@sudobility/contracts 1.16.4 → 1.17.10

package/programs/mailer/src/lib.rs

@@ -12,10 +12,11 @@
 //!
 //! ## Program Architecture
 //!
-//! The program uses Program Derived Addresses (PDAs) for:
-//! - Mailer state: `[b"mailer"]`
-//! - Recipient claims: `[b"claim", recipient.key()]`
-//! - Delegations: `[b"delegation", delegator.key()]`
+//! The program uses Program Derived Addresses (PDAs) with version byte for future-proofing:
+//! - Mailer state: `[b"mailer"]` (no version - global singleton)
+//! - Recipient claims: `[b"claim", &[1], recipient.key()]` (v1)
+//! - Delegations: `[b"delegation", &[1], delegator.key()]` (v1)
+//! - Fee discounts: `[b"discount", &[1], account.key()]` (v1)
 //!
 //! ## Fee Structure
 //!
@@ -54,6 +55,14 @@ const DELEGATION_FEE: u64 = 10_000_000;
 /// Claim period for revenue shares: 60 days in seconds
 const CLAIM_PERIOD: i64 = 60 * 24 * 60 * 60;
 
+/// PDA version byte for forward compatibility
+/// Allows future upgrades to use different PDA structures without collision
+const PDA_VERSION: u8 = 1;
+
+// CPI module for cross-program invocations
+#[cfg(feature = "cpi")]
+pub mod cpi;
+
 #[cfg(not(feature = "no-entrypoint"))]
 solana_program::entrypoint!(process_instruction);
 
@@ -72,6 +81,19 @@ pub struct MailerState {
 
 impl MailerState {
     pub const LEN: usize = 32 + 32 + 8 + 8 + 8 + 1 + 1 + 1; // 91 bytes
+
+    pub fn increase_owner_claimable(&mut self, amount: u64) -> Result<(), ProgramError> {
+        if amount == 0 {
+            return Ok(());
+        }
+
+        self.owner_claimable = self
+            .owner_claimable
+            .checked_add(amount)
+            .ok_or(MailerError::MathOverflow)?;
+
+        Ok(())
+    }
 }
 
 /// Recipient claim account (optimized for smaller rent cost)
@@ -125,6 +147,9 @@ pub enum MailerInstruction {
     Initialize { usdc_mint: Pubkey },
 
     /// Send message with optional revenue sharing
+    /// SOFT-FAIL BEHAVIOR: Does not revert on fee payment failure. No log message emitted if payment fails.
+    /// This design allows composability - calling programs won't fail if message sending fails.
+    /// Monitor program logs: if transaction succeeds but no log appears, message was dropped due to fee failure.
     /// Accounts:
     /// 0. `[signer]` Sender
     /// 1. `[writable]` Recipient claim account (PDA)
@@ -142,6 +167,7 @@ pub enum MailerInstruction {
     },
 
     /// Send prepared message with optional revenue sharing (references off-chain content via mailId)
+    /// SOFT-FAIL BEHAVIOR: Does not revert on fee payment failure. See Send instruction for details.
     /// Accounts:
     /// 0. `[signer]` Sender
     /// 1. `[writable]` Recipient claim account (PDA)
@@ -159,6 +185,7 @@ pub enum MailerInstruction {
 
     /// Send message to email address (no wallet address known)
     /// Charges only 10% owner fee since recipient wallet is unknown
+    /// SOFT-FAIL BEHAVIOR: Does not revert on fee payment failure. See Send instruction for details.
     /// Accounts:
     /// 0. `[signer]` Sender
     /// 1. `[]` Mailer state account (PDA)
@@ -173,6 +200,7 @@ pub enum MailerInstruction {
 
     /// Send prepared message to email address (no wallet address known)
     /// Charges only 10% owner fee since recipient wallet is unknown
+    /// SOFT-FAIL BEHAVIOR: Does not revert on fee payment failure. See Send instruction for details.
     /// Accounts:
     /// 0. `[signer]` Sender
     /// 1. `[]` Mailer state account (PDA)
@@ -182,6 +210,7 @@ pub enum MailerInstruction {
     SendPreparedToEmail { to_email: String, mail_id: String },
 
