@forgedevv/core 0.1.0 → 0.2.0

package/dist/swap.d.ts

@@ -27,9 +27,14 @@
  * Refusals (typed `SwapError`, never a silent fallback):
  *   - the pool is migrated or its curve is complete (`POOL_GRADUATED`): the template trades through
  *     Jupiter in that case;
+ *   - the pool's config is not in the caller's `allowedConfigs` (`POOL_NOT_ALLOWED`): a launchpad
+ *     site only trades its own coins;
  *   - the platform fee wallet does not exist or is not rent-exempt
  *     (`PLATFORM_FEE_WALLET_NOT_RENT_EXEMPT`): the whole swap would fail on-chain (devnet finding);
- *   - the referral account is not an initialized wrapped SOL token account (`REFERRAL_ACCOUNT_INVALID`);
+ *   - the platform fee wallet is not exactly `FORGE_PLATFORM_FEE_WALLET`, or not a system account
+ *     (`PLATFORM_FEE_WALLET_MISMATCH`);
+ *   - the referral account is not an initialized wrapped SOL token account, or is not held by
+ *     `FORGE_MULTISIG_VAULT` when the environment has it (`REFERRAL_ACCOUNT_INVALID`);
  *   - the pool is not a plain SOL-quoted DBC pool (`UNSUPPORTED_POOL`; transfer-hook pools excluded);
  *   - the serialized transaction exceeds 1,232 bytes (`TRANSACTION_TOO_LARGE`).
  *
@@ -50,8 +55,8 @@ import { type PoolConfig, type VirtualPool } from '@meteora-ag/dynamic-bonding-c
 import { type AddressEnv } from './addresses.js';
 /** Platform fee on swaps built by @forge/core, in bps (`FEES.platformFeeBps` from @forge/shared). */
 export declare const PLATFORM_FEE_BPS: number;
-/** Highest slippage tolerance accepted by the builders (50%), whether given in bps or as a minimum. */
-export declare const MAX_SWAP_SLIPPAGE_BPS = 5000;
+/** Highest slippage tolerance accepted by the builders (25%), whether given in bps or as a minimum. */
+export declare const MAX_SWAP_SLIPPAGE_BPS = 2500;
 /**
  * Default compute unit limit. Measured on devnet: ~51,000 CU for a buy (~66,500 when it also creates
  * the coin ATA), ~49,000 CU for a sell; the default leaves about 2x headroom (fee scheduler,
@@ -66,7 +71,7 @@ export declare const MAX_SWAP_PRIORITY_FEE_MICRO_LAMPORTS = 10000000;
 export declare const SWAP_BASE_FEE_LAMPORTS_PER_SIGNATURE = 5000n;
 /** Serialized transaction size limit (`PACKET_DATA_SIZE` = 1,232 bytes). */
 export declare const SWAP_MAX_TRANSACTION_BYTES: number;
-export declare const SWAP_ERROR_CODES: readonly ["INVALID_PARAMS", "POOL_NOT_FOUND", "UNSUPPORTED_POOL", "POOL_GRADUATED", "PLATFORM_FEE_WALLET_NOT_RENT_EXEMPT", "REFERRAL_ACCOUNT_INVALID", "INSUFFICIENT_LIQUIDITY", "QUOTE_FAILED", "AMOUNT_TOO_SMALL", "MIN_AMOUNT_OUT_ABOVE_QUOTE", "SLIPPAGE_TOO_HIGH", "INSUFFICIENT_SOL_BALANCE", "INSUFFICIENT_TOKEN_BALANCE", "TRANSACTION_TOO_LARGE", "RPC_ERROR"];
+export declare const SWAP_ERROR_CODES: readonly ["INVALID_PARAMS", "POOL_NOT_FOUND", "UNSUPPORTED_POOL", "POOL_GRADUATED", "POOL_NOT_ALLOWED", "PLATFORM_FEE_WALLET_NOT_RENT_EXEMPT", "PLATFORM_FEE_WALLET_MISMATCH", "REFERRAL_ACCOUNT_INVALID", "INSUFFICIENT_LIQUIDITY", "QUOTE_FAILED", "AMOUNT_TOO_SMALL", "MIN_AMOUNT_OUT_ABOVE_QUOTE", "SLIPPAGE_TOO_HIGH", "INSUFFICIENT_SOL_BALANCE", "INSUFFICIENT_TOKEN_BALANCE", "TRANSACTION_TOO_LARGE", "RPC_ERROR"];
 export type SwapErrorCode = (typeof SWAP_ERROR_CODES)[number];
 /** Public data attached to a `SwapError` (addresses, amounts as decimal strings). Never secrets. */
 export type SwapErrorDetails = Readonly<Record<string, string | number | boolean>>;
@@ -270,10 +275,31 @@ export interface SwapContext extends SwapPoolState {
     recentBlockhash: string;
     lastValidBlockHeight: number;
 }
-/** Throws unless the platform fee wallet exists and holds at least its rent-exempt minimum. */
-export declare function assertPlatformFeeWalletReady(wallet: PublicKey, account: SwapAccountSnapshot | null, rentExemptMinimum: bigint): void;
-/** Throws unless the referral account is an initialized wrapped SOL token account (SPL Token). */
-export declare function assertReferralAccountReady(address: PublicKey, account: SwapAccountSnapshot | null): void;
+/**
+ * Throws unless the platform fee wallet exists and holds at least its rent-exempt minimum. With
+ * `expectedWallet` (FORGE_PLATFORM_FEE_WALLET, as `buildBuyTx` / `buildSellTx` pass it), the
+ * wallet must be exactly that key and a plain system account: lamports sent to an account owned by
+ * another program could not be spent by FORGE (`PLATFORM_FEE_WALLET_MISMATCH`).
+ */
+export declare function assertPlatformFeeWalletReady(wallet: PublicKey, account: SwapAccountSnapshot | null, rentExemptMinimum: bigint, expectedWallet?: PublicKey | null): void;
+/**
+ * Throws unless the referral account is an initialized wrapped SOL token account (SPL Token).
