logos-blockchain/lez-programs
1
0
Fork 0
mirror of https://github.com/logos-blockchain/lez-programs.git synced 2026-08-25 14:11:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(token): add mint authority model to token program

Browse Source 
Add an optional mint authority to fungible tokens for controlled supply:
create with a designated minter, mint additional supply, rotate the
authority to a new key, or permanently revoke it to fix the supply.

The authority is stored inline on `TokenDefinition::Fungible` as
`authority: Option<AccountId>` (`Some(id)` = mintable by `id`, `None` =
fixed supply). Keeping it a plain `Option<AccountId>` rather than a custom
wrapper type leaves account state decodable by `spel inspect`; the
require/rotate/revoke guard logic lives inline in the handlers.

LEZ rejects a transaction that lists the same account id twice, so one
instruction cannot statically express both "the definition account is the
authority and signs" (self/PDA authority) and "a distinct rotated account
signs" (external authority) — they need opposite signer markers. Each
privileged operation is therefore split into a self and an external
variant:

- `Mint` / `SetAuthority` — the definition account is the signer.
- `MintWithAuthority` / `SetAuthorityWithAuthority` — a distinct authority
  account is the signer; the definition account does not sign.

Creation via `NewFungibleDefinition { mint_authority, .. }`; an all-zero
authority id is rejected. The AMM's LP token uses self/PDA authority — its
stored authority is the LP definition PDA, minted only by the pool via
chained calls.

Covered by token unit tests and zkVM integration tests: creation with and
without an authority, self- and external-authority mint, rotation, and
external rotate/revoke. IDLs regenerated.
This commit is contained in:
bristinWild
2026-07-02 19:19:23 +02:00
committed by r4bbit
parent 751d4ac530
commit fe4c7a96da
22 changed files with 1448 additions and 353 deletions
Download Patch File Download Diff File Expand all files Collapse all files
programs/token/methods/guest/src/bin/token.rs
+106 -24
View File
@@ -1,8 +1,12 @@
#![cfg_attr(not(test), no_main)]
#![allow(
clippy::cloned_ref_to_slice_refs,
reason = "SPEL macro emits cloned validation slices for one-account instructions"
)]
use spel_framework::prelude::*;
use nssa_core::account::{AccountId, AccountWithMetadata};
use spel_framework::context::ProgramContext;
use nssa_core::account::AccountWithMetadata;
use spel_framework::prelude::*;
#[cfg(not(test))]
risc0_zkvm::guest::entry!(main);
@@ -25,15 +29,15 @@ mod token {
recipient: AccountWithMetadata,
amount_to_transfer: u128,
) -> SpelResult {
Ok(spel_framework::SpelOutput::execute(token_program::transfer::transfer(
sender,
recipient,
amount_to_transfer,
), vec![]))
Ok(spel_framework::SpelOutput::execute(
token_program::transfer::transfer(sender, recipient, amount_to_transfer),
vec![],
))
}
/// Create a new fungible token definition without metadata.
/// Definition and holding targets must be uninitialized and authorized.
/// `mint_authority` is `Some(id)` for a mintable token or `None` for fixed supply.
#[instruction]
pub fn new_fungible_definition(
#[account(init, signer)]
@@ -42,6 +46,7 @@ mod token {
holding_target_account: AccountWithMetadata,
name: String,
total_supply: u128,
mint_authority: Option<AccountId>,
) -> SpelResult {
Ok(spel_framework::SpelOutput::execute(
token_program::new_definition::new_fungible_definition(
@@ -49,6 +54,7 @@ mod token {
holding_target_account,
name,
total_supply,
mint_authority,
),
vec![],
))
@@ -111,15 +117,16 @@ mod token {
user_holding_account: AccountWithMetadata,
amount_to_burn: u128,
) -> SpelResult {
Ok(spel_framework::SpelOutput::execute(token_program::burn::burn(
definition_account,
user_holding_account,
amount_to_burn,
), vec![]))
Ok(spel_framework::SpelOutput::execute(
token_program::burn::burn(definition_account, user_holding_account, amount_to_burn),
vec![],
))
}
/// Mint new tokens to the holder's account.
/// Fresh public holders must be explicitly authorized in the same transaction.
/// Mint new tokens under self/PDA authority: the definition account itself is
/// the current mint authority and signs (or is PDA-authorized, e.g. the AMM
/// minting its own LP token). Fresh public holders must be explicitly
/// authorized in the same transaction.
#[instruction]
pub fn mint(
ctx: ProgramContext,
@@ -129,12 +136,87 @@ mod token {
user_holding_account: AccountWithMetadata,
amount_to_mint: u128,
) -> SpelResult {
Ok(spel_framework::SpelOutput::execute(token_program::mint::mint(
definition_account,
user_holding_account,
amount_to_mint,
ctx.self_program_id,
), vec![]))
Ok(spel_framework::SpelOutput::execute(
token_program::mint::mint(
definition_account,
user_holding_account,
amount_to_mint,
ctx.self_program_id,
),
vec![],
))
}
/// Mint new tokens under an external authority: a distinct `authority_account`
/// (the account the mint authority was rotated to) signs, while the definition
/// account is mutated but does not sign. This is the path a rotated authority
/// uses to mint. Fresh public holders must be explicitly authorized in the
/// same transaction.
#[instruction]
pub fn mint_with_authority(
ctx: ProgramContext,
#[account(mut)]
definition_account: AccountWithMetadata,
#[account(mut)]
user_holding_account: AccountWithMetadata,
#[account(signer)]
authority_account: AccountWithMetadata,
amount_to_mint: u128,
) -> SpelResult {
Ok(spel_framework::SpelOutput::execute(
token_program::mint::mint_with_authority(
definition_account,
user_holding_account,
authority_account,
amount_to_mint,
ctx.self_program_id,
),
vec![],
))
}
/// Rotate or renounce the mint authority under self/PDA authority: the definition
/// account itself is the current authority and signs (or is PDA-authorized).
/// Pass `new_authority: None` to permanently renounce minting (fixed supply).
#[instruction]
pub fn set_authority(
ctx: ProgramContext,
#[account(mut, signer)]
definition_account: AccountWithMetadata,
new_authority: Option<AccountId>,
) -> SpelResult {
Ok(spel_framework::SpelOutput::execute(
token_program::set_authority::set_authority(
definition_account,
new_authority,
ctx.self_program_id,
),
vec![],
))
}
/// Rotate or renounce the mint authority under an external authority: a distinct
/// `authority_account` (the account the authority was rotated to) signs, while the
/// definition account is mutated but does not sign. This lets a rotated authority
/// rotate or revoke again. Pass `new_authority: None` to permanently renounce.
#[instruction]
pub fn set_authority_with_authority(
ctx: ProgramContext,
#[account(mut)]
definition_account: AccountWithMetadata,
#[account(signer)]
authority_account: AccountWithMetadata,
new_authority: Option<AccountId>,
) -> SpelResult {
Ok(spel_framework::SpelOutput::execute(
token_program::set_authority::set_authority_with_authority(
definition_account,
authority_account,
new_authority,
ctx.self_program_id,
),
vec![],
))
}
/// Print a new NFT from the master copy.
@@ -146,9 +228,9 @@ mod token {
#[account(init, signer)]
printed_account: AccountWithMetadata,
) -> SpelResult {
Ok(spel_framework::SpelOutput::execute(token_program::print_nft::print_nft(
master_account,
printed_account,
), vec![]))
Ok(spel_framework::SpelOutput::execute(
token_program::print_nft::print_nft(master_account, printed_account),
vec![],
))
}
}