     /// Send message through webhook (referenced by webhookId)
+    /// SOFT-FAIL BEHAVIOR: Does not revert on fee payment failure. See Send instruction for details.
     /// Accounts:
     /// 0. `[signer]` Sender
     /// 1. `[writable]` Recipient claim account (PDA)
@@ -198,6 +227,9 @@ pub enum MailerInstruction {
     },
 
     /// Claim recipient share
+    /// TIMESTAMP DEPENDENCY: Uses Clock::get()?.unix_timestamp for expiration checks (60 days).
+    /// Validators can manipulate timestamps by ±30 seconds or more. Claims near the deadline
+    /// have a small risk of denial. Recommended: Claim well before the 60-day deadline.
     /// Accounts:
     /// 0. `[signer]` Recipient
     /// 1. `[writable]` Recipient claim account (PDA)
@@ -217,12 +249,20 @@ pub enum MailerInstruction {
     ClaimOwnerShare,
 
     /// Set send fee (owner only)
+    /// WARNING: Fee changes take effect IMMEDIATELY with no time delay or notification.
+    /// This allows quick response to market conditions but requires user trust.
+    ///   - No maximum fee cap enforced
+    ///   - Users with pending transactions may pay different fees than expected
+    ///   - Monitor program logs for FeeUpdated events
+    ///
     /// Accounts:
     /// 0. `[signer]` Owner
     /// 1. `[writable]` Mailer state account (PDA)
     SetFee { new_fee: u64 },
 
     /// Delegate to another address
+    /// WARNING: Delegation fee is NON-REFUNDABLE, even if the delegate rejects the delegation.
+    /// The fee is an anti-spam measure and goes to the contract owner regardless of delegation outcome.
     /// Accounts:
     /// 0. `[signer]` Delegator
     /// 1. `[writable]` Delegation account (PDA)
@@ -234,6 +274,8 @@ pub enum MailerInstruction {
     DelegateTo { delegate: Option<Pubkey> },
 
     /// Reject delegation
+    /// NOTE: Rejecting a delegation does NOT refund the delegation fee paid by the delegator.
+    /// The fee is an anti-spam measure and is non-refundable by design.
     /// Accounts:
     /// 0. `[signer]` Rejector
     /// 1. `[writable]` Delegation account (PDA)
@@ -241,6 +283,8 @@ pub enum MailerInstruction {
     RejectDelegation,
 
     /// Set delegation fee (owner only)
+    /// WARNING: Fee changes take effect IMMEDIATELY with no time delay.
+    /// See SetFee instruction for detailed implications of instant fee changes.
     /// Accounts:
     /// 0. `[signer]` Owner
     /// 1. `[writable]` Mailer state account (PDA)
@@ -346,6 +390,8 @@ pub enum MailerError {
     ContractNotPaused,
     #[error("Invalid percentage (must be 0-100)")]
     InvalidPercentage,
+    #[error("Math overflow")]
+    MathOverflow,
 }
 
 impl From<MailerError> for ProgramError {
@@ -557,12 +603,15 @@ fn process_send(
         calculate_fee_with_discount(program_id, sender.key, accounts, mailer_state.send_fee)?
     };
 
+    // Track whether fee was paid successfully
+    let fee_paid: bool;
+
     if revenue_share_to_receiver {
         // Priority mode: full fee with revenue sharing
 
         // Create or load recipient claim account
         let (claim_pda, claim_bump) =
-            Pubkey::find_program_address(&[b"claim", to.as_ref()], program_id);
+            Pubkey::find_program_address(&[b"claim", &[PDA_VERSION], to.as_ref()], program_id);
 
         if recipient_claim.key != &claim_pda {
             return Err(MailerError::InvalidPDA.into());
@@ -587,9 +636,19 @@ fn process_send(
                     recipient_claim.clone(),
                     system_program.clone(),
                 ],
-                &[&[b"claim", to.as_ref(), &[claim_bump]]],
+                &[&[b"claim", &[PDA_VERSION], to.as_ref(), &[claim_bump]]],
             )?;
 
+            // Verify account is rent-exempt
+            let account_lamports = recipient_claim.lamports();
+            if !rent.is_exempt(account_lamports, space) {
+                msg!("ERROR: Recipient claim account not rent-exempt! {} lamports for {} bytes",
+                     account_lamports, space);
+                return Err(ProgramError::InsufficientFunds);
+            }
+            msg!("Created rent-exempt recipient claim account: {} lamports for {} bytes",
+                 account_lamports, space);
+
             // Initialize claim account
             let mut claim_data = recipient_claim.try_borrow_mut_data()?;
             claim_data[0..8]
@@ -606,8 +665,7 @@ fn process_send(
             drop(claim_data);
         }
 
