Merged
Conversation
Contributor
Author
|
/bot review |
|
Bot Agent progress:
Progress:
|
![metoeraag-bot[bot]](https://avatars.githubusercontent.com/u/126859799?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict
Request changes
Summary
Posted 2 validated inline finding(s) after final filtering.
Findings
- [P1]
ts-client/src/dlmm/helpers/oracle/wrapper.ts:96cumulativeActiveBinIdis being decoded as an unsigned 128-bit little-endian integer. DLMM bin IDs are signed, so the cumulative value can also be negative; interpreting its two's-complement bytes as unsigned will produce huge positiveBNs and break TWAP math once the cumulative series crosses zero. Please decode this field as signed (for example,new BN(slice, 'le').fromTwos(128)) or use the same struct decoder as the on-chain layout. - [P2]
ts-client/src/dlmm/helpers/oracle/wrapper.ts:137This assumesmetadata.activeSize > 0. If the oracle exists but has no initialized observations yet,(currentIndex + 1) % 0yieldsNaN,getEarliestSample()returnsundefined, and calls likegetEarliestTimestamp()/getActiveId()will throw instead of returning the documented null/empty result. Please guard the zero-active-size case before doing modulo/indexing.
Repo checks
Repo Checks
- rustup component add --toolchain 1.85.0-x86_64-unknown-linux-gnu rustfmt: ok
info: component rustfmt is up to date
- rustup component add --toolchain 1.85.0-x86_64-unknown-linux-gnu clippy: ok
info: component clippy is up to date
- cargo fetch --locked: ok
- cargo check --workspace: ok
solana-offchain-message v2.2.1
Checking solana-rent-debits v2.2.1
Checking solana-system-transaction v2.2.1
Checking solana-transaction-status-client-types v2.2.4
Checking solana-account-decoder v2.2.4
Checking solana-nonce-account v2.2.1
Checking solana-presigner v2.2.1
Checking solana-compute-budget-interface v2.2.1
Checking anstyle-query v1.1.2
Checking option-ext v0.2.0
Checking anstyle v1.0.10
Checking is_terminal_polyfill v1.70.1
Checking solana-validator-exit v2.2.1
Checking colorchoice v1.0.0
Checking dirs-sys v0.4.1
Compiling heck v0.4.1
Checking anstream v0.6.18
Checking clap_lex v0.6.0
Compiling ruint-macro v1.2.1
Compiling rust_decimal v1.37.1
Compiling clap_derive v4.4.7
Checking clap_builder v4.4.7
Checking ruint v1.9.0
Checking anchor-lang v0.31.0
Checking dirs v5.0.1
Checking solana-rpc-client-api v2.2.4
Compiling bigdecimal v0.4.7
Checking shellexpand v3.1.0
Checking webpki-roots v0.26.8
Checking anchor-spl v0.31.0
Checking ureq v2.12.1
Checking solana-transaction-status v2.2.4
Checking routerify v3.0.0
Checking serde_json_any_key v2.0.0
Checking clap v4.4.7
Checking solana-rpc-client v2.2.4
Checking solana-pubsub-client v2.2.4
Checking solana-quic-client v2.2.4
Checking ark-poly v0.4.2
Checking ark-ec v0.4.2
Checking solana-thin-client v2.2.4
Checking solana-tpu-client v2.2.4
Checking solana-rpc-client-nonce-utils v2.2.4
Checking solana-client v2.2.4
Checking ark-bn254 v0.4.0
Checking solana-bn254 v2.2.1
Checking solana-sdk v2.2.1
Checking anchor-client v0.31.0
Checking commons v0.3.2 (/data/workdir/2962945/MeteoraAg/dlmm-sdk/commons)
Checking market_making v0.0.1 (/data/workdir/2962945/MeteoraAg/dlmm-sdk/market_making)
Checking cli v0.5.2 (/data/workdir/2962945/MeteoraAg/dlmm-sdk/cli)
Finished `dev` profile [unoptimized + debuginfo] target(s) in 57.52s
- cargo fmt --check: ok
- cargo clippy --workspace --all-targets -- -D warnings: failed
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace it with: `bin_array_bitmap >>= bin_array_offset`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: manual implementation of an assign operation
--> commons/src/extensions/bin_array_bitmap.rs:191:25
|
191 | bin_array_bitmap = bin_array_bitmap >> bin_array_offset;
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace it with: `bin_array_bitmap >>= bin_array_offset`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: manual implementation of an assign operation
--> commons/src/extensions/bin_array_bitmap.rs:221:25
|
221 | / bin_array_bitmap = bin_array_bitmap
222 | | << BIN_ARRAY_BITMAP_SIZE as usize - bin_array_offset - 1;
| |____________________________________________________________________________________^ help: replace it with: `bin_array_bitmap <<= BIN_ARRAY_BITMAP_SIZE as usize - bin_array_offset - 1`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: casting the result of `i32::abs()` to u32
--> commons/src/math/u64x64_math.rs:29:32
|
29 | let exp: u32 = if invert { exp.abs() as u32 } else { exp as u32 };
| ^^^^^^^^^^^^^^^^ help: replace with: `exp.unsigned_abs()`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#cast_abs_to_unsigned
= note: `-D clippy::cast-abs-to-unsigned` implied by `-D warnings`
= help: to override `-D warnings` add `#[allow(clippy::cast_abs_to_unsigned)]`
error: could not compile `commons` (lib) due to 23 previous errors
warning: build failed, waiting for other jobs to finish...
