QoL batch 3 #1916
QoL batch 3 #1916
Conversation
🧪 E2E Test StatusE2E tests are non-blocking and validate real blockchain interactions. Failures may occur due to network issues, RPC rate limits, or external service downtime. Test Runs (Newest First): |
PR SummaryMedium Risk Overview
Written by Cursor Bugbot for commit 00489b3. This will update automatically on new commits. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
bump @lzJxhn |
Co-authored-by: nazreen.mohamad <nazreen.mohamad@layerzerolabs.org>
| throw new Error('SOLANA_PRIVATE_KEY environment variable is required for non-multisig transactions') | ||
| } | ||
|
|
||
| const keypair = privateKeyStr ? Keypair.fromSecretKey(bs58.decode(privateKeyStr)) : undefined |
There was a problem hiding this comment.
Token Extensions keypair loading bypasses standard resolution
High Severity
updateTokenExtensionsMetadata reads SOLANA_PRIVATE_KEY directly and decodes with bs58.decode(), bypassing the centralized getSolanaKeypair() from @layerzerolabs/devtools-solana that deriveConnection uses everywhere else. The standard utility supports three keypair sources (SOLANA_PRIVATE_KEY, SOLANA_KEYPAIR_PATH, and ~/.config/solana/id.json) and multiple formats (base58 and JSON array). This function only supports one source in one format, so users relying on SOLANA_KEYPAIR_PATH or the default path will get a misleading error, and array-format private keys will cause a decode failure.
| field: 'name', | ||
| value: name, | ||
| }) | ||
| ) |
There was a problem hiding this comment.
String field names create custom metadata instead of standard
High Severity
createUpdateFieldInstruction is called with string literals 'name', 'symbol', and 'uri' for the field parameter. The SPL Token metadata interface distinguishes between standard fields (passed as Field enum values like Field.Name, Field.Symbol, Field.Uri) and custom additional metadata keys (passed as strings). Passing strings would create or update entries in the additionalMetadata array rather than updating the token's actual name, symbol, or URI. The Field enum needs to be imported from @solana/spl-token and used instead.
Additional Locations (2)
2 participants
Solana OFT debug script: state that value
0for confirmations means 'use default'Closes DEVREL-1238
When running:
Before:
After:
Solana OFT - updateMetadata script supports Token-2022 Metadata Update
Closes DEVREL-1239
Problem
lz:oft:solana:update-metadataonly supported Metaplex metadata, not Token-2022.Solution
updateTokenExtensionsMetadata()with authority validation and rent handling for multisig.Changes
updateMetadata.ts: Auto-detect and support Token-2022 metadata with authority checks and rent top-up.Example Run