-        // Transfer effective fee (may be discounted)
-        // If transfer fails, silently fail without emitting event
+        // Transfer effective fee (may be discounted) and track success
         if effective_fee > 0 {
             let transfer_result = invoke(
                 &spl_token::instruction::transfer(
@@ -626,24 +684,24 @@ fn process_send(
                 ],
             );
 
-            // If transfer fails, return Ok without logging
+            // Check if transfer succeeded
             if transfer_result.is_err() {
-                return Ok(());
-            }
-
-            // Record revenue shares (only if fee > 0 and transfer succeeded)
-            if record_shares(recipient_claim, mailer_account, to, effective_fee).is_err() {
-                return Ok(());
+                fee_paid = false;
+            } else {
+                // Record revenue shares (only if fee > 0 and transfer succeeded)
+                fee_paid = record_shares(recipient_claim, mailer_account, to, effective_fee).is_ok();
             }
+        } else {
+            fee_paid = true; // No fee required
         }
 
-        msg!("Priority mail sent from {} to {}: {} (revenue share enabled, resolve sender: {}, effective fee: {})", sender.key, to, subject, _resolve_sender_to_name, effective_fee);
+        // Always log the message with fee_paid status
+        msg!("Priority mail sent from {} to {}: {} (revenue share enabled, resolve sender: {}, effective fee: {}, fee paid: {})", sender.key, to, subject, _resolve_sender_to_name, effective_fee, fee_paid);
     } else {
         // Standard mode: 10% fee only, no revenue sharing
         let owner_fee = (effective_fee * 10) / 100; // 10% of effective fee
 
-        // Transfer only owner fee (10%)
-        // If transfer fails, silently fail without emitting event
+        // Transfer only owner fee (10%) and track success
         if owner_fee > 0 {
             let transfer_result = invoke(
                 &spl_token::instruction::transfer(
@@ -662,25 +720,29 @@ fn process_send(
                 ],
             );
 
-            // If transfer fails, return Ok without logging
-            if transfer_result.is_err() {
-                return Ok(());
-            }
+            // Check if transfer succeeded
+            fee_paid = transfer_result.is_ok();
+        } else {
+            fee_paid = true; // No fee required
         }
 
-        // Update owner claimable
-        let mut mailer_data = mailer_account.try_borrow_mut_data()?;
-        let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
-        mailer_state.owner_claimable += owner_fee;
-        mailer_state.serialize(&mut &mut mailer_data[8..])?;
+        // Update owner claimable only if fee was paid
+        if fee_paid && owner_fee > 0 {
+            let mut mailer_data = mailer_account.try_borrow_mut_data()?;
+            let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
+            mailer_state.increase_owner_claimable(owner_fee)?;
+            mailer_state.serialize(&mut &mut mailer_data[8..])?;
+        }
 
+        // Always log the message with fee_paid status
         msg!(
-            "Standard mail sent from {} to {}: {} (resolve sender: {}, effective fee: {})",
+            "Standard mail sent from {} to {}: {} (resolve sender: {}, effective fee: {}, fee paid: {})",
             sender.key,
             to,
             subject,
             _resolve_sender_to_name,
-            effective_fee
+            effective_fee,
+            fee_paid
         );
     }
 
@@ -731,12 +793,15 @@ fn process_send_prepared(
         calculate_fee_with_discount(program_id, sender.key, accounts, mailer_state.send_fee)?
     };
 
+    // Track whether fee was paid successfully
+    let fee_paid: bool;
+
     if revenue_share_to_receiver {
         // Priority mode: full fee with revenue sharing
 
         // Create or load recipient claim account
         let (claim_pda, claim_bump) =
-            Pubkey::find_program_address(&[b"claim", to.as_ref()], program_id);
+            Pubkey::find_program_address(&[b"claim", &[PDA_VERSION], to.as_ref()], program_id);
 
         if recipient_claim.key != &claim_pda {
             return Err(MailerError::InvalidPDA.into());
@@ -761,9 +826,19 @@ fn process_send_prepared(
                     recipient_claim.clone(),
                     system_program.clone(),
                 ],
-                &[&[b"claim", to.as_ref(), &[claim_bump]]],
+                &[&[b"claim", &[PDA_VERSION], to.as_ref(), &[claim_bump]]],
             )?;
 
