[PE-6742] Make swaps work for low liquidity AUDIO pair coins by faridsalau · Pull Request #12786 · AudiusProject/apps

faridsalau · 2025-08-21T12:56:54Z

Description

This PR implements a double swap functionality for Jupiter token swaps, allowing tokens to be swapped through an intermediary token (AUDIO) when direct swaps are not available or optimal. This enhances the token swap capabilities by providing an alternative routing mechanism.

Changes

Package Updates

Upgraded @jup-ag/api from version 6.0.6 to 6.0.44 across both packages/common and packages/web
Updated package-lock.json to reflect the new dependency versions

New Files Added

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

Implements direct token swap functionality using Jupiter
Handles single-hop swaps between input and output tokens
Includes proper cleanup of temporary ATAs (Associated Token Accounts)
Returns swap results with transaction signatures and amount information

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

Implements double swap functionality using AUDIO as intermediary token
Performs two sequential swaps: InputToken → AUDIO → OutputToken
Handles creation and cleanup of intermediate ATAs
Manages two separate transactions for the swap chain
Returns both transaction signatures for debugging purposes

Technical Details

Double Swap Flow

First Transaction: InputToken → AUDIO
- Transfer input tokens from user bank to temporary ATA
- Execute Jupiter swap to AUDIO
- Store AUDIO in intermediate ATA
- Clean up input token ATA
Second Transaction: AUDIO → OutputToken
- Use AUDIO from intermediate ATA
- Execute Jupiter swap to output token
- Transfer output tokens to user bank
- Clean up intermediate AUDIO ATA

How Has This Been Tested?

npm run web:prod and perform a swap between TCONE and TCONE2

changeset-bot · 2025-08-21T12:56:59Z

⚠️ No Changeset found

Latest commit: 7694f4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-08-21T12:58:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	npm/@apollo/utils.removealiases@2.0.1
	npm/@babel/plugin-proposal-class-static-block@7.21.0
	npm/@babel/helper-plugin-utils@7.25.9 ⏵ 7.26.5
	npm/@apollo/utils.printwithreducedwhitespace@2.0.1
	npm/@babel/helper-validator-option@7.22.15 ⏵ 7.27.1
	npm/@babel/highlight@7.22.20 ⏵ 7.23.4
	npm/@apollo/utils.sortast@2.0.1
	npm/@babel/preset-typescript@7.22.15
	npm/@babel/helper-validator-identifier@7.25.9 ⏵ 7.27.1
	npm/@babel/helper-function-name@7.22.5 ⏵ 7.23.0
	npm/@babel/register@7.7.0
	npm/@babel/code-frame@7.22.13 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-runtime@7.18.2
	npm/@babel/helper-compilation-targets@7.22.15 ⏵ 7.27.1			⁺¹	⁺⁴
	npm/@apollo/utils.stripsensitiveliterals@2.0.1
	npm/@babel/helper-module-imports@7.22.15 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-react-jsx@7.21.0
	npm/@apollo/utils.dropunuseddefinitions@2.0.1
	npm/@babel/template@7.22.15 ⏵ 7.27.1	⁺¹		⁺¹
	npm/@babel/helper-define-polyfill-provider@0.3.3
	npm/@apollo/utils.usagereporting@2.1.0
	npm/@babel/cli@7.7.0
	npm/@babel/preset-env@7.22.15
	npm/@audius/fetch-nft@0.2.8
	npm/@babel/helper-module-transforms@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁵
	npm/@babel/parser@7.22.16 ⏵ 7.27.1			^-3
	npm/@babel/compat-data@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁴
	npm/@audius/hedgehog@2.1.0 ⏵ 3.0.0-alpha.1	⁺²
	npm/@apollo/utils.logger@2.0.1
	npm/@audius/stems@0.3.10
	npm/@babel/generator@7.22.15 ⏵ 7.27.1			⁺¹	⁺²
	npm/@babel/traverse@7.22.20 ⏵ 7.27.1	⁺¹	⁺⁷⁵	⁺¹
See 16 more rows in the dashboard

View full report

socket-security · 2025-08-21T12:58:27Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/form-data@4.0.1` has a Critical CVE. CVE:GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From:package-lock.json → `npm/form-data@4.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

faridsalau · 2025-08-22T16:54:23Z

 "@audius/sdk": "*",
 "@fingerprintjs/fingerprintjs-pro": "3.5.6",
- "@jup-ag/api": "6.0.6",
+ "@jup-ag/api": "6.0.44",


most recent version. had to update to get dynamicSlippage

raymondjacobson

sorry for the slow review here, thought I submitted friday!

raymondjacobson · 2025-08-22T16:58:39Z

@@ -0,0 +1,239 @@
+import { SwapRequest } from '@jup-ag/api'


nit, i think this would be more self evident if it was named indirectSwap or indirectSwapThroughAudio

raymondjacobson · 2025-08-22T17:00:46Z

+ * Attempts to get a direct quote from Jupiter for the given token pair.
+ * Returns true if a direct quote is available, false otherwise.
+ */
+const isDirectRouteAvailable = async (


good helper

raymondjacobson · 2025-08-25T19:45:27Z

 }
+
+const SWAP_LOOKUP_TABLE_ADDRESS = new PublicKey(
+ '2WB87JxGZieRd7hi3y87wq6HAsPLyb9zrSx8B5z1QEzM'


what is this address?

address lookup table that we setup for swaps

[2ea203a] Finalize send audio flow (#12824) Dylan Jeffers [538bbb2] [PE-6773] Make indirect swaps use userbanks for all interactions and use confirmed for commitment level (#12825) Farid Salau [2a7161a] [QA-2313] Fix receive button on audio page (#12823) Dylan Jeffers [cb15e5e] Hide tier for official Audius account (#12819) Reed [84c191e] [PE-6710] Fix optimistic updates after token swaps (#12818) Reed [4a3cff0] [PE-6752][PE-6697] Swap flow QA updates (#12811) Farid Salau [30bb833] [QA-2295] Fix web chat messages getting cut off (#12817) Reed [c1a9683] [PE-6737] Connect the buy/sell flow to the mobile coin details balance card (#12808) KJ [5b3b909] Fix audio matching copy that got missed (#12816) Randy Schott [ca80e02] Fix explore screen feature flags (#12815) Dylan Jeffers [0b26b53] [QA-2255] Fix mobile lineup & playback bugs (continues playing same track after playing a new lineup page) (#12814) JD Francis [9f8b7dc] [QA-2299] "View Profile" instead of "Artist Page" (#12813) Reed [365d66f] [QA-2296|QA-2298] RC QA Fixes (#12812) JD Francis [07378e7] [PE-6691] Show AUDIO card if user doesn't have any other assets (#12807) Farid Salau [143e376] [PE-6722] Only show badge that user created if they have one (#12806) Farid Salau [4828631] [PE-6641|PE-6642] Artist coin popover fixes (#12804) JD Francis [cdaa316] Fix connected wallet copying wrong address (#12805) JD Francis [4cf1222] [QA-2287] Use X handles in x shares (#12803) Reed [80ec4c6] [PE-6540] Fix artist coin blast logos (#12798) Reed [d6e82d5] Fix flakey ampm test (#12778) Ray Jacobson [9726cb7] [PE-6716] Fix AssetDetailsPage wrong bottom padding (#12802) Reed [c0b6b6a] [PE-6745] Change 'likes' to 'favorites' on remix sort dropdown (#12796) Reed [a70db6e] [PE-6706] Fix userbadge gap (#12801) Reed [dd249a7] Several QA fixes and UI updates (#12795) Farid Salau [31710a0] [PE-6742] Make swaps work for low liquidity AUDIO pair coins (#12786) Farid Salau [ac41903] [PE-6731] Update discord oauth url (#12799) JD Francis [6e2df32] [PE-6681] Fix DMs Header right padding issue (#12800) KJ [84ae6cb] [QA-2255] Fix android playback issue (#12797) JD Francis [6faaad9] [PE-6708][PE-6713] Fixes to artist coin members leaderboard (#12794) JD Francis

faridsalau · 2025-08-21T12:56:54Z

Description

This PR implements a double swap functionality for Jupiter token swaps, allowing tokens to be swapped through an intermediary token (AUDIO) when direct swaps are not available or optimal. This enhances the token swap capabilities by providing an alternative routing mechanism.

Changes

Package Updates

Upgraded @jup-ag/api from version 6.0.6 to 6.0.44 across both packages/common and packages/web
Updated package-lock.json to reflect the new dependency versions

New Files Added

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

Implements direct token swap functionality using Jupiter
Handles single-hop swaps between input and output tokens
Includes proper cleanup of temporary ATAs (Associated Token Accounts)
Returns swap results with transaction signatures and amount information

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

Implements double swap functionality using AUDIO as intermediary token
Performs two sequential swaps: InputToken → AUDIO → OutputToken
Handles creation and cleanup of intermediate ATAs
Manages two separate transactions for the swap chain
Returns both transaction signatures for debugging purposes

Technical Details

Double Swap Flow

First Transaction: InputToken → AUDIO
- Transfer input tokens from user bank to temporary ATA
- Execute Jupiter swap to AUDIO
- Store AUDIO in intermediate ATA
- Clean up input token ATA
Second Transaction: AUDIO → OutputToken
- Use AUDIO from intermediate ATA
- Execute Jupiter swap to output token
- Transfer output tokens to user bank
- Clean up intermediate AUDIO ATA

How Has This Been Tested?

