@layerzerolabs/protocol-stellar-v2 0.2.20 → 0.2.21

package/contracts/workers/dvn-fee-lib/src/dvn_fee_lib.rs

@@ -2,33 +2,32 @@ use crate::errors::DvnFeeLibError;
 use common_macros::{contract_impl, lz_contract};
 use fee_lib_interfaces::{DvnFeeParams, IDvnFeeLib, LayerZeroPriceFeedClient};
 use soroban_sdk::{assert_with_error, Address, Env};
-use utils::upgradeable::UpgradeableInternal;
 
 // ============================================================================
 // Constants
 // ============================================================================
 
 /// Basis points denominator (10000 = 100%).
-pub(crate) const BPS_BASE: i128 = 10000;
+const BPS_BASE: i128 = 10000;
 
 /// Fixed bytes for execute function call.
-pub(crate) const EXECUTE_FIXED_BYTES: u32 = 260;
+const EXECUTE_FIXED_BYTES: u32 = 260;
 
 /// Raw signature bytes length (65 bytes: 64 for signature + 1 for recovery ID).
-pub(crate) const SIGNATURE_RAW_BYTES: u32 = 65;
+const SIGNATURE_RAW_BYTES: u32 = 65;
 
 /// Verify function bytes (padded).
-pub(crate) const VERIFY_BYTES: u32 = 288;
+const VERIFY_BYTES: u32 = 288;
 
 /// Native token decimal rate for XLM (10^7 stroops per XLM).
-pub(crate) const NATIVE_DECIMALS_RATE: u128 = 10_000_000;
+const NATIVE_DECIMALS_RATE: u128 = 10_000_000;
 
 /// DVN fee library contract for calculating DVN verification fees.
 ///
 /// Provides fee calculation logic based on quorum size, destination gas costs,
 /// and current gas prices from the price feed. Handles fee multipliers and
 /// floor margins.
-#[lz_contract(upgradeable)]
+#[lz_contract(upgradeable(no_migration))]
 pub struct DvnFeeLib;
 
 #[contract_impl]
@@ -66,16 +65,6 @@ impl IDvnFeeLib for DvnFeeLib {
     }
 }
 
-// ============================================================================
-// Upgradeable Implementation
-// ============================================================================
-
-/// No migration logic needed for initial upgrade capability
-impl UpgradeableInternal for DvnFeeLib {
-    type MigrationData = ();
-    fn __migrate(_env: &Env, _migration_data: &Self::MigrationData) {}
-}
-
 // ============================================================================
 // Internal Helper Functions
 // ============================================================================
@@ -94,7 +83,7 @@ impl UpgradeableInternal for DvnFeeLib {
 ///
 /// # Returns
 /// Fee with premium applied (max of multiplier fee and margin fee).
-pub(crate) fn apply_premium(
+fn apply_premium(
     env: &Env,
     fee: i128,
     multiplier_bps: u32,
@@ -126,7 +115,7 @@ pub(crate) fn apply_premium(
 ///
 /// # Returns
 /// Total calldata size in bytes.
-pub(crate) fn get_call_data_size(quorum: u32) -> u32 {
+fn get_call_data_size(quorum: u32) -> u32 {
     let mut total_signature_bytes = quorum * SIGNATURE_RAW_BYTES;
     if !total_signature_bytes.is_multiple_of(32) {
         total_signature_bytes = total_signature_bytes - (total_signature_bytes % 32) + 32;
@@ -139,3 +128,32 @@ fn safe_u128_to_i128(env: &Env, value: u128) -> i128 {
     assert_with_error!(env, value <= i128::MAX as u128, DvnFeeLibError::Overflow);
     value as i128
 }
+
+/// Test-only module exposing internal items for unit and integration tests.
+#[cfg(test)]
+pub(crate) mod test {
+    use super::*;
+
+    // Re-export constants for testing
+    pub const BPS_BASE: i128 = super::BPS_BASE;
+    pub const EXECUTE_FIXED_BYTES: u32 = super::EXECUTE_FIXED_BYTES;
+    pub const VERIFY_BYTES: u32 = super::VERIFY_BYTES;
+    pub const NATIVE_DECIMALS_RATE: u128 = super::NATIVE_DECIMALS_RATE;
+
+    /// Test-only wrapper for apply_premium to enable testing.
+    pub fn apply_premium_for_test(
+        env: &Env,
+        fee: i128,
+        multiplier_bps: u32,
+        default_multiplier_bps: u32,
+        floor_margin_usd: u128,
+        native_price_usd: u128,
+    ) -> i128 {
+        super::apply_premium(env, fee, multiplier_bps, default_multiplier_bps, floor_margin_usd, native_price_usd)
+    }
+
+    /// Test-only wrapper for get_call_data_size to enable testing.
+    pub fn get_call_data_size_for_test(quorum: u32) -> u32 {
+        super::get_call_data_size(quorum)
+    }
+}