+            // Verify account is rent-exempt
+            let account_lamports = recipient_claim.lamports();
+            if !rent.is_exempt(account_lamports, space) {
+                msg!("ERROR: Recipient claim account not rent-exempt! {} lamports for {} bytes",
+                     account_lamports, space);
+                return Err(ProgramError::InsufficientFunds);
+            }
+            msg!("Created rent-exempt recipient claim account: {} lamports for {} bytes",
+                 account_lamports, space);
+
             // Initialize claim account
             let mut claim_data = recipient_claim.try_borrow_mut_data()?;
             claim_data[0..8]
@@ -780,7 +855,7 @@ fn process_send_prepared(
             drop(claim_data);
         }
 
-        // Transfer effective fee (may be discounted)
+        // Transfer effective fee (may be discounted) and track success
         if effective_fee > 0 {
             let transfer_result = invoke(
                 &spl_token::instruction::transfer(
@@ -799,22 +874,24 @@ fn process_send_prepared(
                 ],
             );
 
+            // Check if transfer succeeded
             if transfer_result.is_err() {
-                return Ok(());
-            }
-
-            // Record revenue shares (only if fee > 0)
-            if record_shares(recipient_claim, mailer_account, to, effective_fee).is_err() {
-                return Ok(());
+                fee_paid = false;
+            } else {
+                // Record revenue shares (only if fee > 0 and transfer succeeded)
+                fee_paid = record_shares(recipient_claim, mailer_account, to, effective_fee).is_ok();
             }
+        } else {
+            fee_paid = true; // No fee required
         }
 
-        msg!("Priority prepared mail sent from {} to {} (mailId: {}, revenue share enabled, resolve sender: {}, effective fee: {})", sender.key, to, mail_id, _resolve_sender_to_name, effective_fee);
+        // Always log the message with fee_paid status
+        msg!("Priority prepared mail sent from {} to {} (mailId: {}, revenue share enabled, resolve sender: {}, effective fee: {}, fee paid: {})", sender.key, to, mail_id, _resolve_sender_to_name, effective_fee, fee_paid);
     } else {
         // Standard mode: 10% fee only, no revenue sharing
         let owner_fee = (effective_fee * 10) / 100; // 10% of effective fee
 
-        // Transfer only owner fee (10%)
+        // Transfer only owner fee (10%) and track success
         if owner_fee > 0 {
             let transfer_result = invoke(
                 &spl_token::instruction::transfer(
@@ -833,24 +910,29 @@ fn process_send_prepared(
                 ],
             );
 
-            if transfer_result.is_err() {
-                return Ok(());
-            }
+            // Check if transfer succeeded
+            fee_paid = transfer_result.is_ok();
+        } else {
+            fee_paid = true; // No fee required
         }
 
-        // Update owner claimable
-        let mut mailer_data = mailer_account.try_borrow_mut_data()?;
-        let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
-        mailer_state.owner_claimable += owner_fee;
-        mailer_state.serialize(&mut &mut mailer_data[8..])?;
+        // Update owner claimable only if fee was paid
+        if fee_paid && owner_fee > 0 {
+            let mut mailer_data = mailer_account.try_borrow_mut_data()?;
+            let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
+            mailer_state.increase_owner_claimable(owner_fee)?;
+            mailer_state.serialize(&mut &mut mailer_data[8..])?;
+        }
 
+        // Always log the message with fee_paid status
         msg!(
-            "Standard prepared mail sent from {} to {} (mailId: {}, resolve sender: {}, effective fee: {})",
+            "Standard prepared mail sent from {} to {} (mailId: {}, resolve sender: {}, effective fee: {}, fee paid: {})",
             sender.key,
             to,
             mail_id,
             _resolve_sender_to_name,
-            effective_fee
+            effective_fee,
+            fee_paid
         );
     }
 
@@ -901,8 +983,8 @@ fn process_send_to_email(
     // Calculate 10% owner fee (no revenue share since no wallet address)
     let owner_fee = (effective_fee * 10) / 100;
 
