fix(sol): reject num_signers != 1 proposals before paymaster signs (signer-borrow guard)

Author: TheTrunk

src/services/solPaymasterService.ts

@@ -328,10 +328,29 @@ export function validateReimbursement(
   }
 
   // Borsh layout after the 8-byte discriminator: u8 vault_index, then
-  // TransactionMessage = 3×u8 header + Vec<Pubkey> + Vec<CompiledInstruction>
+  // TransactionMessage = 3×u8 header (num_signers, num_writable_signers,
+  // num_writable_non_signers) + Vec<Pubkey> + Vec<CompiledInstruction>
   // + Vec<AddressTableLookup>.
   const data = createIx.data;
-  let off = 8 + 1 + 3;
+  let off = 8 + 1; // discriminator + vault_index
+
+  // SECURITY (signer-borrow prevention): num_signers decides which accounts get
+  // is_signer=true when execute_transaction CPIs them. The vault PDA (index 0)
+  // is the only account the program signs for (its seeds); any additional signer
+  // slot borrows the top-level signature of the outer tx's fee payer — this
+  // paymaster — letting the inner CPI move funds FROM the paymaster
+  // (SystemProgram::transfer) or hijack paymaster-controlled accounts
+  // (nonceAuthorize / SPL setAuthority) even though vault custody is untouched.
+  // Every legitimate SSP proposal sets num_signers === 1 (vault only), so reject
+  // anything else. Mirrors the on-chain require!(num_signers == 1) in
+  // create_transaction; defense-in-depth for this public broadcast path.
+  const numSigners = data.readUInt8(off);
+  if (numSigners !== 1) {
+    throw new Error(
+      `Proposal num_signers must be 1 (only the vault PDA may sign); got ${numSigners} — refusing to sponsor a signer-borrow proposal`,
+    );
+  }
+  off += 3; // skip the 3-byte header
 
   const accountKeysLen = data.readUInt32LE(off);
   off += 4;

tests/unit/solPaymasterValidateReimbursement.spec.ts

@@ -279,4 +279,42 @@ describe('Solana Paymaster Service — validateReimbursement', function () {
       /must reimburse paymaster/,
     );
   });
+
+  it('rejects a signer-borrow proposal (num_signers > 1) that would drain the paymaster', function () {
+    // Pre-mainnet audit regression: at execute time is_signer is taken from
+    // the proposal header, and the paymaster is the outer-tx fee payer (a
+    // top-level signer). A proposal marking the paymaster as a second signer
+    // (index 1 < num_signers = 2) could CPI SystemProgram::transfer FROM the
+    // paymaster, borrowing its signature — draining it. The reimbursement to
+    // the paymaster is included so the floor check would pass; the num_signers
+    // guard must reject it first, before any funds move.
+    const attacker = Keypair.generate().publicKey;
+    const message: TransactionMessage = {
+      numSigners: 2, // illegal: only the vault (index 0) may sign
+      numWritableSigners: 2,
+      numWritableNonSigners: 2,
+      accountKeys: [vault, paymaster, attacker, SystemProgram.programId],
+      instructions: [
+        // reimbursement to the paymaster (satisfies the floor if reached)
+        {
+          programIdIndex: 3,
+          accountIndexes: [0, 1],
+          data: encodeSystemTransferData(MIN_LAMPORTS),
+        },
+        // the drain: transfer FROM paymaster (index 1) TO attacker (index 2)
+        {
+          programIdIndex: 3,
+          accountIndexes: [1, 2],
+          data: encodeSystemTransferData(9_000_000_000),
+        },
+      ],
+    };
+    const tx = makeOuterTx({
+      paymaster,
+      ixs: [buildCreateTransactionIx(message)],
+    });
+    expect(() => validateReimbursement(tx, paymaster, MIN_LAMPORTS)).to.throw(
+      /num_signers must be 1/,
+    );
+  });
 });