package/contracts/workers/dvn-fee-lib/src/lib.rs

@@ -1,9 +1,19 @@
 #![no_std]
 
-pub mod dvn_fee_lib;
 pub mod errors;
 
-pub use dvn_fee_lib::{DvnFeeLib, DvnFeeLibClient};
+cfg_if::cfg_if! {
+    // Include implementation when NOT in library mode, OR when testutils is enabled (for tests)
+    if #[cfg(any(not(feature = "library"), feature = "testutils"))] {
+        mod dvn_fee_lib;
+        // Export the contract and client for testing purposes
+        pub use dvn_fee_lib::{DvnFeeLib, DvnFeeLibClient};
+    }
+}
+
+// Re-export test helpers module for integration tests
+#[cfg(test)]
+use dvn_fee_lib::test;
 
 #[cfg(test)]
 extern crate std;

package/contracts/workers/dvn-fee-lib/src/tests/dvn_fee_lib.rs

@@ -1,18 +1,20 @@
-use crate::dvn_fee_lib::{
-    apply_premium, get_call_data_size, DvnFeeLib, BPS_BASE, EXECUTE_FIXED_BYTES, NATIVE_DECIMALS_RATE, VERIFY_BYTES,
+use crate::test::{
+    apply_premium_for_test, get_call_data_size_for_test, BPS_BASE, EXECUTE_FIXED_BYTES, NATIVE_DECIMALS_RATE,
+    VERIFY_BYTES,
 };
+use crate::DvnFeeLib;
 use fee_lib_interfaces::{DvnFeeParams, FeeEstimate, IDvnFeeLib};
 use soroban_sdk::{contract, contractimpl, testutils::Address as _, Address, Bytes, Env};
 
 #[test]
 fn get_call_data_size_pads_signatures() {
-    let size = get_call_data_size(1);
+    let size = get_call_data_size_for_test(1);
     assert_eq!(size, EXECUTE_FIXED_BYTES + VERIFY_BYTES + 96 + 32);
 
-    let size = get_call_data_size(2);
+    let size = get_call_data_size_for_test(2);
     assert_eq!(size, EXECUTE_FIXED_BYTES + VERIFY_BYTES + 160 + 32);
 
-    let size = get_call_data_size(32);
+    let size = get_call_data_size_for_test(32);
     assert_eq!(size, EXECUTE_FIXED_BYTES + VERIFY_BYTES + 2080 + 32);
 }
 
@@ -22,7 +24,7 @@ fn apply_premium_multiplier_only_both_zero() {
     let fee = 1_000i128;
     let multiplier_bps = 15_000u32;
     // multiplier_bps is non-zero, so default_multiplier_bps is ignored
-    let result = apply_premium(&env, fee, multiplier_bps, 10_000, 0, 0);
+    let result = apply_premium_for_test(&env, fee, multiplier_bps, 10_000, 0, 0);
     assert_eq!(result, fee * multiplier_bps as i128 / BPS_BASE);
 }
 
