solana: add recovery flow

ci_tests/src/index.ts

@@ -330,6 +330,15 @@ async function initSolana(
   });
   console.log("Initialized ntt at", manager.program.programId.toString());
 
+  // NOTE: this is a hack. The next instruction will fail if we don't wait
+  // here, because the address lookup table is not yet available, despite
+  // the transaction having been confirmed.
+  // Looks like a bug, but I haven't investigated further. In practice, this
+  // won't be an issue, becase the address lookup table will have been
+  // created well before anyone is trying to use it, but we might want to be
+  // mindful in the deploy script too.
+  await new Promise((resolve) => setTimeout(resolve, 400));
+
   await manager.registerTransceiver({
     payer: SOL_PRIVATE_KEY,
     owner: SOL_PRIVATE_KEY,

solana/Anchor.toml

@@ -7,9 +7,10 @@ seeds = false
 skip-lint = false
 
 [programs.localnet]
+dummy_transfer_hook = "BgabMDLaxsyB7eGMBt9L22MSk9KMrL4zY2iNe14kyFP5"
 example_native_token_transfers = "nttiK1SepaQt6sZ4WGW5whvc9tEnGXGxuKeptcQPCcS"
-wormhole_governance = "wgvEiKVzX9yyEoh41jZAdC6JqGUTS4CFXbFGBV5TKdZ"
 ntt_quoter = "9jFBLvMZZERVmeY4tbq5MejbXRE18paGEuoB6xVJZgGe"
+wormhole_governance = "wgvEiKVzX9yyEoh41jZAdC6JqGUTS4CFXbFGBV5TKdZ"
 
 [registry]
 url = "https://api.apr.dev"
@@ -31,7 +32,10 @@ address = "worm2ZoG2kUd4vFXhvjh93UUH596ayRfgQ2MgjNMTth"
 program = "programs/example-native-token-transfers/tests/fixtures/mainnet_core_bridge.so"
 
 [test.validator]
+bind_address = "0.0.0.0"
 url = "https://api.mainnet-beta.solana.com"
+ledger = ".anchor/test-ledger"
+rpc_port = 8899
 ticks_per_slot = 16
 
 [[test.validator.account]]

solana/Cargo.toml

@@ -47,6 +47,7 @@ anchor-spl = "0.29.0"
 solana-program = "=1.18.10"
 solana-program-runtime = "=1.18.10"
 solana-program-test = "=1.18.10"
+solana-address-lookup-table-program = "=1.18.10"
 spl-token = "4.0.0"
 spl-token-2022 = "3.0.2"
 

solana/programs/dummy-transfer-hook/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "dummy-transfer-hook"
+version = "0.1.0"
+description = "Created with Anchor"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib", "lib"]
+name = "dummy_transfer_hook"
+
+[features]
+no-entrypoint = []
+no-idl = []
+no-log-ix-name = []
+cpi = ["no-entrypoint"]
+default = []
+mainnet = []
+solana-devnet = []
+tilt-devnet = []
+tilt-devnet2 = [ "tilt-devnet" ]
+
+[dependencies]
+anchor-lang.workspace = true
+anchor-spl.workspace = true
+solana-program.workspace = true
+spl-tlv-account-resolution = "0.6.3"
+spl-transfer-hook-interface = "0.6.3"

solana/programs/dummy-transfer-hook/Xargo.toml

@@ -0,0 +1,2 @@
+[target.bpfel-unknown-unknown.dependencies.std]
+features = []