+ * With `expectedOwner` (FORGE_MULTISIG_VAULT, when the environment has it), the token account must
+ * be held by that key: otherwise the referral share would be paid to someone else.
+ */
+export declare function assertReferralAccountReady(address: PublicKey, account: SwapAccountSnapshot | null, expectedOwner?: PublicKey | null): void;
+/** The FORGE fee accounts a swap transaction must pay, as the builders read them from the env. */
+export interface SwapFeeAccountExpectations {
+    /** The platform fee transfer must go to exactly this key (FORGE_PLATFORM_FEE_WALLET). */
+    platformFeeWallet?: PublicKey | null;
+    /** The Meteora referral token account must be held by this key (FORGE_MULTISIG_VAULT). */
+    referralOwner?: PublicKey | null;
+}
+/**
+ * Throws `POOL_NOT_ALLOWED` unless the pool's config is one of `allowedConfigs`. Without a list
+ * (`undefined`), any config is accepted; an empty list accepts none.
+ */
+export declare function assertPoolConfigAllowed(pool: PublicKey, config: PublicKey, allowedConfigs: readonly (PublicKey | string)[] | undefined): void;
 export interface SwapBuildOptions {
     /** Compute unit limit (default `DEFAULT_SWAP_COMPUTE_UNIT_LIMIT`). */
     computeUnitLimit?: number;
@@ -321,12 +347,19 @@ export declare function compileSwapTransaction(args: {
     sizeBytes: number;
 };
 /**
- * Pure transaction builder: validates the context (pool on its curve, fee accounts ready, balances),
- * quotes, and assembles the instructions in the order documented at the top of this file.
+ * Pure transaction builder: validates the context (pool on its curve, fee accounts ready and, with
+ * `expected`, exactly FORGE's), quotes, and assembles the instructions in the order documented at
+ * the top of this file.
  */
-export declare function buildSwapTransaction(ctx: SwapContext, request: SwapBuildRequest): BuiltSwapTransaction;
-/** Reads and decodes a pool and its config, plus the current point. */
-export declare function fetchSwapPoolState(connection: Connection, poolAddress: PublicKey | string, commitment?: Commitment): Promise<SwapPoolState & {
+export declare function buildSwapTransaction(ctx: SwapContext, request: SwapBuildRequest, expected?: SwapFeeAccountExpectations): BuiltSwapTransaction;
+/**
+ * Reads and decodes a pool and its config, plus the current point. With
+ * `options.allowedConfigs`, a pool whose config is not in the list is refused (`POOL_NOT_ALLOWED`)
+ * before its config is read.
+ */
+export declare function fetchSwapPoolState(connection: Connection, poolAddress: PublicKey | string, commitment?: Commitment, options?: {
+    allowedConfigs?: readonly (PublicKey | string)[];
+}): Promise<SwapPoolState & {
     configAddress: PublicKey;
 }>;
 export interface FetchSwapContextParams {
@@ -336,22 +369,39 @@ export interface FetchSwapContextParams {
     platformFeeWallet: PublicKey;
     referralTokenAccount: PublicKey;
     commitment?: Commitment;
+    /** Configs the pool may belong to; anything else is `POOL_NOT_ALLOWED` (default: any config). */
+    allowedConfigs?: readonly (PublicKey | string)[];
 }
 /** All network reads of a swap build: pool, config, user accounts, fee accounts, rent, blockhash. */
 export declare function fetchSwapContext(p: FetchSwapContextParams): Promise<SwapContext>;
-/** FORGE fee accounts used by the swap, resolved through addresses.ts (never hard-coded). */
+/**
+ * FORGE fee accounts used by the swap, resolved through addresses.ts (never hard-coded), and the
+ * multisig vault that must hold the referral account (`null` when the environment does not have
+ * `FORGE_MULTISIG_VAULT`: the owner check is then skipped).
+ */
 export declare function swapFeeAddresses(env?: AddressEnv): {
     platformFeeWallet: PublicKey;
     referralTokenAccount: PublicKey;
+    multisigVault: PublicKey | null;
 };
 interface SwapCommonParams extends SwapBuildOptions {
     connection: Connection;
     pool: PublicKey | string;
     /** The trader: fee payer, signer and owner of the token accounts. */
     user: PublicKey | string;
-    /** Environment to read the FORGE addresses from (defaults to `process.env`). */
+    /**
+     * Environment to read the FORGE addresses from (defaults to `process.env`):
+     * `FORGE_PLATFORM_FEE_WALLET` and `FORGE_METEORA_REFERRAL_ACCOUNT` (required), and
+     * `FORGE_MULTISIG_VAULT` (optional: when set, the referral account must be held by it).
+     */
     env?: AddressEnv;
     commitment?: Commitment;
+    /**
+     * Configs the pool must belong to (e.g. the two configs of the launchpad whose site builds the
+     * swap). The pool's config is read on-chain; any other pool is refused with `POOL_NOT_ALLOWED`.
+     * Without it, any SOL-quoted DBC pool is accepted.
+     */
+    allowedConfigs?: readonly (PublicKey | string)[];
 }
 export type BuildBuyTxParams = SwapCommonParams & {
     /** SOL into the swap, in lamports. The platform fee is paid on top of it. */
@@ -372,6 +422,8 @@ export type QuoteSwapParams = {
     /** Lamports on a buy, raw coin units on a sell. */
     amountIn: bigint;
     commitment?: Commitment;
+    /** Same as on `buildBuyTx`: configs the pool must belong to (`POOL_NOT_ALLOWED` otherwise). */
+    allowedConfigs?: readonly (PublicKey | string)[];
 } & (SlippageInput | {
     slippageBps?: undefined;
     minAmountOut?: undefined;
@@ -382,8 +434,9 @@ export type QuoteSwapParams = {
  */
 export declare function quoteSwap(params: QuoteSwapParams): Promise<SwapQuote>;
 /**
- * Startup / pre-build check of the FORGE fee accounts: the platform fee wallet must be rent-exempt
- * and the referral account must be a wrapped SOL token account. Throws `SwapError`.
