@layerzerolabs/oapp-solana-contracts 1.2.11

package/src/endpoint_cpi.rs

@@ -0,0 +1,386 @@
+//! CPI helpers for invoking the LayerZero Endpoint program.
+//!
+//! Each function in this module is a thin wrapper that:
+//! 1. Validates the caller-supplied authority key matches the expected account in the accounts
+//!    slice.
+//! 2. Validates that `accounts[0]` is the Endpoint program itself (checked against
+//!    `endpoint_program`) and that enough accounts were supplied.
+//! 3. Invokes the corresponding Endpoint instruction, signing with the OApp's PDA seeds.
+//!
+//! **Important:** The `accounts` slice must follow the field declaration order of the
+//! corresponding `cpi::accounts::*` struct, with `endpoint_program` prepended at index 0.
+//! See each wrapper's "Accounts layout" section for the exact positional order.
+//!
+//! These wrappers are the primary interface OApp programs use to interact with the
+//! LayerZero Endpoint for cross-chain messaging operations.
+//!
+//! The `endpoint` IDL (`idls/endpoint.json`) was obtained with:
+//!
+//! ```text
+//! anchor idl fetch 76y77prsiCMvXMjuoZ5VRrhG5qYBrUMYTE5WgHqgjEn6 --provider.cluster mainnet
+//! ```
+
+use crate::endpoint::{
+    self,
+    cpi::accounts::{Clear, ClearCompose, Quote, RegisterOapp, Send, SendCompose, SetDelegate},
+    types::{
+        ClearComposeParams, ClearParams, MessagingFee, MessagingReceipt, QuoteParams,
+        RegisterOAppParams, SendComposeParams, SendParams, SetDelegateParams,
+    },
+};
+use anchor_lang::{
+    error,
+    prelude::{AccountInfo, CpiContext, ErrorCode, Key, Pubkey, Result},
+    require, require_keys_eq, ToAccountInfos, ToAccountMetas,
+};
+
+pub const REGISTER_OAPP_MIN_ACCOUNTS_LEN: usize = 7;
+pub const SET_DELEGATE_MIN_ACCOUNTS_LEN: usize = 5;
+pub const SEND_MIN_ACCOUNTS_LEN: usize = 10;
+pub const QUOTE_MIN_ACCOUNTS_LEN: usize = 7;
+pub const CLEAR_MIN_ACCOUNTS_LEN: usize = 8;
+pub const SEND_COMPOSE_MIN_ACCOUNTS_LEN: usize = 7;
+pub const CLEAR_COMPOSE_MIN_ACCOUNTS_LEN: usize = 5;
+
+fn validate(accounts: &[AccountInfo], endpoint_program: Pubkey, min_len: usize) -> Result<()> {
+    require!(accounts.len() >= min_len, ErrorCode::AccountNotEnoughKeys);
+    require_keys_eq!(accounts[0].key(), endpoint_program, ErrorCode::InvalidProgramId);
+    Ok(())
+}
+
+fn make_cpi_ctx<'info, T>(
+    accounts: &[AccountInfo<'info>],
+    cpi_accounts: T,
+    min_len: usize,
+) -> CpiContext<'info, 'info, 'info, 'info, T>
+where
+    T: ToAccountMetas + ToAccountInfos<'info>,
+{
+    let mut ctx = CpiContext::new(accounts[0].key(), cpi_accounts);
+    if accounts.len() > min_len {
+        ctx = ctx.with_remaining_accounts(accounts[min_len..].to_vec());
+    }
+    ctx
+}
+
+/// Registers the OApp with the LayerZero Endpoint.
+///
+/// Must be called once during program initialization to establish the OApp's identity
+/// with the Endpoint. After registration, the Endpoint recognizes this program as a
+/// valid sender/receiver of cross-chain messages.
+///
+/// # Accounts layout
+/// The `accounts` slice must follow the `RegisterOapp` struct field order:
+///
+/// 0. `endpoint_program`
+/// 1. `payer`
+/// 2. `oapp`
+/// 3. `oapp_registry`
+/// 4. `system_program`
+/// 5. `event_authority`
+/// 6. `program`
+/// 7. remaining accounts (variable length)
+///
+/// # Accounts validation
+/// - `accounts[0]` must equal the caller-supplied `endpoint_program` parameter.
+/// - `accounts[2]` must match the provided `oapp` key (the OApp PDA).
