Skip to content

Commit 42548f1

Browse files
authored
Merge pull request #67 from quicknode/claude/awesome-newton-7dektm
Audit fixes: critical security bugs, truthful docs, and skill-standards sweep
2 parents 5ac9d2d + 5ad9e48 commit 42548f1

652 files changed

Lines changed: 13117 additions & 5918 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ node_modules/
1919
**/*/target
2020
**/*/tests/fixtures/*
2121
!**/*/tests/fixtures/*.so
22+
# Exception to the exception: escrow native's fixture .so is OUR program's
23+
# build output (cargo build-sbf --sbf-out-dir=tests/fixtures regenerates it),
24+
# not a third-party dump, so it stays untracked.
25+
finance/escrow/native/tests/fixtures/escrow_native_program.so
2226
**/*.rs.bk
2327
**/*/test-ledger
2428
**/*/yarn.lock

.reference/ANCHOR-1.0-MIGRATION.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
### Cargo.toml
66
- Change `anchor-lang = "0.32.1"``anchor-lang = "1.0.0"`
77
- Change `anchor-lang = { version = "0.32.1", ... }``anchor-lang = { version = "1.0.0", ... }`
8-
- Same for `anchor-spl` if present change to `1.0.0`
9-
- Add comment: `# Anchor 1.0.0 pin to RC until stable release`
8+
- Same for `anchor-spl` if present - change to `1.0.0`
9+
- Add comment: `# Anchor 1.0.0 - pin to RC until stable release`
1010
- **REMOVE `interface-instructions` feature** if present (removed in Anchor 1.0). This affects transfer-hook projects.
1111
- Keep all other features as-is (`idl-build`, `init-if-needed`, `cpi`, etc.)
1212

@@ -37,5 +37,5 @@
3737
### interface-instructions removal (transfer-hook projects)
3838
For projects that had `features = ["interface-instructions"]`:
3939
- Remove that feature from Cargo.toml
40-
- The `#[interface]` attribute is removed check if the program source uses it
40+
- The `#[interface]` attribute is removed - check if the program source uses it
4141
- If it does, this needs manual intervention to refactor

CHANGELOG.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,21 @@ All notable changes to this repository are documented here.
44

55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
66

7-
## [2026-04-08] Quicknode fork modernization (Mike MacCana)
7+
## [2026-04-08] - Quicknode fork modernization (Mike MacCana)
88

99
Mike MacCana led the Quicknode fork of the [Solana Foundation program examples](https://github.com/solana-developers/program-examples) from late 2025. The first commits on this repository lineage are dated **8 April 2026**; the summary below covers that work through the initial merge.
1010

1111
### What changed (high level)
1212

1313
**Toolchain and frameworks.** The tree had accumulated examples from several years of Solana development (including Anchor releases going back to the ~0.26 era in 2022 and many intermediate versions). The fork brought the Anchor examples up to **Anchor 1.0.0** stable (from 1.0.0-rc.5), refreshed Agave/Solana CLI pins, standardized on **pnpm**, and added parallel implementations in **[Quasar](https://quasar-lang.com/docs)**, **Pinocchio**, **Native Rust**, and **ASM** where applicable. Token-2022 examples were renamed to **`token-extensions`**.
1414

15-
**Testing.** Replaced the old pattern of local validators, Bankrun, and scattered TypeScript `anchor test` flows with **LiteSVM in-process tests** for most Anchor programs matching current Anchor defaults (`cargo test` wired through `Anchor.toml` / `pnpm test`). Fixed broken or flaky tests across Native, Pinocchio, and Anchor; added missing harnesses (e.g. block-list Pinocchio). CI was reworked for a repo this size: path filtering, caching, matrix sharding, and reliable detection of framework roots.
15+
**Testing.** Replaced the old pattern of local validators, Bankrun, and scattered TypeScript `anchor test` flows with **LiteSVM in-process tests** for most Anchor programs - matching current Anchor defaults (`cargo test` wired through `Anchor.toml` / `pnpm test`). Fixed broken or flaky tests across Native, Pinocchio, and Anchor; added missing harnesses (e.g. block-list Pinocchio). CI was reworked for a repo this size: path filtering, caching, matrix sharding, and reliable detection of framework roots.
1616