Contributor
Author
|
/bot review |
|
Bot Agent progress:
Progress:
|
There was a problem hiding this comment.
Verdict
Comment
Summary
Posted 2 validated inline finding(s) after final filtering.
Findings
- [P2]
ts-client/src/dlmm/helpers/oracle/wrapper.ts:244When there are no initialized observations,getActiveId()returns{ value: currentActiveBinId, duration: 0 }instead ofnull. That makes a spot active ID look like a valid TWAP to callers that only inspectvalue, and it contradicts the contract/docs above (null if no data is available). Please either returnnullhere or make this fallback explicit in the API so consumers can't mistake it for an actual time-weighted result. - [P3]
ts-client/src/dlmm/helpers/oracle/wrapper.ts:27DynamicOracleexposesgetEarliestTimestamp(), and the new example calls it, butIDynamicOracledoesn't declare it. IfgetOracle()(or any consumer) is typed against the interface, this method disappears from the public type surface and the example/API become inconsistent. Consider addinggetEarliestTimestamp(): BN | nulltoIDynamicOracleor keeping the method internal.
Potential concerns (lower confidence)
- [P2]
ts-client/src/dlmm/helpers/oracle/wrapper.ts:86oracleState.length.toNumber()— iflengthis very large (e.g., corrupted account data), this will allocate a huge array and potentially hang or OOM. Consider adding a sanity check thatlengthis reasonable (e.g., consistent with the actual buffer size:observationSlice.length / OBSERVATION_SIZE).
Repo checks
Repo Checks
- rustup component add --toolchain 1.85.0-x86_64-unknown-linux-gnu rustfmt: ok
info: component rustfmt is up to date
- rustup component add --toolchain 1.85.0-x86_64-unknown-linux-gnu clippy: ok
info: component clippy is up to date
- cargo fetch --locked: ok
Downloaded iana-time-zone v0.1.58
Downloaded darling v0.20.1
Downloaded tracing-attributes v0.1.27
Downloaded valuable v0.1.0
Downloaded solana-type-overrides v2.2.4
Downloaded pin-project-lite v0.2.13
Downloaded signal-hook-registry v1.4.1
Downloaded jobserver v0.1.32
Downloaded write16 v1.0.0
Downloaded icu_locid_transform v1.5.0
Downloaded quote v1.0.37
Downloaded solana-svm-rent-collector v2.2.4
Downloaded solana-svm-transaction v2.2.4
Downloaded linux-raw-sys v0.9.3
Downloaded winapi-util v0.1.5
Downloaded shellexpand v3.1.0
Downloaded darling_macro v0.20.1
Downloaded solana-zk-token-sdk v2.2.4
Downloaded solana-measure v2.2.4
Downloaded http-body v0.4.5
Downloaded try-lock v0.2.4
Downloaded solana-account-decoder-client-types v2.2.4
Downloaded solana-transaction-status-client-types v2.2.4
Downloaded utf16_iter v1.0.5
Downloaded solana-reserved-account-keys v2.2.1
Downloaded errno v0.3.10
Downloaded num-iter v0.1.43
Downloaded solana-compute-budget v2.2.4
Downloaded wasm-bindgen-futures v0.4.37
Downloaded proc-macro-crate v3.2.0
Downloaded crossbeam-epoch v0.9.15
Downloaded crossbeam-deque v0.8.3
Downloaded solana-fee v2.2.4
Downloaded filetime v0.2.23
Downloaded solana-compute-budget-program v2.2.4
Downloaded solana-stake-program v2.2.4
Downloaded icu_locid v1.5.0
Downloaded icu_provider v1.5.0
Downloaded proc-macro2 v1.0.94
Downloaded icu_properties_data v1.5.0
Downloaded litemap v0.7.4
Downloaded writeable v0.5.5
Downloaded displaydoc v0.2.4
Downloaded tinystr v0.7.6
Downloaded yoke-derive v0.7.5
Downloaded yoke v0.7.5
Downloaded zerofrom-derive v0.1.5
Downloaded icu_properties v1.5.1
Downloaded once_cell v1.21.2
Downloaded rustls-pki-types v1.11.0
Downloaded webpki-roots v0.26.8
Downloaded icu_locid_transform_data v1.5.0