+pub fn register_oapp(
+    endpoint_program: Pubkey,
+    oapp: Pubkey,
+    accounts: &[AccountInfo],
+    seeds: &[&[u8]],
+    params: RegisterOAppParams,
+) -> Result<()> {
+    validate(accounts, endpoint_program, REGISTER_OAPP_MIN_ACCOUNTS_LEN)?;
+    require_keys_eq!(accounts[2].key(), oapp, ErrorCode::ConstraintAddress);
+
+    let cpi_accounts = RegisterOapp {
+        payer: accounts[1].clone(),
+        oapp: accounts[2].clone(),
+        oapp_registry: accounts[3].clone(),
+        system_program: accounts[4].clone(),
+        event_authority: accounts[5].clone(),
+        program: accounts[6].clone(),
+    };
+    endpoint::cpi::register_oapp(
+        make_cpi_ctx(accounts, cpi_accounts, REGISTER_OAPP_MIN_ACCOUNTS_LEN).with_signer(&[seeds]),
+        params,
+    )
+}
+
+/// Sets a delegate address authorized to configure the OApp's Endpoint settings.
+///
+/// The delegate can manage messaging libraries, executors, and other Endpoint-level
+/// configuration on behalf of the OApp admin.
+///
+/// # Accounts layout
+/// The `accounts` slice must follow the `SetDelegate` struct field order:
+///
+/// 0. `endpoint_program`
+/// 1. `oapp`
+/// 2. `oapp_registry`
+/// 3. `event_authority`
+/// 4. `program`
+/// 5. remaining accounts (variable length)
+///
+/// # Accounts validation
+/// - `accounts[0]` must equal the caller-supplied `endpoint_program` parameter.
+/// - `accounts[1]` must match the provided `oapp` key.
+pub fn set_delegate(
+    endpoint_program: Pubkey,
+    oapp: Pubkey,
+    accounts: &[AccountInfo],
+    seeds: &[&[u8]],
+    params: SetDelegateParams,
+) -> Result<()> {
+    validate(accounts, endpoint_program, SET_DELEGATE_MIN_ACCOUNTS_LEN)?;
+    require_keys_eq!(accounts[1].key(), oapp, ErrorCode::ConstraintAddress);
+
+    let cpi_accounts = SetDelegate {
+        oapp: accounts[1].clone(),
+        oapp_registry: accounts[2].clone(),
+        event_authority: accounts[3].clone(),
+        program: accounts[4].clone(),
+    };
+    endpoint::cpi::set_delegate(
+        make_cpi_ctx(accounts, cpi_accounts, SET_DELEGATE_MIN_ACCOUNTS_LEN).with_signer(&[seeds]),
+        params,
+    )
+}
+
+/// Sends a cross-chain message through the LayerZero Endpoint.
+///
+/// This is the core outbound messaging function. The Endpoint assigns a nonce,
+/// emits a packet event for DVNs to verify, and charges the messaging fee.
+///
+/// # Accounts layout
+/// The `accounts` slice must follow the `Send` struct field order:
+///
+/// 0. `endpoint_program`
+/// 1. `sender`
+/// 2. `send_library_program`
+/// 3. `send_library_config`
+/// 4. `default_send_library_config`
+/// 5. `send_library_info`
+/// 6. `endpoint`
+/// 7. `nonce`
+/// 8. `event_authority`
+/// 9. `program`
+/// 10. remaining accounts (variable length)
+///
+/// # Accounts validation
+/// - `accounts[0]` must equal the caller-supplied `endpoint_program` parameter.
+/// - `accounts[1]` must match the provided `sender` key.
+/// - The `sender` key must appear exactly once in the accounts slice to prevent duplicate-account
+///   exploits that could manipulate fee deduction.
+///
+/// # Returns
+/// A [`MessagingReceipt`] containing the assigned nonce and fee breakdown.
+pub fn send(
+    endpoint_program: Pubkey,
+    sender: Pubkey,
+    accounts: &[AccountInfo],
+    seeds: &[&[u8]],
+    params: SendParams,
+) -> Result<MessagingReceipt> {
+    validate(accounts, endpoint_program, SEND_MIN_ACCOUNTS_LEN)?;
+    require_keys_eq!(accounts[1].key(), sender, ErrorCode::ConstraintAddress);
+    require!(
+        accounts.iter().filter(|acc| acc.key == &sender).count() <= 1,
+        ErrorCode::ConstraintAddress
+    );
+
+    let cpi_accounts = Send {
+        sender: accounts[1].clone(),
+        send_library_program: accounts[2].clone(),
+        send_library_config: accounts[3].clone(),
+        default_send_library_config: accounts[4].clone(),
+        send_library_info: accounts[5].clone(),
+        endpoint: accounts[6].clone(),
+        nonce: accounts[7].clone(),
+        event_authority: accounts[8].clone(),
+        program: accounts[9].clone(),
+    };
+    let rtn = endpoint::cpi::send(
+        make_cpi_ctx(accounts, cpi_accounts, SEND_MIN_ACCOUNTS_LEN).with_signer(&[seeds]),
+        params,
+    )?;
+    Ok(rtn.get())
+}
+
+/// Queries the Endpoint for the fee required to send a cross-chain message.