1717
**Programs and layout.** Broke large monolithic `lib.rs` files into **instruction handler modules**; adopted **`InitSpace`** and explicit PDA bumps instead of magic account sizes; corrected several logic bugs (escrow, token swap invariant, counter authority checks, compression Bubblegum program id, and more). Expanded finance and token-extension coverage; reorganized transfer-hook examples (including block-list under Pinocchio).
1818

1919
**Documentation.** Rewrote the root README (framework badges, clearer example blurbs, ASM links), ran a style and **truth audit** on READMEs, and linked canonical [Solana terminology](https://solana.com/docs/references/terminology) on first mention. Added this changelog, `CONTRIBUTING.md` (aligned with LiteSVM testing), README templates, per-example Anchor and Quasar READMEs, fixed Husky for GUI git clients, removed unused maintainer scripts (`sync-package-json`, `cicd.sh`, local-validator helpers for the allow/block-list UI), dropped the orphan `tokens/spl-token-minter/` tree, and removed legacy root `package.json` dependencies (web3.js, Bankrun, chai).
2020

21-
**Removed / deferred.** Dropped duplicate or WIP trees (duplicate block-list Pinocchio copy, Quasar metadata example blocked on `sol_realloc`, root `yarn.lock`). Some examples remain excluded from CI via `.ghaignore` until they build cleanly again (compression, escrow, pyth, and others see that file for the live list).
21+
**Removed / deferred.** Dropped duplicate or WIP trees (duplicate block-list Pinocchio copy, Quasar metadata example blocked on `sol_realloc`, root `yarn.lock`). Some examples remain excluded from CI via `.ghaignore` until they build cleanly again (compression, escrow, pyth, and others - see that file for the live list).
2222

2323
## Before June 2026
2424

CONTRIBUTING.md

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -20,28 +20,24 @@ Thank you for considering a contribution to this repository. We welcome new exam
2020

2121
## Testing
2222

23-
This repo uses an in-process test runtime no local validator boot, no `solana-test-validator`, no `anchor test --validator legacy`.
23+
This repo uses an in-process test runtime - no local validator boot, no `solana-test-validator`, no `anchor test --validator legacy`.
2424

25-
For Anchor and Quasar examples, tests are written in TypeScript and run with `node:test` via `tsx`:
26-
27-
```bash
28-
npx tsx --test --test-reporter=spec tests/*.ts
29-
```
30-
31-
The conventional `Anchor.toml` `[scripts]` entry is:
25+
**Anchor examples** are tested in Rust with [LiteSVM](https://www.anchor-lang.com/docs/testing/litesvm). Tests live in `programs/<name>/tests/`, load the compiled program with `include_bytes!("../../../target/deploy/<name>.so")`, and run with `cargo test` (build the `.so` first with `cargo build-sbf` or `anchor build`). The conventional `Anchor.toml` `[scripts]` entry is:
3226

3327
```toml
3428
[scripts]
35-
test = "npx create-codama-clients; npx tsx --test --test-reporter=spec tests/*.ts"
29+
test = "cargo test"
3630
```
3731

38-
The TypeScript tests use:
32+
Optional helpers come from the [`solana-kite`](https://crates.io/crates/solana-kite) crate (wallet creation, token mint helpers, `send_transaction_from_instructions`).
33+
34+
**Quasar examples** are tested in Rust with QuasarSVM. Run `quasar build` (which also generates the Rust client crate under `target/client/rust/` that the tests import), then `quasar test` or `cargo test`.
35+
36+
**Native and Pinocchio examples** use `litesvm` directly from Rust, except for a few that keep TypeScript tests (`tsx --test` with [`solana-kite`](https://solanakite.org) and [`@solana/kit`](https://solanakit.com)) where the example is specifically about client-side tooling.
3937

