2019-03-13 12:58:44 -07:00
|
|
|
use crate::bank::TransactionError;
|
2019-03-03 09:12:36 -08:00
|
|
|
use crate::native_loader;
|
2019-03-13 11:28:54 -07:00
|
|
|
use crate::system_program::SystemError;
|
2019-02-18 22:26:22 -08:00
|
|
|
use solana_sdk::account::{create_keyed_accounts, Account, KeyedAccount};
|
|
|
|
use solana_sdk::native_program::ProgramError;
|
|
|
|
use solana_sdk::pubkey::Pubkey;
|
|
|
|
use solana_sdk::system_program;
|
|
|
|
use solana_sdk::transaction::Transaction;
|
|
|
|
|
2019-03-13 10:46:49 -07:00
|
|
|
/// Reasons the runtime might have rejected an instruction.
|
|
|
|
#[derive(Debug, PartialEq, Eq, Clone)]
|
|
|
|
pub enum InstructionError {
|
|
|
|
/// Executing the instruction produced an error.
|
|
|
|
ProgramError(ProgramError),
|
|
|
|
|
|
|
|
/// Program's instruction lamport balance does not equal the balance after the instruction
|
|
|
|
UnbalancedInstruction,
|
|
|
|
|
|
|
|
/// Program modified an account's program id
|
|
|
|
ModifiedProgramId,
|
|
|
|
|
|
|
|
/// Program spent the lamports of an account that doesn't belong to it
|
|
|
|
ExternalAccountLamportSpend,
|
|
|
|
|
|
|
|
/// Program modified the userdata of an account that doesn't belong to it
|
|
|
|
ExternalAccountUserdataModified,
|
|
|
|
}
|
|
|
|
|
2019-03-13 10:55:43 -07:00
|
|
|
impl InstructionError {
|
|
|
|
pub fn new_result_with_negative_lamports() -> Self {
|
2019-03-13 11:28:54 -07:00
|
|
|
let serialized_error =
|
|
|
|
bincode::serialize(&SystemError::ResultWithNegativeLamports).unwrap();
|
|
|
|
InstructionError::ProgramError(ProgramError::CustomError(serialized_error))
|
2019-03-13 10:55:43 -07:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-02-18 22:26:22 -08:00
|
|
|
/// Process an instruction
|
|
|
|
/// This method calls the instruction's program entrypoint method
|
|
|
|
fn process_instruction(
|
|
|
|
tx: &Transaction,
|
|
|
|
instruction_index: usize,
|
|
|
|
executable_accounts: &mut [(Pubkey, Account)],
|
|
|
|
program_accounts: &mut [&mut Account],
|
|
|
|
tick_height: u64,
|
|
|
|
) -> Result<(), ProgramError> {
|
|
|
|
let program_id = tx.program_id(instruction_index);
|
|
|
|
|
|
|
|
let mut keyed_accounts = create_keyed_accounts(executable_accounts);
|
|
|
|
let mut keyed_accounts2: Vec<_> = tx.instructions[instruction_index]
|
|
|
|
.accounts
|
|
|
|
.iter()
|
|
|
|
.map(|&index| {
|
|
|
|
let index = index as usize;
|
|
|
|
let key = &tx.account_keys[index];
|
|
|
|
(key, index < tx.signatures.len())
|
|
|
|
})
|
|
|
|
.zip(program_accounts.iter_mut())
|
|
|
|
.map(|((key, is_signer), account)| KeyedAccount::new(key, is_signer, account))
|
|
|
|
.collect();
|
|
|
|
keyed_accounts.append(&mut keyed_accounts2);
|
|
|
|
|
|
|
|
if system_program::check_id(&program_id) {
|
2019-03-12 07:48:22 -07:00
|
|
|
crate::system_program::entrypoint(
|
2019-02-18 22:26:22 -08:00
|
|
|
&program_id,
|
|
|
|
&mut keyed_accounts[1..],
|
|
|
|
&tx.instructions[instruction_index].userdata,
|
|
|
|
tick_height,
|
|
|
|
)
|
|
|
|
} else {
|
2019-03-03 09:12:36 -08:00
|
|
|
native_loader::entrypoint(
|
2019-02-18 22:26:22 -08:00
|
|
|
&program_id,
|
|
|
|
&mut keyed_accounts,
|
|
|
|
&tx.instructions[instruction_index].userdata,
|
|
|
|
tick_height,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
fn verify_instruction(
|
|
|
|
program_id: &Pubkey,
|
|
|
|
pre_program_id: &Pubkey,
|
2019-03-05 16:28:14 -08:00
|
|
|
pre_lamports: u64,
|
2019-02-15 10:55:32 -08:00
|
|
|
pre_userdata: &[u8],
|
2019-02-18 22:26:22 -08:00
|
|
|
account: &Account,
|
2019-03-13 10:46:49 -07:00
|
|
|
) -> Result<(), InstructionError> {
|
2019-02-18 22:26:22 -08:00
|
|
|
// Verify the transaction
|
|
|
|
|
|
|
|
// Make sure that program_id is still the same or this was just assigned by the system program
|
|
|
|
if *pre_program_id != account.owner && !system_program::check_id(&program_id) {
|
2019-03-13 10:46:49 -07:00
|
|
|
return Err(InstructionError::ModifiedProgramId);
|
2019-02-18 22:26:22 -08:00
|
|
|
}
|
|
|
|
// For accounts unassigned to the program, the individual balance of each accounts cannot decrease.