@@ -31,7 +33,7 @@ fn apply_premium_multiplier_only_native_price_zero() {
     let env = Env::default();
     let fee = 1_000i128;
     let multiplier_bps = 15_000u32;
-    let result = apply_premium(&env, fee, multiplier_bps, 10_000, 100, 0);
+    let result = apply_premium_for_test(&env, fee, multiplier_bps, 10_000, 100, 0);
     assert_eq!(result, fee * multiplier_bps as i128 / BPS_BASE);
 }
 
@@ -40,7 +42,7 @@ fn apply_premium_multiplier_only_floor_margin_zero() {
     let env = Env::default();
     let fee = 1_000i128;
     let multiplier_bps = 15_000u32;
-    let result = apply_premium(&env, fee, multiplier_bps, 10_000, 0, NATIVE_DECIMALS_RATE);
+    let result = apply_premium_for_test(&env, fee, multiplier_bps, 10_000, 0, NATIVE_DECIMALS_RATE);
     assert_eq!(result, fee * multiplier_bps as i128 / BPS_BASE);
 }
 
@@ -50,7 +52,7 @@ fn apply_premium_uses_default_when_multiplier_zero() {
     let fee = 1_000i128;
     let default_bps = 12_000u32;
     // multiplier_bps is 0, so default_multiplier_bps should be used
-    let result = apply_premium(&env, fee, 0, default_bps, 0, 0);
+    let result = apply_premium_for_test(&env, fee, 0, default_bps, 0, 0);
     assert_eq!(result, fee * default_bps as i128 / BPS_BASE);
 }
 
@@ -62,7 +64,7 @@ fn apply_premium_floor_margin_wins() {
     let floor_margin_usd = 10u128;
     let native_price_usd = NATIVE_DECIMALS_RATE;
 
-    let result = apply_premium(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
+    let result = apply_premium_for_test(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
     assert_eq!(result, fee + floor_margin_usd as i128);
 }
 
@@ -74,7 +76,7 @@ fn apply_premium_multiplier_wins_over_small_floor() {
     let floor_margin_usd = 1u128;
     let native_price_usd = NATIVE_DECIMALS_RATE;
 
-    let result = apply_premium(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
+    let result = apply_premium_for_test(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
     assert_eq!(result, 1_200);
 }
 
@@ -281,7 +283,7 @@ fn apply_premium_panics_on_overflow() {
     let env = Env::default();
     let fee = i128::MAX / 2;
     let multiplier_bps = 20_000u32;
-    apply_premium(&env, fee, multiplier_bps, 10_000, u128::MAX, 1);
+    apply_premium_for_test(&env, fee, multiplier_bps, 10_000, u128::MAX, 1);
 }
 
 #[test]
@@ -292,6 +294,6 @@ fn apply_premium_floor_margin_truncates() {
     let floor_margin_usd = 1u128;
     let native_price_usd = NATIVE_DECIMALS_RATE * 3 / 2;
 
-    let result = apply_premium(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
+    let result = apply_premium_for_test(&env, fee, multiplier_bps, 10_000, floor_margin_usd, native_price_usd);
     assert_eq!(result, 0);
 }

package/contracts/workers/executor/Cargo.toml

@@ -26,5 +26,8 @@ endpoint-v2 = { workspace = true, features = ["library"] }
 
 [dev-dependencies]
 soroban-sdk = { workspace = true, features = ["testutils"] }
+rand = { workspace = true }
+ed25519-dalek = { workspace = true }
+utils = { workspace = true, features = ["testutils"] }
 