+ * Startup / pre-build check of the FORGE fee accounts: the platform fee wallet must be a
+ * rent-exempt system account and the referral account must be a wrapped SOL token account, held by
+ * `FORGE_MULTISIG_VAULT` when the environment has it. Throws `SwapError`.
  */
 export declare function assertSwapFeeAccountsReady(params: {
     connection: Connection;

package/dist/swap.js

@@ -27,9 +27,14 @@
  * Refusals (typed `SwapError`, never a silent fallback):
  *   - the pool is migrated or its curve is complete (`POOL_GRADUATED`): the template trades through
  *     Jupiter in that case;
+ *   - the pool's config is not in the caller's `allowedConfigs` (`POOL_NOT_ALLOWED`): a launchpad
+ *     site only trades its own coins;
  *   - the platform fee wallet does not exist or is not rent-exempt
  *     (`PLATFORM_FEE_WALLET_NOT_RENT_EXEMPT`): the whole swap would fail on-chain (devnet finding);
- *   - the referral account is not an initialized wrapped SOL token account (`REFERRAL_ACCOUNT_INVALID`);
+ *   - the platform fee wallet is not exactly `FORGE_PLATFORM_FEE_WALLET`, or not a system account
+ *     (`PLATFORM_FEE_WALLET_MISMATCH`);
+ *   - the referral account is not an initialized wrapped SOL token account, or is not held by
+ *     `FORGE_MULTISIG_VAULT` when the environment has it (`REFERRAL_ACCOUNT_INVALID`);
  *   - the pool is not a plain SOL-quoted DBC pool (`UNSUPPORTED_POOL`; transfer-hook pools excluded);
  *   - the serialized transaction exceeds 1,232 bytes (`TRANSACTION_TOO_LARGE`).
  *
@@ -48,15 +53,15 @@ import { ComputeBudgetProgram, PACKET_DATA_SIZE, PublicKey, SYSVAR_INSTRUCTIONS_
 import { ACCOUNT_SIZE, ExtensionType, NATIVE_MINT, TOKEN_2022_PROGRAM_ID, TOKEN_PROGRAM_ID, createAssociatedTokenAccountIdempotentInstruction, createCloseAccountInstruction, createSyncNativeInstruction, getAccountLen, getAssociatedTokenAddressSync, unpackAccount, } from '@solana/spl-token';
 import BN from 'bn.js';
 import { ActivationType, BaseFeeMode, DYNAMIC_BONDING_CURVE_PROGRAM_ID, DynamicBondingCurveIdl, TradeDirection, createDbcProgram, deriveDbcEventAuthority, deriveDbcPoolAuthority, getFeeMode, getTokenProgram, isRateLimiterApplied, swapQuote, } from '@meteora-ag/dynamic-bonding-curve-sdk';
-import { requireAddresses } from './addresses.js';
+import { readOptionalAddress, requireAddresses } from './addresses.js';
 import { FEES } from './constants.js';
 // ---------------------------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------------------------
 /** Platform fee on swaps built by @forge/core, in bps (`FEES.platformFeeBps` from @forge/shared). */
 export const PLATFORM_FEE_BPS = FEES.platformFeeBps;
-/** Highest slippage tolerance accepted by the builders (50%), whether given in bps or as a minimum. */
-export const MAX_SWAP_SLIPPAGE_BPS = 5_000;
+/** Highest slippage tolerance accepted by the builders (25%), whether given in bps or as a minimum. */
+export const MAX_SWAP_SLIPPAGE_BPS = 2_500;
 /**
  * Default compute unit limit. Measured on devnet: ~51,000 CU for a buy (~66,500 when it also creates
  * the coin ATA), ~49,000 CU for a sell; the default leaves about 2x headroom (fee scheduler,
@@ -83,7 +88,11 @@ export const SWAP_ERROR_CODES = [
     'POOL_NOT_FOUND',
     'UNSUPPORTED_POOL',
     'POOL_GRADUATED',
+    /** The pool's config is not in the caller's `allowedConfigs` (e.g. another launchpad's coin). */
+    'POOL_NOT_ALLOWED',
     'PLATFORM_FEE_WALLET_NOT_RENT_EXEMPT',
+    /** The platform fee wallet is not FORGE_PLATFORM_FEE_WALLET, or not a plain system account. */
+    'PLATFORM_FEE_WALLET_MISMATCH',
     'REFERRAL_ACCOUNT_INVALID',
     'INSUFFICIENT_LIQUIDITY',
     'QUOTE_FAILED',
@@ -419,8 +428,19 @@ function coinAtaSize(tokenProgram) {
         ? getAccountLen([ExtensionType.ImmutableOwner])
         : ACCOUNT_SIZE;
 }
-/** Throws unless the platform fee wallet exists and holds at least its rent-exempt minimum. */
-export function assertPlatformFeeWalletReady(wallet, account, rentExemptMinimum) {
+/**
+ * Throws unless the platform fee wallet exists and holds at least its rent-exempt minimum. With
+ * `expectedWallet` (FORGE_PLATFORM_FEE_WALLET, as `buildBuyTx` / `buildSellTx` pass it), the
+ * wallet must be exactly that key and a plain system account: lamports sent to an account owned by
+ * another program could not be spent by FORGE (`PLATFORM_FEE_WALLET_MISMATCH`).
