@layerzerolabs/protocol-stellar-v2 0.2.13 → 0.2.18

package/contracts/workers/dvn-fee-lib/src/tests/dvn_fee_lib.rs

@@ -18,66 +18,73 @@ fn get_call_data_size_pads_signatures() {
 
 #[test]
 fn apply_premium_multiplier_only_both_zero() {
+    let env = Env::default();
     let fee = 1_000i128;
     let multiplier_bps = 15_000u32;
     // multiplier_bps is non-zero, so default_multiplier_bps is ignored
-    let result = apply_premium(fee, multiplier_bps, 10_000, 0, 0);
+    let result = apply_premium(&env, fee, multiplier_bps, 10_000, 0, 0);
     assert_eq!(result, fee * multiplier_bps as i128 / BPS_BASE);
 }
 
 #[test]
 fn apply_premium_multiplier_only_native_price_zero() {
+    let env = Env::default();
     let fee = 1_000i128;
     let multiplier_bps = 15_000u32;
-    let result = apply_premium(fee, multiplier_bps, 10_000, 100, 0);
+    let result = apply_premium(&env, fee, multiplier_bps, 10_000, 100, 0);
     assert_eq!(result, fee * multiplier_bps as i128 / BPS_BASE);
 }
 
 #[test]
 fn apply_premium_multiplier_only_floor_margin_zero() {
+    let env = Env::default();
     let fee = 1_000i128;
     let multiplier_bps = 15_000u32;
-    let result = apply_premium(fee, multiplier_bps, 10_000, 0, NATIVE_DECIMALS_RATE);
+    let result = apply_premium(&env, fee, multiplier_bps, 10_000, 0, NATIVE_DECIMALS_RATE);
     assert_eq!(result, fee * multiplier_bps as i128 / BPS_BASE);
 }
 
 #[test]
 fn apply_premium_uses_default_when_multiplier_zero() {
+    let env = Env::default();
     let fee = 1_000i128;
     let default_bps = 12_000u32;
     // multiplier_bps is 0, so default_multiplier_bps should be used
-    let result = apply_premium(fee, 0, default_bps, 0, 0);
+    let result = apply_premium(&env, fee, 0, default_bps, 0, 0);
     assert_eq!(result, fee * default_bps as i128 / BPS_BASE);
 }
 
 #[test]
 fn apply_premium_floor_margin_wins() {
+    let env = Env::default();
     let fee = 1_000i128;
     let multiplier_bps = 10_000u32;
     let floor_margin_usd = 10u128;
     let native_price_usd = NATIVE_DECIMALS_RATE;
 
-    let result = apply_premium(fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
+    let result = apply_premium(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
     assert_eq!(result, fee + floor_margin_usd as i128);
 }
 
 #[test]
 fn apply_premium_multiplier_wins_over_small_floor() {
+    let env = Env::default();
     let fee = 1_000i128;
     let multiplier_bps = 12_000u32;
     let floor_margin_usd = 1u128;
     let native_price_usd = NATIVE_DECIMALS_RATE;
 
-    let result = apply_premium(fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
+    let result = apply_premium(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
     assert_eq!(result, 1_200);
 }
 
 #[test]
-#[should_panic(expected = "Error(Contract, #2)")] // DvnFeeLibError::InvalidGas
+#[should_panic(expected = "Error(Contract, #1)")] // DvnFeeLibError::EidNotSupported
 fn get_fee_panics_when_gas_zero() {
     let env = Env::default();
     env.mock_all_auths();
-    let fee_lib_addr = env.register(DvnFeeLib, ());
+    let owner = Address::generate(&env);
+    let fee_lib_addr = env.register(DvnFeeLib, (&owner,));
     let params = DvnFeeParams {
         sender: Address::generate(&env),
         dst_eid: 1,
@@ -95,11 +102,12 @@ fn get_fee_panics_when_gas_zero() {
 }
 