Downloaded icu_provider_macros v1.5.0
Downloaded synstructure v0.13.1
Downloaded zerofrom v0.1.5
Downloaded zerovec-derive v0.10.3
- cargo fmt --check: ok
- cargo check --workspace: ok
2.4
Checking solana-rent-collector v2.3.0
Checking solana-offchain-message v2.2.1
Checking solana-rent-debits v2.2.1
Checking solana-rpc-client-api v2.2.4
Checking solana-system-transaction v2.2.1
Checking solana-nonce-account v2.2.1
Checking solana-presigner v2.2.1
Checking solana-account-decoder v2.2.4
Checking solana-compute-budget-interface v2.2.1
Checking solana-validator-exit v2.2.1
Checking option-ext v0.2.0
Checking anstyle-query v1.1.2
Checking anstyle v1.0.10
Checking is_terminal_polyfill v1.70.1
Checking colorchoice v1.0.0
Checking dirs-sys v0.4.1
Compiling heck v0.4.1
Compiling rust_decimal v1.37.1
Checking anstream v0.6.18
Compiling ruint-macro v1.2.1
Checking clap_lex v0.6.0
Compiling clap_derive v4.4.7
Checking clap_builder v4.4.7
Checking dirs v5.0.1
Compiling bigdecimal v0.4.7
Checking ruint v1.9.0
Checking shellexpand v3.1.0
Checking webpki-roots v0.26.8
Checking solana-transaction-status v2.2.4
Checking ureq v2.12.1
Checking anchor-lang v0.31.0
Checking routerify v3.0.0
Checking solana-rpc-client v2.2.4
Checking solana-pubsub-client v2.2.4
Checking solana-quic-client v2.2.4
Checking anchor-spl v0.31.0
Checking serde_json_any_key v2.0.0
Checking clap v4.4.7
Checking solana-tpu-client v2.2.4
Checking solana-rpc-client-nonce-utils v2.2.4
Checking solana-thin-client v2.2.4
Checking solana-client v2.2.4
Checking ark-poly v0.4.2
Checking ark-ec v0.4.2
Checking ark-bn254 v0.4.0
Checking solana-bn254 v2.2.1
Checking solana-sdk v2.2.1
Checking anchor-client v0.31.0
Checking commons v0.3.2 (/data/workdir/2962945/MeteoraAg/dlmm-sdk/commons)
Checking cli v0.5.2 (/data/workdir/2962945/MeteoraAg/dlmm-sdk/cli)
Checking market_making v0.0.1 (/data/workdir/2962945/MeteoraAg/dlmm-sdk/market_making)
Finished `dev` profile [unoptimized + debuginfo] target(s) in 55.83s
- cargo clippy --workspace --all-targets -- -D warnings: failed
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace it with: `bin_array_bitmap >>= bin_array_offset`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: manual implementation of an assign operation
--> commons/src/extensions/bin_array_bitmap.rs:191:25
|
191 | bin_array_bitmap = bin_array_bitmap >> bin_array_offset;
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace it with: `bin_array_bitmap >>= bin_array_offset`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: manual implementation of an assign operation
--> commons/src/extensions/bin_array_bitmap.rs:221:25
|
221 | / bin_array_bitmap = bin_array_bitmap
222 | | << BIN_ARRAY_BITMAP_SIZE as usize - bin_array_offset - 1;
| |____________________________________________________________________________________^ help: replace it with: `bin_array_bitmap <<= BIN_ARRAY_BITMAP_SIZE as usize - bin_array_offset - 1`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: casting the result of `i32::abs()` to u32
--> commons/src/math/u64x64_math.rs:29:32
|
29 | let exp: u32 = if invert { exp.abs() as u32 } else { exp as u32 };
| ^^^^^^^^^^^^^^^^ help: replace with: `exp.unsigned_abs()`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#cast_abs_to_unsigned
= note: `-D clippy::cast-abs-to-unsigned` implied by `-D warnings`
= help: to override `-D warnings` add `#[allow(clippy::cast_abs_to_unsigned)]`
error: could not compile `commons` (lib) due to 23 previous errors
warning: build failed, waiting for other jobs to finish...
