r4bbit de9a3d5320 fix(amm)!: restrict UpdateConfig to authority transfer only ...

UpdateConfig let the admin rewrite token_program_id and
twap_oracle_program_id in place. Both are immutable deployment
parameters — twap_oracle_program_id derives the current-tick PDA and
every price-observation/price account PDA, and token_program_id is the
program the AMM issues its vault transfers to — so changing either
after any pool exists would orphan every derived account and vault. A
genuine change requires redeploying the AMM, never an in-place edit.

- Instruction::UpdateConfig now carries a single required field,
  new_authority; the two program-id fields are removed.
- update_config assigns the new authority directly (no Option/if-let);
  PDA + admin + signature preconditions unchanged.
- Guest handler and IDL updated to match.
- Drop the integration test that mutated token_program_id (it
  exercised the vulnerability); keep reject-non-admin and
  authority-handoff, and assert program ids survive a transfer.

BREAKING CHANGE: the UpdateConfig instruction ABI changed — the
token_program_id and twap_oracle_program_id fields are removed and
new_authority is now required (was Option). Any client constructing
UpdateConfig must be updated. The instruction enum change also alters
the program ImageID: redeploy and update every ImageID-derived value
(deployed program ids, client/config files, PDA-derived addresses,
AMM/ATA program-id inputs) before submitting

2026-08-05 18:08:43 +02:00

..

src

refactor: move programs into programs and UIs into apps

2026-05-26 14:05:52 +02:00

tests

fix(amm)!: restrict UpdateConfig to authority transfer only

2026-08-05 18:08:43 +02:00

Cargo.toml

build(deps): bump spel to v0.6.0 and logos-execution-zone to v0.2.0

2026-07-15 15:11:47 +02:00