@layerzerolabs/oapp-solana-contracts 1.2.72 → 1.2.74

package/Anchor.toml

@@ -1,18 +1,14 @@
 [toolchain]
-anchor_version = "1.1.2"
-solana_version = "3.1.10"
+anchor_version = "1.2.1"
+solana_version = "4.3.0"
 
 [features]
-seeds = false
 skip-lint = false
 resolution = false
 
 [programs.localnet]
 counter = "Cnt11111111111111111111111111111111111111111"
 
-[registry]
-url = "https://api.apr.dev"
-
 [provider]
 cluster = "Localnet"
 wallet = "~/.config/solana/id.json"

package/Cargo.toml

@@ -19,8 +19,8 @@ idl-build = ["anchor-lang/idl-build", "anchor-spl/idl-build", "oapp-macros/idl-b
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(target_os, values("solana"))'] }
 
 [dependencies]
-anchor-lang = { version = "1.1.2" }
-anchor-spl = { version = "1.1.2" }
+anchor-lang = { version = "1.2.1", default-features = false, features = ["solana-v4"] }
+anchor-spl = { version = "1.2.1", default-features = false, features = ["associated_token", "mint", "token", "token_2022", "token_2022_extensions", "solana-v4"] }
 oapp-macros = { path = "macros" }
 solana-keccak-hasher = "3.1.0"
 spl-type-length-value = { version = "0.9.1", features = ["derive"] }

package/README.md

@@ -55,22 +55,22 @@ Every OApp program exposes a standard set of instructions, generated by the `#[o
 
 Generated by the `#[oapp]` attribute macro from `oapp`.
 
-| Instruction             | View | Has Default | Description                                                |
-| ----------------------- | ---- | ----------- | ---------------------------------------------------------- |
-| `set_peer`              | No   | Yes         | Register a trusted remote OApp                             |
-| `get_peer`              | Yes  | Yes         | Read registered peer address                               |
-| `init_enforced_options` | No   | Yes         | Create the EnforcedOptions PDA with initial options buffer |
-| `set_enforced_options`  | No   | Yes         | Update enforced send options (with resize)                 |
-| `get_enforced_options`  | Yes  | Yes         | Read enforced options                                      |
-| `next_nonce`            | Yes  | Yes         | Read next inbound nonce                                    |
-| `is_compose_msg_sender` | Yes  | Yes         | Validate compose message sender                            |
-| `lz_receive_types_info` | Yes  | No          | Return LzReceiveTypes version and accounts                 |
-| `lz_receive_types_v3`   | No   | No          | Write the lz_receive execution plan to caller scratch      |
-| `lz_receive`            | No   | No          | Execute inbound cross-chain message                        |
-| `clear`                 | No   | Yes         | Consume a verified inbound message without `lz_receive`    |
-| `skip`                  | No   | Yes         | Skip the next inbound nonce                                |
-| `burn`                  | No   | Yes         | Permanently burn a verified inbound payload                |
-| `nilify`                | No   | Yes         | Block an inbound nonce until it is re-verified             |
+| Instruction             | View | Has Default | Description                                                        |
+| ----------------------- | ---- | ----------- | ------------------------------------------------------------------ |
+| `set_peer`              | No   | Yes         | Register a trusted remote OApp                                     |
+| `get_peer`              | Yes  | Yes         | Read registered peer address                                       |
+| `init_enforced_options` | No   | Yes         | Create the EnforcedOptions PDA with initial options buffer         |
+| `set_enforced_options`  | No   | Yes         | Update enforced send options (with resize)                         |
+| `get_enforced_options`  | Yes  | Yes         | Read enforced options                                              |
+| `next_nonce`            | Yes  | Yes         | Next nonce for ordered delivery; the default returns 0 (unordered) |
+| `is_compose_msg_sender` | Yes  | Yes         | Validate compose message sender                                    |
+| `lz_receive_types_info` | Yes  | No          | Return LzReceiveTypes version and accounts                         |
+| `lz_receive_types_v3`   | No   | No          | Write the lz_receive execution plan to caller scratch              |
+| `lz_receive`            | No   | No          | Execute inbound cross-chain message                                |
+| `clear`                 | No   | Yes         | Consume a verified inbound message without `lz_receive`            |
+| `skip`                  | No   | Yes         | Skip the next unverified inbound nonce                             |
+| `burn`                  | No   | Yes         | Permanently burn a verified payload at or below the inbound nonce  |
+| `nilify`                | No   | Yes         | Block an inbound nonce until it is re-verified                     |
 
 ### RBAC Instructions
 

package/macros/Cargo.toml

@@ -11,7 +11,7 @@ default = []
 idl-build = ["anchor-lang/idl-build"]
 
 [dependencies]
-anchor-lang = { version = "1.1.2" }
+anchor-lang = { version = "1.2.1", default-features = false, features = ["solana-v4"] }
 anchor-trait = { path = "../dependencies/framework-solana-anchor-trait" }
 syn = { version = "2.0", features = ["full", "parsing", "extra-traits"] }
 quote = "1.0"

package/macros/src/instructions/oapp/next_nonce.rs

@@ -35,7 +35,8 @@ fn generate_default_impl(
 
                 #[account(
                     seeds = [::oapp::NONCE_SEED, oapp.key().as_ref(), &params.src_eid.to_be_bytes(), &params.sender],
-                    bump
+                    bump,
+                    seeds::program = ::oapp::endpoint::ID
                 )]
                 pub nonce_account: UncheckedAccount<'info>,
             }