 #[test]
-#[should_panic(expected = "Error(Contract, #1)")] // DvnFeeLibError::InvalidDVNOptions
+#[should_panic(expected = "Error(Contract, #2)")] // DvnFeeLibError::InvalidDVNOptions
 fn get_fee_panics_when_options_not_empty() {
     let env = Env::default();
     env.mock_all_auths();
-    let fee_lib_addr = env.register(DvnFeeLib, ());
+    let owner = Address::generate(&env);
+    let fee_lib_addr = env.register(DvnFeeLib, (&owner,));
     let mut options = Bytes::new(&env);
     options.push_back(1u8);
 
@@ -171,7 +179,8 @@ impl MockPriceFeedNegative {
 fn get_fee_success_path() {
     let env = Env::default();
     env.mock_all_auths();
-    let fee_lib_addr = env.register(DvnFeeLib, ());
+    let owner = Address::generate(&env);
+    let fee_lib_addr = env.register(DvnFeeLib, (&owner,));
     let params = DvnFeeParams {
         sender: Address::generate(&env),
         dst_eid: 7,
@@ -194,7 +203,8 @@ fn get_fee_success_path() {
 fn get_fee_uses_default_multiplier_when_zero() {
     let env = Env::default();
     env.mock_all_auths();
-    let fee_lib_addr = env.register(DvnFeeLib, ());
+    let owner = Address::generate(&env);
+    let fee_lib_addr = env.register(DvnFeeLib, (&owner,));
 
     // multiplier_bps = 0, default_multiplier_bps = 12000 (1.2x)
     // MockPriceFeed returns fee=100, so result = 100 * 12000 / 10000 = 120
@@ -220,7 +230,8 @@ fn get_fee_uses_default_multiplier_when_zero() {
 fn get_fee_prefers_dst_multiplier_over_default() {
     let env = Env::default();
     env.mock_all_auths();
-    let fee_lib_addr = env.register(DvnFeeLib, ());
+    let owner = Address::generate(&env);
+    let fee_lib_addr = env.register(DvnFeeLib, (&owner,));
 
     // multiplier_bps = 15000 (1.5x), default_multiplier_bps = 10000 (1.0x)
     // MockPriceFeed returns fee=100, so result = 100 * 15000 / 10000 = 150
@@ -247,7 +258,8 @@ fn get_fee_prefers_dst_multiplier_over_default() {
 fn get_fee_panics_when_price_feed_returns_negative_fee() {
     let env = Env::default();
     env.mock_all_auths();
-    let fee_lib_addr = env.register(DvnFeeLib, ());
+    let owner = Address::generate(&env);
+    let fee_lib_addr = env.register(DvnFeeLib, (&owner,));
     let params = DvnFeeParams {
         sender: Address::generate(&env),
         dst_eid: 7,
@@ -267,18 +279,20 @@ fn get_fee_panics_when_price_feed_returns_negative_fee() {
 #[test]
 #[should_panic]
 fn apply_premium_panics_on_overflow() {
+    let env = Env::default();
     let fee = i128::MAX / 2;
     let multiplier_bps = 20_000u32;
-    apply_premium(fee, multiplier_bps, 10_000, u128::MAX, 1);
+    apply_premium(&env, fee, multiplier_bps, 10_000, u128::MAX, 1);
 }
 
 #[test]
 fn apply_premium_floor_margin_truncates() {
+    let env = Env::default();
     let fee = 0i128;
     let multiplier_bps = 10_000u32;
     let floor_margin_usd = 1u128;
     let native_price_usd = NATIVE_DECIMALS_RATE * 3 / 2;
 
-    let result = apply_premium(fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
+    let result = apply_premium(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
     assert_eq!(result, 0);
 }

package/contracts/workers/executor/src/auth.rs

@@ -1,10 +1,11 @@
 use super::*;
-
+use endpoint_v2::LayerZeroEndpointV2Client;
 use soroban_sdk::{
     address_payload::AddressPayload,
     auth::{Context, CustomAccountInterface},
-    contractimpl, contracttype,
+    contracttype,
     crypto::Hash,
+    Symbol, TryFromVal, Val,
 };
 