npm run web:prod and perform a swap between TCONE and TCONE2

changeset-bot · 2025-08-21T12:56:59Z

⚠️ No Changeset found

Latest commit: 7694f4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-08-21T12:58:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	npm/@apollo/utils.removealiases@2.0.1
	npm/@babel/plugin-proposal-class-static-block@7.21.0
	npm/@babel/helper-plugin-utils@7.25.9 ⏵ 7.26.5
	npm/@apollo/utils.printwithreducedwhitespace@2.0.1
	npm/@babel/helper-validator-option@7.22.15 ⏵ 7.27.1
	npm/@babel/highlight@7.22.20 ⏵ 7.23.4
	npm/@apollo/utils.sortast@2.0.1
	npm/@babel/preset-typescript@7.22.15
	npm/@babel/helper-validator-identifier@7.25.9 ⏵ 7.27.1
	npm/@babel/helper-function-name@7.22.5 ⏵ 7.23.0
	npm/@babel/register@7.7.0
	npm/@babel/code-frame@7.22.13 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-runtime@7.18.2
	npm/@babel/helper-compilation-targets@7.22.15 ⏵ 7.27.1			⁺¹	⁺⁴
	npm/@apollo/utils.stripsensitiveliterals@2.0.1
	npm/@babel/helper-module-imports@7.22.15 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-react-jsx@7.21.0
	npm/@apollo/utils.dropunuseddefinitions@2.0.1
	npm/@babel/template@7.22.15 ⏵ 7.27.1	⁺¹		⁺¹
	npm/@babel/helper-define-polyfill-provider@0.3.3
	npm/@apollo/utils.usagereporting@2.1.0
	npm/@babel/cli@7.7.0
	npm/@babel/preset-env@7.22.15
	npm/@audius/fetch-nft@0.2.8
	npm/@babel/helper-module-transforms@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁵
	npm/@babel/parser@7.22.16 ⏵ 7.27.1			^-3
	npm/@babel/compat-data@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁴
	npm/@audius/hedgehog@2.1.0 ⏵ 3.0.0-alpha.1	⁺²
	npm/@apollo/utils.logger@2.0.1
	npm/@audius/stems@0.3.10
	npm/@babel/generator@7.22.15 ⏵ 7.27.1			⁺¹	⁺²
	npm/@babel/traverse@7.22.20 ⏵ 7.27.1	⁺¹	⁺⁷⁵	⁺¹
See 16 more rows in the dashboard

View full report

socket-security · 2025-08-21T12:58:27Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/form-data@4.0.1` has a Critical CVE. CVE:GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From:package-lock.json → `npm/form-data@4.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

faridsalau · 2025-08-22T16:54:23Z

 "@audius/sdk": "*",
 "@fingerprintjs/fingerprintjs-pro": "3.5.6",
- "@jup-ag/api": "6.0.6",
+ "@jup-ag/api": "6.0.44",


most recent version. had to update to get dynamicSlippage

raymondjacobson

sorry for the slow review here, thought I submitted friday!

raymondjacobson · 2025-08-22T16:58:39Z

@@ -0,0 +1,239 @@
+import { SwapRequest } from '@jup-ag/api'


nit, i think this would be more self evident if it was named indirectSwap or indirectSwapThroughAudio

raymondjacobson · 2025-08-22T17:00:46Z

+ * Attempts to get a direct quote from Jupiter for the given token pair.
+ * Returns true if a direct quote is available, false otherwise.
+ */
+const isDirectRouteAvailable = async (


good helper

raymondjacobson · 2025-08-25T19:45:27Z

 }
+
+const SWAP_LOOKUP_TABLE_ADDRESS = new PublicKey(
+ '2WB87JxGZieRd7hi3y87wq6HAsPLyb9zrSx8B5z1QEzM'


what is this address?

address lookup table that we setup for swaps

[2ea203a] Finalize send audio flow (#12824) Dylan Jeffers [538bbb2] [PE-6773] Make indirect swaps use userbanks for all interactions and use confirmed for commitment level (#12825) Farid Salau [2a7161a] [QA-2313] Fix receive button on audio page (#12823) Dylan Jeffers [cb15e5e] Hide tier for official Audius account (#12819) Reed [84c191e] [PE-6710] Fix optimistic updates after token swaps (#12818) Reed [4a3cff0] [PE-6752][PE-6697] Swap flow QA updates (#12811) Farid Salau [30bb833] [QA-2295] Fix web chat messages getting cut off (#12817) Reed [c1a9683] [PE-6737] Connect the buy/sell flow to the mobile coin details balance card (#12808) KJ [5b3b909] Fix audio matching copy that got missed (#12816) Randy Schott [ca80e02] Fix explore screen feature flags (#12815) Dylan Jeffers [0b26b53] [QA-2255] Fix mobile lineup & playback bugs (continues playing same track after playing a new lineup page) (#12814) JD Francis [9f8b7dc] [QA-2299] "View Profile" instead of "Artist Page" (#12813) Reed [365d66f] [QA-2296|QA-2298] RC QA Fixes (#12812) JD Francis [07378e7] [PE-6691] Show AUDIO card if user doesn't have any other assets (#12807) Farid Salau [143e376] [PE-6722] Only show badge that user created if they have one (#12806) Farid Salau [4828631] [PE-6641|PE-6642] Artist coin popover fixes (#12804) JD Francis [cdaa316] Fix connected wallet copying wrong address (#12805) JD Francis [4cf1222] [QA-2287] Use X handles in x shares (#12803) Reed [80ec4c6] [PE-6540] Fix artist coin blast logos (#12798) Reed [d6e82d5] Fix flakey ampm test (#12778) Ray Jacobson [9726cb7] [PE-6716] Fix AssetDetailsPage wrong bottom padding (#12802) Reed [c0b6b6a] [PE-6745] Change 'likes' to 'favorites' on remix sort dropdown (#12796) Reed [a70db6e] [PE-6706] Fix userbadge gap (#12801) Reed [dd249a7] Several QA fixes and UI updates (#12795) Farid Salau [31710a0] [PE-6742] Make swaps work for low liquidity AUDIO pair coins (#12786) Farid Salau [ac41903] [PE-6731] Update discord oauth url (#12799) JD Francis [6e2df32] [PE-6681] Fix DMs Header right padding issue (#12800) KJ [84ae6cb] [QA-2255] Fix android playback issue (#12797) JD Francis [6faaad9] [PE-6708][PE-6713] Fixes to artist coin members leaderboard (#12794) JD Francis

faridsalau · 2025-08-21T12:56:54Z

Description

This PR implements a double swap functionality for Jupiter token swaps, allowing tokens to be swapped through an intermediary token (AUDIO) when direct swaps are not available or optimal. This enhances the token swap capabilities by providing an alternative routing mechanism.

Changes

Package Updates

Upgraded @jup-ag/api from version 6.0.6 to 6.0.44 across both packages/common and packages/web
Updated package-lock.json to reflect the new dependency versions

New Files Added

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

Implements direct token swap functionality using Jupiter
Handles single-hop swaps between input and output tokens
Includes proper cleanup of temporary ATAs (Associated Token Accounts)
Returns swap results with transaction signatures and amount information

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

Implements double swap functionality using AUDIO as intermediary token
Performs two sequential swaps: InputToken → AUDIO → OutputToken
Handles creation and cleanup of intermediate ATAs
Manages two separate transactions for the swap chain
Returns both transaction signatures for debugging purposes

Technical Details

Double Swap Flow

First Transaction: InputToken → AUDIO
- Transfer input tokens from user bank to temporary ATA
- Execute Jupiter swap to AUDIO
- Store AUDIO in intermediate ATA
- Clean up input token ATA
Second Transaction: AUDIO → OutputToken
- Use AUDIO from intermediate ATA
- Execute Jupiter swap to output token
- Transfer output tokens to user bank
- Clean up intermediate AUDIO ATA

How Has This Been Tested?

npm run web:prod and perform a swap between TCONE and TCONE2

changeset-bot · 2025-08-21T12:56:59Z

⚠️ No Changeset found

Latest commit: 7694f4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-08-21T12:58:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	npm/@apollo/utils.removealiases@2.0.1
	npm/@babel/plugin-proposal-class-static-block@7.21.0
	npm/@babel/helper-plugin-utils@7.25.9 ⏵ 7.26.5
	npm/@apollo/utils.printwithreducedwhitespace@2.0.1
	npm/@babel/helper-validator-option@7.22.15 ⏵ 7.27.1
	npm/@babel/highlight@7.22.20 ⏵ 7.23.4
	npm/@apollo/utils.sortast@2.0.1
	npm/@babel/preset-typescript@7.22.15
	npm/@babel/helper-validator-identifier@7.25.9 ⏵ 7.27.1
	npm/@babel/helper-function-name@7.22.5 ⏵ 7.23.0
	npm/@babel/register@7.7.0
	npm/@babel/code-frame@7.22.13 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-runtime@7.18.2
	npm/@babel/helper-compilation-targets@7.22.15 ⏵ 7.27.1			⁺¹	⁺⁴
	npm/@apollo/utils.stripsensitiveliterals@2.0.1
	npm/@babel/helper-module-imports@7.22.15 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-react-jsx@7.21.0
	npm/@apollo/utils.dropunuseddefinitions@2.0.1
	npm/@babel/template@7.22.15 ⏵ 7.27.1	⁺¹		⁺¹
	npm/@babel/helper-define-polyfill-provider@0.3.3
	npm/@apollo/utils.usagereporting@2.1.0
	npm/@babel/cli@7.7.0
	npm/@babel/preset-env@7.22.15
	npm/@audius/fetch-nft@0.2.8
	npm/@babel/helper-module-transforms@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁵
	npm/@babel/parser@7.22.16 ⏵ 7.27.1			^-3
	npm/@babel/compat-data@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁴
	npm/@audius/hedgehog@2.1.0 ⏵ 3.0.0-alpha.1	⁺²
	npm/@apollo/utils.logger@2.0.1
	npm/@audius/stems@0.3.10
	npm/@babel/generator@7.22.15 ⏵ 7.27.1			⁺¹	⁺²
	npm/@babel/traverse@7.22.20 ⏵ 7.27.1	⁺¹	⁺⁷⁵	⁺¹
See 16 more rows in the dashboard