|
2019-03-05 16:28:14 -08:00
|
|
|
if *program_id != account.owner && pre_lamports > account.lamports {
|
2019-03-13 10:46:49 -07:00
|
|
|
return Err(InstructionError::ExternalAccountLamportSpend);
|
2019-02-18 22:26:22 -08:00
|
|
|
}
|
2019-02-15 10:55:32 -08:00
|
|
|
// For accounts unassigned to the program, the userdata may not change.
|
|
|
|
if *program_id != account.owner
|
|
|
|
&& !system_program::check_id(&program_id)
|
|
|
|
&& pre_userdata != &account.userdata[..]
|
|
|
|
{
|
2019-03-13 10:46:49 -07:00
|
|
|
return Err(InstructionError::ExternalAccountUserdataModified);
|
2019-02-15 10:55:32 -08:00
|
|
|
}
|
2019-02-18 22:26:22 -08:00
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Execute an instruction
|
|
|
|
/// This method calls the instruction's program entrypoint method and verifies that the result of
|
|
|
|
/// the call does not violate the bank's accounting rules.
|
|
|
|
/// The accounts are committed back to the bank only if this function returns Ok(_).
|
|
|
|
fn execute_instruction(
|
|
|
|
tx: &Transaction,
|
|
|
|
instruction_index: usize,
|
|
|
|
executable_accounts: &mut [(Pubkey, Account)],
|
|
|
|
program_accounts: &mut [&mut Account],
|
|
|
|
tick_height: u64,
|
2019-03-13 10:46:49 -07:00
|
|
|
) -> Result<(), InstructionError> {
|
2019-02-18 22:26:22 -08:00
|
|
|
let program_id = tx.program_id(instruction_index);
|
|
|
|
// TODO: the runtime should be checking read/write access to memory
|
|
|
|
// we are trusting the hard-coded programs not to clobber or allocate
|
2019-03-05 16:28:14 -08:00
|
|
|
let pre_total: u64 = program_accounts.iter().map(|a| a.lamports).sum();
|
2019-02-18 22:26:22 -08:00
|
|
|
let pre_data: Vec<_> = program_accounts
|
|
|
|
.iter_mut()
|
2019-03-05 16:28:14 -08:00
|
|
|
.map(|a| (a.owner, a.lamports, a.userdata.clone()))
|
2019-02-18 22:26:22 -08:00
|
|
|
.collect();
|
|
|
|
|
|
|
|
process_instruction(
|
|
|
|
tx,
|
|
|
|
instruction_index,
|
|
|
|
executable_accounts,
|
|
|
|
program_accounts,
|
|
|
|
tick_height,
|
2019-03-11 12:40:52 -07:00
|
|
|
)
|
2019-03-13 10:46:49 -07:00
|
|
|
.map_err(verify_error)
|
|
|
|
.map_err(InstructionError::ProgramError)?;
|
2019-02-18 22:26:22 -08:00
|
|
|
|
|
|
|
// Verify the instruction
|
2019-03-05 16:28:14 -08:00
|
|
|
for ((pre_program_id, pre_lamports, pre_userdata), post_account) in
|
2019-02-15 10:55:32 -08:00
|
|
|
pre_data.iter().zip(program_accounts.iter())
|
2019-02-18 22:26:22 -08:00
|
|
|
{
|
2019-02-15 10:55:32 -08:00
|
|
|
verify_instruction(
|
|
|
|
&program_id,
|
|
|
|
pre_program_id,
|
2019-03-05 16:28:14 -08:00
|
|
|
*pre_lamports,
|
2019-02-15 10:55:32 -08:00
|
|
|
pre_userdata,
|
|
|
|
post_account,
|
|
|
|
)?;
|
2019-02-18 22:26:22 -08:00
|
|
|
}
|
2019-03-05 16:28:14 -08:00
|
|
|
// The total sum of all the lamports in all the accounts cannot change.