+///
+/// This is a read-only CPI — no PDA signer seeds are needed. Call this before
+/// [`send`] to determine the [`MessagingFee`] the caller must pay.
+///
+/// # Accounts layout
+/// The `accounts` slice must follow the `Quote` struct field order:
+///
+/// 0. `endpoint_program`
+/// 1. `send_library_program`
+/// 2. `send_library_config`
+/// 3. `default_send_library_config`
+/// 4. `send_library_info`
+/// 5. `endpoint`
+/// 6. `nonce`
+/// 7. remaining accounts (variable length)
+///
+/// # Accounts validation
+/// - `accounts[0]` must equal the caller-supplied `endpoint_program` parameter.
+pub fn quote(
+    endpoint_program: Pubkey,
+    accounts: &[AccountInfo],
+    params: QuoteParams,
+) -> Result<MessagingFee> {
+    validate(accounts, endpoint_program, QUOTE_MIN_ACCOUNTS_LEN)?;
+
+    let cpi_accounts = Quote {
+        send_library_program: accounts[1].clone(),
+        send_library_config: accounts[2].clone(),
+        default_send_library_config: accounts[3].clone(),
+        send_library_info: accounts[4].clone(),
+        endpoint: accounts[5].clone(),
+        nonce: accounts[6].clone(),
+    };
+    let result =
+        endpoint::cpi::quote(make_cpi_ctx(accounts, cpi_accounts, QUOTE_MIN_ACCOUNTS_LEN), params)?;
+    Ok(result.get())
+}
+
+/// Marks an inbound message as received by clearing it from the Endpoint.
+///
+/// Called during `lz_receive` processing to acknowledge that the OApp has consumed the
+/// message payload for a given (srcEid, sender, nonce) tuple. This advances the
+/// inbound nonce and allows subsequent messages to be delivered.
+///
+/// # Accounts layout
+/// The `accounts` slice must follow the `Clear` struct field order:
+///
+/// 0. `endpoint_program`
+/// 1. `signer`
+/// 2. `oapp_registry`
+/// 3. `nonce`
+/// 4. `payload_hash`
+/// 5. `endpoint`
+/// 6. `event_authority`
+/// 7. `program`
+/// 8. remaining accounts (variable length)
+///
+/// # Accounts validation
+/// - `accounts[0]` must equal the caller-supplied `endpoint_program` parameter.
+/// - `accounts[1]` is the `signer` — pinned to `receiver`. The OApp PDA path signs via `seeds`; the
+///   delegate path requires the delegate to already be a signer. The Endpoint accepts either the
+///   OApp PDA (`params.receiver`) or the registered delegate as `signer`.
+///
+/// # Returns
+/// The payload hash (`[u8; 32]`) of the cleared message.
+pub fn clear(
+    endpoint_program: Pubkey,
+    receiver: Pubkey,
+    accounts: &[AccountInfo],
+    seeds: &[&[u8]],
+    params: ClearParams,
+) -> Result<[u8; 32]> {
+    validate(accounts, endpoint_program, CLEAR_MIN_ACCOUNTS_LEN)?;
+    require_keys_eq!(accounts[1].key(), receiver, ErrorCode::ConstraintAddress);
+
+    let cpi_accounts = Clear {
+        signer: accounts[1].clone(),
+        oapp_registry: accounts[2].clone(),
+        nonce: accounts[3].clone(),
+        payload_hash: accounts[4].clone(),
+        endpoint: accounts[5].clone(),
+        event_authority: accounts[6].clone(),
+        program: accounts[7].clone(),
+    };
+    let result = endpoint::cpi::clear(
+        make_cpi_ctx(accounts, cpi_accounts, CLEAR_MIN_ACCOUNTS_LEN).with_signer(&[seeds]),
+        params,
+    )?;
+    Ok(result.get())
+}
+
+/// Sends a composed message to another program on the same chain.