 // ============================================================================
@@ -26,7 +27,7 @@ pub struct ExecutorSignature {
 // Custom Account Interface Implementation
 // ============================================================================
 
-#[contractimpl]
+#[contract_impl]
 impl CustomAccountInterface for LzExecutor {
     type Signature = ExecutorSignature;
     type Error = ExecutorError;
@@ -35,7 +36,6 @@ impl CustomAccountInterface for LzExecutor {
     ///
     /// The public key must correspond to a registered admin and must have signed the signature_payload.
     /// Uses Ed25519 signature verification.
-    /// Only whitelisted function calls are authorized.
     fn __check_auth(
         env: Env,
         signature_payload: Hash<32>,
@@ -70,24 +70,88 @@ impl LzExecutor {
         Ok(())
     }
 
-    /// Validates that the first auth context is a whitelisted (contract, function) pair.
-    /// Sub-invocations are trusted since they're controlled by the whitelisted contract.
+    /// Validates auth contexts according to executor rules.
+    ///
+    /// # Design
+    ///
+    /// For `lz_receive`: OApps call `verify_and_clear_payload` (see `oapp_receiver.rs`)
+    /// which requires executor auth and optionally transfers native token from executor to OApp.
+    ///
+    /// For `lz_compose`: Composers follow the same pattern - require executor auth and
+    /// optionally transfer native token from executor to composer.
+    ///
+    /// Both create 1-2 auth contexts depending on whether value == 0:
+    /// - Context 1: `lz_receive`/`lz_compose` on the OApp/Composer (always present)
+    /// - Context 2: `transfer` on native token (only if value != 0)
+    ///
+    /// For `lz_receive_alert`/`lz_compose_alert`: These are called directly on the endpoint
+    /// to record failed executions. Only 1 context on the endpoint is expected.
     fn validate_auth_contexts(env: &Env, contexts: &Vec<Context>) -> Result<(), ExecutorError> {
-        let first_context = contexts.first().ok_or(ExecutorError::UnauthorizedContext)?;
-
-        match first_context {
-            Context::Contract(contract_context) => {
-                // Check if (contract, fn_name) pair is whitelisted
-                if !Self::is_whitelisted_fn(env, &contract_context.contract, &contract_context.fn_name) {
-                    return Err(ExecutorError::UnauthorizedContext);
-                }
+        // Early bounds check: max 2 contexts expected
+        if contexts.len() > 2 {
+            return Err(ExecutorError::UnauthorizedContext);
+        }
+
+        let first_ctx = contexts.first().ok_or(ExecutorError::UnauthorizedContext)?;
+        let Context::Contract(first_ctx) = first_ctx else {
+            return Err(ExecutorError::UnauthorizedContext);
+        };
+
+        let first_fn_name = &first_ctx.fn_name;
+
+        // Alert path: lz_receive_alert or lz_compose_alert (lazy Symbol creation)
+        if *first_fn_name == Symbol::new(env, "lz_receive_alert")
+            || *first_fn_name == Symbol::new(env, "lz_compose_alert")
+        {
+            // Require exactly 1 context and the contract must be the endpoint
+            if contexts.len() != 1 || first_ctx.contract != Self::endpoint(env) {
+                return Err(ExecutorError::UnauthorizedContext);
             }
-            // Contract creation is not allowed
-            Context::CreateContractHostFn(_) | Context::CreateContractWithCtorHostFn(_) => {
+            return Ok(());
+        }
+
+        // Execute path: lz_receive or lz_compose
+        if *first_fn_name != Symbol::new(env, "lz_receive") && *first_fn_name != Symbol::new(env, "lz_compose") {
+            return Err(ExecutorError::UnauthorizedContext);
+        }
+
+        let value = Self::extract_i128(env, first_ctx.args.last())?;
+        if value == 0 {
+            // If value is 0, there should be exactly 1 context
+            if contexts.len() != 1 {
                 return Err(ExecutorError::UnauthorizedContext);
             }
+            return Ok(());
+        }
+
+        // value != 0: validate transfer context (only if there are 2 contexts)
+        if contexts.len() != 2 {
+            return Err(ExecutorError::UnauthorizedContext);
+        }
+
+        // Second context must be the transfer context
+        let Context::Contract(second_ctx) = contexts.get(1).unwrap() else {
+            return Err(ExecutorError::UnauthorizedContext);
+        };
+
+        let native_token = LayerZeroEndpointV2Client::new(env, &Self::endpoint(env)).native_token();
+        let transfer_amount = Self::extract_i128(env, second_ctx.args.get(2))?;
+
+        // Validate transfer context: must be transfer with matching value and native token contract
+        if second_ctx.fn_name != Symbol::new(env, "transfer")
+            || second_ctx.contract != native_token
+            || transfer_amount != value
+        {
+            return Err(ExecutorError::UnauthorizedContext);
         }
 