-    // Transfer fee from sender to mailer
-    if owner_fee > 0 {
+    // Transfer fee from sender to mailer and track success
+    let fee_paid: bool = if owner_fee > 0 {
         let transfer_ix = spl_token::instruction::transfer(
             token_program.key,
             sender_usdc.key,
@@ -922,23 +1004,28 @@ fn process_send_to_email(
             ],
         );
 
-        if transfer_result.is_err() {
-            return Ok(());
-        }
-    }
+        // Check if transfer succeeded
+        transfer_result.is_ok()
+    } else {
+        true // No fee required
+    };
 
-    // Update owner claimable
-    let mut mailer_data = mailer_account.try_borrow_mut_data()?;
-    let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
-    mailer_state.owner_claimable += owner_fee;
-    mailer_state.serialize(&mut &mut mailer_data[8..])?;
+    // Update owner claimable only if fee was paid
+    if fee_paid && owner_fee > 0 {
+        let mut mailer_data = mailer_account.try_borrow_mut_data()?;
+        let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
+        mailer_state.increase_owner_claimable(owner_fee)?;
+        mailer_state.serialize(&mut &mut mailer_data[8..])?;
+    }
 
+    // Always log the message with fee_paid status
     msg!(
-        "Mail sent from {} to email {}: {} (effective fee: {})",
+        "Mail sent from {} to email {}: {} (effective fee: {}, fee paid: {})",
         sender.key,
         to_email,
         subject,
-        effective_fee
+        effective_fee,
+        fee_paid
     );
 
     Ok(())
@@ -987,8 +1074,8 @@ fn process_send_prepared_to_email(
     // Calculate 10% owner fee (no revenue share since no wallet address)
     let owner_fee = (effective_fee * 10) / 100;
 
-    // Transfer fee from sender to mailer
-    if owner_fee > 0 {
+    // Transfer fee from sender to mailer and track success
+    let fee_paid: bool = if owner_fee > 0 {
         let transfer_ix = spl_token::instruction::transfer(
             token_program.key,
             sender_usdc.key,
@@ -1008,23 +1095,28 @@ fn process_send_prepared_to_email(
             ],
         );
 
-        if transfer_result.is_err() {
-            return Ok(());
-        }
-    }
+        // Check if transfer succeeded
+        transfer_result.is_ok()
+    } else {
+        true // No fee required
+    };
 
-    // Update owner claimable
-    let mut mailer_data = mailer_account.try_borrow_mut_data()?;
-    let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
-    mailer_state.owner_claimable += owner_fee;
-    mailer_state.serialize(&mut &mut mailer_data[8..])?;
+    // Update owner claimable only if fee was paid
+    if fee_paid && owner_fee > 0 {
+        let mut mailer_data = mailer_account.try_borrow_mut_data()?;
+        let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
+        mailer_state.increase_owner_claimable(owner_fee)?;
+        mailer_state.serialize(&mut &mut mailer_data[8..])?;
+    }
 
+    // Always log the message with fee_paid status
     msg!(
-        "Prepared mail sent from {} to email {} (mailId: {}, effective fee: {})",
+        "Prepared mail sent from {} to email {} (mailId: {}, effective fee: {}, fee paid: {})",
         sender.key,
         to_email,
         mail_id,
-        effective_fee
+        effective_fee,
+        fee_paid
     );
 
     Ok(())
@@ -1074,12 +1166,15 @@ fn process_send_through_webhook(
         calculate_fee_with_discount(program_id, sender.key, accounts, mailer_state.send_fee)?
     };
 
+    // Track whether fee was paid successfully
+    let fee_paid: bool;
+
     if revenue_share_to_receiver {
         // Priority mode: full fee with revenue sharing
 
         // Create or load recipient claim account
         let (claim_pda, claim_bump) =
-            Pubkey::find_program_address(&[b"claim", to.as_ref()], program_id);
+            Pubkey::find_program_address(&[b"claim", &[PDA_VERSION], to.as_ref()], program_id);
 
         if recipient_claim.key != &claim_pda {
             return Err(MailerError::InvalidPDA.into());
@@ -1104,9 +1199,19 @@ fn process_send_through_webhook(
                     recipient_claim.clone(),
                     system_program.clone(),
                 ],
-                &[&[b"claim", to.as_ref(), &[claim_bump]]],
+                &[&[b"claim", &[PDA_VERSION], to.as_ref(), &[claim_bump]]],
             )?;
 
