@layerzerolabs/protocol-stellar-v2 0.2.28 → 0.2.30

package/contracts/workers/executor-helper/src/tests/setup.rs

@@ -253,7 +253,7 @@ impl MockExecutor {
         origin: &Origin,
         dst_eid: u32,
         oapp: &Address,
-        params: &Vec<NativeDropParams>,
+        native_drop_params: &Vec<NativeDropParams>,
     ) {
         admin.require_auth();
         let record = NativeDropRecord {
@@ -261,7 +261,7 @@ impl MockExecutor {
             origin: origin.clone(),
             dst_eid,
             oapp: oapp.clone(),
-            params: params.clone(),
+            params: native_drop_params.clone(),
         };
         env.storage().instance().set(&Symbol::new(env, "native_drop"), &record);
     }
@@ -278,6 +278,7 @@ impl MockExecutor {
 pub struct TestSetup<'a> {
     pub env: Env,
     pub executor_helper_client: ExecutorHelperClient<'a>,
+    pub executor_helper: Address,
     pub executor: Address,
     pub endpoint: Address,
     pub receiver: Address,
@@ -314,12 +315,13 @@ impl<'a> TestSetup<'a> {
         let admin = Address::generate(&env);
 
         // Register ExecutorHelper contract
-        let contract_id = env.register(ExecutorHelper, ());
-        let client = ExecutorHelperClient::new(&env, &contract_id);
+        let executor_helper = env.register(ExecutorHelper, ());
+        let client = ExecutorHelperClient::new(&env, &executor_helper);
 
         Self {
             env,
             executor_helper_client: client,
+            executor_helper,
             executor,
             endpoint,
             receiver,
@@ -349,37 +351,147 @@ impl<'a> TestSetup<'a> {
     }
 
     pub fn mock_lz_receive_auth(&self, executor: &Address, params: &ExecutionParams) {
-        self.env.mock_auths(&[MockAuth {
-            address: executor,
-            invoke: &MockAuthInvoke {
-                contract: &params.receiver,
-                fn_name: "lz_receive",
-                args: (executor, &params.origin, &params.guid, &params.message, &params.extra_data, &params.value)
-                    .into_val(&self.env),
-                sub_invokes: &[],
-            },
-        }]);
+        if params.value == 0 {
+            // No value transfer - executor auth with lz_receive sub-invoke
+            self.env.mock_auths(&[MockAuth {
+                address: executor,
+                invoke: &MockAuthInvoke {
+                    contract: &self.executor_helper,
+                    fn_name: "execute",
+                    args: (executor, params, &self.admin).into_val(&self.env),
+                    sub_invokes: &[MockAuthInvoke {
+                        contract: &params.receiver,
+                        fn_name: "lz_receive",
+                        args: (
+                            executor,
+                            &params.origin,
+                            &params.guid,
+                            &params.message,
+                            &params.extra_data,
+                            &params.value,
+                        )
+                            .into_val(&self.env),
+                        sub_invokes: &[],
+                    }],
+                },
+            }]);
+        } else {
+            // With value transfer - executor auth with lz_receive and transfer sub-invokes
+            self.env.mock_auths(&[
+                MockAuth {
+                    address: executor,
+                    invoke: &MockAuthInvoke {
+                        contract: &self.executor_helper,
+                        fn_name: "execute",
+                        args: (executor, params, &self.admin).into_val(&self.env),
+                        sub_invokes: &[
+                            MockAuthInvoke {
+                                contract: &params.receiver,
+                                fn_name: "lz_receive",
+                                args: (
+                                    executor,
+                                    &params.origin,
+                                    &params.guid,
+                                    &params.message,
+                                    &params.extra_data,
+                                    &params.value,
+                                )
+                                    .into_val(&self.env),
+                                sub_invokes: &[],
+                            },
+                            MockAuthInvoke {
+                                contract: &self.native_token,
+                                fn_name: "transfer",
+                                args: (&self.admin, executor, &params.value).into_val(&self.env),
+                                sub_invokes: &[],
+                            },
+                        ],
+                    },
+                },
+                MockAuth {
+                    address: &self.admin,
+                    invoke: &MockAuthInvoke {
+                        contract: &self.native_token,
+                        fn_name: "transfer",
+                        args: (&self.admin, executor, &params.value).into_val(&self.env),
+                        sub_invokes: &[],
+                    },
+                },
+            ]);
+        }
     }
 