+///
+/// Composition allows an OApp to trigger follow-up logic in a separate program after
+/// receiving a cross-chain message. The Endpoint stores the composed message hash,
+/// and the target program's `lz_compose` handler is invoked to process it.
+///
+/// # Accounts layout
+/// The `accounts` slice must follow the `SendCompose` struct field order:
+///
+/// 0. `endpoint_program`
+/// 1. `from`
+/// 2. `payer`
+/// 3. `compose_message`
+/// 4. `system_program`
+/// 5. `event_authority`
+/// 6. `program`
+/// 7. remaining accounts (variable length)
+///
+/// # Accounts validation
+/// - `accounts[0]` must equal the caller-supplied `endpoint_program` parameter.
+/// - `accounts[1]` must match the provided `from` key (the sending OApp PDA).
+pub fn send_compose(
+    endpoint_program: Pubkey,
+    from: Pubkey,
+    accounts: &[AccountInfo],
+    seeds: &[&[u8]],
+    params: SendComposeParams,
+) -> Result<()> {
+    validate(accounts, endpoint_program, SEND_COMPOSE_MIN_ACCOUNTS_LEN)?;
+    require_keys_eq!(accounts[1].key(), from, ErrorCode::ConstraintAddress);
+
+    let cpi_accounts = SendCompose {
+        from: accounts[1].clone(),
+        payer: accounts[2].clone(),
+        compose_message: accounts[3].clone(),
+        system_program: accounts[4].clone(),
+        event_authority: accounts[5].clone(),
+        program: accounts[6].clone(),
+    };
+    endpoint::cpi::send_compose(
+        make_cpi_ctx(accounts, cpi_accounts, SEND_COMPOSE_MIN_ACCOUNTS_LEN).with_signer(&[seeds]),
+        params,
+    )
+}
+
+/// Clears (acknowledges) a composed message after processing.
+///
+/// Called by the target program's `lz_compose` handler after it has consumed the
+/// composed message. This marks the composition as complete in the Endpoint.
+///
+/// # Accounts layout
+/// The `accounts` slice must follow the `ClearCompose` struct field order:
+///
+/// 0. `endpoint_program`
+/// 1. `to`
+/// 2. `compose_message`
+/// 3. `event_authority`
+/// 4. `program`
+/// 5. remaining accounts (variable length)
+///
+/// # Accounts validation
+/// - `accounts[0]` must equal the caller-supplied `endpoint_program` parameter.
+/// - `accounts[1]` must match the provided `to` key (the receiving program's PDA).
+pub fn clear_compose(
+    endpoint_program: Pubkey,
+    to: Pubkey,
+    accounts: &[AccountInfo],
+    seeds: &[&[u8]],
+    params: ClearComposeParams,
+) -> Result<()> {
+    validate(accounts, endpoint_program, CLEAR_COMPOSE_MIN_ACCOUNTS_LEN)?;
+    require_keys_eq!(accounts[1].key(), to, ErrorCode::ConstraintAddress);
+
+    let cpi_accounts = ClearCompose {
+        to: accounts[1].clone(),
+        compose_message: accounts[2].clone(),
+        event_authority: accounts[3].clone(),
+        program: accounts[4].clone(),
+    };
+    endpoint::cpi::clear_compose(
+        make_cpi_ctx(accounts, cpi_accounts, CLEAR_COMPOSE_MIN_ACCOUNTS_LEN).with_signer(&[seeds]),
+        params,
+    )
+}

package/src/errors.rs

@@ -0,0 +1,16 @@
+use anchor_lang::error_code;
+
+/// Custom error codes for OApp operations
+#[error_code]
+pub enum OAppError {
+    #[msg("Invalid address lookup table")]
+    InvalidAddressLookupTable,
+    #[msg("Invalid options")]
+    InvalidOptions,
+    #[msg("Invalid options length")]
+    InvalidOptionsLength,
+    #[msg("No peer set for the given EID")]
+    NoPeer,
+    #[msg("TLV update would change entry size")]
+    TlvLengthMismatch,
+}

package/src/events.rs

@@ -0,0 +1,26 @@
+use anchor_lang::prelude::*;
+
+/// Emitted when a peer is set for a destination endpoint.
+///
+/// `oapp` is the OApp-store PDA this peer entry belongs to. A single OApp
+/// program manages many independent OApp-store instances (mirroring how the
+/// SPL Token program manages many `Mint` accounts), so the event carries the
+/// store pubkey to let off-chain consumers attribute each change to the right
+/// instance.