40-
- [`solana-kite`](https://solanakite.org) for the connection, wallet creation, token mint helpers, PDA derivation, and `sendTransactionFromInstructions`.
41-
- [`@solana/kit`](https://solanakit.com) for the core types (`KeyPairSigner`, `Address`, `lamports`).
42-
- A [Codama](https://github.com/codama-idl/codama)-generated client (via `npx create-codama-clients`) for invoking the program instructions. Do **not** use `anchor.workspace` or `program.methods.X().rpc()`.
38+
Do not write TypeScript tests for Anchor or Quasar programs, and do not use `anchor.workspace` or `program.methods.X().rpc()`.
4339

44-
Native and Pinocchio examples may use `litesvm` directly from Rust where appropriate.
40+
Tests must exercise the program for real: initialize accounts, send transactions through the program's instruction handlers, and assert resulting state and balances. Placeholder tests (`assert!(true)`, build-only checks) don't count.
4541

4642
## Style
4743

@@ -54,7 +50,7 @@ Other conventions:
5450
- Use full words rather than abbreviations (`transaction`, not `tx` or `txn`; `account`, not `acc`).
5551
- Prefer `async`/`await` over `.then()`/`.catch()`.
5652
- Use `Array<T>` rather than `T[]` in TypeScript.
57-
- Avoid magic numbers name or explain them.
53+
- Avoid magic numbers - name or explain them.
5854
- Write "onchain" / "offchain" as single words (no hyphen).
5955

6056
## Excluding an example from CI

Cargo.lock

Lines changed: 0 additions & 55 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

README.md

Lines changed: 25 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66

77
Each example is available in one or more of the following frameworks:
88

9-
- [⚓ Anchor](https://www.anchor-lang.com/) the most popular framework for Solana development. Build with `anchor build`, test with `pnpm test` as defined in `Anchor.toml`.
10-
- [💫 Quasar](https://quasar-lang.com/docs) a newer, more performant framework with Anchor-compatible ergonomics. Run `pnpm test` to execute tests.
11-
- [🤥 Pinocchio](https://github.com/anza-xyz/pinocchio) a zero-copy, zero-allocation library for Solana programs. Run `pnpm test` to execute tests.
12-
- [🦀 Native Rust](https://docs.anza.xyz/) vanilla Rust using Solana's native crates. Run `pnpm test` to execute tests.
13-
- [🧬 ASM](https://github.com/blueshift-gg/sbpf) hand-written sBPF assembly built with the `sbpf` toolchain. Run `pnpm build-and-test` to build and test.
9+
- [⚓ Anchor](https://www.anchor-lang.com/) - the most popular framework for Solana development. Build with `anchor build`, test with `pnpm test` as defined in `Anchor.toml`.
10+
- [💫 Quasar](https://quasar-lang.com/docs) - a newer, more performant framework with Anchor-compatible ergonomics. Run `pnpm test` to execute tests.
11+
- [🤥 Pinocchio](https://github.com/anza-xyz/pinocchio) - a zero-copy, zero-allocation library for Solana programs. Run `pnpm test` to execute tests.
12+
- [🦀 Native Rust](https://docs.anza.xyz/) - vanilla Rust using Solana's native crates. Run `pnpm test` to execute tests.
13+
- [🧬 ASM](https://github.com/blueshift-gg/sbpf) - hand-written sBPF assembly built with the `sbpf` toolchain. Run `pnpm build-and-test` to build and test.
1414

1515
> [!NOTE]
1616
> You don't need to write your own program for basic tasks like creating [accounts](https://solana.com/docs/terminology#account), transferring SOL, or minting tokens. These are handled by existing programs like the System Program and Token Program.
@@ -19,7 +19,7 @@ Each example is available in one or more of the following frameworks:
1919

2020
### Escrow
2121

22-
**Start here the best first finance program to learn on Solana.** A neutral account that holds funds until both sides deliver, like a real-estate escrow or a lawyer's trust account. The maker deposits token A and names how much token B they want; when a taker supplies token B, the program swaps both in a single all-or-nothing transaction. This swap is the core idea behind every onchain exchange.
22+
**Start here - the best first finance program to learn on Solana.** A neutral account that holds funds until both sides deliver, like a real-estate escrow or a lawyer's trust account. The maker deposits token A and names how much token B they want; when a taker supplies token B, the program swaps both in a single all-or-nothing transaction. This swap is the core idea behind every onchain exchange.
2323

2424
[⚓ Anchor](./finance/escrow/anchor) [💫 Quasar](./finance/escrow/quasar) [🦀 Native](./finance/escrow/native)
2525

@@ -49,7 +49,7 @@ A managed investment fund onchain, like an ETF or mutual fund. Investors deposit
4949

5050
### Betting Market
5151

52-
Parimutuel (pooled) prediction market an admin opens an event with multiple outcomes, bettors stake tokens on an outcome, and at settlement the losing pool (minus a protocol fee) is split among winners in proportion to their stake.
52+
Parimutuel (pooled) prediction market - an admin opens an event with multiple outcomes, bettors stake tokens on an outcome, and at settlement the losing pool (minus a protocol fee) is split among winners in proportion to their stake.
5353

5454
[⚓ Anchor](./tokens/betting-market/anchor)
5555

@@ -70,7 +70,7 @@ Store and retrieve data using Solana accounts.
7070

7171
### Counter
7272

73-
Use a [PDA](https://solana.com/docs/terminology#program-derived-address-pda) to store global state a counter that increments when called.
73+
Use a [PDA](https://solana.com/docs/terminology#program-derived-address-pda) to store global state - a counter that increments when called.
7474

7575
[⚓ Anchor](./basics/counter/anchor) [💫 Quasar](./basics/counter/quasar) [🤥 Pinocchio](./basics/counter/pinocchio) [🦀 Native](./basics/counter/native)
7676

@@ -100,7 +100,7 @@ Create new accounts on the blockchain.
100100

101101
### Cross-Program Invocation
102102

103-
Call one program from another the hand program invokes the lever program to toggle a switch.
103+
Call one program from another - the hand program invokes the lever program to toggle a switch.
104104

105105
[⚓ Anchor](./basics/cross-program-invocation/anchor) [💫 Quasar](./basics/cross-program-invocation/quasar) [🦀 Native](./basics/cross-program-invocation/native)
106106

@@ -148,7 +148,7 @@ Send SOL between two accounts.
148148

149149
### Pyth Price Feeds
150150

151-
An **oracle** brings real-world market prices a dollar, a stock, a token [onchain](https://solana.com/docs/terminology#onchain), like a Bloomberg terminal feeding live quotes. [Pyth](https://pyth.network/) publishes low-latency prices from institutional sources, each in its own price feed account. This example reads a feed and logs its price, confidence interval, and exponent the building block an AMM, lending market, or vault uses to value assets.
151+
An **oracle** brings real-world market prices - a dollar, a stock, a token - [onchain](https://solana.com/docs/terminology#onchain), like a Bloomberg terminal feeding live quotes. [Pyth](https://pyth.network/) publishes low-latency prices from institutional sources, each in its own price feed account. This example reads a feed and logs its price, confidence interval, and exponent - the building block an AMM, lending market, or vault uses to value assets.
152152

153153
[⚓ Anchor](./basics/pyth/anchor) [💫 Quasar](./basics/pyth/quasar)
154154

@@ -282,43 +282,43 @@ Create tokens with a built-in transfer fee.
282282

283283
[⚓ Anchor](./tokens/token-extensions/transfer-fee/anchor) [💫 Quasar](./tokens/token-extensions/transfer-fee/quasar) [🦀 Native](./tokens/token-extensions/transfer-fee/native)
284284

285-
### Transfer Hook Hello World
285+
### Transfer Hook - Hello World
286286

287287
A minimal transfer hook that executes custom logic on every token transfer.
288288

289289
[⚓ Anchor](./tokens/token-extensions/transfer-hook/hello-world/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/hello-world/quasar)
290290

291-
### Transfer Hook Counter
291+
### Transfer Hook - Counter
292292

293293
Count how many times tokens have been transferred.
294294

295295
[⚓ Anchor](./tokens/token-extensions/transfer-hook/counter/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/counter/quasar)
296296

297-
### Transfer Hook Account Data as Seed
297+
### Transfer Hook - Account Data as Seed
298298

299299
Use token account owner data as seeds to derive extra accounts in a transfer hook.
300300

301301
[⚓ Anchor](./tokens/token-extensions/transfer-hook/account-data-as-seed/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/account-data-as-seed/quasar)
302302

303-
### Transfer Hook Allow/Block List
303+
### Transfer Hook - Allow/Block List
304304

305305
Restrict or allow token transfers using an onchain list managed by a list authority.
306306

307307
[⚓ Anchor](./tokens/token-extensions/transfer-hook/allow-block-list-token/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/allow-block-list-token/quasar)
308308

309-
### Transfer Hook Transfer Cost
309+
### Transfer Hook - Transfer Cost
310310

311311
Charge an additional fee on every token transfer.
312312

313313
[⚓ Anchor](./tokens/token-extensions/transfer-hook/transfer-cost/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/transfer-cost/quasar)
314314

315-
### Transfer Hook Transfer Switch
315+
### Transfer Hook - Transfer Switch
316316

317317
Enable or disable token transfers with an onchain switch.
318318

319319
[⚓ Anchor](./tokens/token-extensions/transfer-hook/transfer-switch/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/transfer-switch/quasar)
320320

321-
### Transfer Hook Whitelist
321+
### Transfer Hook - Whitelist
322322

323323
Restrict transfers so only whitelisted accounts can receive tokens.
324324

@@ -344,6 +344,14 @@ Work with Metaplex compressed NFTs.
344344

345345
[⚓ Anchor](./compression/cutils/anchor) [💫 Quasar](./compression/cutils/quasar)
346346

347+
## Tools
348+
349+
### Shank and Codama
350+
351+
Generate an IDL from a native Rust program with [Shank](https://github.com/metaplex-foundation/shank), then generate a TypeScript client from that IDL with [Codama](https://github.com/codama-idl/codama).
352+
353+
[🦀 Native](./tools/shank-and-codama/native)
354+
347355
---
348356

349357
**PRs welcome!** Follow the [contributing guidelines](./CONTRIBUTING.md) and see [CHANGELOG.md](./CHANGELOG.md) for release history.

basics/account-data/anchor/Anchor.toml

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,9 @@ skip-lint = false
88
[programs.localnet]
99
account_data_anchor_program = "GpVcgWdgVErgLqsn8VYUch6EqDerMgNqoLSmGyKrd6MR"
1010

11-
# [registry] section removed — no longer used in Anchor 1.0
12-
1311
[provider]
1412
cluster = "Localnet"
1513
wallet = "~/.config/solana/id.json"
1614

1715
[scripts]
18-
test = "cargo test"
19-
litesvm-test = "pnpm ts-mocha -p ./tsconfig.json -t 1000000 tests/litesvm.test.ts" #For litesvm test
16+
test = "cargo test"

basics/account-data/anchor/programs/anchor-program-example/src/instructions/create.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ use crate::state::AddressInfo;
22
use anchor_lang::prelude::*;
33

44
#[derive(Accounts)]
5-
pub struct CreateAddressInfo<'info> {
5+
pub struct CreateAddressInfoAccountConstraints<'info> {
66
#[account(mut)]
77
payer: Signer<'info>,
88

@@ -16,7 +16,7 @@ pub struct CreateAddressInfo<'info> {
1616
}
1717

1818
pub fn handle_create_address_info(
19-
context: Context<CreateAddressInfo>,
19+
context: Context<CreateAddressInfoAccountConstraints>,
2020
name: String,
2121
house_number: u8,
2222
street: String,

basics/account-data/anchor/programs/anchor-program-example/src/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ pub mod account_data_anchor_program {
1111
use super::*;
1212

1313
pub fn create_address_info(
14-
context: Context<CreateAddressInfo>,
14+
context: Context<CreateAddressInfoAccountConstraints>,
1515
name: String,
1616
house_number: u8,
1717
street: String,

basics/account-data/anchor/programs/anchor-program-example/tests/test_account_data.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ fn test_create_address_info() {
3939
city: "Solana Beach".to_string(),
4040
}
4141
.data(),
42-
account_data_anchor_program::accounts::CreateAddressInfo {
42+
account_data_anchor_program::accounts::CreateAddressInfoAccountConstraints {
4343
payer: payer.pubkey(),
4444
address_info: address_info_keypair.pubkey(),
4545
system_program: system_program::id(),

0 commit comments

Comments
 (0)