+            // Verify account is rent-exempt
+            let account_lamports = recipient_claim.lamports();
+            if !rent.is_exempt(account_lamports, space) {
+                msg!("ERROR: Recipient claim account not rent-exempt! {} lamports for {} bytes",
+                     account_lamports, space);
+                return Err(ProgramError::InsufficientFunds);
+            }
+            msg!("Created rent-exempt recipient claim account: {} lamports for {} bytes",
+                 account_lamports, space);
+
             // Initialize claim account
             let mut claim_data = recipient_claim.try_borrow_mut_data()?;
             claim_data[0..8]
@@ -1123,7 +1228,7 @@ fn process_send_through_webhook(
             drop(claim_data);
         }
 
-        // Transfer effective fee (may be discounted)
+        // Transfer effective fee (may be discounted) and track success
         if effective_fee > 0 {
             let transfer_result = invoke(
                 &spl_token::instruction::transfer(
@@ -1142,22 +1247,24 @@ fn process_send_through_webhook(
                 ],
             );
 
+            // Check if transfer succeeded
             if transfer_result.is_err() {
-                return Ok(());
-            }
-
-            // Record revenue shares (only if fee > 0)
-            if record_shares(recipient_claim, mailer_account, to, effective_fee).is_err() {
-                return Ok(());
+                fee_paid = false;
+            } else {
+                // Record revenue shares (only if fee > 0 and transfer succeeded)
+                fee_paid = record_shares(recipient_claim, mailer_account, to, effective_fee).is_ok();
             }
+        } else {
+            fee_paid = true; // No fee required
         }
 
-        msg!("Webhook mail sent from {} to {} (webhookId: {}, revenue share enabled, resolve sender: {}, effective fee: {})", sender.key, to, webhook_id, _resolve_sender_to_name, effective_fee);
+        // Always log the message with fee_paid status
+        msg!("Webhook mail sent from {} to {} (webhookId: {}, revenue share enabled, resolve sender: {}, effective fee: {}, fee paid: {})", sender.key, to, webhook_id, _resolve_sender_to_name, effective_fee, fee_paid);
     } else {
         // Standard mode: 10% fee only, no revenue sharing
         let owner_fee = (effective_fee * 10) / 100; // 10% of effective fee
 
-        // Transfer only owner fee (10%)
+        // Transfer only owner fee (10%) and track success
         if owner_fee > 0 {
             let transfer_result = invoke(
                 &spl_token::instruction::transfer(
@@ -1176,24 +1283,29 @@ fn process_send_through_webhook(
                 ],
             );
 
-            if transfer_result.is_err() {
-                return Ok(());
-            }
+            // Check if transfer succeeded
+            fee_paid = transfer_result.is_ok();
+        } else {
+            fee_paid = true; // No fee required
         }
 
-        // Update owner claimable
-        let mut mailer_data = mailer_account.try_borrow_mut_data()?;
-        let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
-        mailer_state.owner_claimable += owner_fee;
-        mailer_state.serialize(&mut &mut mailer_data[8..])?;
+        // Update owner claimable only if fee was paid
+        if fee_paid && owner_fee > 0 {
+            let mut mailer_data = mailer_account.try_borrow_mut_data()?;
+            let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
+            mailer_state.increase_owner_claimable(owner_fee)?;
+            mailer_state.serialize(&mut &mut mailer_data[8..])?;
+        }
 
+        // Always log the message with fee_paid status
         msg!(
-            "Webhook mail sent from {} to {} (webhookId: {}, resolve sender: {}, effective fee: {})",
+            "Webhook mail sent from {} to {} (webhookId: {}, resolve sender: {}, effective fee: {}, fee paid: {})",
             sender.key,
             to,
             webhook_id,
             _resolve_sender_to_name,
-            effective_fee
+            effective_fee,
+            fee_paid
         );
     }
 
@@ -1216,7 +1328,7 @@ fn process_claim_recipient_share(_program_id: &Pubkey, accounts: &[AccountInfo])
 
     let (mailer_pda, _) = assert_mailer_account(_program_id, mailer_account)?;
     let (claim_pda, _) =
-        Pubkey::find_program_address(&[b"claim", recipient.key.as_ref()], _program_id);
+        Pubkey::find_program_address(&[b"claim", &[PDA_VERSION], recipient.key.as_ref()], _program_id);
     if recipient_claim.key != &claim_pda {
         return Err(MailerError::InvalidPDA.into());
     }
@@ -1405,7 +1517,7 @@ fn process_delegate_to(
 
     // Verify delegation account PDA
     let (delegation_pda, delegation_bump) =
-        Pubkey::find_program_address(&[b"delegation", delegator.key.as_ref()], program_id);
+        Pubkey::find_program_address(&[b"delegation", &[PDA_VERSION], delegator.key.as_ref()], program_id);
 
     if delegation_account.key != &delegation_pda {
         return Err(MailerError::InvalidPDA.into());
@@ -1430,9 +1542,19 @@ fn process_delegate_to(
                 delegation_account.clone(),
                 system_program.clone(),
             ],
-            &[&[b"delegation", delegator.key.as_ref(), &[delegation_bump]]],
+            &[&[b"delegation", &[PDA_VERSION], delegator.key.as_ref(), &[delegation_bump]]],
         )?;
 
+        // Verify account is rent-exempt
+        let account_lamports = delegation_account.lamports();
+        if !rent.is_exempt(account_lamports, space) {
+            msg!("ERROR: Delegation account not rent-exempt! {} lamports for {} bytes",
+                 account_lamports, space);
+            return Err(ProgramError::InsufficientFunds);
+        }
+        msg!("Created rent-exempt delegation account: {} lamports for {} bytes",
+             account_lamports, space);
+
         // Initialize delegation account
         let mut delegation_data = delegation_account.try_borrow_mut_data()?;
         delegation_data[0..8]
@@ -1472,7 +1594,7 @@ fn process_delegate_to(
             let mut mailer_data_mut = mailer_account.try_borrow_mut_data()?;
             let mut mailer_state_mut: MailerState =
                 BorshDeserialize::deserialize(&mut &mailer_data_mut[8..])?;
-            mailer_state_mut.owner_claimable += mailer_state.delegation_fee;
+            mailer_state_mut.increase_owner_claimable(mailer_state.delegation_fee)?;
             mailer_state_mut.serialize(&mut &mut mailer_data_mut[8..])?;
             drop(mailer_data_mut);
         }
@@ -1607,7 +1729,7 @@ fn process_set_custom_fee_percentage(
 
     // Verify fee discount account PDA
     let (discount_pda, bump) =
-        Pubkey::find_program_address(&[b"discount", account.as_ref()], program_id);
+        Pubkey::find_program_address(&[b"discount", &[PDA_VERSION], account.as_ref()], program_id);
 
     if fee_discount_account.key != &discount_pda {
         return Err(MailerError::InvalidPDA.into());
@@ -1632,9 +1754,19 @@ fn process_set_custom_fee_percentage(
                 fee_discount_account.clone(),
                 system_program.clone(),
             ],
-            &[&[b"discount", account.as_ref(), &[bump]]],
+            &[&[b"discount", &[PDA_VERSION], account.as_ref(), &[bump]]],
         )?;
 
+        // Verify account is rent-exempt
+        let account_lamports = fee_discount_account.lamports();
+        if !rent.is_exempt(account_lamports, space) {
+            msg!("ERROR: Fee discount account not rent-exempt! {} lamports for {} bytes",
+                 account_lamports, space);
+            return Err(ProgramError::InsufficientFunds);
+        }
+        msg!("Created rent-exempt fee discount account: {} lamports for {} bytes",
+             account_lamports, space);
+
         // Initialize discount account
         let mut discount_data = fee_discount_account.try_borrow_mut_data()?;
         discount_data[0..8]
@@ -1693,7 +1825,7 @@ fn process_clear_custom_fee_percentage(
 
     // Verify fee discount account PDA
     let (discount_pda, _) =
-        Pubkey::find_program_address(&[b"discount", account.as_ref()], program_id);
+        Pubkey::find_program_address(&[b"discount", &[PDA_VERSION], account.as_ref()], program_id);
 
     if fee_discount_account.key != &discount_pda {
         return Err(MailerError::InvalidPDA.into());
@@ -1776,7 +1908,7 @@ fn record_shares(
     // Update owner's claimable amount
     let mut mailer_data = mailer_account.try_borrow_mut_data()?;
     let mut mailer_state: MailerState = BorshDeserialize::deserialize(&mut &mailer_data[8..])?;
-    mailer_state.owner_claimable += owner_amount;
+    mailer_state.increase_owner_claimable(owner_amount)?;
     mailer_state.serialize(&mut &mut mailer_data[8..])?;
 
     msg!(
@@ -1797,7 +1929,7 @@ fn calculate_fee_with_discount(
 ) -> Result<u64, ProgramError> {
     // Try to find fee discount account
     let (discount_pda, _) =
-        Pubkey::find_program_address(&[b"discount", account.as_ref()], program_id);
+        Pubkey::find_program_address(&[b"discount", &[PDA_VERSION], account.as_ref()], program_id);
 