codewithgun
force-pushed
the
feat/oracle
branch
from
02d71a1 to
51335d3
Compare
Contributor
Author
|
/bot review |
|
Bot Agent progress:
Progress:
|
There was a problem hiding this comment.
Verdict
Comment
Summary
Posted 1 validated inline finding(s) after final filtering.
Findings
- [P3]
ts-client/src/dlmm/helpers/oracle/wrapper.ts:92Because this parser manually walksoracleState.lengthobservations out of a raw buffer, it should validatedata.length >= ORACLE_METADATA_SIZE + length * OBSERVATION_SIZEbefore entering the loop.Buffer.subarray()past the end just returns a shorter slice, andnew BN(empty, 'le')decodes to0, so a truncated or layout-mismatched account would silently become zeroed observations and produce plausible-but-wrong TWAPs instead of failing fast.
Potential concerns (lower confidence)
- [P1]
ts-client/src/dlmm/helpers/oracle/wrapper.ts:181Potential infinite loop when oracle data is corrupted.
The while (true) loop relies on previousIndex eventually reaching idx to terminate. While this holds for well-formed data, it processes untrusted on-chain data. If the oracle account is corrupted or adversarially crafted, this loop could hang indefinitely. I'd recommend adding a safety counter (maxIterations = activeSize) to prevent hangs:
let iterations = 0;
while (iterations < this.metadata.activeSize.toNumber()) {
iterations++;
// ... existing loop body
}
return null;Repo checks
Repo Checks
- rustup component add --toolchain 1.85.0-x86_64-unknown-linux-gnu rustfmt: ok
info: component rustfmt is up to date
- rustup component add --toolchain 1.85.0-x86_64-unknown-linux-gnu clippy: ok
info: component clippy is up to date
- cargo fetch --locked: ok
- cargo fmt --check: ok
- cargo check --workspace: ok
Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.60s
- cargo clippy --workspace --all-targets -- -D warnings: failed
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace it with: `bin_array_bitmap >>= bin_array_offset`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: manual implementation of an assign operation
--> commons/src/extensions/bin_array_bitmap.rs:191:25
|
191 | bin_array_bitmap = bin_array_bitmap >> bin_array_offset;
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace it with: `bin_array_bitmap >>= bin_array_offset`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: manual implementation of an assign operation
--> commons/src/extensions/bin_array_bitmap.rs:221:25
|
221 | / bin_array_bitmap = bin_array_bitmap
222 | | << BIN_ARRAY_BITMAP_SIZE as usize - bin_array_offset - 1;
| |____________________________________________________________________________________^ help: replace it with: `bin_array_bitmap <<= BIN_ARRAY_BITMAP_SIZE as usize - bin_array_offset - 1`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#assign_op_pattern
error: casting the result of `i32::abs()` to u32
--> commons/src/math/u64x64_math.rs:29:32
|
29 | let exp: u32 = if invert { exp.abs() as u32 } else { exp as u32 };
| ^^^^^^^^^^^^^^^^ help: replace with: `exp.unsigned_abs()`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#cast_abs_to_unsigned
= note: `-D clippy::cast-abs-to-unsigned` implied by `-D warnings`
= help: to override `-D warnings` add `#[allow(clippy::cast_abs_to_unsigned)]`
error: could not compile `commons` (lib) due to 23 previous errors
warning: build failed, waiting for other jobs to finish...
dannxbt
approved these changes
Apr 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.