+ */
+export function assertPlatformFeeWalletReady(wallet, account, rentExemptMinimum, expectedWallet) {
+    if (expectedWallet && !wallet.equals(expectedWallet)) {
+        throw new SwapError('PLATFORM_FEE_WALLET_MISMATCH', 'The platform fee must go to FORGE_PLATFORM_FEE_WALLET and nowhere else', { details: { platformFeeWallet: wallet.toBase58() } });
+    }
+    if (expectedWallet && account && !account.owner.equals(SystemProgram.programId)) {
+        throw new SwapError('PLATFORM_FEE_WALLET_MISMATCH', 'FORGE_PLATFORM_FEE_WALLET must be a system account (a wallet)', { details: { platformFeeWallet: wallet.toBase58(), owner: account.owner.toBase58() } });
+    }
     const lamports = account?.lamports ?? 0n;
     if (!account || lamports < rentExemptMinimum) {
         throw new SwapError('PLATFORM_FEE_WALLET_NOT_RENT_EXEMPT', 'FORGE_PLATFORM_FEE_WALLET must exist and be rent-exempt, otherwise every swap fails on-chain', {
@@ -432,8 +452,12 @@ export function assertPlatformFeeWalletReady(wallet, account, rentExemptMinimum)
         });
     }
 }
-/** Throws unless the referral account is an initialized wrapped SOL token account (SPL Token). */
-export function assertReferralAccountReady(address, account) {
+/**
+ * Throws unless the referral account is an initialized wrapped SOL token account (SPL Token).
+ * With `expectedOwner` (FORGE_MULTISIG_VAULT, when the environment has it), the token account must
+ * be held by that key: otherwise the referral share would be paid to someone else.
+ */
+export function assertReferralAccountReady(address, account, expectedOwner) {
     const fail = (reason, cause) => new SwapError('REFERRAL_ACCOUNT_INVALID', `FORGE_METEORA_REFERRAL_ACCOUNT ${reason}`, {
         details: { referralTokenAccount: address.toBase58() },
         cause,
@@ -453,6 +477,27 @@ export function assertReferralAccountReady(address, account) {
         throw fail('is not a wrapped SOL account');
     if (!token.isInitialized || token.isFrozen)
         throw fail('is not usable (uninitialized or frozen)');
+    if (expectedOwner && !token.owner.equals(expectedOwner)) {
+        throw fail('is not held by FORGE_MULTISIG_VAULT');
+    }
+}
+function toConfigKeys(allowedConfigs) {
+    if (!Array.isArray(allowedConfigs))
+        throw invalid('allowedConfigs must be an array');
+    return allowedConfigs.map((config, i) => toPublicKey(`allowedConfigs[${i}]`, config));
+}
+/**
+ * Throws `POOL_NOT_ALLOWED` unless the pool's config is one of `allowedConfigs`. Without a list
+ * (`undefined`), any config is accepted; an empty list accepts none.
+ */
+export function assertPoolConfigAllowed(pool, config, allowedConfigs) {
+    if (allowedConfigs === undefined)
+        return;
+    if (!toConfigKeys(allowedConfigs).some((allowed) => allowed.equals(config))) {
+        throw new SwapError('POOL_NOT_ALLOWED', 'This pool does not belong to this launchpad', {
+            details: { pool: pool.toBase58(), config: config.toBase58() },
+        });
+    }
 }
 function tokenBalance(address, account, tokenProgram) {
     if (!account || !account.owner.equals(tokenProgram))
@@ -523,13 +568,14 @@ export function compileSwapTransaction(args) {
     return { transaction, sizeBytes };
 }
 /**
- * Pure transaction builder: validates the context (pool on its curve, fee accounts ready, balances),
- * quotes, and assembles the instructions in the order documented at the top of this file.
+ * Pure transaction builder: validates the context (pool on its curve, fee accounts ready and, with
+ * `expected`, exactly FORGE's), quotes, and assembles the instructions in the order documented at
+ * the top of this file.
  */
-export function buildSwapTransaction(ctx, request) {
+export function buildSwapTransaction(ctx, request, expected = {}) {
     const options = readBuildOptions(request);
-    assertPlatformFeeWalletReady(ctx.platformFeeWallet, ctx.platformFeeWalletAccount, ctx.platformFeeWalletRentExemptMinimum);
-    assertReferralAccountReady(ctx.referralTokenAccount, ctx.referralTokenAccountInfo);
+    assertPlatformFeeWalletReady(ctx.platformFeeWallet, ctx.platformFeeWalletAccount, ctx.platformFeeWalletRentExemptMinimum, expected.platformFeeWallet);
+    assertReferralAccountReady(ctx.referralTokenAccount, ctx.referralTokenAccountInfo, expected.referralOwner);
     const quote = computeSwapQuote(ctx, request);
     const side = request.side;
     const coinProgram = coinTokenProgram(ctx.virtualPool);
@@ -707,13 +753,20 @@ async function getCurrentPointRobust(connection, activationType, commitment) {
     // Only used for the quote (fee scheduler); the program uses its own clock.
     return new BN(blockTime ?? Math.floor(Date.now() / 1000));
 }
-/** Reads and decodes a pool and its config, plus the current point. */
-export async function fetchSwapPoolState(connection, poolAddress, commitment = DEFAULT_COMMITMENT) {
+/**
+ * Reads and decodes a pool and its config, plus the current point. With
+ * `options.allowedConfigs`, a pool whose config is not in the list is refused (`POOL_NOT_ALLOWED`)
+ * before its config is read.
