') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); Swen dev v4 cli pt 1/x by SwenSchaeferjohann · Pull Request #15 · Lightprotocol/light-protocol · GitHub
Skip to content

Swen dev v4 cli pt 1/x - #15

Merged
ananas-block merged 62 commits into
mainfrom
swen-dev_v4-cli
Feb 18, 2023
Merged

Swen dev v4 cli pt 1/x#15
ananas-block merged 62 commits into
mainfrom
swen-dev_v4-cli

Conversation

@SwenSchaeferjohann

@SwenSchaeferjohannSwenSchaeferjohann commented Feb 12, 2023•
edited
Loading

Copy link
Copy Markdown
Contributor

will open up new cli-subtask branch after this is merged ( cli needs be extended, spl,relayer etc)
tests(functional_tests) and cli (user class, all cmds) are all running.

edit:

Summary of changes

  • Added relayer dir (wie)
  • Added CLI (tested)
  • Sdk:
    • Extended user class
    • Added provider class
    • Transaction class and tx params working with node/browsercontext
    • keypair class -> account class

Qs:

  • Verifiers0,1: need check for payer/wallet still?

ananas-blockand others added 30 commits June 2, 2022 00:24
@ananas-block
added closing tmp account
57cffca
@ananas-block
removed warning
8280e9d
Swen
merged pull without fast-forward. updated gitignore, added cli/ dir
be69f83
Swen
Merge branch 'main' of github.com:Lightprotocol/light-protocol-onchain
c09f1f6
Swen
added base cli layout
4f29d40
Swen
olved merge conflicts in lockfiles taging
9e63294
Swen
removed sdk-ts/lib folder, added cli staging
a6926aa
Swen
added: newwallet, register, login, todo: fetchutxos
ce92bac
Swen
again removed light-sdk-ts/lib staging: built ts
bcd48b1
Swen
rm n Please enter the commit message for your changes. Lines starting
92635ff
Swen
rmd lib li cleanup, refactor
36fa655
Swen
cli done: shield,unshield,etc. (TODO: transfer add shielded pubkey re…
e3abd68
…cipient or do a lookup)
Swen
rm
6c15ea6
Swen
commands working, layout wise done TODO: debug onchain, debug: getut…
07e0ef7
…xosel, inutxos, oututxos
removed lib
Swen
removed lookuptable.txt
ad7d685
Swen
upd to yarn, debugging version mismatch - took current pckjsons (HEAD)
44379f1
Swen
added verifiertests
4ccbf53
Swen
shield, unshield non-SPL working. resolved merkletree build. TODO: tr…
5cd4bae
…ansfer., SPL, 10-inUtxos
Swen
applied transaction rebase
7560a63
Swen
rebased tx
0fba8b6
Swen
extended readme, log cleanup, rm some repeated calls
dac67a2
Swen
readme: /relayer wip
0600b1c
Swen
latest
023f712
Swen
cleanup
f148882
Swen
tmp merge tx
d838219
Swen
removed keypair import in buildbalance.ts
b87a29f
Swen
merged: .relayer -> .params.relayer ++ instance -> provider
e104221
Swen
added verif0 -> provider.browserwallet err (is this required?)
48187a1
Swen
added verif1: wallet check (still required?) + functional_tests -> us…
43b3352
…ing new Tx class
Swen
cli and onchain tests all running.
77618c7
ananas-block
ananas-block reviewed Feb 17, 2023
View reviewed changes
Comment threadlight-system-programs/programs/merkle_tree_program/src/lib.rs Outdated
ananas-block
ananas-block reviewed Feb 17, 2023
View reviewed changes
Comment threadlight-system-programs/tests/verifier_tests.ts
@@ -19,7 +19,6 @@ import {
merkleTreeProgramId,

@ananas-blockananas-blockFeb 17, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this file impossible to review

@ananas-block

ananas-block commented Feb 18, 2023

Copy link
Copy Markdown
Contributor

the js files are still in the tests folder ...

