSTRUCTION_LAYOUTS.ApproveChecked.index]: { minBytes: 10, minAccounts: 4 },
+  [TOKEN_INSTRUCTION_LAYOUTS.Revoke.index]: { minBytes: 1, minAccounts: 2 },
+  [TOKEN_INSTRUCTION_LAYOUTS.SyncNative.index]: { minBytes: 1, minAccounts: 1 },
+  [TOKEN_INSTRUCTION_LAYOUTS.SetAuthority.index]: { minBytes: 35, minAccounts: 2 },
+})
+
+/** System program instruction type index → { minBytes, minAccounts } for hasValidShape. */
+export const SYSTEM_INSTRUCTION_REQUIREMENTS = Object.freeze({
+  [SYSTEM_INSTRUCTION_LAYOUTS.Transfer.index]: { minBytes: 12, minAccounts: 2 },
+})
+
+/**
+ * Checks that an instruction has the required shape (data length and account count).
+ * Works with both legacy shape (keys/data) and normalized shape (accounts/data).
+ *
+ * @param {Object} instruction - Instruction object with `data` and either `keys` or `accounts`
+ * @param {Object} reqs - Requirements: `{ minBytes?: number, minAccounts?: number }`
+ * @returns {boolean}
+ */
+export function hasValidShape(instruction, reqs) {
+  if (!reqs) return false
+  let data = null
+  if (instruction?.data != null) {
+    try {
+      data = toBuffer(instruction.data)
+    } catch {
+      return false
+    }
+  }
+
+  const minBytes = reqs.minBytes ?? 0
+  const minAccounts = reqs.minAccounts ?? 0
+  const accounts = instruction?.keys ?? instruction?.accounts
+  return (
+    data != null &&
+    data.length >= minBytes &&
+    Array.isArray(accounts) &&
+    accounts.length >= minAccounts
+  )
+}
+
 export function isTokenProgramInstruction(instruction) {
   const programId = instruction?.programId
   if (!programId) return false
@@ -16,12 +71,11 @@ export function isTokenProgramInstruction(instruction) {
 export function isSystemTransferInstruction(instruction) {
   const programId = instruction?.programId
   if (!programId || !programId.equals(SYSTEM_PROGRAM_ID)) return false
-  if (!Array.isArray(instruction.keys) || instruction.keys.length !== 2) return false
-  if (!instruction.data) return false
+  const reqs = SYSTEM_INSTRUCTION_REQUIREMENTS[SYSTEM_INSTRUCTION_LAYOUTS.Transfer.index]
+  if (!hasValidShape(instruction, reqs)) return false
   try {
     const buffer = toBuffer(instruction.data)
-    if (buffer.length < 12) return false
-    return buffer.readUInt32LE(0) === 2
+    return buffer.readUInt32LE(0) === SYSTEM_INSTRUCTION_LAYOUTS.Transfer.index
   } catch {
     return false
   }
@@ -35,31 +89,34 @@ export function isComputeBudgetInstruction(instruction) {
 
 export function isSetAuthorityInstruction(instruction) {
   if (!isTokenProgramInstruction(instruction)) return false
-  if (!instruction.data) return false
+  const reqs = TOKEN_INSTRUCTION_REQUIREMENTS[TOKEN_INSTRUCTION_LAYOUTS.SetAuthority.index]
+  if (!hasValidShape(instruction, reqs)) return false
   const buffer = toBuffer(instruction.data)
-  return buffer.length > 0 && buffer[0] === TOKEN_INSTRUCTION_LAYOUTS.SetAuthority.index
+  return buffer[0] === TOKEN_INSTRUCTION_LAYOUTS.SetAuthority.index
 }
 
 export function isTransferInstruction(instruction) {
   if (!isTokenProgramInstruction(instruction)) return false
-  if (!instruction.data) return false
+  const reqs = TOKEN_INSTRUCTION_REQUIREMENTS[TOKEN_INSTRUCTION_LAYOUTS.Transfer.index]
+  if (!hasValidShape(instruction, reqs)) return false
   const buffer = toBuffer(instruction.data)
-  return buffer.length > 0 && buffer[0] === TOKEN_INSTRUCTION_LAYOUTS.Transfer.index
+  return buffer[0] === TOKEN_INSTRUCTION_LAYOUTS.Transfer.index
 }
 
 export function isTransferCheckedInstruction(instruction) {
   if (!isTokenProgramInstruction(instruction)) return false
-  if (!instruction.data) return false
+  const reqs = TOKEN_INSTRUCTION_REQUIREMENTS[TOKEN_INSTRUCTION_LAYOUTS.TransferChecked.index]
+  if (!hasValidShape(instruction, reqs)) return false
   const buffer = toBuffer(instruction.data)
-  return buffer.length > 0 && buffer[0] === TOKEN_INSTRUCTION_LAYOUTS.TransferChecked.index
+  return buffer[0] === TOKEN_INSTRUCTION_LAYOUTS.TransferChecked.index
 }
 
 export function isTransferCheckedWithFeeInstruction(instruction) {
   if (!isTokenProgramInstruction(instruction)) return false
-  if (!instruction.data) return false
+  const reqs = TOKEN_INSTRUCTION_REQUIREMENTS[TOKEN_INSTRUCTION_LAYOUTS.TransferFeeExtension.index]
+  if (!hasValidShape(instruction, reqs)) return false
   const buffer = toBuffer(instruction.data)
   return (
-    buffer.length >= 2 &&
     buffer[0] === TOKEN_INSTRUCTION_LAYOUTS.TransferFeeExtension.index &&
     buffer[1] === TRANSFER_FEE_SUB_INSTRUCTIONS.TransferCheckedWithFee
   )