+ */
+export async function fetchSwapPoolState(connection, poolAddress, commitment = DEFAULT_COMMITMENT, options = {}) {
     const pool = toPublicKey('pool', poolAddress);
+    if (options.allowedConfigs !== undefined)
+        toConfigKeys(options.allowedConfigs);
     const program = dbcProgram(connection);
     const poolInfo = await rpc('getAccountInfo(pool)', () => connection.getAccountInfo(pool, commitment));
     const virtualPool = decodeDbcAccount(program, 'virtualPool', pool, snapshot(poolInfo));
     const configAddress = virtualPool.poolState.config;
+    assertPoolConfigAllowed(pool, configAddress, options.allowedConfigs);
     const configInfo = await rpc('getAccountInfo(config)', () => connection.getAccountInfo(configAddress, commitment));
     const config = decodeDbcAccount(program, 'poolConfig', configAddress, snapshot(configInfo));
     const currentPoint = await getCurrentPointRobust(connection, config.activationType, commitment);
@@ -725,6 +778,8 @@ export async function fetchSwapContext(p) {
     const commitment = p.commitment ?? DEFAULT_COMMITMENT;
     const user = toPublicKey('user', p.user);
     const pool = toPublicKey('pool', p.pool);
+    if (p.allowedConfigs !== undefined)
+        toConfigKeys(p.allowedConfigs);
     const program = dbcProgram(connection);
     const [first, latest, slot] = await Promise.all([
         rpc('getMultipleAccountsInfo', () => connection.getMultipleAccountsInfo([pool, p.platformFeeWallet, p.referralTokenAccount, user], commitment)),
@@ -734,6 +789,7 @@ export async function fetchSwapContext(p) {
     const [poolInfo, platformInfo, referralInfo, userInfo] = first.map(snapshot);
     const virtualPool = decodeDbcAccount(program, 'virtualPool', pool, poolInfo ?? null);
     const configAddress = virtualPool.poolState.config;
+    assertPoolConfigAllowed(pool, configAddress, p.allowedConfigs);
     const coinProgram = coinTokenProgram(virtualPool);
     const userCoinAta = getAssociatedTokenAddressSync(virtualPool.poolState.baseMint, user, true, coinProgram);
     const userWrappedSolAta = getAssociatedTokenAddressSync(NATIVE_MINT, user, true, TOKEN_PROGRAM_ID);
@@ -775,12 +831,17 @@ export async function fetchSwapContext(p) {
         lastValidBlockHeight: latest.lastValidBlockHeight,
     };
 }
-/** FORGE fee accounts used by the swap, resolved through addresses.ts (never hard-coded). */
+/**
+ * FORGE fee accounts used by the swap, resolved through addresses.ts (never hard-coded), and the
+ * multisig vault that must hold the referral account (`null` when the environment does not have
+ * `FORGE_MULTISIG_VAULT`: the owner check is then skipped).
+ */
 export function swapFeeAddresses(env) {
     const a = requireAddresses(['FORGE_PLATFORM_FEE_WALLET', 'FORGE_METEORA_REFERRAL_ACCOUNT'], env);
     return {
         platformFeeWallet: a.FORGE_PLATFORM_FEE_WALLET,
         referralTokenAccount: a.FORGE_METEORA_REFERRAL_ACCOUNT,
+        multisigVault: readOptionalAddress('FORGE_MULTISIG_VAULT', env),
     };
 }
 function slippageOf(p) {
@@ -791,7 +852,9 @@ async function buildSide(side, amountIn, p) {
     assertU64(side === 'buy' ? 'amountInLamports' : 'amountInTokens', amountIn, 1n);
     const slippage = readSlippage(slippageOf(p));
     const options = readBuildOptions(p);
-    const { platformFeeWallet, referralTokenAccount } = swapFeeAddresses(p.env);
+    const { platformFeeWallet, referralTokenAccount, multisigVault } = swapFeeAddresses(p.env);
+    if (p.allowedConfigs !== undefined)
+        toConfigKeys(p.allowedConfigs);
     const ctx = await fetchSwapContext({
         connection: p.connection,
         pool: p.pool,
@@ -799,8 +862,9 @@ async function buildSide(side, amountIn, p) {
         platformFeeWallet,
         referralTokenAccount,
         ...(p.commitment ? { commitment: p.commitment } : {}),
+        ...(p.allowedConfigs !== undefined ? { allowedConfigs: p.allowedConfigs } : {}),
     });
-    return buildSwapTransaction(ctx, { side, amountIn, slippage, ...options });
+    return buildSwapTransaction(ctx, { side, amountIn, slippage, ...options }, { platformFeeWallet, referralOwner: multisigVault });
 }
 /** Unsigned buy transaction (SOL -> coin) with the FORGE referral and the platform fee. */
 export async function buildBuyTx(params) {
@@ -819,18 +883,19 @@ export async function quoteSwap(params) {
     const slippage = params.slippageBps === undefined && params.minAmountOut === undefined
         ? { slippageBps: 0 }
         : readSlippage(slippageOf(params));
-    const state = await fetchSwapPoolState(params.connection, params.pool, params.commitment);
+    const state = await fetchSwapPoolState(params.connection, params.pool, params.commitment, params.allowedConfigs !== undefined ? { allowedConfigs: params.allowedConfigs } : {});
     return computeSwapQuote(state, { side: params.side, amountIn: params.amountIn, slippage });
 }
 /**
- * Startup / pre-build check of the FORGE fee accounts: the platform fee wallet must be rent-exempt
- * and the referral account must be a wrapped SOL token account. Throws `SwapError`.
+ * Startup / pre-build check of the FORGE fee accounts: the platform fee wallet must be a
+ * rent-exempt system account and the referral account must be a wrapped SOL token account, held by
+ * `FORGE_MULTISIG_VAULT` when the environment has it. Throws `SwapError`.
  */
 export async function assertSwapFeeAccountsReady(params) {
     const commitment = params.commitment ?? DEFAULT_COMMITMENT;
-    const { platformFeeWallet, referralTokenAccount } = swapFeeAddresses(params.env);
+    const { platformFeeWallet, referralTokenAccount, multisigVault } = swapFeeAddresses(params.env);
     const [platformInfo, referralInfo] = (await rpc('getMultipleAccountsInfo', () => params.connection.getMultipleAccountsInfo([platformFeeWallet, referralTokenAccount], commitment))).map(snapshot);
     const rentMinimum = BigInt(await rpc('getMinimumBalanceForRentExemption', () => params.connection.getMinimumBalanceForRentExemption(platformInfo?.data.length ?? 0, commitment)));
-    assertPlatformFeeWalletReady(platformFeeWallet, platformInfo ?? null, rentMinimum);
-    assertReferralAccountReady(referralTokenAccount, referralInfo ?? null);
+    assertPlatformFeeWalletReady(platformFeeWallet, platformInfo ?? null, rentMinimum, platformFeeWallet);
+    assertReferralAccountReady(referralTokenAccount, referralInfo ?? null, multisigVault);
 }

package/dist/validate.d.ts

@@ -8,6 +8,11 @@
  *    pool creation fee 0 or 0.001..100 SOL, ...), using the SDK constants and helpers;
  *  - FORGE's stricter bounds (client trading fee 50..200 bps, pool creation fee 0 or 0.001..1 SOL,
  *    migration threshold exactly 10 SOL, SOL quote, immutable metadata, ...);
+ *  - FORGE's fixed settings, for every field that moves value: no migration fee, no locked
+ *    vesting, the token supply of `FORGE_TOKEN_SETTINGS` (fixed, nothing minted later), FORGE's
+ *    curve and start price (they decide the leftover sent to the leftover receiver), timestamp
+ *    activation, and the anti-sniper schedule exactly `ANTI_SNIPER_FEE_SCHEDULE` (or a flat fee
+ *    when `spec.antiSniper` is off);
  *  - that the parameters match the spec they were built from;
  *  - finally, the SDK's own `validateConfigParameters`, as a catch-all for curve-level rules.