View full report

socket-security · 2025-08-21T12:58:27Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/form-data@4.0.1` has a Critical CVE. CVE:GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From:package-lock.json → `npm/form-data@4.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

faridsalau · 2025-08-22T16:54:23Z

 "@audius/sdk": "*",
 "@fingerprintjs/fingerprintjs-pro": "3.5.6",
- "@jup-ag/api": "6.0.6",
+ "@jup-ag/api": "6.0.44",


most recent version. had to update to get dynamicSlippage

raymondjacobson

sorry for the slow review here, thought I submitted friday!

raymondjacobson · 2025-08-22T16:58:39Z

@@ -0,0 +1,239 @@
+import { SwapRequest } from '@jup-ag/api'


nit, i think this would be more self evident if it was named indirectSwap or indirectSwapThroughAudio

raymondjacobson · 2025-08-22T17:00:46Z

+ * Attempts to get a direct quote from Jupiter for the given token pair.
+ * Returns true if a direct quote is available, false otherwise.
+ */
+const isDirectRouteAvailable = async (


good helper

raymondjacobson · 2025-08-25T19:45:27Z

 }
+
+const SWAP_LOOKUP_TABLE_ADDRESS = new PublicKey(
+ '2WB87JxGZieRd7hi3y87wq6HAsPLyb9zrSx8B5z1QEzM'


what is this address?

address lookup table that we setup for swaps

[2ea203a] Finalize send audio flow (#12824) Dylan Jeffers [538bbb2] [PE-6773] Make indirect swaps use userbanks for all interactions and use confirmed for commitment level (#12825) Farid Salau [2a7161a] [QA-2313] Fix receive button on audio page (#12823) Dylan Jeffers [cb15e5e] Hide tier for official Audius account (#12819) Reed [84c191e] [PE-6710] Fix optimistic updates after token swaps (#12818) Reed [4a3cff0] [PE-6752][PE-6697] Swap flow QA updates (#12811) Farid Salau [30bb833] [QA-2295] Fix web chat messages getting cut off (#12817) Reed [c1a9683] [PE-6737] Connect the buy/sell flow to the mobile coin details balance card (#12808) KJ [5b3b909] Fix audio matching copy that got missed (#12816) Randy Schott [ca80e02] Fix explore screen feature flags (#12815) Dylan Jeffers [0b26b53] [QA-2255] Fix mobile lineup & playback bugs (continues playing same track after playing a new lineup page) (#12814) JD Francis [9f8b7dc] [QA-2299] "View Profile" instead of "Artist Page" (#12813) Reed [365d66f] [QA-2296|QA-2298] RC QA Fixes (#12812) JD Francis [07378e7] [PE-6691] Show AUDIO card if user doesn't have any other assets (#12807) Farid Salau [143e376] [PE-6722] Only show badge that user created if they have one (#12806) Farid Salau [4828631] [PE-6641|PE-6642] Artist coin popover fixes (#12804) JD Francis [cdaa316] Fix connected wallet copying wrong address (#12805) JD Francis [4cf1222] [QA-2287] Use X handles in x shares (#12803) Reed [80ec4c6] [PE-6540] Fix artist coin blast logos (#12798) Reed [d6e82d5] Fix flakey ampm test (#12778) Ray Jacobson [9726cb7] [PE-6716] Fix AssetDetailsPage wrong bottom padding (#12802) Reed [c0b6b6a] [PE-6745] Change 'likes' to 'favorites' on remix sort dropdown (#12796) Reed [a70db6e] [PE-6706] Fix userbadge gap (#12801) Reed [dd249a7] Several QA fixes and UI updates (#12795) Farid Salau [31710a0] [PE-6742] Make swaps work for low liquidity AUDIO pair coins (#12786) Farid Salau [ac41903] [PE-6731] Update discord oauth url (#12799) JD Francis [6e2df32] [PE-6681] Fix DMs Header right padding issue (#12800) KJ [84ae6cb] [QA-2255] Fix android playback issue (#12797) JD Francis [6faaad9] [PE-6708][PE-6713] Fixes to artist coin members leaderboard (#12794) JD Francis

faridsalau · 2025-08-21T12:56:54Z

Description

This PR implements a double swap functionality for Jupiter token swaps, allowing tokens to be swapped through an intermediary token (AUDIO) when direct swaps are not available or optimal. This enhances the token swap capabilities by providing an alternative routing mechanism.

Changes

Package Updates

Upgraded @jup-ag/api from version 6.0.6 to 6.0.44 across both packages/common and packages/web
Updated package-lock.json to reflect the new dependency versions

New Files Added

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

Implements direct token swap functionality using Jupiter
Handles single-hop swaps between input and output tokens
Includes proper cleanup of temporary ATAs (Associated Token Accounts)
Returns swap results with transaction signatures and amount information

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

Implements double swap functionality using AUDIO as intermediary token
Performs two sequential swaps: InputToken → AUDIO → OutputToken
Handles creation and cleanup of intermediate ATAs
Manages two separate transactions for the swap chain
Returns both transaction signatures for debugging purposes

Technical Details

Double Swap Flow

First Transaction: InputToken → AUDIO
- Transfer input tokens from user bank to temporary ATA
- Execute Jupiter swap to AUDIO
- Store AUDIO in intermediate ATA
- Clean up input token ATA
Second Transaction: AUDIO → OutputToken
- Use AUDIO from intermediate ATA
- Execute Jupiter swap to output token
- Transfer output tokens to user bank
- Clean up intermediate AUDIO ATA

How Has This Been Tested?

npm run web:prod and perform a swap between TCONE and TCONE2

changeset-bot · 2025-08-21T12:56:59Z

⚠️ No Changeset found

Latest commit: 7694f4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-08-21T12:58:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	npm/@apollo/utils.removealiases@2.0.1
	npm/@babel/plugin-proposal-class-static-block@7.21.0
	npm/@babel/helper-plugin-utils@7.25.9 ⏵ 7.26.5
	npm/@apollo/utils.printwithreducedwhitespace@2.0.1
	npm/@babel/helper-validator-option@7.22.15 ⏵ 7.27.1
	npm/@babel/highlight@7.22.20 ⏵ 7.23.4
	npm/@apollo/utils.sortast@2.0.1
	npm/@babel/preset-typescript@7.22.15
	npm/@babel/helper-validator-identifier@7.25.9 ⏵ 7.27.1
	npm/@babel/helper-function-name@7.22.5 ⏵ 7.23.0
	npm/@babel/register@7.7.0
	npm/@babel/code-frame@7.22.13 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-runtime@7.18.2
	npm/@babel/helper-compilation-targets@7.22.15 ⏵ 7.27.1			⁺¹	⁺⁴
	npm/@apollo/utils.stripsensitiveliterals@2.0.1
	npm/@babel/helper-module-imports@7.22.15 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-react-jsx@7.21.0
	npm/@apollo/utils.dropunuseddefinitions@2.0.1
	npm/@babel/template@7.22.15 ⏵ 7.27.1	⁺¹		⁺¹
	npm/@babel/helper-define-polyfill-provider@0.3.3
	npm/@apollo/utils.usagereporting@2.1.0
	npm/@babel/cli@7.7.0
	npm/@babel/preset-env@7.22.15
	npm/@audius/fetch-nft@0.2.8
	npm/@babel/helper-module-transforms@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁵
	npm/@babel/parser@7.22.16 ⏵ 7.27.1			^-3
	npm/@babel/compat-data@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁴
	npm/@audius/hedgehog@2.1.0 ⏵ 3.0.0-alpha.1	⁺²
	npm/@apollo/utils.logger@2.0.1
	npm/@audius/stems@0.3.10
	npm/@babel/generator@7.22.15 ⏵ 7.27.1			⁺¹	⁺²
	npm/@babel/traverse@7.22.20 ⏵ 7.27.1	⁺¹	⁺⁷⁵	⁺¹
See 16 more rows in the dashboard

View full report

socket-security · 2025-08-21T12:58:27Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/form-data@4.0.1` has a Critical CVE. CVE:GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From:package-lock.json → `npm/form-data@4.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

faridsalau · 2025-08-22T16:54:23Z

 "@audius/sdk": "*",
 "@fingerprintjs/fingerprintjs-pro": "3.5.6",
- "@jup-ag/api": "6.0.6",
+ "@jup-ag/api": "6.0.44",


most recent version. had to update to get dynamicSlippage

raymondjacobson

sorry for the slow review here, thought I submitted friday!

raymondjacobson · 2025-08-22T16:58:39Z

@@ -0,0 +1,239 @@
+import { SwapRequest } from '@jup-ag/api'


nit, i think this would be more self evident if it was named indirectSwap or indirectSwapThroughAudio

raymondjacobson · 2025-08-22T17:00:46Z

+ * Attempts to get a direct quote from Jupiter for the given token pair.
+ * Returns true if a direct quote is available, false otherwise.
+ */
+const isDirectRouteAvailable = async (


good helper

raymondjacobson · 2025-08-25T19:45:27Z

 }
+
+const SWAP_LOOKUP_TABLE_ADDRESS = new PublicKey(
+ '2WB87JxGZieRd7hi3y87wq6HAsPLyb9zrSx8B5z1QEzM'


what is this address?

address lookup table that we setup for swaps

[2ea203a] Finalize send audio flow (#12824) Dylan Jeffers [538bbb2] [PE-6773] Make indirect swaps use userbanks for all interactions and use confirmed for commitment level (#12825) Farid Salau [2a7161a] [QA-2313] Fix receive button on audio page (#12823) Dylan Jeffers [cb15e5e] Hide tier for official Audius account (#12819) Reed [84c191e] [PE-6710] Fix optimistic updates after token swaps (#12818) Reed [4a3cff0] [PE-6752][PE-6697] Swap flow QA updates (#12811) Farid Salau [30bb833] [QA-2295] Fix web chat messages getting cut off (#12817) Reed [c1a9683] [PE-6737] Connect the buy/sell flow to the mobile coin details balance card (#12808) KJ [5b3b909] Fix audio matching copy that got missed (#12816) Randy Schott [ca80e02] Fix explore screen feature flags (#12815) Dylan Jeffers [0b26b53] [QA-2255] Fix mobile lineup & playback bugs (continues playing same track after playing a new lineup page) (#12814) JD Francis [9f8b7dc] [QA-2299] "View Profile" instead of "Artist Page" (#12813) Reed [365d66f] [QA-2296|QA-2298] RC QA Fixes (#12812) JD Francis [07378e7] [PE-6691] Show AUDIO card if user doesn't have any other assets (#12807) Farid Salau [143e376] [PE-6722] Only show badge that user created if they have one (#12806) Farid Salau [4828631] [PE-6641|PE-6642] Artist coin popover fixes (#12804) JD Francis [cdaa316] Fix connected wallet copying wrong address (#12805) JD Francis [4cf1222] [QA-2287] Use X handles in x shares (#12803) Reed [80ec4c6] [PE-6540] Fix artist coin blast logos (#12798) Reed [d6e82d5] Fix flakey ampm test (#12778) Ray Jacobson [9726cb7] [PE-6716] Fix AssetDetailsPage wrong bottom padding (#12802) Reed [c0b6b6a] [PE-6745] Change 'likes' to 'favorites' on remix sort dropdown (#12796) Reed [a70db6e] [PE-6706] Fix userbadge gap (#12801) Reed [dd249a7] Several QA fixes and UI updates (#12795) Farid Salau [31710a0] [PE-6742] Make swaps work for low liquidity AUDIO pair coins (#12786) Farid Salau [ac41903] [PE-6731] Update discord oauth url (#12799) JD Francis [6e2df32] [PE-6681] Fix DMs Header right padding issue (#12800) KJ [84ae6cb] [QA-2255] Fix android playback issue (#12797) JD Francis [6faaad9] [PE-6708][PE-6713] Fixes to artist coin members leaderboard (#12794) JD Francis

faridsalau · 2025-08-21T12:56:54Z

Description

This PR implements a double swap functionality for Jupiter token swaps, allowing tokens to be swapped through an intermediary token (AUDIO) when direct swaps are not available or optimal. This enhances the token swap capabilities by providing an alternative routing mechanism.

Changes

Package Updates

Upgraded @jup-ag/api from version 6.0.6 to 6.0.44 across both packages/common and packages/web
Updated package-lock.json to reflect the new dependency versions

New Files Added

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

Implements direct token swap functionality using Jupiter
Handles single-hop swaps between input and output tokens
Includes proper cleanup of temporary ATAs (Associated Token Accounts)
Returns swap results with transaction signatures and amount information

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

Implements double swap functionality using AUDIO as intermediary token
Performs two sequential swaps: InputToken → AUDIO → OutputToken
Handles creation and cleanup of intermediate ATAs
Manages two separate transactions for the swap chain
Returns both transaction signatures for debugging purposes

Technical Details

Double Swap Flow

First Transaction: InputToken → AUDIO
- Transfer input tokens from user bank to temporary ATA
- Execute Jupiter swap to AUDIO
- Store AUDIO in intermediate ATA
- Clean up input token ATA
Second Transaction: AUDIO → OutputToken
- Use AUDIO from intermediate ATA
- Execute Jupiter swap to output token
- Transfer output tokens to user bank
- Clean up intermediate AUDIO ATA

How Has This Been Tested?

npm run web:prod and perform a swap between TCONE and TCONE2

changeset-bot · 2025-08-21T12:56:59Z

⚠️ No Changeset found

Latest commit: 7694f4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-08-21T12:58:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	npm/@apollo/utils.removealiases@2.0.1
	npm/@babel/plugin-proposal-class-static-block@7.21.0
	npm/@babel/helper-plugin-utils@7.25.9 ⏵ 7.26.5
	npm/@apollo/utils.printwithreducedwhitespace@2.0.1
	npm/@babel/helper-validator-option@7.22.15 ⏵ 7.27.1
	npm/@babel/highlight@7.22.20 ⏵ 7.23.4
	npm/@apollo/utils.sortast@2.0.1
	npm/@babel/preset-typescript@7.22.15
	npm/@babel/helper-validator-identifier@7.25.9 ⏵ 7.27.1
	npm/@babel/helper-function-name@7.22.5 ⏵ 7.23.0
	npm/@babel/register@7.7.0
	npm/@babel/code-frame@7.22.13 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-runtime@7.18.2
	npm/@babel/helper-compilation-targets@7.22.15 ⏵ 7.27.1			⁺¹	⁺⁴
	npm/@apollo/utils.stripsensitiveliterals@2.0.1
	npm/@babel/helper-module-imports@7.22.15 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-react-jsx@7.21.0
	npm/@apollo/utils.dropunuseddefinitions@2.0.1
	npm/@babel/template@7.22.15 ⏵ 7.27.1	⁺¹		⁺¹
	npm/@babel/helper-define-polyfill-provider@0.3.3
	npm/@apollo/utils.usagereporting@2.1.0
	npm/@babel/cli@7.7.0
	npm/@babel/preset-env@7.22.15
	npm/@audius/fetch-nft@0.2.8
	npm/@babel/helper-module-transforms@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁵
	npm/@babel/parser@7.22.16 ⏵ 7.27.1			^-3
	npm/@babel/compat-data@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁴
	npm/@audius/hedgehog@2.1.0 ⏵ 3.0.0-alpha.1	⁺²
	npm/@apollo/utils.logger@2.0.1
	npm/@audius/stems@0.3.10
	npm/@babel/generator@7.22.15 ⏵ 7.27.1			⁺¹	⁺²
	npm/@babel/traverse@7.22.20 ⏵ 7.27.1	⁺¹	⁺⁷⁵	⁺¹
See 16 more rows in the dashboard

View full report

socket-security · 2025-08-21T12:58:27Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/form-data@4.0.1` has a Critical CVE. CVE:GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From:package-lock.json → `npm/form-data@4.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

faridsalau · 2025-08-22T16:54:23Z

 "@audius/sdk": "*",
 "@fingerprintjs/fingerprintjs-pro": "3.5.6",
- "@jup-ag/api": "6.0.6",
+ "@jup-ag/api": "6.0.44",


most recent version. had to update to get dynamicSlippage

raymondjacobson

sorry for the slow review here, thought I submitted friday!

raymondjacobson · 2025-08-22T16:58:39Z

@@ -0,0 +1,239 @@
+import { SwapRequest } from '@jup-ag/api'


nit, i think this would be more self evident if it was named indirectSwap or indirectSwapThroughAudio

raymondjacobson · 2025-08-22T17:00:46Z

+ * Attempts to get a direct quote from Jupiter for the given token pair.
+ * Returns true if a direct quote is available, false otherwise.
+ */
+const isDirectRouteAvailable = async (


good helper

raymondjacobson · 2025-08-25T19:45:27Z

 }
+
+const SWAP_LOOKUP_TABLE_ADDRESS = new PublicKey(
+ '2WB87JxGZieRd7hi3y87wq6HAsPLyb9zrSx8B5z1QEzM'


what is this address?

address lookup table that we setup for swaps

[2ea203a] Finalize send audio flow (#12824) Dylan Jeffers [538bbb2] [PE-6773] Make indirect swaps use userbanks for all interactions and use confirmed for commitment level (#12825) Farid Salau [2a7161a] [QA-2313] Fix receive button on audio page (#12823) Dylan Jeffers [cb15e5e] Hide tier for official Audius account (#12819) Reed [84c191e] [PE-6710] Fix optimistic updates after token swaps (#12818) Reed [4a3cff0] [PE-6752][PE-6697] Swap flow QA updates (#12811) Farid Salau [30bb833] [QA-2295] Fix web chat messages getting cut off (#12817) Reed [c1a9683] [PE-6737] Connect the buy/sell flow to the mobile coin details balance card (#12808) KJ [5b3b909] Fix audio matching copy that got missed (#12816) Randy Schott [ca80e02] Fix explore screen feature flags (#12815) Dylan Jeffers [0b26b53] [QA-2255] Fix mobile lineup & playback bugs (continues playing same track after playing a new lineup page) (#12814) JD Francis [9f8b7dc] [QA-2299] "View Profile" instead of "Artist Page" (#12813) Reed [365d66f] [QA-2296|QA-2298] RC QA Fixes (#12812) JD Francis [07378e7] [PE-6691] Show AUDIO card if user doesn't have any other assets (#12807) Farid Salau [143e376] [PE-6722] Only show badge that user created if they have one (#12806) Farid Salau [4828631] [PE-6641|PE-6642] Artist coin popover fixes (#12804) JD Francis [cdaa316] Fix connected wallet copying wrong address (#12805) JD Francis [4cf1222] [QA-2287] Use X handles in x shares (#12803) Reed [80ec4c6] [PE-6540] Fix artist coin blast logos (#12798) Reed [d6e82d5] Fix flakey ampm test (#12778) Ray Jacobson [9726cb7] [PE-6716] Fix AssetDetailsPage wrong bottom padding (#12802) Reed [c0b6b6a] [PE-6745] Change 'likes' to 'favorites' on remix sort dropdown (#12796) Reed [a70db6e] [PE-6706] Fix userbadge gap (#12801) Reed [dd249a7] Several QA fixes and UI updates (#12795) Farid Salau [31710a0] [PE-6742] Make swaps work for low liquidity AUDIO pair coins (#12786) Farid Salau [ac41903] [PE-6731] Update discord oauth url (#12799) JD Francis [6e2df32] [PE-6681] Fix DMs Header right padding issue (#12800) KJ [84ae6cb] [QA-2255] Fix android playback issue (#12797) JD Francis [6faaad9] [PE-6708][PE-6713] Fixes to artist coin members leaderboard (#12794) JD Francis

faridsalau · 2025-08-21T12:56:54Z

Description

This PR implements a double swap functionality for Jupiter token swaps, allowing tokens to be swapped through an intermediary token (AUDIO) when direct swaps are not available or optimal. This enhances the token swap capabilities by providing an alternative routing mechanism.