|
|
|
|
let post_total: u64 = program_accounts.iter().map(|a| a.lamports).sum();
|
2019-02-18 22:26:22 -08:00
|
|
|
if pre_total != post_total {
|
2019-03-13 10:46:49 -07:00
|
|
|
return Err(InstructionError::UnbalancedInstruction);
|
2019-02-18 22:26:22 -08:00
|
|
|
}
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Return true if the slice has any duplicate elements
|
|
|
|
pub fn has_duplicates<T: PartialEq>(xs: &[T]) -> bool {
|
|
|
|
// Note: This is an O(n^2) algorithm, but requires no heap allocations. The benchmark
|
|
|
|
// `bench_has_duplicates` in benches/runtime.rs shows that this implementation is
|
|
|
|
// ~50 times faster than using HashSet for very short slices.
|
|
|
|
for i in 1..xs.len() {
|
|
|
|
if xs[i..].contains(&xs[i - 1]) {
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
false
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Get mut references to a subset of elements.
|
2019-03-07 09:35:28 -08:00
|
|
|
fn get_subset_unchecked_mut<'a, T>(xs: &'a mut [T], indexes: &[u8]) -> Vec<&'a mut T> {
|
2019-02-18 22:26:22 -08:00
|
|
|
// Since the compiler doesn't know the indexes are unique, dereferencing
|
|
|
|
// multiple mut elements is assumed to be unsafe. If, however, all
|
|
|
|
// indexes are unique, it's perfectly safe. The returned elements will share
|
|
|
|
// the liftime of the input slice.
|
|
|
|
|
|
|
|
// Make certain there are no duplicate indexes. If there are, panic because we
|
|
|
|
// can't return multiple mut references to the same element.
|
|
|
|
if has_duplicates(indexes) {
|
|
|
|
panic!("duplicate indexes");
|
|
|
|
}
|
|
|
|
|
|
|
|
indexes
|
|
|
|
.iter()
|
|
|
|
.map(|i| {
|
|
|
|
let ptr = &mut xs[*i as usize] as *mut T;
|
|
|
|
unsafe { &mut *ptr }
|
|
|
|
})
|
|
|
|
.collect()
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Execute a transaction.
|
|
|
|
/// This method calls each instruction in the transaction over the set of loaded Accounts
|
|
|
|
/// The accounts are committed back to the bank only if every instruction succeeds
|
|
|
|
pub fn execute_transaction(
|
|
|
|
tx: &Transaction,
|
|
|
|
loaders: &mut [Vec<(Pubkey, Account)>],
|
|
|
|
tx_accounts: &mut [Account],
|
|
|
|
tick_height: u64,
|
2019-03-13 12:58:44 -07:00
|
|
|
) -> Result<(), TransactionError> {
|
2019-02-18 22:26:22 -08:00
|
|
|
for (instruction_index, instruction) in tx.instructions.iter().enumerate() {
|
|
|
|
let executable_accounts = &mut (&mut loaders[instruction.program_ids_index as usize]);
|
|
|
|
let mut program_accounts = get_subset_unchecked_mut(tx_accounts, &instruction.accounts);
|
|
|
|
execute_instruction(
|
|
|
|
tx,
|
|
|
|
instruction_index,
|
|
|
|
executable_accounts,
|
|
|
|
&mut program_accounts,
|
|
|
|
tick_height,
|
|
|
|
)
|
2019-03-13 12:58:44 -07:00
|
|
|
.map_err(|err| TransactionError::InstructionError(instruction_index as u8, err))?;
|
2019-02-18 22:26:22 -08:00
|
|
|
}
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
2019-03-07 09:35:28 -08:00
|
|
|
/// A utility function for unit-tests. Same as execute_transaction(), but bypasses the loaders
|
|
|
|
/// for easier usage and better stack traces.
