Audit fixes: critical security bugs, truthful docs, and skill-standards sweep - #67

Merged

mikemaccana merged 28 commits into

mainfrom

claude/awesome-newton-7dektm

Jun 11, 2026

Commits on Jun 10, 2026

docs and style sweep: truthful testing docs, remove dead scaffold, em-dash and onchain spelling fixes
claude
committed
9b5a867
order-book: ceil taker fee in the protocol's favour, move withdraw_fees under instructions/admin
claude
committed
1ff38c5
token-fundraiser: fix inverted lifecycle windows, drainable refund, and unit-scaling bugs in both variants
claude
committed
22b28d0
vault-strategy: bind strategy mints and router, cap fee_bps, revive orphaned test suite
claude
committed
e8061d2
external-delegate-token-master: close signature replay hole, add missing authority check
claude
committed
1da4e55
counter, program-derived-addresses: named overflow errors, AccountConstraints names, discriminator-based space
claude
committed
f1b842b
token-swap/quasar: fix ratio clamp scaling deposits up, add slippage floors, named errors
claude
committed
8f4b3c7
vault-strategy: replace em-dashes in prose with regular dashes
claude
committed
2bf39c4
escrow: stop the taker pocketing the maker's rent, add native cancel_offer, bind quasar accounts
claude
committed
65f0645
escrow/native: untrack built program fixture; CI rebuilds it via cargo build-sbf
claude
committed
7787407
cnft-vault: enforce a withdraw authority, bounds-check proof lengths, real quasar tests
claude
committed
cd367aa
cutils, cnft-burn: remove banned handler-as-method pattern, dead state, runtime hashing
claude
committed
155fe6a
cutils: drop README references to the removed validate/actuate pattern
claude
committed
b188f99
gitignore: keep escrow native's rebuilt fixture .so untracked
claude
committed
f2db3d8
Cargo.lock: prune stale counter-mpl-stack and shank entries left from removed packages
claude
committed
3e2441c
wip: checkpoint of in-progress fix sweeps (signer checks, decimal scaling, ID alignment)
claude
committed
638f427
betting-market: close Bet accounts and free User index slots; wallets no longer brick at 32 lifetime bets
claude
committed
0441253
wip: checkpoint of in-progress rename and signer-check sweeps
claude
committed
ed04599
shank-and-codama, close-account, transfer-sol, pyth: signer/owner checks, full-lamport closes, oracle validation
claude
committed
4bbbc7f

Navigation Menu

Uh oh!

Audit fixes: critical security bugs, truthful docs, and skill-standards sweep - #67

Audit fixes: critical security bugs, truthful docs, and skill-standards sweep#67
mikemaccana merged 28 commits into
mainfrom
claude/awesome-newton-7dektm

Commits on Jun 10, 2026

docs and style sweep: truthful testing docs, remove dead scaffold, em-dash and onchain spelling fixes

order-book: ceil taker fee in the protocol's favour, move withdraw_fees under instructions/admin

token-fundraiser: fix inverted lifecycle windows, drainable refund, and unit-scaling bugs in both variants

vault-strategy: bind strategy mints and router, cap fee_bps, revive orphaned test suite

external-delegate-token-master: close signature replay hole, add missing authority check

counter, program-derived-addresses: named overflow errors, AccountConstraints names, discriminator-based space

token-swap/quasar: fix ratio clamp scaling deposits up, add slippage floors, named errors

vault-strategy: replace em-dashes in prose with regular dashes

escrow: stop the taker pocketing the maker's rent, add native cancel_offer, bind quasar accounts

escrow/native: untrack built program fixture; CI rebuilds it via cargo build-sbf

cnft-vault: enforce a withdraw authority, bounds-check proof lengths, real quasar tests

cutils, cnft-burn: remove banned handler-as-method pattern, dead state, runtime hashing

cutils: drop README references to the removed validate/actuate pattern

gitignore: keep escrow native's rebuilt fixture .so untracked

Cargo.lock: prune stale counter-mpl-stack and shank entries left from removed packages

wip: checkpoint of in-progress fix sweeps (signer checks, decimal scaling, ID alignment)

betting-market: close Bet accounts and free User index slots; wallets no longer brick at 32 lifetime bets

wip: checkpoint of in-progress rename and signer-check sweeps

shank-and-codama, close-account, transfer-sol, pyth: signer/owner checks, full-lamport closes, oracle validation

Commits on Jun 11, 2026

wip: checkpoint of in-progress rename and ID-alignment sweeps

transfer-sol/quasar: adopt anchor sibling's program ID; finish quasar AccountConstraints renames in counter, hello-solana, transfer-sol

wip: checkpoint of in-progress rename and ID-alignment sweeps

transfer-sol/anchor: rename TransferSolWithCpi to TransferSolWithCpiAccountConstraints

wip: checkpoint of in-progress rename and ID-alignment sweeps

wip: checkpoint of in-progress token-extensions rename sweep

token-extensions: finish AccountConstraints rename sweep across all 33 anchor and quasar variants

extension_nft, reference doc: final AccountConstraints straggler and em-dash sweep

apply cargo fmt and biome formatting