  * Lamport amounts are compared as `bigint`.
@@ -15,7 +20,15 @@
 import { type ConfigParameters } from '@meteora-ag/dynamic-bonding-curve-sdk';
 import { PublicKey } from '@solana/web3.js';
 import type { LaunchpadSpec } from '@forge/shared';
-export type ViolationCode = 'INVALID_ADDRESS' | 'QUOTE_NOT_SOL' | 'FEE_CLAIMER_MISMATCH' | 'LEFTOVER_RECEIVER_MISMATCH' | 'FEE_MODE_NOT_ALLOWED' | 'FEE_OUT_OF_SDK_BOUNDS' | 'FEE_OUT_OF_CLIENT_BOUNDS' | 'FEE_MISMATCH' | 'FEE_SCHEDULER_INVALID' | 'FEE_SCHEDULER_TOO_LONG' | 'ANTI_SNIPER_MISMATCH' | 'DYNAMIC_FEE_NOT_ALLOWED' | 'COLLECT_FEE_MODE_NOT_ALLOWED' | 'MIGRATION_OPTION_NOT_ALLOWED' | 'MIGRATION_FEE_OPTION_INVALID' | 'MIGRATION_FEE_INVALID' | 'MIGRATED_POOL_FEE_OUT_OF_BOUNDS' | 'MIGRATED_POOL_FEE_INVALID' | 'MIGRATION_THRESHOLD_MISMATCH' | 'POOL_CREATION_FEE_OUT_OF_SDK_BOUNDS' | 'POOL_CREATION_FEE_OUT_OF_CLIENT_BOUNDS' | 'POOL_CREATION_FEE_MISMATCH' | 'CREATOR_TRADING_FEE_OUT_OF_BOUNDS' | 'CREATOR_TRADING_FEE_MISMATCH' | 'LP_PERCENTAGES_INVALID' | 'LIQUIDITY_VESTING_INVALID' | 'LOCKED_LIQUIDITY_TOO_LOW' | 'CREATOR_LOCKED_LIQUIDITY_REQUIRED' | 'TOKEN_UPDATE_AUTHORITY_NOT_IMMUTABLE' | 'TOKEN_TYPE_INVALID' | 'TOKEN_DECIMAL_INVALID' | 'ACTIVATION_TYPE_INVALID' | 'FIRST_SWAP_MIN_FEE_REQUIRED'
+export type ViolationCode = 'INVALID_ADDRESS' | 'QUOTE_NOT_SOL' | 'FEE_CLAIMER_MISMATCH' | 'LEFTOVER_RECEIVER_MISMATCH' | 'FEE_MODE_NOT_ALLOWED' | 'FEE_OUT_OF_SDK_BOUNDS' | 'FEE_OUT_OF_CLIENT_BOUNDS' | 'FEE_MISMATCH' | 'FEE_SCHEDULER_INVALID' | 'FEE_SCHEDULER_TOO_LONG' | 'ANTI_SNIPER_MISMATCH' | 'DYNAMIC_FEE_NOT_ALLOWED' | 'COLLECT_FEE_MODE_NOT_ALLOWED' | 'MIGRATION_OPTION_NOT_ALLOWED' | 'MIGRATION_FEE_OPTION_INVALID' | 'MIGRATION_FEE_INVALID'
+/** A migration fee (to the partner or the creator) is set: FORGE configs take none. */
+ | 'MIGRATION_FEE_NOT_ALLOWED' | 'MIGRATED_POOL_FEE_OUT_OF_BOUNDS' | 'MIGRATED_POOL_FEE_INVALID' | 'MIGRATION_THRESHOLD_MISMATCH' | 'POOL_CREATION_FEE_OUT_OF_SDK_BOUNDS' | 'POOL_CREATION_FEE_OUT_OF_CLIENT_BOUNDS' | 'POOL_CREATION_FEE_MISMATCH' | 'CREATOR_TRADING_FEE_OUT_OF_BOUNDS' | 'CREATOR_TRADING_FEE_MISMATCH' | 'LP_PERCENTAGES_INVALID' | 'LIQUIDITY_VESTING_INVALID' | 'LOCKED_LIQUIDITY_TOO_LOW' | 'CREATOR_LOCKED_LIQUIDITY_REQUIRED' | 'TOKEN_UPDATE_AUTHORITY_NOT_IMMUTABLE'
+/** Locked vesting of base tokens is set: FORGE configs vest nothing. */
+ | 'LOCKED_VESTING_NOT_ALLOWED'
+/** Token supply differs from `FORGE_TOKEN_SETTINGS` (1,000,000,000 tokens, 6 decimals, fixed). */
+ | 'TOKEN_SUPPLY_MISMATCH'
+/** Start price or curve differs from FORGE's (they decide the swap / migration / leftover split). */
+ | 'CURVE_MISMATCH' | 'TOKEN_TYPE_INVALID' | 'TOKEN_DECIMAL_INVALID' | 'ACTIVATION_TYPE_INVALID' | 'FIRST_SWAP_MIN_FEE_REQUIRED'
 /** Coin name + symbol + metadata URI exceed the launch transaction budget. */
  | 'LAUNCH_METADATA_TOO_LONG' | 'SPEC_INVALID' | 'SDK_REJECTED';
 export interface Violation {

package/dist/validate.js

@@ -8,6 +8,11 @@
  *    pool creation fee 0 or 0.001..100 SOL, ...), using the SDK constants and helpers;
  *  - FORGE's stricter bounds (client trading fee 50..200 bps, pool creation fee 0 or 0.001..1 SOL,
  *    migration threshold exactly 10 SOL, SOL quote, immutable metadata, ...);
+ *  - FORGE's fixed settings, for every field that moves value: no migration fee, no locked
+ *    vesting, the token supply of `FORGE_TOKEN_SETTINGS` (fixed, nothing minted later), FORGE's
+ *    curve and start price (they decide the leftover sent to the leftover receiver), timestamp
+ *    activation, and the anti-sniper schedule exactly `ANTI_SNIPER_FEE_SCHEDULE` (or a flat fee
+ *    when `spec.antiSniper` is off);
  *  - that the parameters match the spec they were built from;
  *  - finally, the SDK's own `validateConfigParameters`, as a catch-all for curve-level rules.