|
|
|
|
pub fn process_transaction<F, E>(
|
|
|
|
tx: &Transaction,
|
2019-03-07 12:42:01 -08:00
|
|
|
tx_accounts: &mut Vec<Account>,
|
2019-03-07 09:35:28 -08:00
|
|
|
process_instruction: F,
|
|
|
|
) -> Result<(), E>
|
|
|
|
where
|
2019-03-07 12:34:13 -08:00
|
|
|
F: Fn(&Pubkey, &mut [KeyedAccount], &[u8]) -> Result<(), E>,
|
2019-03-07 09:35:28 -08:00
|
|
|
{
|
2019-03-07 12:42:01 -08:00
|
|
|
for _ in tx_accounts.len()..tx.account_keys.len() {
|
2019-03-09 19:28:43 -08:00
|
|
|
tx_accounts.push(Account::new(0, 0, &system_program::id()));
|
2019-03-07 12:42:01 -08:00
|
|
|
}
|
2019-03-07 12:34:13 -08:00
|
|
|
for (i, ix) in tx.instructions.iter().enumerate() {
|
2019-03-07 09:35:28 -08:00
|
|
|
let mut ix_accounts = get_subset_unchecked_mut(tx_accounts, &ix.accounts);
|
|
|
|
let mut keyed_accounts: Vec<_> = ix
|
|
|
|
.accounts
|
|
|
|
.iter()
|
|
|
|
.map(|&index| {
|
|
|
|
let index = index as usize;
|
|
|
|
let key = &tx.account_keys[index];
|
|
|
|
(key, index < tx.signatures.len())
|
|
|
|
})
|
|
|
|
.zip(ix_accounts.iter_mut())
|
|
|
|
.map(|((key, is_signer), account)| KeyedAccount::new(key, is_signer, account))
|
|
|
|
.collect();
|
|
|
|
|
2019-03-07 12:34:13 -08:00
|
|
|
let program_id = tx.program_id(i);
|
|
|
|
if system_program::check_id(&program_id) {
|
2019-03-12 07:48:22 -07:00
|
|
|
crate::system_program::entrypoint(&program_id, &mut keyed_accounts, &ix.userdata, 0)
|
2019-03-07 12:34:13 -08:00
|
|
|
.unwrap();
|
|
|
|
} else {
|
|
|
|
process_instruction(&program_id, &mut keyed_accounts, &ix.userdata)?;
|
|
|
|
}
|
2019-03-07 09:35:28 -08:00
|
|
|
}
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
2019-03-11 15:35:25 -07:00
|
|
|
fn verify_error(err: ProgramError) -> ProgramError {
|
|
|
|
match err {
|
|
|
|
ProgramError::CustomError(mut error) => {
|
|
|
|
error.truncate(32);
|
|
|
|
ProgramError::CustomError(error)
|
|
|
|
}
|
|
|
|
e => e,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-02-18 22:26:22 -08:00
|
|
|
#[cfg(test)]
|
|
|
|
mod tests {
|
|
|
|
use super::*;
|
2019-02-22 12:08:54 -08:00
|
|
|
use solana_sdk::signature::{Keypair, KeypairUtil};
|
2019-02-18 22:26:22 -08:00
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn test_has_duplicates() {
|
|
|
|
assert!(!has_duplicates(&[1, 2]));
|
|
|
|
assert!(has_duplicates(&[1, 2, 1]));
|
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn test_get_subset_unchecked_mut() {
|
|
|
|
assert_eq!(get_subset_unchecked_mut(&mut [7, 8], &[0]), vec![&mut 7]);
|
|
|
|
assert_eq!(
|
|
|
|
get_subset_unchecked_mut(&mut [7, 8], &[0, 1]),
|
|
|
|
vec![&mut 7, &mut 8]
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
#[should_panic]
|
|
|
|
fn test_get_subset_unchecked_mut_duplicate_index() {
|
|
|
|
// This panics, because it assumes duplicate detection is done elsewhere.