     // Check if any account in the accounts slice matches the discount PDA
     let discount_account = accounts.iter().find(|acc| acc.key == &discount_pda);
@@ -1875,6 +2007,10 @@ fn process_pause(_program_id: &Pubkey, accounts: &[AccountInfo]) -> ProgramResul
         assert_token_account(owner_usdc, owner.key, &mailer_state.usdc_mint)?;
         assert_token_account(mailer_usdc, &mailer_pda, &mailer_state.usdc_mint)?;
 
+        // Save updated state BEFORE external call (CEI pattern)
+        mailer_state.serialize(&mut &mut mailer_data[8..])?;
+        drop(mailer_data); // Release borrow before external call
+
         // Transfer USDC from mailer to owner
         invoke_signed(
             &spl_token::instruction::transfer(
@@ -1895,11 +2031,11 @@ fn process_pause(_program_id: &Pubkey, accounts: &[AccountInfo]) -> ProgramResul
         )?;
 
         msg!("Distributed owner funds during pause: {}", amount);
+    } else {
+        // Save updated state even if no distribution
+        mailer_state.serialize(&mut &mut mailer_data[8..])?;
     }
 
-    // Save updated state
-    mailer_state.serialize(&mut &mut mailer_data[8..])?;
-
     msg!("Contract paused by owner: {}", owner.key);
     Ok(())
 }
@@ -1965,7 +2101,7 @@ fn process_distribute_claimable_funds(
     }
 
     // Verify recipient claim PDA
-    let (claim_pda, _) = Pubkey::find_program_address(&[b"claim", recipient.as_ref()], _program_id);
+    let (claim_pda, _) = Pubkey::find_program_address(&[b"claim", &[PDA_VERSION], recipient.as_ref()], _program_id);
     if recipient_claim_account.key != &claim_pda {
         return Err(MailerError::InvalidPDA.into());
     }
@@ -1987,6 +2123,10 @@ fn process_distribute_claimable_funds(
     assert_token_account(recipient_usdc, &recipient, &mailer_state.usdc_mint)?;
     assert_token_account(mailer_usdc, &mailer_pda, &mailer_state.usdc_mint)?;
 
+    // Save updated state BEFORE external call (CEI pattern)
+    claim_state.serialize(&mut &mut claim_data[8..])?;
+    drop(claim_data); // Release borrow before external call
+
     // Transfer USDC from mailer to recipient
     invoke_signed(
         &spl_token::instruction::transfer(
@@ -2006,8 +2146,6 @@ fn process_distribute_claimable_funds(
         &[&[b"mailer", &[mailer_state.bump]]],
     )?;
 
-    claim_state.serialize(&mut &mut claim_data[8..])?;
-
     msg!("Distributed claimable funds to {}: {}", recipient, amount);
     Ok(())
 }
@@ -2038,7 +2176,7 @@ fn process_claim_expired_shares(
     }
 
     // Verify recipient claim PDA
-    let (claim_pda, _) = Pubkey::find_program_address(&[b"claim", recipient.as_ref()], program_id);
+    let (claim_pda, _) = Pubkey::find_program_address(&[b"claim", &[PDA_VERSION], recipient.as_ref()], program_id);
     if recipient_claim_account.key != &claim_pda {
         return Err(MailerError::InvalidPDA.into());
     }
@@ -2065,7 +2203,7 @@ fn process_claim_expired_shares(
     claim_state.serialize(&mut &mut claim_data[8..])?;
     drop(claim_data);
 
-    mailer_state.owner_claimable += amount;
+    mailer_state.increase_owner_claimable(amount)?;
     mailer_state.serialize(&mut &mut mailer_data[8..])?;
 
     msg!("Expired shares claimed for {}: {}", recipient, amount);