     pub fn mock_lz_compose_auth(&self, executor: &Address, params: &ComposeParams) {
-        self.env.mock_auths(&[MockAuth {
-            address: executor,
-            invoke: &MockAuthInvoke {
-                contract: &params.to,
-                fn_name: "lz_compose",
-                args: (
-                    executor,
-                    &params.from,
-                    &params.guid,
-                    &params.index,
-                    &params.message,
-                    &params.extra_data,
-                    &params.value,
-                )
-                    .into_val(&self.env),
-                sub_invokes: &[],
-            },
-        }]);
+        if params.value == 0 {
+            // No value transfer - executor auth with lz_compose sub-invoke
+            self.env.mock_auths(&[MockAuth {
+                address: executor,
+                invoke: &MockAuthInvoke {
+                    contract: &self.executor_helper,
+                    fn_name: "compose",
+                    args: (executor, params, &self.admin).into_val(&self.env),
+                    sub_invokes: &[MockAuthInvoke {
+                        contract: &params.to,
+                        fn_name: "lz_compose",
+                        args: (
+                            executor,
+                            &params.from,
+                            &params.guid,
+                            &params.index,
+                            &params.message,
+                            &params.extra_data,
+                            &params.value,
+                        )
+                            .into_val(&self.env),
+                        sub_invokes: &[],
+                    }],
+                },
+            }]);
+        } else {
+            // With value transfer - executor auth with lz_compose and transfer sub-invokes
+            self.env.mock_auths(&[
+                MockAuth {
+                    address: executor,
+                    invoke: &MockAuthInvoke {
+                        contract: &self.executor_helper,
+                        fn_name: "compose",
+                        args: (executor, params, &self.admin).into_val(&self.env),
+                        sub_invokes: &[
+                            MockAuthInvoke {
+                                contract: &params.to,
+                                fn_name: "lz_compose",
+                                args: (
+                                    executor,
+                                    &params.from,
+                                    &params.guid,
+                                    &params.index,
+                                    &params.message,
+                                    &params.extra_data,
+                                    &params.value,
+                                )
+                                    .into_val(&self.env),
+                                sub_invokes: &[],
+                            },
+                            MockAuthInvoke {
+                                contract: &self.native_token,
+                                fn_name: "transfer",
+                                args: (&self.admin, executor, &params.value).into_val(&self.env),
+                                sub_invokes: &[],
+                            },
+                        ],
+                    },
+                },
+                MockAuth {
+                    address: &self.admin,
+                    invoke: &MockAuthInvoke {
+                        contract: &self.native_token,
+                        fn_name: "transfer",
+                        args: (&self.admin, executor, &params.value).into_val(&self.env),
+                        sub_invokes: &[],
+                    },
+                },
+            ]);
+        }
     }
 
     pub fn mock_native_drop_auth(
@@ -389,14 +501,15 @@ impl<'a> TestSetup<'a> {
         origin: &Origin,
         dst_eid: u32,
         oapp: &Address,
-        params: &Vec<NativeDropParams>,
+        native_drop_params: &Vec<NativeDropParams>,
     ) {
+        // native_drop on executor contract only requires admin auth
         self.env.mock_auths(&[MockAuth {
             address: admin,
             invoke: &MockAuthInvoke {
                 contract: executor,
                 fn_name: "native_drop",
-                args: (admin, origin, &dst_eid, oapp, params).into_val(&self.env),
+                args: (admin, origin, &dst_eid, oapp, native_drop_params).into_val(&self.env),
                 sub_invokes: &[],
             },
         }]);

package/contracts/workers/price-feed/src/lib.rs

@@ -1,9 +1,11 @@
 #![no_std]
 
-pub mod errors;
 pub mod events;
 pub mod types;
 
+mod errors;
+pub use errors::*;
+
 cfg_if::cfg_if! {
     // Include implementation when NOT in library mode, OR when testutils is enabled (for tests)
     if #[cfg(any(not(feature = "library"), feature = "testutils"))] {

package/contracts/workers/worker/src/lib.rs

@@ -1,11 +1,12 @@
 #![no_std]
 
-pub mod errors;
 pub mod events;
 pub mod storage;
 
+mod errors;
 mod worker;
 
+pub use errors::*;
 pub use worker::*;
 
 #[cfg(test)]

package/contracts/workers/worker/src/worker.rs

@@ -6,9 +6,9 @@ use crate::{
     },
     storage::WorkerStorage,
 };
-use common_macros::contract_trait;
+use common_macros::{contract_trait, only_auth};
 use soroban_sdk::{assert_with_error, panic_with_error, Address, Env, Vec};
-use utils::auth::{self, Auth};
+use utils::auth::Auth;
 
 /// Worker interface providing common functionality for LayerZero workers.
 ///
@@ -28,10 +28,11 @@ pub trait Worker: Auth {
     ///
     /// # Arguments
     /// * `paused` - `true` to pause, `false` to unpause
+    #[only_auth]
     fn set_paused(env: &soroban_sdk::Env, paused: bool) {
-        let authorizer = auth::enforce_auth::<Self>(env);
         assert_with_error!(env, Self::paused(env) != paused, WorkerError::PauseStatusUnchanged);
 
+        let authorizer = Self::authorizer(env);
         WorkerStorage::set_paused(env, &paused);
         if paused {
             Paused { pauser: authorizer }.publish(env);
@@ -48,8 +49,8 @@ pub trait Worker: Auth {
     /// # Arguments
     /// * `admin` - The address to set admin status for
     /// * `active` - `true` to add admin, `false` to remove
+    #[only_auth]
     fn set_admin(env: &soroban_sdk::Env, admin: &soroban_sdk::Address, active: bool) {
-        auth::require_auth::<Self>(env);
         set_admin_no_auth::<Self>(env, admin, active);
     }
 
@@ -61,8 +62,8 @@ pub trait Worker: Auth {
     /// # Arguments
     /// * `message_lib` - The message library contract address
     /// * `supported` - `true` to add support, `false` to remove support
+    #[only_auth]
     fn set_supported_message_lib(env: &soroban_sdk::Env, message_lib: &soroban_sdk::Address, supported: bool) {
-        auth::require_auth::<Self>(env);
         set_message_lib_no_auth::<Self>(env, message_lib, supported);
     }
 
@@ -75,9 +76,8 @@ pub trait Worker: Auth {
     /// # Arguments
     /// * `oapp` - The OApp contract address
     /// * `allowed` - `true` to add to allowlist, `false` to remove
+    #[only_auth]
     fn set_allowlist(env: &soroban_sdk::Env, oapp: &soroban_sdk::Address, allowed: bool) {
-        auth::require_auth::<Self>(env);
-
         let is_on_list = Self::is_on_allowlist(env, oapp);
         if allowed {
             // Add to allowlist - ensure not already present
@@ -105,8 +105,8 @@ pub trait Worker: Auth {
     /// # Arguments
     /// * `oapp` - The OApp contract address
     /// * `denied` - `true` to add to denylist, `false` to remove
+    #[only_auth]
     fn set_denylist(env: &soroban_sdk::Env, oapp: &soroban_sdk::Address, denied: bool) {
-        auth::require_auth::<Self>(env);
         let is_on_list = Self::is_on_denylist(env, oapp);
 
         if denied {
@@ -151,8 +151,7 @@ pub trait Worker: Auth {
         deposit_address: &soroban_sdk::Address,
     ) {
         require_admin_auth::<Self>(env, admin);
-        WorkerStorage::set_deposit_address(env, deposit_address);
-        SetDepositAddress { deposit_address: deposit_address.clone() }.publish(env);
+        set_deposit_address_no_auth(env, deposit_address);
     }
 
     /// Sets supported executor option types for a destination endpoint.
@@ -181,8 +180,7 @@ pub trait Worker: Auth {
     /// * `worker_fee_lib` - Fee library contract address implementing `IExecutorFeeLib`
     fn set_worker_fee_lib(env: &soroban_sdk::Env, admin: &soroban_sdk::Address, worker_fee_lib: &soroban_sdk::Address) {
         require_admin_auth::<Self>(env, admin);
-        WorkerStorage::set_worker_fee_lib(env, worker_fee_lib);
-        SetWorkerFeeLib { fee_lib: worker_fee_lib.clone() }.publish(env);
+        set_worker_fee_lib_no_auth(env, worker_fee_lib);
     }
 
     /// Sets the price feed contract address.
@@ -195,8 +193,7 @@ pub trait Worker: Auth {
     /// * `price_feed` - Price feed contract address implementing `ILayerZeroPriceFeed`
     fn set_price_feed(env: &soroban_sdk::Env, admin: &soroban_sdk::Address, price_feed: &soroban_sdk::Address) {
         require_admin_auth::<Self>(env, admin);
-        WorkerStorage::set_price_feed(env, price_feed);
-        SetPriceFeed { price_feed: price_feed.clone() }.publish(env);
+        set_price_feed_no_auth(env, price_feed);
     }
 
     // ========================================================================
@@ -329,9 +326,8 @@ pub fn init_worker<T: Worker>(
 
     set_price_feed_no_auth(env, price_feed);
     set_default_multiplier_bps_no_auth(env, default_multiplier_bps);
-
-    WorkerStorage::set_worker_fee_lib(env, worker_fee_lib);
-    WorkerStorage::set_deposit_address(env, deposit_address);
+    set_worker_fee_lib_no_auth(env, worker_fee_lib);
+    set_deposit_address_no_auth(env, deposit_address);
 }
 
 // ============================================================================================
@@ -449,6 +445,24 @@ fn set_message_lib_no_auth<T: Worker>(env: &Env, message_lib: &Address, supporte
     SetSupportedMessageLib { message_lib: message_lib.clone(), supported }.publish(env);
 }
 
+/// Sets the deposit address without authentication.
+///
+/// # Arguments
+/// * `deposit_address` - Address to receive collected fees
+fn set_deposit_address_no_auth(env: &Env, deposit_address: &Address) {
+    WorkerStorage::set_deposit_address(env, deposit_address);
+    SetDepositAddress { deposit_address: deposit_address.clone() }.publish(env);
+}
+
+/// Sets the worker fee library contract address without authentication.
+///
+/// # Arguments
+/// * `worker_fee_lib` - Fee library contract address
+fn set_worker_fee_lib_no_auth(env: &Env, worker_fee_lib: &Address) {
+    WorkerStorage::set_worker_fee_lib(env, worker_fee_lib);
+    SetWorkerFeeLib { fee_lib: worker_fee_lib.clone() }.publish(env);
+}
+
 /// Sets the price feed contract address without authentication.
 ///
 /// # Arguments

package/docs/oapp-guide.md

@@ -40,8 +40,11 @@ impl LzReceiveInternal for MyOApp {
 
 The macro automatically generates:
 