+#[event]
+pub struct PeerSet {
+    pub oapp: Pubkey,
+    pub eid: u32,
+    pub peer: [u8; 32],
+}
+
+/// Emitted when enforced options are set for a destination endpoint and message type.
+///
+/// See [`PeerSet`] for the rationale of the `oapp` field.
+#[event]
+pub struct EnforcedOptionsSet {
+    pub oapp: Pubkey,
+    pub eid: u32,
+    pub msg_type: u16,
+    pub options: Vec<u8>,
+}

package/src/lib.rs

@@ -0,0 +1,82 @@
+//! LayerZero OApp SDK for Solana.
+//!
+//! Provides the core building blocks for Solana programs that integrate with the
+//! LayerZero V2 cross-chain messaging protocol as an Omnichain Application (OApp).
+//!
+//! # What's included
+//!
+//! - **PDA seeds** – canonical constants for deriving all protocol-related accounts (peers,
+//!   enforced options, nonces, payload hashes, etc.).
+//! - **Endpoint CPI helpers** – thin wrappers around cross-program invocations to the LayerZero
+//!   Endpoint program (send, quote, compose, etc.).
+//! - **Account macros** – re-exported from [`oapp_macros`] to generate boilerplate Anchor account
+//!   structs for standard OApp instructions.
+//! - **Types & traits** – shared parameter / return structs, the [`OAppState`] trait for PDA signer
+//!   seeds, and messaging option builders.
+
+pub mod common;
+pub mod endpoint_cpi;
+pub mod events;
+pub mod lz_compose_types_v2;
+pub mod lz_receive_types_v2;
+pub mod oapp_info;
+pub mod options;
+pub mod types;
+pub mod utils;
+
+mod errors;
+use anchor_lang::prelude::*;
+// `idls/endpoint.json` is vendored here because `declare_program!` reads the
+// IDL at compile time, and downstream consumers of this crate cannot rely on
+// a workspace-relative path to the Endpoint program's own build output.
+declare_program!(endpoint);
+
+pub use errors::*;
+
+// Re-export procedural macros so consumers can `use oapp::oapp`
+pub use oapp_macros::*;
+
+// OApp state & config
+pub const OAPP_SEED: &[u8] = b"OApp";
+pub const OAPP_INFO_SEED: &[u8] = b"OAppInfo";
+pub const PEER_SEED: &[u8] = b"Peer";
+pub const ENFORCED_OPTIONS_SEED: &[u8] = b"EnforcedOptions";
+
+// Messaging
+pub const LZ_COMPOSE_TYPES_SEED: &[u8] = b"LzComposeTypes";
+pub const LZ_RECEIVE_TYPES_SEED: &[u8] = b"LzReceiveTypes";
+pub const NONCE_SEED: &[u8] = b"Nonce";
+pub const PENDING_NONCE_SEED: &[u8] = b"PendingNonce";
+pub const PAYLOAD_HASH_SEED: &[u8] = b"PayloadHash";
+pub const COMPOSED_MESSAGE_HASH_SEED: &[u8] = b"ComposedMessageHash";
+
+// Endpoint & library config
+pub const ENDPOINT_SEED: &[u8] = b"Endpoint";
+pub const MESSAGE_LIB_SEED: &[u8] = b"MessageLib";
+pub const SEND_LIBRARY_CONFIG_SEED: &[u8] = b"SendLibraryConfig";
+pub const RECEIVE_LIBRARY_CONFIG_SEED: &[u8] = b"ReceiveLibraryConfig";
+
+// Event
+pub const EVENT_SEED: &[u8] = b"__event_authority";
+
+// PDA seed helpers below use `Box::leak` to produce the `&'static [&'static [u8]]`
+// shape required by Anchor's `#[account(seeds = ...)]` attribute. Each call leaks
+// ~64 bytes. **SVM-only**: harmless on-chain because the BPF VM allocator is torn
+// down at the end of every transaction, so leaks never accumulate. Do not call
+// these from long-running off-chain Rust (native test runners, indexers, CLIs) —
+// derive PDAs with stack-local arrays in those contexts instead.
+
+/// PDA seeds for an OApp's `lz_receive_types_accounts` PDA.