package/macros/src/lib.rs

@@ -75,6 +75,25 @@ pub fn composer(attr: TokenStream, item: TokenStream) -> TokenStream {
 /// The body of this stub is unreachable: `#[composer]` consumes the enclosing
 /// module token stream and strips this marker before rustc sees it.
 /// Override logic lives in `composer::expand`.
+///
+/// # Security: `lz_compose`
+///
+/// The handler MUST verify that `params.from` is an OApp it trusts. Anyone can
+/// queue a compose message with the Endpoint's `send_compose`, which records
+/// its signer as `from`; `clear_compose` only proves the message came from
+/// `params.from`, not that the sender is trusted. Bind the trusted sender
+/// (e.g. the OFT store whose receives queue these messages) in the composer's
+/// state and check it declaratively:
+///
+/// ```ignore
+/// #[account(
+///     seeds = [COMPOSER_SEED],
+///     bump = composer_store.bump,
+///     constraint = composer_store.key() == params.to,
+///     constraint = composer_store.oft_store == params.from,
+/// )]
+/// pub composer_store: Account<'info, ComposerStore>,
+/// ```
 #[proc_macro_attribute]
 pub fn composer_instruction(_attr: TokenStream, item: TokenStream) -> TokenStream {
     item

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layerzerolabs/oapp-solana-contracts",
-  "version": "1.2.72",
+  "version": "1.2.74",
   "private": false,
   "license": "MIT",
   "type": "module",
@@ -15,14 +15,14 @@
     "rustfmt.toml"
   ],
   "dependencies": {
-    "@layerzerolabs/framework-solana-anchor-trait": "1.2.72",
-    "@layerzerolabs/rbac-solana-contracts": "1.2.72"
+    "@layerzerolabs/framework-solana-anchor-trait": "1.2.74",
+    "@layerzerolabs/rbac-solana-contracts": "1.2.74"
   },
   "devDependencies": {
-    "@layerzerolabs/build-utils-rust": "1.2.72",
-    "@layerzerolabs/tsup-configuration": "1.2.72",
-    "@layerzerolabs/typescript-configuration": "1.2.72",
-    "@layerzerolabs/vm-tooling-solana": "1.2.72"
+    "@layerzerolabs/build-utils-rust": "1.2.74",
+    "@layerzerolabs/tsup-configuration": "1.2.74",
+    "@layerzerolabs/typescript-configuration": "1.2.74",
+    "@layerzerolabs/vm-tooling-solana": "1.2.74"
   },
   "publishConfig": {
     "access": "restricted",

package/rust-toolchain.toml

@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.92.0"
+channel = "1.97.1"
 components = ["rustfmt", "clippy"]

package/src/endpoint_cpi.rs

@@ -33,7 +33,6 @@ use crate::endpoint::{
     },
 };
 use anchor_lang::{
-    error,
     prelude::{AccountInfo, CpiContext, ErrorCode, Key, Pubkey, Result},
     require, require_keys_eq, ToAccountInfos, ToAccountMetas,
 };
@@ -208,11 +207,22 @@ pub fn send(
         event_authority: accounts[8].clone(),
         program: accounts[9].clone(),
     };
-    let rtn = endpoint::cpi::send(
+    invoke_send(
         make_cpi_ctx(accounts, cpi_accounts, SEND_MIN_ACCOUNTS_LEN).with_signer(&[seeds]),
         params,
-    )?;
-    Ok(rtn.get())
+    )
+}
+
+// SBPF v3 has fixed 4 KiB stack frames with no guard gaps, so a frame that overflows silently
+// corrupts its neighbour instead of faulting. The generated CPI needs most of a frame on its own;
+// kept out of line, neither it nor the caller exceeds 4 KiB (inlined, platform-tools v1.57 builds a
+// 4.6 KiB frame).
+#[inline(never)]
+fn invoke_send<'a, 'b, 'c, 'info>(
+    ctx: CpiContext<'a, 'b, 'c, 'info, Send<'info>>,
+    params: SendParams,
+) -> Result<MessagingReceipt> {
+    Ok(endpoint::cpi::send(ctx, params)?.get())
 }
 
 /// Queries the Endpoint for the fee required to send a cross-chain message.
@@ -300,14 +310,24 @@ pub fn clear(
         event_authority: accounts[6].clone(),
         program: accounts[7].clone(),
     };
-    let result = endpoint::cpi::clear(
+    invoke_clear(
         make_cpi_ctx(accounts, cpi_accounts, CLEAR_MIN_ACCOUNTS_LEN).with_signer(&[seeds]),
         params,
-    )?;
-    Ok(result.get())
+    )
+}
+
+/// Out of line for the same reason as [`invoke_send`].
+#[inline(never)]
+fn invoke_clear<'a, 'b, 'c, 'info>(
+    ctx: CpiContext<'a, 'b, 'c, 'info, Clear<'info>>,
+    params: ClearParams,
+) -> Result<[u8; 32]> {
+    Ok(endpoint::cpi::clear(ctx, params)?.get())
 }
 
-/// Skips the next inbound nonce on the Endpoint messaging channel.
+/// Skips the next inbound nonce on the Endpoint messaging channel. The Endpoint only accepts
+/// `inbound_nonce + 1`, the next unverified nonce, so this cannot reach a verified payload; use
+/// [`burn`] or [`clear`] for one.
 ///
 /// # Accounts layout
 /// The `accounts` slice must follow the `Skip` struct field order:
@@ -353,7 +373,8 @@ pub fn skip(
     )
 }
 
-/// Permanently burns a verified payload hash so it can never be executed or re-verified.
+/// Permanently burns a verified payload hash so it can never be executed or re-verified. The
+/// Endpoint requires the payload's nonce to be at or below the inbound nonce.
 ///
 /// # Accounts layout
 /// The `accounts` slice must follow the `Burn` struct field order: