DEVREL-468 feat: add oapp-solana

[nazreen]

Important: When merging into main, do not squash/rebase merge, since the audit will reference a commit hash in the feature branch. Only use merge commit approach.

Warning: do not use this in production, it is not yet audited. Although, in any case, even if you use this as a starting example for your production use case, you would still need to get your specific OApp implementation audited.

This PR will remain in draft mode until audit is completed.

---

One-liner

This PR adds a new example for a Solana OApp that interacts with an EVM OApp. The OApps pass strings to each other cross-chain.

Details

• The EVM OApp is taken from the existing oapp example, with slight modifications (adding in enforced options support)
• The Solana OApp is deliberately simple. It supports only one account (which acts as the OApp / Peer) per program. This is in contrast to the OFT Program, where one OFT Program can be used for multiple OFTs (The OFT Store addresses are used as the peer addresses when cross-chain transferring)
• enforced options are implemented for both Solidity OApp and Solana OApp
• for both the Solidity contract and Solana Program, codecs are introduced

Out of scope

• Ordered Execution mode
• implementation of composeMsg/compose_msg is out of scope of this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​kinobi-so/​renderers@​0.21.5
	kinobi@​0.21.5
	@​kinobi-so/​renderers-js-umi@​0.21.7
	@​kinobi-so/​nodes-from-anchor@​0.21.3
	@​kinobi-so/​nodes@​0.21.5

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click for details)
Warn		@kinobi-so/errors@0.21.5 is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → npm/@kinobi-so/nodes@0.21.5 → npm/@kinobi-so/nodes-from-anchor@0.21.3 → npm/@kinobi-so/renderers-js-umi@0.21.7 → npm/kinobi@0.21.5 → npm/@kinobi-so/renderers@0.21.5 → npm/@kinobi-so/errors@0.21.5 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/errors@0.21.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/node-types@0.21.5 is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → npm/@kinobi-so/nodes@0.21.5 → npm/@kinobi-so/nodes-from-anchor@0.21.3 → npm/@kinobi-so/renderers-js-umi@0.21.7 → npm/kinobi@0.21.5 → npm/@kinobi-so/renderers@0.21.5 → npm/@kinobi-so/node-types@0.21.5 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/node-types@0.21.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/nodes-from-anchor@0.21.3 is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → npm/@kinobi-so/nodes-from-anchor@0.21.3 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/nodes-from-anchor@0.21.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/nodes@0.21.5 is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → npm/@kinobi-so/nodes@0.21.5 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/nodes@0.21.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/renderers-core@0.21.3 is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → npm/@kinobi-so/renderers-js-umi@0.21.7 → npm/@kinobi-so/renderers@0.21.5 → npm/@kinobi-so/renderers-core@0.21.3 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/renderers-core@0.21.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/renderers-js-umi@0.21.7 is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → npm/@kinobi-so/renderers-js-umi@0.21.7 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/renderers-js-umi@0.21.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/renderers-js@0.21.9 is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → npm/@kinobi-so/renderers@0.21.5 → npm/@kinobi-so/renderers-js@0.21.9 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/renderers-js@0.21.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/renderers-rust@0.21.8 is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → npm/@kinobi-so/renderers@0.21.5 → npm/@kinobi-so/renderers-rust@0.21.8 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/renderers-rust@0.21.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/renderers@0.21.5 is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → npm/@kinobi-so/renderers@0.21.5 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/renderers@0.21.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/validators@0.21.5 is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → npm/@kinobi-so/renderers-js-umi@0.21.7 → npm/kinobi@0.21.5 → npm/@kinobi-so/validators@0.21.5 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/validators@0.21.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@kinobi-so/visitors@0.21.5 is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → npm/@kinobi-so/nodes-from-anchor@0.21.3 → npm/kinobi@0.21.5 → npm/@kinobi-so/visitors@0.21.5 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@kinobi-so/visitors@0.21.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		kinobi@0.21.5 is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → npm/kinobi@0.21.5 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/kinobi@0.21.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[St0rmBr3w]

@nazreen what are your thoughts on removing the counter from the example entirely?

[St0rmBr3w]

Given the time crunch I think this looks good. Some minor items, but we can improve rolling forward. Great work!

[nazreen]

note: commits after 82a04bc do not change the program/contract code

[nazreen]

CI currently failing due to unrelated Ton test

@layerzerolabs/test-devtools-ton#test: command (/app/packages/test-devtools-ton) /usr/local/bin/pnpm run test exited (1)

 Tasks:    87 successful, 105 total
Cached:    58 cached, 105 total
  Time:    12.945s 
Failed:    @layerzerolabs/test-devtools-ton#test

[St0rmBr3w]

LGTM!

[ItsAdel]

I only ran the end to end tests. Approving based on that working. Did not get a chance to code review