solana/programs/dummy-transfer-hook/src/lib.rs

@@ -0,0 +1,171 @@
+use anchor_lang::prelude::*;
+use anchor_spl::{
+    associated_token::AssociatedToken,
+    token_interface::{Mint, TokenAccount, TokenInterface},
+};
+use spl_tlv_account_resolution::state::ExtraAccountMetaList;
+
+declare_id!("BgabMDLaxsyB7eGMBt9L22MSk9KMrL4zY2iNe14kyFP5");
+
+/// Index of the sender token account in the accounts passed to the transfer hook
+pub const SENDER_TOKEN_ACCOUNT_INDEX: u8 = 0;
+/// Index of the mint account in the accounts passed to the transfer hook
+pub const MINT_ACCOUNT_INDEX: u8 = 1;
+/// Index of the destination token account in the accounts passed to the transfer hook
+pub const DESTINATION_TOKEN_ACCOUNT_INDEX: u8 = 2;
+/// Index of the authority account in the accounts passed to the transfer hook
+pub const AUTHORITY_ACCOUNT_INDEX: u8 = 3;
+
+/// Number of extra accounts in the ExtraAccountMetaList account
+pub const EXTRA_ACCOUNTS_LEN: u8 = 2;
+
+#[program]
+pub mod dummy_transfer_hook {
+    use spl_tlv_account_resolution::{
+        account::ExtraAccountMeta, seeds::Seed, state::ExtraAccountMetaList,
+    };
+    use spl_transfer_hook_interface::instruction::{ExecuteInstruction, TransferHookInstruction};
+
+    use super::*;
+
+    pub fn initialize_extra_account_meta_list(
+        ctx: Context<InitializeExtraAccountMetaList>,
+    ) -> Result<()> {
+        let account_metas = vec![
+            ExtraAccountMeta::new_with_seeds(
+                &[
+                    Seed::Literal {
+                        bytes: "dummy_account".as_bytes().to_vec(),
+                    },
+                    // owner field of the sender token account
+                    Seed::AccountData {
+                        account_index: SENDER_TOKEN_ACCOUNT_INDEX,
+                        data_index: 32,
+                        length: 32,
+                    },
+                ],
+                false, // is_signer
+                false, // is_writable
+            )?,
+            ExtraAccountMeta::new_with_seeds(
+                &[Seed::Literal {
+                    bytes: "counter".as_bytes().to_vec(),
+                }],
+                false, // is_signer
+                true,  // is_writable
+            )?,
+        ];
+
+        assert_eq!(EXTRA_ACCOUNTS_LEN as usize, account_metas.len());
+
+        // initialize ExtraAccountMetaList account with extra accounts
+        ExtraAccountMetaList::init::<ExecuteInstruction>(
+            &mut ctx.accounts.extra_account_meta_list.try_borrow_mut_data()?,
+            &account_metas,
+        )?;
+
+        Ok(())
+    }
+
+    pub fn transfer_hook(ctx: Context<TransferHook>, _amount: u64) -> Result<()> {
+        ctx.accounts.counter.count += 1;
+        Ok(())
+    }
+
+    // NOTE: the CPI call makes that the token2022 program makes (naturally) does not
+    // follow the anchor calling convention, so we need to implement a fallback
+    // instruction to handle the custom instruction
+    pub fn fallback<'info>(
+        program_id: &Pubkey,
+        accounts: &'info [AccountInfo<'info>],
+        data: &[u8],
+    ) -> Result<()> {
+        let instruction = TransferHookInstruction::unpack(data)?;
+
+        // match instruction discriminator to transfer hook interface execute instruction
+        // token2022 program CPIs this instruction on token transfer
+        match instruction {
+            TransferHookInstruction::Execute { amount } => {
+                let amount_bytes = amount.to_le_bytes();
+
+                // invoke custom transfer hook instruction on our program
+                __private::__global::transfer_hook(program_id, accounts, &amount_bytes)
+            }
+            _ => Err(ProgramError::InvalidInstructionData.into()),
+        }
+    }
+}
+
+#[account]
+#[derive(InitSpace)]
+pub struct Counter {
+    pub count: u64,
+}
+
+#[derive(Accounts)]
+pub struct InitializeExtraAccountMetaList<'info> {
+    #[account(mut)]
+    payer: Signer<'info>,
+
+    /// CHECK: ExtraAccountMetaList Account, must use these seeds
+    #[account(
+        init,
+        payer = payer,
+        space = ExtraAccountMetaList::size_of(EXTRA_ACCOUNTS_LEN as usize)?,
+        seeds = [b"extra-account-metas", mint.key().as_ref()],
+        bump
+    )]
+    pub extra_account_meta_list: AccountInfo<'info>,
+    pub mint: InterfaceAccount<'info, Mint>,
+    pub token_program: Interface<'info, TokenInterface>,
+    pub associated_token_program: Program<'info, AssociatedToken>,
+
+    #[account(
+        init,
+        payer = payer,
+        space = 8 + Counter::INIT_SPACE,
+        seeds = [b"counter"],
+        bump
+    )]
+    pub counter: Account<'info, Counter>,
+
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+/// NOTE: this is just a dummy transfer hook to test that the accounts are
+/// passed in correctly. Do NOT use this as a starting point in a real
+/// application, as it's not secure.
+pub struct TransferHook<'info> {
+    #[account(
+        token::mint = mint,
+    )]
+    pub source_token: InterfaceAccount<'info, TokenAccount>,
+    pub mint: InterfaceAccount<'info, Mint>,
+    #[account(
+        token::mint = mint,
+    )]
+    pub destination_token: InterfaceAccount<'info, TokenAccount>,
+    /// CHECK: source token account authority, can be SystemAccount or PDA owned by another program
+    pub authority: UncheckedAccount<'info>,
+    /// CHECK: ExtraAccountMetaList Account,
+    #[account(
+        seeds = [b"extra-account-metas", mint.key().as_ref()],
+        bump
+    )]
+    pub extra_account_meta_list: UncheckedAccount<'info>,
+    #[account(
+        seeds = [b"dummy_account", source_token.owner.as_ref()],
+        bump
+    )]
+    /// CHECK: dummy account. It just tests that the off-chain code correctly
+    /// computes and the on-chain code correctly passes on the PDA.
+    pub dummy_account: AccountInfo<'info>,
+
+    #[account(
+        mut,
+        seeds = [b"counter"],
+        bump
+    )]
+    pub counter: Account<'info, Counter>,
+}