  * Lamport amounts are compared as `bigint`.
@@ -16,6 +21,7 @@ import { ActivationType, BaseFeeMode, CollectFeeMode, MigrationFeeOption, Migrat
 import { PublicKey } from '@solana/web3.js';
 import BN from 'bn.js';
 import { CLIENT_BOUNDS, CLIENT_POOL_CREATION_FEE_LAMPORTS, FEE_DENOMINATOR, FEES, MAX_ANTI_SNIPER_DURATION_SECONDS, MAX_ANTI_SNIPER_DURATION_SLOTS, MAX_ANTI_SNIPER_STARTING_FEE_BPS, MAX_BASIS_POINT, MAX_FEE_BPS, MAX_FEE_NUMERATOR, MAX_FIRST_BUY_SOL, MAX_MIGRATED_POOL_FEE_BPS, MAX_POOL_CREATION_FEE, MIGRATION_THRESHOLD_LAMPORTS, MIN_FEE_BPS, MIN_FEE_NUMERATOR, MIN_LOCKED_LIQUIDITY_BPS, MIN_MIGRATED_POOL_FEE_BPS, MIN_POOL_CREATION_FEE, SECONDS_PER_DAY, SOL_QUOTE_MINT, solToLamports, } from './constants.js';
+import { ANTI_SNIPER_FEE_SCHEDULE, FORGE_ACTIVATION_TYPE, FORGE_TOKEN_SETTINGS, FORGE_TOKEN_SUPPLY_RAW, forgeBaseFee, forgeReferenceCurve, } from './settings.js';
 /** Thrown by `assertValid` when a result has violations. */
 export class ValidationError extends Error {
     violations;
@@ -95,6 +101,15 @@ const FEE_NUMERATOR_PER_BPS = BigInt(FEE_DENOMINATOR / MAX_BASIS_POINT);
 function bpsToNumerator(bps) {
     return BigInt(bpsToFeeNumerator(bps).toString());
 }
+/** FORGE's base fee for this fee and anti-sniper flag, or null when the SDK refuses the fee. */
+function expectedBaseFee(tradingFeeBps, antiSniper) {
+    try {
+        return forgeBaseFee(tradingFeeBps, antiSniper);
+    }
+    catch {
+        return null;
+    }
+}
 /** Fee numerator to bps, rounded to the nearest bps (for messages and the bounds check). */
 function numeratorToRoundedBps(numerator) {
     return Number((numerator + FEE_NUMERATOR_PER_BPS / 2n) / FEE_NUMERATOR_PER_BPS);
@@ -212,6 +227,7 @@ function validateConfig(config, spec, expected) {
     collectTradingFee(config, spec, c);
     collectModes(config, c);
     collectMigration(config, c);
+    collectSupply(config, c);
     collectPoolCreationFee(config, spec, expected, c);
     collectCreatorTradingFee(config, expected, c);
     collectLiquidity(config, expected, c);
@@ -343,6 +359,26 @@ function collectTradingFee(config, spec, c) {
     else if (spec?.antiSniper === false && !schedulerOff) {
         c.add(field, 'ANTI_SNIPER_MISMATCH', 'spec.antiSniper is off: the fee scheduler must be disabled');
     }
+    // FORGE's schedule exactly, not just one within the bounds: a single long period at 99% (or an
+    // exponential curve) would keep traders paying the starting fee far longer than announced.
+    const reported = c.violations.some((v) => v.field === field && (v.code === 'ANTI_SNIPER_MISMATCH' || v.code === 'FEE_MISMATCH'));
+    if (!reported &&
+        typeof spec?.antiSniper === 'boolean' &&
+        isIntInRange(spec.tradingFeeBps, MIN_FEE_BPS, MAX_FEE_BPS)) {
+        const forge = expectedBaseFee(spec.tradingFeeBps, spec.antiSniper);
+        const same = forge !== null &&
+            toBigInt(forge.cliffFeeNumerator) === cliff &&
+            forge.firstFactor === numberOfPeriod &&
+            toBigInt(forge.secondFactor) === periodFrequency &&
+            toBigInt(forge.thirdFactor) === reductionFactor &&
+            forge.baseFeeMode === mode;
+        if (!same) {
+            const schedule = ANTI_SNIPER_FEE_SCHEDULE;
+            c.add(field, spec.antiSniper ? 'ANTI_SNIPER_MISMATCH' : 'FEE_MISMATCH', spec.antiSniper
+                ? `the anti-sniper schedule must be exactly ANTI_SNIPER_FEE_SCHEDULE: linear from ${schedule.startingFeeBps} bps to spec.tradingFeeBps in ${schedule.numberOfPeriod} periods over ${schedule.totalDurationSeconds} s`
+                : 'spec.antiSniper is off: the base fee must be a flat spec.tradingFeeBps in FeeSchedulerLinear mode');
+        }
+    }
     if (config.poolFees.dynamicFee !== null && config.poolFees.dynamicFee !== undefined) {
         c.add('poolFees.dynamicFee', 'DYNAMIC_FEE_NOT_ALLOWED', 'dynamic fee must be disabled (it would raise the fee above the client bounds)');
     }
@@ -351,14 +387,53 @@ function collectModes(config, c) {
     if (config.collectFeeMode !== CollectFeeMode.QuoteToken) {
         c.add('collectFeeMode', 'COLLECT_FEE_MODE_NOT_ALLOWED', 'collectFeeMode must be QuoteToken (fees and the referral are paid in SOL)');
     }
-    if (!enumValues(ActivationType).includes(config.activationType)) {
-        c.add('activationType', 'ACTIVATION_TYPE_INVALID', 'activationType must be Slot or Timestamp');
+    // The anti-sniper periods are counted in seconds: a slot-based config would run them in slots.