 

package/contracts/workers/executor/src/executor.rs

@@ -10,14 +10,14 @@ use endpoint_v2::{FeeRecipient, LayerZeroEndpointV2Client, Origin};
 use fee_lib_interfaces::{ExecutorFeeLibClient, FeeParams};
 use message_lib_common::interfaces::ILayerZeroExecutor;
 use soroban_sdk::{token::TokenClient, vec, Address, Bytes, BytesN, Env, Vec};
-use utils::{option_ext::OptionExt, upgradeable::UpgradeableInternal};
+use utils::option_ext::OptionExt;
 use worker::{
     assert_acl, assert_not_paused, assert_supported_message_lib, errors::WorkerError, init_worker, require_admin_auth,
     Worker,
 };
 
 /// LayerZero Executor contract for cross-chain message execution.
-#[lz_contract(upgradeable)]
+#[lz_contract(upgradeable(no_migration))]
 pub struct LzExecutor;
 
 #[contract_impl]
@@ -194,16 +194,6 @@ impl ILayerZeroExecutor for LzExecutor {
 #[contract_impl(contracttrait)]
 impl Worker for LzExecutor {}
 
-// ============================================================================
-// Upgradeable Implementation
-// ============================================================================
-
-/// No migration logic needed for initial upgrade capability
-impl UpgradeableInternal for LzExecutor {
-    type MigrationData = ();
-    fn __migrate(_env: &Env, _migration_data: &Self::MigrationData) {}
-}
-
 // ============================================================================
 // Include SubModules
 // ============================================================================

package/contracts/workers/executor/src/lib.rs

@@ -16,5 +16,5 @@ cfg_if::cfg_if! {
     }
 }
 
-// #[cfg(test)]
-// mod tests;
+#[cfg(test)]
+mod tests;