         Ok(())
     }
+
+    /// Extracts an i128 value from an optional Val.
+    #[inline]
+    fn extract_i128(env: &Env, val: Option<Val>) -> Result<i128, ExecutorError> {
+        let val = val.ok_or(ExecutorError::UnauthorizedContext)?;
+        i128::try_from_val(env, &val).map_err(|_| ExecutorError::UnauthorizedContext)
+    }
 }

package/contracts/workers/executor/src/executor.rs

@@ -5,27 +5,25 @@ use crate::{
     storage::ExecutorStorage,
     NativeDropParams,
 };
-use common_macros::{contract_impl, only_owner, ttl_configurable};
+use common_macros::{contract_impl, lz_contract};
 use endpoint_v2::{FeeRecipient, LayerZeroEndpointV2Client, Origin};
 use message_lib_common::interfaces::ILayerZeroExecutor;
-use soroban_sdk::{contract, token::TokenClient, vec, Address, Bytes, BytesN, Env, Symbol, Vec};
-use utils::option_ext::OptionExt;
-use utils::ownable::Ownable;
+use soroban_sdk::{token::TokenClient, vec, Address, Bytes, BytesN, Env, Vec};
+use utils::{option_ext::OptionExt, upgradeable::UpgradeableInternal};
 use worker::{
     assert_acl, assert_not_paused, assert_supported_message_lib, init_worker, require_admin_auth, set_admin_by_owner,
     ExecutorFeeLibClient, FeeParams, Worker,
 };
 
 /// LayerZero Executor contract for cross-chain message execution.
-#[contract]
-#[ttl_configurable]
+#[lz_contract(upgradeable)]
 pub struct LzExecutor;
 
 #[contract_impl]
 impl LzExecutor {
     /// Initializes the executor contract.
     ///
-    /// Sets up ownership, worker configuration, endpoint address, and whitelisted functions.
+    /// Sets up ownership, worker configuration, and endpoint address.
     ///
     /// # Arguments
     /// * `endpoint` - LayerZero Endpoint V2 contract address
@@ -34,7 +32,6 @@ impl LzExecutor {
     /// * `message_libs` - Supported message library addresses (e.g., ULN302)
     /// * `price_feed` - Price feed contract address for fee calculations
     /// * `default_multiplier_bps` - Default fee multiplier in basis points (10000 = 1x)
-    /// * `whitelist` - Initial whitelisted (contract, function) pairs for authorization
     /// * `worker_fee_lib` - Worker fee library contract address
     /// * `deposit_address` - Address to receive fee payments
     pub fn __constructor(
@@ -45,7 +42,6 @@ impl LzExecutor {
         message_libs: &Vec<Address>,
         price_feed: &Address,
         default_multiplier_bps: u32,
-        whitelist: &Vec<(Address, Symbol)>,
         worker_fee_lib: &Address,
         deposit_address: &Address,
     ) {
@@ -60,26 +56,6 @@ impl LzExecutor {
             deposit_address,
         );
         ExecutorStorage::set_endpoint(env, endpoint);
-
-        // Set initial whitelisted functions
-        for (contract, fn_name) in whitelist.iter() {
-            ExecutorStorage::set_whitelisted_fn(env, &contract, &fn_name, &true);
-        }
-    }
-
-    /// Sets whether a (contract, function) pair is whitelisted.
-    /// When `allowed` is false, the entry is removed from storage to save space.
-    ///
-    /// Only the contract owner can call this function.
-    #[only_owner]
-    pub fn set_whitelisted_fn(env: &Env, contract: &Address, fn_name: &Symbol, allowed: bool) {
-        let value = if allowed { Some(true) } else { None };
-        ExecutorStorage::set_or_remove_whitelisted_fn(env, contract, fn_name, &value);
-    }
-
-    /// Returns whether a (contract, function) pair is whitelisted.
-    pub fn is_whitelisted_fn(env: &Env, contract: &Address, fn_name: &Symbol) -> bool {
-        ExecutorStorage::has_whitelisted_fn(env, contract, fn_name)
     }
 
