Repository navigation
feat(sdk-coin-sol): confidential transfer token enablement (CHALO-1883) - #10019
Merged
Merged
Conversation
Contributor
bhavidhingra
changed the title
bhavidhingra
force-pushed
the
bhavi/chalo-1883-sol-ct-enable-token
branch
2 times, most recently
from
October 21, 2026 10:03
a79c7a0 to
e08228d
Compare
Contributor
|
|
bhavidhingra
force-pushed
the
bhavi/chalo-1883-sol-ct-enable-token
branch
2 times, most recently
from
October 21, 2026 13:13
7fffea6 to
62c982e
Compare
…LO-1883) - sdk-core: configureAccount opt-out flag flows through BuildTokenEnablementOptions, PrebuildTransactionWithIntentOptions, intent payloads, the BuildParams codec and the PopulatedIntent type - sdk-coin-sol: ConfidentialTransferBuilder.createAta emits the idempotent CreateATA plus the Token-2022 Reallocate that adds the ConfidentialTransferAccount extension (ConfigureAccount fails on-chain without it) - sdk-coin-sol: fix the ConfigureAccount data layout - add the required 32-byte new_account_elgamal_pubkey (span 47 -> 79, matching ConfigureAccountInstructionData); the PR #9968 layout omitted it and would have been rejected on-chain - sdk-coin-sol: Transaction.fromRawTransaction parses v1 (0x81) wires, derives the transaction type from the parsed instructions (shared with the legacy path) and classifies CreateATA + ConfigureAccount txs as ConfidentialTransfer, not ATA-init - sdk-coin-sol: verifyTransaction accepts CT enable txs (ConfidentialTransfer) under type enabletoken, keeping the token name/address spoof checks - instructionParamsFactory: preserve CreateATA and CT metadata on CT-typed parses - sdk-coin-sol: CT buildV1 parity with the v1 payment builder - AdvanceNonceAccount injection and compiled-order signature zero-fill for unsigned server builds - tests: v1 enablement wire (4 instructions incl. Reallocate), CT verify acceptance and token-name tamper rejection
bhavidhingra
force-pushed
the
bhavi/chalo-1883-sol-ct-enable-token
branch
from
October 21, 2026 13:17
62c982e to
f5a7ef5
Compare
MohammedRyaan786
approved these changes
Oct 21, 2026
harman-bitgo
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat(sdk-coin-sol): CT-aware token enablement
Refs: CHALO-1883
Summary
Makes
enableTokenCT-aware end-to-end in the SDK:configureAccountopt-out flag (default true) flows throughBuildTokenEnablementOptions,PrebuildTransactionWithIntentOptions, theintent payloads (both EVM and non-EVM paths), and the
BuildParamscodec.ConfidentialTransferBuilder.createAtaaccepts a
CreateAssociatedTokenAccount(idempotent) instruction so one v1 txcarries CreateATA + ConfigureAccount + VerifyPubkeyValidity.
the required 32-byte
new_account_elgamal_pubkey(span 47 → 79, matching theon-chain
ConfigureAccountInstructionData). The PR feat(sdk-coin-sol): durable-nonce support in ConfidentialTransferBuilder v1 #9968 layout omitted it andwould have been rejected on-chain.
Transaction.fromRawTransactionrecognizesthe 0x81 v1 wire, decodes the message into a metadata
SolTransaction, and setsv1TransactionBytes/v1MessageBytes— verify/explain no longer assume legacyserialization.
verifyTransactionaccepts CT enable txs(explained type
ConfidentialTransfer) undertype: enabletoken, keeping thetoken-name/token-address spoof checks.
injects
AdvanceNonceAccountfor durable nonce and fills signatures incompiled-signer order with zero-filled placeholders for unsigned builds.
CreateAssociatedTokenAccountmetadataon
ConfidentialTransfer-typed parses (enablement round-trips keep the ATA entry).Why
ConfigureAccountis not idempotent on-chain and registers a per-address ElGamalkey; server-side enablement (wallet-platform) needs an unsigned v1 wire it can
persist and sign via MPC. Both the layout fix and the unsigned-wire support were
required before any e2e could pass.
Testing
test/unit/transactionBuilder/confidentialEnablementV1.ts(3) —CreateATA + ConfigureAccount + VerifyPubkeyValidity v1 wire (0x81), instruction
order, minimum-instruction guard.
test/unit/ctEnablementVerify.ts(2) — CT-enable tx accepted undertype: enabletoken; token-name tamper still rejected.confidentialTransferBuilder.tstests for the 79-byte layout and the+32 offsets;
confidentialTransferV1.ts/confidentialTransferV1Ops.tscall sites gain
elgamalPubkey.Breaking changes
None for existing consumers:
elgamalPubkeyis only required by the CTConfigureAccount builder (no external callers), and
enabletokenverificationonly widens the accepted explained type.