') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix: verify mint and owner in idempotent ATA early return by ananas-block · Pull Request #2255 · Lightprotocol/light-protocol · GitHub
Skip to content

fix: verify mint and owner in idempotent ATA early return - #2255

Closed
ananas-block wants to merge 3 commits into
mainfrom
fix/audit-issue-4-idempotent-ata-checks
Closed

fix: verify mint and owner in idempotent ATA early return#2255
ananas-block wants to merge 3 commits into
mainfrom
fix/audit-issue-4-idempotent-ata-checks

Conversation

@ananas-block

@ananas-blockananas-block commented Feb 6, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Add mint and owner validation in the idempotent ATA early return path so that an existing account for a different mint/owner is not silently accepted.

Summary by CodeRabbit

Bug Fixes

  • Implemented validation checks during token account creation to verify that stored mint and owner values align with requested values. Detects and prevents mismatches, reporting failures clearly to maintain data integrity and ensure correct token account configurations.

@ananas-block
fix: verify mint and owner in idempotent ATA early return
f40e048
Audit issue #4 (LOW): The idempotent ATA path returned Ok() when the
account was already owned by the program without verifying the stored
mint and owner matched the requested values. Add Token deserialization
and field checks before the early return.
@ananas-block
chore: format
331d3a9
@coderabbitai

coderabbitaiBot commented Feb 6, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor
📝 Walkthrough

Walkthrough

This change adds runtime verification to the idempotent ATA creation path by validating that stored mint and owner match requested values. If either field mismatches, a specific error is emitted; if both match, execution continues as before.

Changes

Cohort / File(s)Summary
ATA Creation Validation
programs/compressed-token/program/src/ctoken/create_ata.rs		Added pubkey_eq import and runtime verification logic in the idempotent path to compare stored mint and owner against requested values, emitting "MintMismatch" or "OwnerMismatch" errors on failure.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Suggested labels

ai-review

Suggested reviewers

  • sergeytimoshin
  • SwenSchaeferjohann

Poem

🔐 A token's identity now stands guard,
Idempotent paths less scarred,
Mint and owner locked in place—
No silent mismatches win this race! ✨

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title accurately describes the main change: adding verification of mint and owner values in the idempotent ATA early return path, which is the core security fix addressed in the changeset.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 70.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/audit-issue-4-idempotent-ata-checks

No actionable comments were generated in the recent review. 🎉

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@ananas-blockananas-block mentioned this pull request Feb 9, 2026
Merged
@ananas-block

ananas-block commented Feb 9, 2026

Copy link
Copy Markdown
ContributorAuthor

Superseded by #2249 which combines issues #3, #4, and #15.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ananas-block