+/// Seed shape: [LZ_RECEIVE_TYPES_SEED, oapp_key]
+pub fn lz_receive_types_seeds(oapp_key: &Pubkey) -> &'static [&'static [u8]] {
+    let key_bytes: &'static [u8; 32] = Box::leak(Box::new(oapp_key.to_bytes()));
+    Box::leak(Box::new([LZ_RECEIVE_TYPES_SEED, key_bytes.as_slice()]))
+}
+
+/// Trait for OApp state types.
+///
+/// Defines the minimal interface for PDA signer seeds used in CPI invocations.
+/// `N` is the number of seed segments (e.g. 3 for `[PREFIX, key, bump]`).
+pub trait OAppState<const N: usize> {
+    fn signer_seeds(&self) -> [&[u8]; N];
+}

package/src/lz_compose_types_v2.rs

@@ -0,0 +1,88 @@
+use crate::{common::AccountMetaRef, COMPOSED_MESSAGE_HASH_SEED, EVENT_SEED};
+use anchor_lang::prelude::*;
+use solana_keccak_hasher::hash;
+
+/// Version identifier returned by `lz_compose_types_info` for the V2 flow.
+pub const LZ_COMPOSE_TYPES_VERSION: u8 = 2;
+
+/// Payload returned from `lz_compose_types_info` when the version is V2.
+///
+/// The executor uses these accounts to construct the follow-up
+/// `lz_compose_types_v2` call.
+#[derive(AnchorSerialize, AnchorDeserialize, Clone, Debug)]
+pub struct LzComposeTypesV2Accounts {
+    pub accounts: Vec<Pubkey>,
+}
+
+/// Output of the lz_compose_types_v2 instruction.
+///
+/// This structure enables the multi-instruction execution model where composers
+/// can define multiple instructions to be executed atomically by the Executor.
+/// The Executor constructs a single transaction containing all returned instructions.
+#[derive(AnchorSerialize, AnchorDeserialize, Clone)]
+pub struct LzComposeTypesV2Result {
+    /// The version of context account
+    pub context_version: u8,
+    /// ALTs required for this execution context
+    /// Used by the Executor to resolve AltIndex references in AccountMetaRef
+    pub alts: Vec<Pubkey>,
+    /// The complete list of instructions required for LzCompose execution
+    /// MUST include exactly one LzCompose instruction
+    /// MAY include additional Standard instructions for preprocessing/postprocessing
+    /// Instructions are executed in the order returned
+    pub instructions: Vec<ComposeInstruction>,
+}
+
+/// The list of instructions that can be executed in the LzCompose transaction.
+#[derive(AnchorSerialize, AnchorDeserialize, Clone)]
+pub enum ComposeInstruction {
+    /// The main LzCompose instruction (exactly one required per transaction)
+    /// This instruction processes the incoming composed message
+    LzCompose {
+        /// Account list for the lz_compose instruction
+        /// Uses AddressLocator for flexible address resolution
+        accounts: Vec<AccountMetaRef>,
+    },
+    /// Arbitrary custom instruction for preprocessing/postprocessing
+    Standard {
+        /// Target program ID for the custom instruction
+        program_id: Pubkey,
+        /// Account list for the custom instruction
+        accounts: Vec<AccountMetaRef>,
+        /// Instruction data payload
+        data: Vec<u8>,
+    },
+}
+
+/// V2 version of get_accounts_for_clear_compose that returns AccountMetaRef
+pub fn get_accounts_for_clear_compose(
+    endpoint_program: Pubkey,
+    from: &Pubkey,
+    to: &Pubkey,
+    guid: &[u8; 32],
+    index: u16,
+    composed_message: &[u8],
+) -> Vec<AccountMetaRef> {
+    let (composed_message_account, _) = Pubkey::find_program_address(
+        &[
+            COMPOSED_MESSAGE_HASH_SEED,
+            &from.to_bytes(),
+            &to.to_bytes(),
+            &guid[..],
+            &index.to_be_bytes(),
+            &hash(composed_message).to_bytes(),
+        ],
+        &endpoint_program,
+    );
+
+    let (event_authority_account, _) =
+        Pubkey::find_program_address(&[EVENT_SEED], &endpoint_program);
+
+    vec![
+        AccountMetaRef { pubkey: endpoint_program.into(), is_writable: false },
+        AccountMetaRef { pubkey: (*to).into(), is_writable: false },
+        AccountMetaRef { pubkey: composed_message_account.into(), is_writable: true },
+        AccountMetaRef { pubkey: event_authority_account.into(), is_writable: false },
+        AccountMetaRef { pubkey: endpoint_program.into(), is_writable: false },
+    ]
+}