package/contracts/workers/executor/src/tests/auth.rs

@@ -0,0 +1,394 @@
+use super::setup::{Ed25519KeyPair, TestSetup};
+use crate::auth::ExecutorSignature;
+use crate::errors::ExecutorError;
+use soroban_sdk::auth::{Context, ContractContext, CreateContractHostFnContext};
+use soroban_sdk::testutils::Address as _;
+use soroban_sdk::{vec, Address, BytesN, Env, IntoVal, Symbol, Val, Vec};
+
+fn mk_sig(setup: &TestSetup<'_>, admin_kp: &Ed25519KeyPair, payload: &BytesN<32>) -> ExecutorSignature {
+    ExecutorSignature {
+        public_key: admin_kp.public_key(&setup.env),
+        signature: admin_kp.sign_payload(&setup.env, payload),
+    }
+}
+
+fn contract_ctx(env: &Env, contract: Address, fn_name: &str, args: Vec<Val>) -> Context {
+    Context::Contract(ContractContext { contract, fn_name: Symbol::new(env, fn_name), args })
+}
+
+fn check_auth(
+    setup: &TestSetup<'_>,
+    payload: &BytesN<32>,
+    sig: ExecutorSignature,
+    auth_contexts: &Vec<Context>,
+) -> Result<(), Result<ExecutorError, soroban_sdk::InvokeError>> {
+    setup.env.try_invoke_contract_check_auth::<ExecutorError>(
+        &setup.contract_id,
+        payload,
+        sig.into_val(&setup.env),
+        auth_contexts,
+    )
+}
+
+#[test]
+fn test_check_auth_allows_lz_receive_value_zero_single_context() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    // Executor auth expects `lz_receive`/`lz_compose` contexts and requires the last arg to be `value: i128`.
+    // Use value = 0 so only a single context is required.
+    let args: Vec<Val> = vec![&setup.env, 0i128.into_val(&setup.env)];
+    let oapp = Address::generate(&setup.env);
+    let auth_contexts: Vec<Context> = vec![&setup.env, contract_ctx(&setup.env, oapp, "lz_receive", args)];
+
+    let res = check_auth(&setup, &payload, sig, &auth_contexts);
+    assert!(res.is_ok(), "Expected success, got {:?}", res);
+}
+
+#[test]
+fn test_check_auth_allows_lz_compose_value_zero_single_context() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let args: Vec<Val> = vec![&setup.env, 0i128.into_val(&setup.env)];
+    let composer = Address::generate(&setup.env);
+    let auth_contexts: Vec<Context> = vec![&setup.env, contract_ctx(&setup.env, composer, "lz_compose", args)];
+
+    let res = check_auth(&setup, &payload, sig, &auth_contexts);
+    assert!(res.is_ok(), "Expected success, got {:?}", res);
+}
+
+#[test]
+fn test_check_auth_allows_value_transfer_when_value_nonzero() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let value: i128 = 123;
+    let oapp = Address::generate(&setup.env);
+    let exec_args: Vec<Val> = vec![&setup.env, value.into_val(&setup.env)];
+
+    let from = Address::generate(&setup.env);
+    let to = Address::generate(&setup.env);
+    let transfer_args: Vec<Val> =
+        vec![&setup.env, from.into_val(&setup.env), to.into_val(&setup.env), value.into_val(&setup.env)];
+
+    let auth_contexts: Vec<Context> = vec![
+        &setup.env,
+        contract_ctx(&setup.env, oapp, "lz_receive", exec_args),
+        contract_ctx(&setup.env, setup.native_token.clone(), "transfer", transfer_args),
+    ];
+
+    let res = check_auth(&setup, &payload, sig, &auth_contexts);
+    assert!(res.is_ok(), "Expected success, got {:?}", res);
+}
+
+#[test]
+fn test_check_auth_allows_alert_calls_only_on_endpoint() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let empty_args: Vec<Val> = Vec::new(&setup.env);
+    for fn_name in ["lz_receive_alert", "lz_compose_alert"] {
+        let contexts: Vec<Context> =
+            vec![&setup.env, contract_ctx(&setup.env, setup.endpoint.clone(), fn_name, empty_args.clone())];
+        let res = check_auth(&setup, &payload, sig.clone(), &contexts);
+        assert!(res.is_ok(), "Expected success for {fn_name}, got {:?}", res);
+    }
+}
+
+#[test]
+fn test_check_auth_rejects_signature_mismatch() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let other_kp = Ed25519KeyPair::generate();
+
+    // Admin pubkey is registered, but signature is produced by a different key.
+    let sig = ExecutorSignature {
+        public_key: admin_kp.public_key(&setup.env),
+        signature: other_kp.sign_payload(&setup.env, &payload),