Changes

Package Updates

Upgraded @jup-ag/api from version 6.0.6 to 6.0.44 across both packages/common and packages/web
Updated package-lock.json to reflect the new dependency versions

New Files Added

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

Implements direct token swap functionality using Jupiter
Handles single-hop swaps between input and output tokens
Includes proper cleanup of temporary ATAs (Associated Token Accounts)
Returns swap results with transaction signatures and amount information

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

Implements double swap functionality using AUDIO as intermediary token
Performs two sequential swaps: InputToken → AUDIO → OutputToken
Handles creation and cleanup of intermediate ATAs
Manages two separate transactions for the swap chain
Returns both transaction signatures for debugging purposes

Technical Details

Double Swap Flow

First Transaction: InputToken → AUDIO
- Transfer input tokens from user bank to temporary ATA
- Execute Jupiter swap to AUDIO
- Store AUDIO in intermediate ATA
- Clean up input token ATA
Second Transaction: AUDIO → OutputToken
- Use AUDIO from intermediate ATA
- Execute Jupiter swap to output token
- Transfer output tokens to user bank
- Clean up intermediate AUDIO ATA

How Has This Been Tested?

npm run web:prod and perform a swap between TCONE and TCONE2

changeset-bot · 2025-08-21T12:56:59Z

⚠️ No Changeset found

Latest commit: 7694f4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-08-21T12:58:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	npm/@apollo/utils.removealiases@2.0.1
	npm/@babel/plugin-proposal-class-static-block@7.21.0
	npm/@babel/helper-plugin-utils@7.25.9 ⏵ 7.26.5
	npm/@apollo/utils.printwithreducedwhitespace@2.0.1
	npm/@babel/helper-validator-option@7.22.15 ⏵ 7.27.1
	npm/@babel/highlight@7.22.20 ⏵ 7.23.4
	npm/@apollo/utils.sortast@2.0.1
	npm/@babel/preset-typescript@7.22.15
	npm/@babel/helper-validator-identifier@7.25.9 ⏵ 7.27.1
	npm/@babel/helper-function-name@7.22.5 ⏵ 7.23.0
	npm/@babel/register@7.7.0
	npm/@babel/code-frame@7.22.13 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-runtime@7.18.2
	npm/@babel/helper-compilation-targets@7.22.15 ⏵ 7.27.1			⁺¹	⁺⁴
	npm/@apollo/utils.stripsensitiveliterals@2.0.1
	npm/@babel/helper-module-imports@7.22.15 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-react-jsx@7.21.0
	npm/@apollo/utils.dropunuseddefinitions@2.0.1
	npm/@babel/template@7.22.15 ⏵ 7.27.1	⁺¹		⁺¹
	npm/@babel/helper-define-polyfill-provider@0.3.3
	npm/@apollo/utils.usagereporting@2.1.0
	npm/@babel/cli@7.7.0
	npm/@babel/preset-env@7.22.15
	npm/@audius/fetch-nft@0.2.8
	npm/@babel/helper-module-transforms@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁵
	npm/@babel/parser@7.22.16 ⏵ 7.27.1			^-3
	npm/@babel/compat-data@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁴
	npm/@audius/hedgehog@2.1.0 ⏵ 3.0.0-alpha.1	⁺²
	npm/@apollo/utils.logger@2.0.1
	npm/@audius/stems@0.3.10
	npm/@babel/generator@7.22.15 ⏵ 7.27.1			⁺¹	⁺²
	npm/@babel/traverse@7.22.20 ⏵ 7.27.1	⁺¹	⁺⁷⁵	⁺¹
See 16 more rows in the dashboard

View full report

socket-security · 2025-08-21T12:58:27Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/form-data@4.0.1` has a Critical CVE. CVE:GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From:package-lock.json → `npm/form-data@4.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

faridsalau · 2025-08-22T16:54:23Z

 "@audius/sdk": "*",
 "@fingerprintjs/fingerprintjs-pro": "3.5.6",
- "@jup-ag/api": "6.0.6",
+ "@jup-ag/api": "6.0.44",


most recent version. had to update to get dynamicSlippage

raymondjacobson

sorry for the slow review here, thought I submitted friday!

raymondjacobson · 2025-08-22T16:58:39Z

@@ -0,0 +1,239 @@
+import { SwapRequest } from '@jup-ag/api'


nit, i think this would be more self evident if it was named indirectSwap or indirectSwapThroughAudio

raymondjacobson · 2025-08-22T17:00:46Z

+ * Attempts to get a direct quote from Jupiter for the given token pair.
+ * Returns true if a direct quote is available, false otherwise.
+ */
+const isDirectRouteAvailable = async (


good helper

raymondjacobson · 2025-08-25T19:45:27Z

 }
+
+const SWAP_LOOKUP_TABLE_ADDRESS = new PublicKey(
+ '2WB87JxGZieRd7hi3y87wq6HAsPLyb9zrSx8B5z1QEzM'


what is this address?

address lookup table that we setup for swaps

[2ea203a] Finalize send audio flow (#12824) Dylan Jeffers [538bbb2] [PE-6773] Make indirect swaps use userbanks for all interactions and use confirmed for commitment level (#12825) Farid Salau [2a7161a] [QA-2313] Fix receive button on audio page (#12823) Dylan Jeffers [cb15e5e] Hide tier for official Audius account (#12819) Reed [84c191e] [PE-6710] Fix optimistic updates after token swaps (#12818) Reed [4a3cff0] [PE-6752][PE-6697] Swap flow QA updates (#12811) Farid Salau [30bb833] [QA-2295] Fix web chat messages getting cut off (#12817) Reed [c1a9683] [PE-6737] Connect the buy/sell flow to the mobile coin details balance card (#12808) KJ [5b3b909] Fix audio matching copy that got missed (#12816) Randy Schott [ca80e02] Fix explore screen feature flags (#12815) Dylan Jeffers [0b26b53] [QA-2255] Fix mobile lineup & playback bugs (continues playing same track after playing a new lineup page) (#12814) JD Francis [9f8b7dc] [QA-2299] "View Profile" instead of "Artist Page" (#12813) Reed [365d66f] [QA-2296|QA-2298] RC QA Fixes (#12812) JD Francis [07378e7] [PE-6691] Show AUDIO card if user doesn't have any other assets (#12807) Farid Salau [143e376] [PE-6722] Only show badge that user created if they have one (#12806) Farid Salau [4828631] [PE-6641|PE-6642] Artist coin popover fixes (#12804) JD Francis [cdaa316] Fix connected wallet copying wrong address (#12805) JD Francis [4cf1222] [QA-2287] Use X handles in x shares (#12803) Reed [80ec4c6] [PE-6540] Fix artist coin blast logos (#12798) Reed [d6e82d5] Fix flakey ampm test (#12778) Ray Jacobson [9726cb7] [PE-6716] Fix AssetDetailsPage wrong bottom padding (#12802) Reed [c0b6b6a] [PE-6745] Change 'likes' to 'favorites' on remix sort dropdown (#12796) Reed [a70db6e] [PE-6706] Fix userbadge gap (#12801) Reed [dd249a7] Several QA fixes and UI updates (#12795) Farid Salau [31710a0] [PE-6742] Make swaps work for low liquidity AUDIO pair coins (#12786) Farid Salau [ac41903] [PE-6731] Update discord oauth url (#12799) JD Francis [6e2df32] [PE-6681] Fix DMs Header right padding issue (#12800) KJ [84ae6cb] [QA-2255] Fix android playback issue (#12797) JD Francis [6faaad9] [PE-6708][PE-6713] Fixes to artist coin members leaderboard (#12794) JD Francis

faridsalau · 2025-08-21T12:56:54Z

Description

This PR implements a double swap functionality for Jupiter token swaps, allowing tokens to be swapped through an intermediary token (AUDIO) when direct swaps are not available or optimal. This enhances the token swap capabilities by providing an alternative routing mechanism.

Changes

Package Updates

Upgraded @jup-ag/api from version 6.0.6 to 6.0.44 across both packages/common and packages/web
Updated package-lock.json to reflect the new dependency versions

New Files Added

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

Implements direct token swap functionality using Jupiter
Handles single-hop swaps between input and output tokens
Includes proper cleanup of temporary ATAs (Associated Token Accounts)
Returns swap results with transaction signatures and amount information

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

Implements double swap functionality using AUDIO as intermediary token
Performs two sequential swaps: InputToken → AUDIO → OutputToken
Handles creation and cleanup of intermediate ATAs
Manages two separate transactions for the swap chain
Returns both transaction signatures for debugging purposes

Technical Details

Double Swap Flow

First Transaction: InputToken → AUDIO
- Transfer input tokens from user bank to temporary ATA
- Execute Jupiter swap to AUDIO
- Store AUDIO in intermediate ATA
- Clean up input token ATA
Second Transaction: AUDIO → OutputToken
- Use AUDIO from intermediate ATA
- Execute Jupiter swap to output token
- Transfer output tokens to user bank
- Clean up intermediate AUDIO ATA

How Has This Been Tested?

npm run web:prod and perform a swap between TCONE and TCONE2

changeset-bot · 2025-08-21T12:56:59Z

⚠️ No Changeset found

Latest commit: 7694f4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-08-21T12:58:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	npm/@apollo/utils.removealiases@2.0.1
	npm/@babel/plugin-proposal-class-static-block@7.21.0
	npm/@babel/helper-plugin-utils@7.25.9 ⏵ 7.26.5
	npm/@apollo/utils.printwithreducedwhitespace@2.0.1
	npm/@babel/helper-validator-option@7.22.15 ⏵ 7.27.1
	npm/@babel/highlight@7.22.20 ⏵ 7.23.4
	npm/@apollo/utils.sortast@2.0.1
	npm/@babel/preset-typescript@7.22.15
	npm/@babel/helper-validator-identifier@7.25.9 ⏵ 7.27.1
	npm/@babel/helper-function-name@7.22.5 ⏵ 7.23.0
	npm/@babel/register@7.7.0
	npm/@babel/code-frame@7.22.13 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-runtime@7.18.2
	npm/@babel/helper-compilation-targets@7.22.15 ⏵ 7.27.1			⁺¹	⁺⁴
	npm/@apollo/utils.stripsensitiveliterals@2.0.1
	npm/@babel/helper-module-imports@7.22.15 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-react-jsx@7.21.0
	npm/@apollo/utils.dropunuseddefinitions@2.0.1
	npm/@babel/template@7.22.15 ⏵ 7.27.1	⁺¹		⁺¹
	npm/@babel/helper-define-polyfill-provider@0.3.3
	npm/@apollo/utils.usagereporting@2.1.0
	npm/@babel/cli@7.7.0
	npm/@babel/preset-env@7.22.15
	npm/@audius/fetch-nft@0.2.8
	npm/@babel/helper-module-transforms@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁵
	npm/@babel/parser@7.22.16 ⏵ 7.27.1			^-3
	npm/@babel/compat-data@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁴
	npm/@audius/hedgehog@2.1.0 ⏵ 3.0.0-alpha.1	⁺²
	npm/@apollo/utils.logger@2.0.1
	npm/@audius/stems@0.3.10
	npm/@babel/generator@7.22.15 ⏵ 7.27.1			⁺¹	⁺²
	npm/@babel/traverse@7.22.20 ⏵ 7.27.1	⁺¹	⁺⁷⁵	⁺¹
See 16 more rows in the dashboard

View full report

socket-security · 2025-08-21T12:58:27Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/form-data@4.0.1` has a Critical CVE. CVE:GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From:package-lock.json → `npm/form-data@4.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

faridsalau · 2025-08-22T16:54:23Z

 "@audius/sdk": "*",
 "@fingerprintjs/fingerprintjs-pro": "3.5.6",
- "@jup-ag/api": "6.0.6",
+ "@jup-ag/api": "6.0.44",


most recent version. had to update to get dynamicSlippage

raymondjacobson

sorry for the slow review here, thought I submitted friday!

raymondjacobson · 2025-08-22T16:58:39Z

@@ -0,0 +1,239 @@
+import { SwapRequest } from '@jup-ag/api'


nit, i think this would be more self evident if it was named indirectSwap or indirectSwapThroughAudio

raymondjacobson · 2025-08-22T17:00:46Z

+ * Attempts to get a direct quote from Jupiter for the given token pair.
+ * Returns true if a direct quote is available, false otherwise.
+ */
+const isDirectRouteAvailable = async (


good helper

raymondjacobson · 2025-08-25T19:45:27Z

 }
+
+const SWAP_LOOKUP_TABLE_ADDRESS = new PublicKey(
+ '2WB87JxGZieRd7hi3y87wq6HAsPLyb9zrSx8B5z1QEzM'


what is this address?

address lookup table that we setup for swaps

[2ea203a] Finalize send audio flow (#12824) Dylan Jeffers [538bbb2] [PE-6773] Make indirect swaps use userbanks for all interactions and use confirmed for commitment level (#12825) Farid Salau [2a7161a] [QA-2313] Fix receive button on audio page (#12823) Dylan Jeffers [cb15e5e] Hide tier for official Audius account (#12819) Reed [84c191e] [PE-6710] Fix optimistic updates after token swaps (#12818) Reed [4a3cff0] [PE-6752][PE-6697] Swap flow QA updates (#12811) Farid Salau [30bb833] [QA-2295] Fix web chat messages getting cut off (#12817) Reed [c1a9683] [PE-6737] Connect the buy/sell flow to the mobile coin details balance card (#12808) KJ [5b3b909] Fix audio matching copy that got missed (#12816) Randy Schott [ca80e02] Fix explore screen feature flags (#12815) Dylan Jeffers [0b26b53] [QA-2255] Fix mobile lineup & playback bugs (continues playing same track after playing a new lineup page) (#12814) JD Francis [9f8b7dc] [QA-2299] "View Profile" instead of "Artist Page" (#12813) Reed [365d66f] [QA-2296|QA-2298] RC QA Fixes (#12812) JD Francis [07378e7] [PE-6691] Show AUDIO card if user doesn't have any other assets (#12807) Farid Salau [143e376] [PE-6722] Only show badge that user created if they have one (#12806) Farid Salau [4828631] [PE-6641|PE-6642] Artist coin popover fixes (#12804) JD Francis [cdaa316] Fix connected wallet copying wrong address (#12805) JD Francis [4cf1222] [QA-2287] Use X handles in x shares (#12803) Reed [80ec4c6] [PE-6540] Fix artist coin blast logos (#12798) Reed [d6e82d5] Fix flakey ampm test (#12778) Ray Jacobson [9726cb7] [PE-6716] Fix AssetDetailsPage wrong bottom padding (#12802) Reed [c0b6b6a] [PE-6745] Change 'likes' to 'favorites' on remix sort dropdown (#12796) Reed [a70db6e] [PE-6706] Fix userbadge gap (#12801) Reed [dd249a7] Several QA fixes and UI updates (#12795) Farid Salau [31710a0] [PE-6742] Make swaps work for low liquidity AUDIO pair coins (#12786) Farid Salau [ac41903] [PE-6731] Update discord oauth url (#12799) JD Francis [6e2df32] [PE-6681] Fix DMs Header right padding issue (#12800) KJ [84ae6cb] [QA-2255] Fix android playback issue (#12797) JD Francis [6faaad9] [PE-6708][PE-6713] Fixes to artist coin members leaderboard (#12794) JD Francis

faridsalau · 2025-08-21T12:56:54Z

Description

This PR implements a double swap functionality for Jupiter token swaps, allowing tokens to be swapped through an intermediary token (AUDIO) when direct swaps are not available or optimal. This enhances the token swap capabilities by providing an alternative routing mechanism.

Changes

Package Updates

Upgraded @jup-ag/api from version 6.0.6 to 6.0.44 across both packages/common and packages/web
Updated package-lock.json to reflect the new dependency versions

New Files Added

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

Implements direct token swap functionality using Jupiter
Handles single-hop swaps between input and output tokens
Includes proper cleanup of temporary ATAs (Associated Token Accounts)
Returns swap results with transaction signatures and amount information

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

Implements double swap functionality using AUDIO as intermediary token
Performs two sequential swaps: InputToken → AUDIO → OutputToken
Handles creation and cleanup of intermediate ATAs
Manages two separate transactions for the swap chain
Returns both transaction signatures for debugging purposes

Technical Details

Double Swap Flow

First Transaction: InputToken → AUDIO
- Transfer input tokens from user bank to temporary ATA
- Execute Jupiter swap to AUDIO
- Store AUDIO in intermediate ATA
- Clean up input token ATA
Second Transaction: AUDIO → OutputToken
- Use AUDIO from intermediate ATA
- Execute Jupiter swap to output token
- Transfer output tokens to user bank
- Clean up intermediate AUDIO ATA

How Has This Been Tested?

npm run web:prod and perform a swap between TCONE and TCONE2

changeset-bot · 2025-08-21T12:56:59Z

⚠️ No Changeset found

Latest commit: 7694f4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-08-21T12:58:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	npm/@apollo/utils.removealiases@2.0.1
	npm/@babel/plugin-proposal-class-static-block@7.21.0
	npm/@babel/helper-plugin-utils@7.25.9 ⏵ 7.26.5
	npm/@apollo/utils.printwithreducedwhitespace@2.0.1
	npm/@babel/helper-validator-option@7.22.15 ⏵ 7.27.1
	npm/@babel/highlight@7.22.20 ⏵ 7.23.4
	npm/@apollo/utils.sortast@2.0.1
	npm/@babel/preset-typescript@7.22.15
	npm/@babel/helper-validator-identifier@7.25.9 ⏵ 7.27.1
	npm/@babel/helper-function-name@7.22.5 ⏵ 7.23.0
	npm/@babel/register@7.7.0
	npm/@babel/code-frame@7.22.13 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-runtime@7.18.2
	npm/@babel/helper-compilation-targets@7.22.15 ⏵ 7.27.1			⁺¹	⁺⁴
	npm/@apollo/utils.stripsensitiveliterals@2.0.1
	npm/@babel/helper-module-imports@7.22.15 ⏵ 7.27.1			⁺¹
	npm/@babel/plugin-transform-react-jsx@7.21.0
	npm/@apollo/utils.dropunuseddefinitions@2.0.1
	npm/@babel/template@7.22.15 ⏵ 7.27.1	⁺¹		⁺¹
	npm/@babel/helper-define-polyfill-provider@0.3.3
	npm/@apollo/utils.usagereporting@2.1.0
	npm/@babel/cli@7.7.0
	npm/@babel/preset-env@7.22.15
	npm/@audius/fetch-nft@0.2.8
	npm/@babel/helper-module-transforms@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁵
	npm/@babel/parser@7.22.16 ⏵ 7.27.1			^-3
	npm/@babel/compat-data@7.22.20 ⏵ 7.27.1	⁺¹		⁺¹	⁺⁴
	npm/@audius/hedgehog@2.1.0 ⏵ 3.0.0-alpha.1	⁺²
	npm/@apollo/utils.logger@2.0.1
	npm/@audius/stems@0.3.10
	npm/@babel/generator@7.22.15 ⏵ 7.27.1			⁺¹	⁺²
	npm/@babel/traverse@7.22.20 ⏵ 7.27.1	⁺¹	⁺⁷⁵	⁺¹
See 16 more rows in the dashboard

View full report

socket-security · 2025-08-21T12:58:27Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/form-data@4.0.1` has a Critical CVE. CVE:GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From:package-lock.json → `npm/form-data@4.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

faridsalau · 2025-08-22T16:54:23Z

 "@audius/sdk": "*",
 "@fingerprintjs/fingerprintjs-pro": "3.5.6",
- "@jup-ag/api": "6.0.6",
+ "@jup-ag/api": "6.0.44",


most recent version. had to update to get dynamicSlippage

raymondjacobson

sorry for the slow review here, thought I submitted friday!

raymondjacobson · 2025-08-22T16:58:39Z

@@ -0,0 +1,239 @@
+import { SwapRequest } from '@jup-ag/api'


nit, i think this would be more self evident if it was named indirectSwap or indirectSwapThroughAudio

raymondjacobson · 2025-08-22T17:00:46Z

+ * Attempts to get a direct quote from Jupiter for the given token pair.
+ * Returns true if a direct quote is available, false otherwise.
+ */
+const isDirectRouteAvailable = async (


good helper

raymondjacobson · 2025-08-25T19:45:27Z

 }
+
+const SWAP_LOOKUP_TABLE_ADDRESS = new PublicKey(
+ '2WB87JxGZieRd7hi3y87wq6HAsPLyb9zrSx8B5z1QEzM'


what is this address?

address lookup table that we setup for swaps

[2ea203a] Finalize send audio flow (#12824) Dylan Jeffers [538bbb2] [PE-6773] Make indirect swaps use userbanks for all interactions and use confirmed for commitment level (#12825) Farid Salau [2a7161a] [QA-2313] Fix receive button on audio page (#12823) Dylan Jeffers [cb15e5e] Hide tier for official Audius account (#12819) Reed [84c191e] [PE-6710] Fix optimistic updates after token swaps (#12818) Reed [4a3cff0] [PE-6752][PE-6697] Swap flow QA updates (#12811) Farid Salau [30bb833] [QA-2295] Fix web chat messages getting cut off (#12817) Reed [c1a9683] [PE-6737] Connect the buy/sell flow to the mobile coin details balance card (#12808) KJ [5b3b909] Fix audio matching copy that got missed (#12816) Randy Schott [ca80e02] Fix explore screen feature flags (#12815) Dylan Jeffers [0b26b53] [QA-2255] Fix mobile lineup & playback bugs (continues playing same track after playing a new lineup page) (#12814) JD Francis [9f8b7dc] [QA-2299] "View Profile" instead of "Artist Page" (#12813) Reed [365d66f] [QA-2296|QA-2298] RC QA Fixes (#12812) JD Francis [07378e7] [PE-6691] Show AUDIO card if user doesn't have any other assets (#12807) Farid Salau [143e376] [PE-6722] Only show badge that user created if they have one (#12806) Farid Salau [4828631] [PE-6641|PE-6642] Artist coin popover fixes (#12804) JD Francis [cdaa316] Fix connected wallet copying wrong address (#12805) JD Francis [4cf1222] [QA-2287] Use X handles in x shares (#12803) Reed [80ec4c6] [PE-6540] Fix artist coin blast logos (#12798) Reed [d6e82d5] Fix flakey ampm test (#12778) Ray Jacobson [9726cb7] [PE-6716] Fix AssetDetailsPage wrong bottom padding (#12802) Reed [c0b6b6a] [PE-6745] Change 'likes' to 'favorites' on remix sort dropdown (#12796) Reed [a70db6e] [PE-6706] Fix userbadge gap (#12801) Reed [dd249a7] Several QA fixes and UI updates (#12795) Farid Salau [31710a0] [PE-6742] Make swaps work for low liquidity AUDIO pair coins (#12786) Farid Salau [ac41903] [PE-6731] Update discord oauth url (#12799) JD Francis [6e2df32] [PE-6681] Fix DMs Header right padding issue (#12800) KJ [84ae6cb] [QA-2255] Fix android playback issue (#12797) JD Francis [6faaad9] [PE-6708][PE-6713] Fixes to artist coin members leaderboard (#12794) JD Francis

faridsalauand others added 10 commits August 19, 2025 16:23

Add check for instruction type
a3931af

Improve direct dbc swaps
52a30d7

Undo env var change
43bd8ab

Small updates
16f5a65

Merge branch 'main' into fs-ac-relay
9276540

Update tests
283b6b2

Add double swap
9c474ad

Add double swaps
6adbeb8

Merge branch 'main' into fs-ac-double-swap
8c912be

Fix merge
32c7d15

pull-request-sizeBot added the size/XL label Aug 21, 2025

faridsalau added 3 commits August 21, 2025 11:57

Rename functions
ae95813

Remove comments
cd77c3d

Merge branch 'main' into fs-ac-double-swap
160b091

raymondjacobson reviewed Aug 21, 2025
View reviewed changes

Comment threadpackages/common/src/api/tan-query/jupiter/useSwapTokens.ts Outdated

faridsalau added 3 commits August 22, 2025 08:31

Address comment
44de759

Update to only wait for finalized under certain conditions
197cc79

Merge branch 'main' into fs-ac-double-swap
d20003f

faridsalau changed the title ~~Fs ac double swap~~[PE-6742] Make swaps work for low liquidity AUDIO pair coins Aug 22, 2025

faridsalau commented Aug 22, 2025
View reviewed changes

faridsalau marked this pull request as ready for review August 22, 2025 16:56

faridsalau requested review from dharit-tan and raymondjacobson August 22, 2025 16:56

Remove unused instruction
7694f4b

raymondjacobson approved these changes Aug 25, 2025
View reviewed changes

raymondjacobson reviewed Aug 25, 2025
View reviewed changes

faridsalau merged commit 31710a0 into mainAug 26, 2025
8 of 12 checks passed

faridsalau deleted the fs-ac-double-swap branch August 26, 2025 15:18

faridsalauand others added 10 commits August 19, 2025 16:23

Add check for instruction type
a3931af

Improve direct dbc swaps
52a30d7

Undo env var change
43bd8ab

Small updates
16f5a65

Merge branch 'main' into fs-ac-relay
9276540

Update tests
283b6b2

Add double swap
9c474ad

Add double swaps
6adbeb8

Merge branch 'main' into fs-ac-double-swap
8c912be

Fix merge
32c7d15

pull-request-sizeBot added the size/XL label Aug 21, 2025

faridsalau added 3 commits August 21, 2025 11:57

Rename functions
ae95813

Remove comments
cd77c3d

Merge branch 'main' into fs-ac-double-swap
160b091

raymondjacobson reviewed Aug 21, 2025
View reviewed changes

Comment threadpackages/common/src/api/tan-query/jupiter/useSwapTokens.ts Outdated

faridsalau added 3 commits August 22, 2025 08:31

Address comment
44de759

Update to only wait for finalized under certain conditions
197cc79

Merge branch 'main' into fs-ac-double-swap
d20003f

faridsalau changed the title ~~Fs ac double swap~~[PE-6742] Make swaps work for low liquidity AUDIO pair coins Aug 22, 2025

faridsalau commented Aug 22, 2025
View reviewed changes

faridsalau marked this pull request as ready for review August 22, 2025 16:56

faridsalau requested review from dharit-tan and raymondjacobson August 22, 2025 16:56

Remove unused instruction
7694f4b

raymondjacobson approved these changes Aug 25, 2025
View reviewed changes

raymondjacobson reviewed Aug 25, 2025
View reviewed changes

faridsalau merged commit 31710a0 into mainAug 26, 2025
8 of 12 checks passed

faridsalau deleted the fs-ac-double-swap branch August 26, 2025 15:18

faridsalauand others added 10 commits August 19, 2025 16:23

Add check for instruction type
a3931af

Improve direct dbc swaps
52a30d7

Undo env var change
43bd8ab

Small updates
16f5a65

Merge branch 'main' into fs-ac-relay
9276540

Update tests
283b6b2

Add double swap
9c474ad

Add double swaps
6adbeb8

Merge branch 'main' into fs-ac-double-swap
8c912be

Fix merge
32c7d15

pull-request-sizeBot added the size/XL label Aug 21, 2025

faridsalau added 3 commits August 21, 2025 11:57

Rename functions
ae95813

Remove comments
cd77c3d

Merge branch 'main' into fs-ac-double-swap
160b091

raymondjacobson reviewed Aug 21, 2025
View reviewed changes

Comment threadpackages/common/src/api/tan-query/jupiter/useSwapTokens.ts Outdated

faridsalau added 3 commits August 22, 2025 08:31

Address comment
44de759

Update to only wait for finalized under certain conditions
197cc79

Merge branch 'main' into fs-ac-double-swap
d20003f

faridsalau changed the title ~~Fs ac double swap~~[PE-6742] Make swaps work for low liquidity AUDIO pair coins Aug 22, 2025

faridsalau commented Aug 22, 2025
View reviewed changes

faridsalau marked this pull request as ready for review August 22, 2025 16:56

faridsalau requested review from dharit-tan and raymondjacobson August 22, 2025 16:56

Remove unused instruction
7694f4b

raymondjacobson approved these changes Aug 25, 2025
View reviewed changes

raymondjacobson reviewed Aug 25, 2025
View reviewed changes

faridsalau merged commit 31710a0 into mainAug 26, 2025
8 of 12 checks passed

faridsalau deleted the fs-ac-double-swap branch August 26, 2025 15:18

faridsalauand others added 10 commits August 19, 2025 16:23

Add check for instruction type
a3931af

Improve direct dbc swaps
52a30d7

Undo env var change
43bd8ab

Small updates
16f5a65

Merge branch 'main' into fs-ac-relay
9276540

Update tests
283b6b2

Add double swap
9c474ad

Add double swaps
6adbeb8

Merge branch 'main' into fs-ac-double-swap
8c912be

Fix merge
32c7d15

pull-request-sizeBot added the size/XL label Aug 21, 2025

faridsalau added 3 commits August 21, 2025 11:57

Rename functions
ae95813

Remove comments
cd77c3d

Merge branch 'main' into fs-ac-double-swap
160b091

raymondjacobson reviewed Aug 21, 2025
View reviewed changes

Comment threadpackages/common/src/api/tan-query/jupiter/useSwapTokens.ts Outdated

faridsalau added 3 commits August 22, 2025 08:31

Address comment
44de759

Update to only wait for finalized under certain conditions
197cc79

Merge branch 'main' into fs-ac-double-swap
d20003f

faridsalau changed the title ~~Fs ac double swap~~[PE-6742] Make swaps work for low liquidity AUDIO pair coins Aug 22, 2025

faridsalau commented Aug 22, 2025
View reviewed changes

faridsalau marked this pull request as ready for review August 22, 2025 16:56

faridsalau requested review from dharit-tan and raymondjacobson August 22, 2025 16:56

Remove unused instruction
7694f4b

raymondjacobson approved these changes Aug 25, 2025
View reviewed changes

raymondjacobson reviewed Aug 25, 2025
View reviewed changes

faridsalau merged commit 31710a0 into mainAug 26, 2025
8 of 12 checks passed

faridsalau deleted the fs-ac-double-swap branch August 26, 2025 15:18

faridsalauand others added 10 commits August 19, 2025 16:23

Add check for instruction type
a3931af

Improve direct dbc swaps
52a30d7

Undo env var change
43bd8ab

Small updates
16f5a65

Merge branch 'main' into fs-ac-relay
9276540

Update tests
283b6b2

Add double swap
9c474ad

Add double swaps
6adbeb8

Merge branch 'main' into fs-ac-double-swap
8c912be

Fix merge
32c7d15

pull-request-sizeBot added the size/XL label Aug 21, 2025

faridsalau added 3 commits August 21, 2025 11:57

Rename functions
ae95813

Remove comments
cd77c3d

Merge branch 'main' into fs-ac-double-swap
160b091

raymondjacobson reviewed Aug 21, 2025
View reviewed changes

Comment threadpackages/common/src/api/tan-query/jupiter/useSwapTokens.ts Outdated

faridsalau added 3 commits August 22, 2025 08:31

Address comment
44de759

Update to only wait for finalized under certain conditions
197cc79

Merge branch 'main' into fs-ac-double-swap
d20003f

faridsalau changed the title ~~Fs ac double swap~~[PE-6742] Make swaps work for low liquidity AUDIO pair coins Aug 22, 2025

faridsalau commented Aug 22, 2025
View reviewed changes

faridsalau marked this pull request as ready for review August 22, 2025 16:56

faridsalau requested review from dharit-tan and raymondjacobson August 22, 2025 16:56

Remove unused instruction
7694f4b

raymondjacobson approved these changes Aug 25, 2025
View reviewed changes

raymondjacobson reviewed Aug 25, 2025
View reviewed changes

faridsalau merged commit 31710a0 into mainAug 26, 2025
8 of 12 checks passed

faridsalau deleted the fs-ac-double-swap branch August 26, 2025 15:18

faridsalauand others added 10 commits August 19, 2025 16:23

Add check for instruction type
a3931af

Improve direct dbc swaps
52a30d7

Undo env var change
43bd8ab

Small updates
16f5a65

Merge branch 'main' into fs-ac-relay
9276540

Update tests
283b6b2

Add double swap
9c474ad

Add double swaps
6adbeb8

Merge branch 'main' into fs-ac-double-swap
8c912be

Fix merge
32c7d15

pull-request-sizeBot added the size/XL label Aug 21, 2025

faridsalau added 3 commits August 21, 2025 11:57

Rename functions
ae95813

Remove comments
cd77c3d

Merge branch 'main' into fs-ac-double-swap
160b091

raymondjacobson reviewed Aug 21, 2025
View reviewed changes

Comment threadpackages/common/src/api/tan-query/jupiter/useSwapTokens.ts Outdated

faridsalau added 3 commits August 22, 2025 08:31

Address comment
44de759

Update to only wait for finalized under certain conditions
197cc79

Merge branch 'main' into fs-ac-double-swap
d20003f

faridsalau changed the title ~~Fs ac double swap~~[PE-6742] Make swaps work for low liquidity AUDIO pair coins Aug 22, 2025

faridsalau commented Aug 22, 2025
View reviewed changes

faridsalau marked this pull request as ready for review August 22, 2025 16:56

faridsalau requested review from dharit-tan and raymondjacobson August 22, 2025 16:56

Remove unused instruction
7694f4b

raymondjacobson approved these changes Aug 25, 2025
View reviewed changes

raymondjacobson reviewed Aug 25, 2025
View reviewed changes

faridsalau merged commit 31710a0 into mainAug 26, 2025
8 of 12 checks passed

faridsalau deleted the fs-ac-double-swap branch August 26, 2025 15:18

faridsalauand others added 10 commits August 19, 2025 16:23

Add check for instruction type
a3931af

Improve direct dbc swaps
52a30d7

Undo env var change
43bd8ab

Small updates
16f5a65

Merge branch 'main' into fs-ac-relay
9276540

Update tests
283b6b2

Add double swap
9c474ad

Add double swaps
6adbeb8

Merge branch 'main' into fs-ac-double-swap
8c912be

Fix merge
32c7d15

pull-request-sizeBot added the size/XL label Aug 21, 2025

faridsalau added 3 commits August 21, 2025 11:57

Rename functions
ae95813

Remove comments
cd77c3d

Merge branch 'main' into fs-ac-double-swap
160b091

raymondjacobson reviewed Aug 21, 2025
View reviewed changes

Comment threadpackages/common/src/api/tan-query/jupiter/useSwapTokens.ts Outdated

faridsalau added 3 commits August 22, 2025 08:31

Address comment
44de759

Update to only wait for finalized under certain conditions
197cc79

Merge branch 'main' into fs-ac-double-swap
d20003f

faridsalau changed the title ~~Fs ac double swap~~[PE-6742] Make swaps work for low liquidity AUDIO pair coins Aug 22, 2025

faridsalau commented Aug 22, 2025
View reviewed changes

faridsalau marked this pull request as ready for review August 22, 2025 16:56

faridsalau requested review from dharit-tan and raymondjacobson August 22, 2025 16:56

Remove unused instruction
7694f4b

raymondjacobson approved these changes Aug 25, 2025
View reviewed changes

raymondjacobson reviewed Aug 25, 2025
View reviewed changes

faridsalau merged commit 31710a0 into mainAug 26, 2025
8 of 12 checks passed

faridsalau deleted the fs-ac-double-swap branch August 26, 2025 15:18

faridsalauand others added 10 commits August 19, 2025 16:23

Add check for instruction type
a3931af

Improve direct dbc swaps
52a30d7

Undo env var change
43bd8ab

Small updates
16f5a65

Merge branch 'main' into fs-ac-relay
9276540

Update tests
283b6b2

Add double swap
9c474ad

Add double swaps
6adbeb8

Merge branch 'main' into fs-ac-double-swap
8c912be

Fix merge
32c7d15

pull-request-sizeBot added the size/XL label Aug 21, 2025

faridsalau added 3 commits August 21, 2025 11:57

Rename functions
ae95813

Remove comments
cd77c3d

Merge branch 'main' into fs-ac-double-swap
160b091

raymondjacobson reviewed Aug 21, 2025
View reviewed changes

Comment threadpackages/common/src/api/tan-query/jupiter/useSwapTokens.ts Outdated

faridsalau added 3 commits August 22, 2025 08:31

Address comment
44de759

Update to only wait for finalized under certain conditions
197cc79

Merge branch 'main' into fs-ac-double-swap
d20003f

faridsalau changed the title ~~Fs ac double swap~~[PE-6742] Make swaps work for low liquidity AUDIO pair coins Aug 22, 2025

faridsalau commented Aug 22, 2025
View reviewed changes

faridsalau marked this pull request as ready for review August 22, 2025 16:56

faridsalau requested review from dharit-tan and raymondjacobson August 22, 2025 16:56

Remove unused instruction
7694f4b

raymondjacobson approved these changes Aug 25, 2025
View reviewed changes

raymondjacobson reviewed Aug 25, 2025
View reviewed changes

faridsalau merged commit 31710a0 into mainAug 26, 2025
8 of 12 checks passed

faridsalau deleted the fs-ac-double-swap branch August 26, 2025 15:18

Uh oh!

Conversation

faridsalau commented Aug 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Package Updates

New Files Added

packages/common/src/api/tan-query/jupiter/directSwap.ts

packages/common/src/api/tan-query/jupiter/doubleSwap.ts

Technical Details

Double Swap Flow

How Has This Been Tested?

Uh oh!

changeset-botBot commented Aug 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

socket-securityBot commented Aug 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-securityBot commented Aug 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

raymondjacobson left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

faridsalau commented Aug 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Package Updates

New Files Added

packages/common/src/api/tan-query/jupiter/directSwap.ts

packages/common/src/api/tan-query/jupiter/doubleSwap.ts

Technical Details

Double Swap Flow

How Has This Been Tested?

Uh oh!

changeset-botBot commented Aug 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

socket-securityBot commented Aug 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-securityBot commented Aug 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

raymondjacobson left a comment

Choose a reason for hiding this comment

faridsalau commented Aug 21, 2025•
edited
Loading

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

changeset-botBot commented Aug 21, 2025•
edited
Loading

socket-securityBot commented Aug 21, 2025•
edited
Loading

socket-securityBot commented Aug 21, 2025•
edited
Loading

faridsalau commented Aug 21, 2025•
edited
Loading

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

changeset-botBot commented Aug 21, 2025•
edited
Loading

socket-securityBot commented Aug 21, 2025•
edited
Loading

socket-securityBot commented Aug 21, 2025•
edited
Loading

faridsalau commented Aug 21, 2025•
edited
Loading

`packages/common/src/api/tan-query/jupiter/directSwap.ts`

`packages/common/src/api/tan-query/jupiter/doubleSwap.ts`

changeset-botBot commented Aug 21, 2025•
edited
Loading

socket-securityBot commented Aug 21, 2025•
edited
Loading

socket-securityBot commented Aug 21, 2025•
edited
Loading