+    if (!enumValues(ActivationType).includes(config.activationType) ||
+        config.activationType !== FORGE_ACTIVATION_TYPE) {
+        c.add('activationType', 'ACTIVATION_TYPE_INVALID', 'activationType must be Timestamp (FORGE_ACTIVATION_TYPE)');
+    }
+    if (!enumValues(TokenType).includes(config.tokenType) ||
+        config.tokenType !== FORGE_TOKEN_SETTINGS.tokenType) {
+        c.add('tokenType', 'TOKEN_TYPE_INVALID', 'tokenType must be SPLToken (FORGE_TOKEN_SETTINGS)');
     }
-    if (!enumValues(TokenType).includes(config.tokenType)) {
-        c.add('tokenType', 'TOKEN_TYPE_INVALID', 'tokenType must be SPLToken or Token2022');
+    if (!enumValues(TokenDecimal).includes(config.tokenDecimal) ||
+        config.tokenDecimal !== FORGE_TOKEN_SETTINGS.tokenBaseDecimal) {
+        c.add('tokenDecimal', 'TOKEN_DECIMAL_INVALID', `tokenDecimal must be ${FORGE_TOKEN_SETTINGS.tokenBaseDecimal} (FORGE_TOKEN_SETTINGS)`);
     }
-    if (!enumValues(TokenDecimal).includes(config.tokenDecimal)) {
-        c.add('tokenDecimal', 'TOKEN_DECIMAL_INVALID', 'tokenDecimal must be between 6 and 9');
+}
+/**
+ * Supply side (every field decides where tokens go): no locked vesting, FORGE's fixed token
+ * supply, and FORGE's curve and start price (with a fixed supply they decide how much is swapped,
+ * migrated and left over to the leftover receiver).
+ */
+function collectSupply(config, c) {
+    const vesting = config.lockedVesting;
+    const vestingFields = vesting
+        ? [
+            vesting.amountPerPeriod,
+            vesting.cliffDurationFromMigrationTime,
+            vesting.frequency,
+            vesting.numberOfPeriod,
+            vesting.cliffUnlockAmount,
+        ]
+        : [];
+    if (!vesting || vestingFields.some((value) => toBigInt(value) !== 0n)) {
+        c.add('lockedVesting', 'LOCKED_VESTING_NOT_ALLOWED', 'lockedVesting must be all zero (FORGE configs vest no base token)');
+    }
+    const supply = config.tokenSupply;
+    if (!supply ||
+        toBigInt(supply.preMigrationTokenSupply) !== FORGE_TOKEN_SUPPLY_RAW ||
+        toBigInt(supply.postMigrationTokenSupply) !== FORGE_TOKEN_SUPPLY_RAW) {
+        c.add('tokenSupply', 'TOKEN_SUPPLY_MISMATCH', `tokenSupply must be fixed at ${FORGE_TOKEN_SUPPLY_RAW} raw units before and after migration (FORGE_TOKEN_SETTINGS)`);
+    }
+    const reference = forgeReferenceCurve();
+    const curve = Array.isArray(config.curve) ? config.curve : [];
+    const sameCurve = toBigInt(config.sqrtStartPrice) === toBigInt(reference.sqrtStartPrice) &&
+        curve.length === reference.curve.length &&
+        reference.curve.every((point, i) => toBigInt(curve[i]?.sqrtPrice) === toBigInt(point.sqrtPrice) &&
+            toBigInt(curve[i]?.liquidity) === toBigInt(point.liquidity));
+    if (!sameCurve) {
+        c.add('curve', 'CURVE_MISMATCH', "sqrtStartPrice and curve must be FORGE's (FORGE_TOKEN_SETTINGS, FORGE_MIGRATION_SETTINGS, 10 SOL threshold)");
     }
 }
 function collectMigration(config, c) {
@@ -379,6 +454,11 @@ function collectMigration(config, c) {
     if (feeReason !== null) {
         c.add('migrationFee', 'MIGRATION_FEE_INVALID', `migrationFee: ${feeReason}`);
     }
+    else if (config.migrationFee.feePercentage !== 0 ||
+        config.migrationFee.creatorFeePercentage !== 0) {
+        // The SDK allows up to 99% / 100% of the migrated quote: on a FORGE config it is always 0.
+        c.add('migrationFee', 'MIGRATION_FEE_NOT_ALLOWED', 'migrationFee.feePercentage and migrationFee.creatorFeePercentage must be 0');
+    }
     const pool = config.migratedPoolFee;
     if (!pool) {
         c.add('migratedPoolFee', 'MIGRATED_POOL_FEE_INVALID', 'migratedPoolFee is required');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgedevv/core",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "FORGE transaction core: Meteora Dynamic Bonding Curve configs, pools, swaps, claims and on-chain checks. Published on npm as @forgedevv/core.",
   "license": "UNLICENSED",
   "repository": {
@@ -47,7 +47,8 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@forge/shared": "npm:@forgedevv/shared@0.1.0",
+    "@forge/shared": "npm:@forgedevv/shared@0.2.0",
+    "@meteora-ag/cp-amm-sdk": "1.5.1",
     "@meteora-ag/dynamic-bonding-curve-sdk": "1.5.13",
     "@solana/spl-token": "0.4.15",
     "@solana/web3.js": "1.99.0",