+    };
+
+    let oapp = Address::generate(&setup.env);
+    let args: Vec<Val> = vec![&setup.env, 0i128.into_val(&setup.env)];
+    let contexts: Vec<Context> = vec![&setup.env, contract_ctx(&setup.env, oapp, "lz_receive", args)];
+
+    let res = check_auth(&setup, &payload, sig, &contexts);
+    assert!(matches!(res, Err(Err(_))), "Expected host error, got {:?}", res);
+}
+
+#[test]
+fn test_check_auth_rejects_non_admin() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let oapp = Address::generate(&setup.env);
+    let args: Vec<Val> = vec![&setup.env, 0i128.into_val(&setup.env)];
+    let contexts: Vec<Context> = vec![&setup.env, contract_ctx(&setup.env, oapp, "lz_receive", args)];
+
+    // Unauthorized: signer not in admins list
+    let non_admin_kp = Ed25519KeyPair::generate();
+    let sig = ExecutorSignature {
+        public_key: non_admin_kp.public_key(&setup.env),
+        signature: non_admin_kp.sign_payload(&setup.env, &payload),
+    };
+
+    let res = check_auth(&setup, &payload, sig, &contexts);
+    assert_eq!(res, Err(Ok(ExecutorError::Unauthorized)));
+}
+
+#[test]
+fn test_check_auth_rejects_empty_or_too_many_contexts() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    // Empty contexts
+    let empty: Vec<Context> = Vec::new(&setup.env);
+    assert_eq!(check_auth(&setup, &payload, sig.clone(), &empty), Err(Ok(ExecutorError::UnauthorizedContext)));
+
+    // Too many contexts (>2)
+    let oapp = Address::generate(&setup.env);
+    let args0: Vec<Val> = vec![&setup.env, 0i128.into_val(&setup.env)];
+    let too_many: Vec<Context> = vec![
+        &setup.env,
+        contract_ctx(&setup.env, oapp.clone(), "lz_receive", args0.clone()),
+        contract_ctx(&setup.env, oapp.clone(), "lz_receive", args0.clone()),
+        contract_ctx(&setup.env, oapp, "lz_receive", args0),
+    ];
+    assert_eq!(check_auth(&setup, &payload, sig, &too_many), Err(Ok(ExecutorError::UnauthorizedContext)));
+}
+
+#[test]
+fn test_check_auth_rejects_non_contract_first_context() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let create_ctx: Vec<Context> = vec![
+        &setup.env,
+        Context::CreateContractHostFn(CreateContractHostFnContext {
+            executable: soroban_sdk::auth::ContractExecutable::Wasm(BytesN::from_array(&setup.env, &[2u8; 32])),
+            salt: BytesN::from_array(&setup.env, &[3u8; 32]),
+        }),
+    ];
+    assert_eq!(check_auth(&setup, &payload, sig, &create_ctx), Err(Ok(ExecutorError::UnauthorizedContext)));
+}
+
+#[test]
+fn test_check_auth_rejects_invalid_execute_fn_name() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let oapp = Address::generate(&setup.env);
+    let bad_fn: Vec<Context> =
+        vec![&setup.env, contract_ctx(&setup.env, oapp, "not_allowed", vec![&setup.env, 0i128.into_val(&setup.env)])];
+    assert_eq!(check_auth(&setup, &payload, sig, &bad_fn), Err(Ok(ExecutorError::UnauthorizedContext)));
+}
+
+#[test]
+fn test_check_auth_rejects_invalid_alert_contexts() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let oapp = Address::generate(&setup.env);
+
+    // Alert fn must target endpoint and must be the only context
+    let bad_alert_contract: Vec<Context> =
+        vec![&setup.env, contract_ctx(&setup.env, oapp.clone(), "lz_receive_alert", Vec::new(&setup.env))];
+    assert_eq!(
+        check_auth(&setup, &payload, sig.clone(), &bad_alert_contract),
+        Err(Ok(ExecutorError::UnauthorizedContext))
+    );
+
+    let bad_alert_extra_ctx: Vec<Context> = vec![
+        &setup.env,
+        contract_ctx(&setup.env, setup.endpoint.clone(), "lz_receive_alert", Vec::new(&setup.env)),
+        contract_ctx(&setup.env, oapp, "lz_receive", vec![&setup.env, 0i128.into_val(&setup.env)]),
+    ];
+    assert_eq!(check_auth(&setup, &payload, sig, &bad_alert_extra_ctx), Err(Ok(ExecutorError::UnauthorizedContext)));
+}
+
+#[test]
+fn test_check_auth_rejects_execute_missing_or_wrong_value_type() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let oapp = Address::generate(&setup.env);
+
+    // Execute path requires last arg to be i128 value
+    let missing_value: Vec<Context> =
