fix(quasar): use transfer_checked in finance programs#101
Merged
Conversation
…tures Raw .transfer() omits the mint and decimals, so a wrong-mint or wrong-decimals token account would be caught only by downstream balance checks (or not at all). transfer_checked carries the mint and decimals through the CPI, matching the Anchor twins and the lending/quasar program. Each call now passes the mint whose token accounts are being moved and its .decimals(); token conservation and vault invariants are unchanged. Verified with cargo check on all three crates (QuasarSVM tests run in CI). token-fundraiser needs its mint threaded into three instruction structs and is handled separately.
Unlike the other finance programs, token-fundraiser's contribute/refund/ check_contributions instructions had no mint account in scope, so the transfer CPIs could not be checked. Thread the fundraiser's mint through each instruction: add `mint_to_raise: Account<Mint>` bound to `Fundraiser.mint_to_raise` via has_one, then transfer_checked with its decimals. The generated client picks up the new account automatically; the LiteSVM tests pass it via fixture.mint. Program verified with cargo check (lib); QuasarSVM tests run in CI, which regenerates the client with the added account.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The Quasar finance programs moved tokens with raw
.transfer(), which omits the mint and decimals from the CPI.transfer_checkedcarries both, so a wrong-mint or wrong-decimals token account fails the CPI instead of being caught only by downstream balance checks (or not at all). This matches the Anchor twins and thelending/quasarprogram, which already usedtransfer_checked.Converted all raw token transfers in:
collateral_mint)Each call now passes the mint whose token accounts are being moved and its
.decimals()..burn/.mint_to/.close_accountCPIs are untouched.token-fundraiser needed an account added
Its contribute/refund/check_contributions instructions had no mint in scope, so each gained a
mint_to_raise: Account<Mint>bound toFundraiser.mint_to_raiseviahas_one(validated against stored state, not caller-supplied). The generated client picks up the new account automatically; the LiteSVM tests pass it viafixture.mint.Verification
cargo checkpasses on all four crates (token-fundraiser via--lib, since its tests depend on thequasar build-generated client). The Quasar CI (quasar build+cargo testunder QuasarSVM) exercises the full behavior — token conservation and vault invariants are unchanged.🤖 Generated with Claude Code