-- `#[contract]` attribute
-- `#[ownable]` trait implementation
+- `#[common_macros::lz_contract]` attribute, which combines:
+    - `#[soroban_sdk::contract]` — makes the struct a Soroban contract
+    - `#[common_macros::ownable]` — adds single-owner access control
+    - `#[common_macros::ttl_configurable]` — adds TTL configuration with auth
+    - `#[common_macros::ttl_extendable]` — adds manual TTL extension support
 - `OAppCore` implementation
 - `OAppSenderInternal` implementation
 - `OAppReceiver` implementation
@@ -57,7 +60,7 @@ use oapp::oapp_core::initialize_oapp;
 #[contract_impl]
 impl MyOApp {
     pub fn __constructor(env: &Env, owner: &Address, endpoint: &Address, delegate: &Address) {
-        initialize_oapp::<Self>(env, owner, endpoint, &Some(delegate.clone()));
+        initialize_oapp::<Self>(env, owner, endpoint, delegate);
     }
 }
 ```
@@ -66,7 +69,7 @@ The `initialize_oapp` function:
 
 1. Sets the contract owner
 2. Stores the LayerZero endpoint address
-3. Optionally sets a delegate on the endpoint
+3. Sets a delegate on the endpoint
 
 ## Peer management
 
@@ -90,14 +93,15 @@ Peers are stored as `BytesN<32>` to maintain cross-chain address compatibility.
 Use the internal sender methods to send cross-chain messages:
 
 ```rust
-use oapp::oapp_sender::OAppSenderInternal;
+use oapp::oapp_sender::{FeePayer, OAppSenderInternal};
 
 impl MyOApp {
     pub fn send_message(env: &Env, caller: &Address, dst_eid: u32, message: &Bytes, options: &Bytes, fee: &MessagingFee) {
         caller.require_auth();
 
-        // Send the message (handles fee payment automatically)
-        Self::__lz_send(env, dst_eid, message, options, caller, fee, caller);
+        // Send the message — caller already authorized, use FeePayer::Verified to avoid
+        // a duplicate require_auth() node in the Soroban auth tree.
+        Self::__lz_send(env, dst_eid, message, options, &FeePayer::Verified(caller.clone()), fee, caller);
     }
 
     pub fn quote(env: &Env, dst_eid: u32, message: &Bytes, options: &Bytes, pay_in_zro: bool) -> MessagingFee {
@@ -106,7 +110,12 @@ impl MyOApp {
 }
 ```
 
-The `__lz_send` method:
+The `__lz_send` method accepts a [`FeePayer`] enum that indicates authorization state:
+
+- `FeePayer::Unverified(addr)` — Safe default. `__lz_send` will call `addr.require_auth()`.
+- `FeePayer::Verified(addr)` — Caller already called `require_auth()` on this address.
+
+The method then:
 
 1. Transfers the native fee from the payer to the endpoint
 2. Transfers the ZRO fee if applicable

package/docs/oft-guide.md

@@ -107,10 +107,10 @@ impl MyOFT {
         token: &Address,
         owner: &Address,
         endpoint: &Address,
-        delegate: &Option<Address>,
+        delegate: &Address,
     ) {
         // shared_decimals = 6 is common for cross-chain compatibility
-        Self::__initialize_oft(env, owner, token, endpoint, delegate, 6);
+        Self::__initialize_oft(env, token, 6, owner, endpoint, delegate);
     }
 }
 
@@ -159,7 +159,7 @@ Receive: 1_500_000 shared → 1.5 tokens in local decimals
 
 ```rust
 // 1. Quote the transfer
-let (limit, fee_details, receipt) = oft.quote_oft(&send_param);
+let (limit, fee_details, receipt) = oft.quote_oft(&from, &send_param);
 
 // 2. Quote LayerZero fees
 let messaging_fee = oft.quote_send(&from, &send_param, false);

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@layerzerolabs/protocol-stellar-v2",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "private": false,
   "devDependencies": {
     "@types/node": "^22.18.6",
     "tsx": "^4.19.3",
     "typescript": "^5.8.2",
-    "@layerzerolabs/common-node-utils": "0.2.28",
-    "@layerzerolabs/vm-tooling-stellar": "0.2.28"
+    "@layerzerolabs/common-node-utils": "0.2.30",
+    "@layerzerolabs/vm-tooling-stellar": "0.2.30"
   },
   "publishConfig": {
     "access": "restricted",