+        vec![&setup.env, contract_ctx(&setup.env, oapp.clone(), "lz_receive", Vec::new(&setup.env))];
+    assert_eq!(check_auth(&setup, &payload, sig.clone(), &missing_value), Err(Ok(ExecutorError::UnauthorizedContext)));
+
+    let wrong_value_type: Vec<Context> = vec![
+        &setup.env,
+        contract_ctx(
+            &setup.env,
+            oapp,
+            "lz_receive",
+            vec![&setup.env, Symbol::new(&setup.env, "not_i128").into_val(&setup.env)],
+        ),
+    ];
+    assert_eq!(check_auth(&setup, &payload, sig, &wrong_value_type), Err(Ok(ExecutorError::UnauthorizedContext)));
+}
+
+#[test]
+fn test_check_auth_rejects_value_zero_with_extra_context() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let oapp = Address::generate(&setup.env);
+    let value_zero_with_transfer: Vec<Context> = vec![
+        &setup.env,
+        contract_ctx(&setup.env, oapp, "lz_receive", vec![&setup.env, 0i128.into_val(&setup.env)]),
+        contract_ctx(
+            &setup.env,
+            setup.native_token.clone(),
+            "transfer",
+            vec![
+                &setup.env,
+                Address::generate(&setup.env).into_val(&setup.env),
+                Address::generate(&setup.env).into_val(&setup.env),
+                1i128.into_val(&setup.env),
+            ],
+        ),
+    ];
+    assert_eq!(
+        check_auth(&setup, &payload, sig, &value_zero_with_transfer),
+        Err(Ok(ExecutorError::UnauthorizedContext))
+    );
+}
+
+#[test]
+fn test_check_auth_rejects_value_nonzero_missing_transfer_context() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let oapp = Address::generate(&setup.env);
+    let value_nonzero_missing_transfer: Vec<Context> =
+        vec![&setup.env, contract_ctx(&setup.env, oapp, "lz_receive", vec![&setup.env, 1i128.into_val(&setup.env)])];
+    assert_eq!(
+        check_auth(&setup, &payload, sig, &value_nonzero_missing_transfer),
+        Err(Ok(ExecutorError::UnauthorizedContext))
+    );
+}
+
+#[test]
+fn test_check_auth_rejects_invalid_transfer_context() {
+    let env = Env::default();
+    let admin_kp = Ed25519KeyPair::generate();
+    let admin_addr = admin_kp.address(&env);
+    let setup = TestSetup::new_with_env_and_admin(env, &admin_addr);
+
+    let payload = BytesN::from_array(&setup.env, &[1u8; 32]);
+    let sig = mk_sig(&setup, &admin_kp, &payload);
+
+    let oapp = Address::generate(&setup.env);
+    let base_exec: Context = contract_ctx(&setup.env, oapp, "lz_receive", vec![&setup.env, 5i128.into_val(&setup.env)]);
+    let transfer_args: Vec<Val> = vec![
+        &setup.env,
+        Address::generate(&setup.env).into_val(&setup.env),
+        Address::generate(&setup.env).into_val(&setup.env),
+        5i128.into_val(&setup.env),
+    ];
+
+    // Wrong transfer fn name
+    let wrong_transfer_fn: Vec<Context> = vec![
+        &setup.env,
+        base_exec.clone(),
+        contract_ctx(&setup.env, setup.native_token.clone(), "not_transfer", transfer_args.clone()),
+    ];
+    assert_eq!(
+        check_auth(&setup, &payload, sig.clone(), &wrong_transfer_fn),
+        Err(Ok(ExecutorError::UnauthorizedContext))
+    );
+
+    // Wrong transfer contract
+    let wrong_transfer_contract: Vec<Context> = vec![
+        &setup.env,
+        base_exec.clone(),
+        contract_ctx(&setup.env, Address::generate(&setup.env), "transfer", transfer_args.clone()),
+    ];
+    assert_eq!(
+        check_auth(&setup, &payload, sig.clone(), &wrong_transfer_contract),
+        Err(Ok(ExecutorError::UnauthorizedContext))
+    );
+
+    // Wrong transfer amount (must match value)
+    let wrong_transfer_amount: Vec<Context> = vec![
+        &setup.env,
+        base_exec,
+        contract_ctx(
+            &setup.env,
+            setup.native_token.clone(),
+            "transfer",
+            vec![
+                &setup.env,
+                Address::generate(&setup.env).into_val(&setup.env),
+                Address::generate(&setup.env).into_val(&setup.env),
+                6i128.into_val(&setup.env),
+            ],
+        ),
+    ];
+    assert_eq!(check_auth(&setup, &payload, sig, &wrong_transfer_amount), Err(Ok(ExecutorError::UnauthorizedContext)));
+}