solana/programs/example-native-token-transfers/Cargo.toml

@@ -9,15 +9,17 @@ crate-type = ["cdylib", "lib"]
 name = "example_native_token_transfers"
 
 [features]
-default = ["mainnet"]
+default = ["owner-recovery", "mainnet"]
 no-entrypoint = []
 no-idl = []
 no-log-ix-name = []
 cpi = ["no-entrypoint"]
 idl-build = [
   "anchor-lang/idl-build",
-  "anchor-spl/idl-build"
+  "anchor-spl/idl-build",
 ]
+# whether the owner can recover transactions
+owner-recovery = []
 # cargo-test-sbf will pass this along
 test-sbf = []
 # networks
@@ -38,6 +40,7 @@ bitmaps = "3.2.1"
 hex.workspace = true
 cfg-if.workspace = true
 solana-program.workspace = true
+solana-address-lookup-table-program.workspace = true
 spl-token-2022 = { workspace = true, features = ["no-entrypoint"] }
 wormhole-anchor-sdk.workspace = true
 wormhole-io.workspace = true

solana/programs/example-native-token-transfers/src/error.rs

@@ -51,6 +51,8 @@ pub enum NTTError {
     OverflowScaledAmount,
     #[msg("BitmapIndexOutOfBounds")]
     BitmapIndexOutOfBounds,
+    #[msg("FeatureNotEnabled")]
+    FeatureNotEnabled,
 }
 
 impl From<ScalingError> for NTTError {

solana/programs/example-native-token-transfers/src/instructions/initialize.rs

@@ -65,6 +65,7 @@ pub struct Initialize<'info> {
         payer = payer,
         associated_token::mint = mint,
         associated_token::authority = token_authority,
+        associated_token::token_program = token_program,
     )]
     /// The custody account that holds tokens in locking mode.
     /// NOTE: the account is unconditionally initialized, but not used in