@ananas-block
ananas-block merged commit 9c405a2 into mainFeb 18, 2023
@vadorovsky
vadorovsky deleted the swen-dev_v4-cli branch November 12, 2023 20:36
vadorovsky pushed a commit to vadorovsky/light-protocol that referenced this pull request May 1, 2024
@ananas-block
Merge pull requestLightprotocol#15from Lightprotocol/swen-dev_v4-cli
f01452b
Swen dev v4 cli pt 1/x
ananas-block added a commit that referenced this pull request Feb 6, 2026
@ananas-block
fix: enforce canonical bump in PDA verification
cdafb79
Audit issue #15 (HIGH): verify_pda used derive_address which accepts
any bump seed, allowing non-canonical bumps for ATAs. Switch to
find_program_address to derive the canonical bump and reject any
non-canonical bump with InvalidSeeds error.
This was referenced Feb 6, 2026
Merged
Closed
Closed
ananas-block added a commit that referenced this pull request Feb 9, 2026
@ananas-block
fix: remove bump from ATA instruction data and derive canonical bump …
6833acc
…on-chain
Remove client-provided bump from CreateAssociatedTokenAccountInstructionData
and all SDK/test callers. The on-chain program now derives the canonical bump
via find_program_address, preventing non-canonical bump attacks (audit #15).
- Remove bump field from instruction data structs
- Update verify_pda to derive canonical bump and return it
- Update validate_ata_derivation and decompress_mint callers
- Remove _with_bump SDK variants and ATA2 dead code
- Remove associated_token::bump from macro attribute support
- Update derive_associated_token_account to return Pubkey only
- Update all 100+ call sites across SDK, tests, and TypeScript
ananas-block added a commit that referenced this pull request Feb 11, 2026
@ananas-block
fix: enforce canonical bump in PDA verification
e03ec34
Audit issue #15 (HIGH): verify_pda used derive_address which accepts
any bump seed, allowing non-canonical bumps for ATAs. Switch to
find_program_address to derive the canonical bump and reject any
non-canonical bump with InvalidSeeds error.
ananas-block added a commit that referenced this pull request Feb 11, 2026
@ananas-block
fix: remove bump from ATA instruction data and derive canonical bump …
76a2a44
…on-chain
Remove client-provided bump from CreateAssociatedTokenAccountInstructionData
and all SDK/test callers. The on-chain program now derives the canonical bump
via find_program_address, preventing non-canonical bump attacks (audit #15).
- Remove bump field from instruction data structs
- Update verify_pda to derive canonical bump and return it
- Update validate_ata_derivation and decompress_mint callers
- Remove _with_bump SDK variants and ATA2 dead code
- Remove associated_token::bump from macro attribute support
- Update derive_associated_token_account to return Pubkey only
- Update all 100+ call sites across SDK, tests, and TypeScript
ananas-block added a commit that referenced this pull request Feb 11, 2026
@ananas-block
fix: enforce canonical bump in ata verification (#2249)
291933b
* fix: enforce canonical bump in PDA verification
Audit issue #15 (HIGH): verify_pda used derive_address which accepts
any bump seed, allowing non-canonical bumps for ATAs. Switch to
find_program_address to derive the canonical bump and reject any
non-canonical bump with InvalidSeeds error.
* fix: use pinocchio::pubkey::find_program_address instead of pinocchio_pubkey
* fix: remove bump from ATA instruction data and derive canonical bump on-chain
Remove client-provided bump from CreateAssociatedTokenAccountInstructionData
and all SDK/test callers. The on-chain program now derives the canonical bump
via find_program_address, preventing non-canonical bump attacks (audit #15).
- Remove bump field from instruction data structs
- Update verify_pda to derive canonical bump and return it
- Update validate_ata_derivation and decompress_mint callers
- Remove _with_bump SDK variants and ATA2 dead code
- Remove associated_token::bump from macro attribute support
- Update derive_associated_token_account to return Pubkey only
- Update all 100+ call sites across SDK, tests, and TypeScript
* fix: update wrong bump test for canonical bump derivation
With canonical bumps, the program derives the bump internally so
providing a wrong bump is no longer possible. Replace with a test
that passes a wrong ATA address to verify PDA validation.
* fix test
* fix lint
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ananas-blockananas-blockananas-block left review comments
+1 more reviewer
@vadorovskyvadorovskyvadorovsky left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@SwenSchaeferjohann@ananas-block@vadorovsky