     /// Withdraws a token from the contract to a specified address.
@@ -227,6 +203,18 @@ impl ILayerZeroExecutor for LzExecutor {
 #[contract_impl(contracttrait)]
 impl Worker for LzExecutor {}
 
+// ============================================================================
+// Upgradeable Implementation
+// ============================================================================
+
+impl UpgradeableInternal for LzExecutor {
+    type MigrationData = ();
+
+    fn __migrate(_env: &Env, _migration_data: &Self::MigrationData) {
+        // No migration logic needed for initial upgrade capability
+    }
+}
+
 // ============================================================================
 // Include SubModules
 // ============================================================================

package/contracts/workers/executor/src/storage.rs

@@ -1,12 +1,12 @@
 use common_macros::storage;
-use soroban_sdk::{Address, Symbol};
+use soroban_sdk::Address;
 
 use crate::DstConfig;
 
 /// Storage keys for the Executor contract.
 ///
 /// Manages persistent storage for destination configurations and instance storage
-/// for the endpoint address and whitelisted functions.
+/// for the endpoint address.
 #[storage]
 pub enum ExecutorStorage {
     /// Destination chain configuration indexed by endpoint ID.
@@ -21,11 +21,4 @@ pub enum ExecutorStorage {
     /// Used for receive-flow operations to interact with the endpoint.
     #[instance(Address)]
     Endpoint,
-
-    /// Whitelisted function for a specific contract.
-    ///
-    /// Only whitelisted (contract, function) pairs can trigger Executor authorization.
-    /// This allows fine-grained control over which contracts can call which functions.
-    #[instance(bool)]
-    WhitelistedFn { contract: Address, fn_name: Symbol },
 }

package/contracts/workers/executor-fee-lib/Cargo.toml

@@ -6,7 +6,7 @@ license.workspace = true
 publish = false
 
 [lib]
-crate-type = ["cdylib"]
+crate-type = ["cdylib", "rlib"]
 doctest = false
 
 [dependencies]

package/contracts/workers/executor-fee-lib/src/errors.rs

@@ -2,14 +2,16 @@ use common_macros::contract_error;
 
 #[contract_error]
 pub enum ExecutorFeeLibError {
+    EidNotSupported,
+    InvalidExecutorOptions,
+    InvalidFee,
+    InvalidLzComposeOption,
+    InvalidLzReceiveOption,
+    InvalidNativeDropOption,
+    NativeAmountExceedsCap,
     NoOptions,
+    Overflow,
     UnsupportedOptionType,
-    ZeroLzReceiveGasProvided,
     ZeroLzComposeGasProvided,
-    NativeAmountExceedsCap,
-    InvalidLzReceiveOption,
-    InvalidNativeDropOption,
-    InvalidLzComposeOption,
-    InvalidExecutorOptions,
-    EidNotSupported,
+    ZeroLzReceiveGasProvided,
 }