|
|
|
|
get_subset_unchecked_mut(&mut [7, 8], &[0, 0]);
|
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
#[should_panic]
|
|
|
|
fn test_get_subset_unchecked_mut_out_of_bounds() {
|
|
|
|
// This panics, because it assumes bounds validation is done elsewhere.
|
|
|
|
get_subset_unchecked_mut(&mut [7, 8], &[2]);
|
|
|
|
}
|
2019-02-22 12:08:54 -08:00
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn test_verify_instruction_change_program_id() {
|
2019-03-13 10:46:49 -07:00
|
|
|
fn change_program_id(
|
|
|
|
ix: &Pubkey,
|
|
|
|
pre: &Pubkey,
|
|
|
|
post: &Pubkey,
|
|
|
|
) -> Result<(), InstructionError> {
|
2019-02-22 12:08:54 -08:00
|
|
|
verify_instruction(&ix, &pre, 0, &[], &Account::new(0, 0, post))
|
|
|
|
}
|
|
|
|
|
|
|
|
let system_program_id = system_program::id();
|
|
|
|
let alice_program_id = Keypair::new().pubkey();
|
|
|
|
let mallory_program_id = Keypair::new().pubkey();
|
|
|
|
|
|
|
|
assert_eq!(
|
2019-03-09 19:28:43 -08:00
|
|
|
change_program_id(&system_program_id, &system_program_id, &alice_program_id),
|
2019-02-22 12:08:54 -08:00
|
|
|
Ok(()),
|
|
|
|
"system program should be able to change the account owner"
|
|
|
|
);
|
|
|
|
assert_eq!(
|
2019-03-09 19:28:43 -08:00
|
|
|
change_program_id(&mallory_program_id, &system_program_id, &alice_program_id),
|
2019-03-13 10:46:49 -07:00
|
|
|
Err(InstructionError::ModifiedProgramId),
|
2019-02-22 12:08:54 -08:00
|
|
|
"malicious Mallory should not be able to change the account owner"
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn test_verify_instruction_change_userdata() {
|
2019-03-13 10:46:49 -07:00
|
|
|
fn change_userdata(program_id: &Pubkey) -> Result<(), InstructionError> {
|
2019-02-22 12:08:54 -08:00
|
|
|
let alice_program_id = Keypair::new().pubkey();
|
2019-03-09 19:28:43 -08:00
|
|
|
let account = Account::new(0, 0, &alice_program_id);
|
2019-02-22 12:08:54 -08:00
|
|
|
verify_instruction(&program_id, &alice_program_id, 0, &[42], &account)
|
|
|
|
}
|
|
|
|
|
|
|
|
let system_program_id = system_program::id();
|
|
|
|
let mallory_program_id = Keypair::new().pubkey();
|
|
|
|
|
|
|
|
assert_eq!(
|
2019-03-09 19:28:43 -08:00
|
|
|
change_userdata(&system_program_id),
|
2019-02-22 12:08:54 -08:00
|
|
|
Ok(()),
|
|
|
|
"system program should be able to change the userdata"
|
|
|
|
);
|
|
|
|
assert_eq!(
|
2019-03-09 19:28:43 -08:00
|
|
|
change_userdata(&mallory_program_id),
|
2019-03-13 10:46:49 -07:00
|
|
|
Err(InstructionError::ExternalAccountUserdataModified),
|
2019-02-22 12:08:54 -08:00
|
|
|
"malicious Mallory should not be able to change the account userdata"
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
2019-03-11 15:35:25 -07:00
|
|
|
#[test]
|
|
|
|
fn test_verify_error() {
|
|
|
|
let short_error = ProgramError::CustomError(vec![1, 2, 3]);
|
|
|
|
let expected_short_error = short_error.clone(); // short CustomError errors should be untouched
|
|
|
|
assert_eq!(verify_error(short_error), expected_short_error);
|
|
|
|
|
|
|
|
let long_error = ProgramError::CustomError(vec![8; 40]);
|
|
|
|
let expected_long_error = ProgramError::CustomError(vec![8; 32]); // long CustomError errors should be truncated
|
|
|
|
assert_eq!(verify_error(long_error), expected_long_error);
|
|
|
|
|
|
|
|
let other_error = ProgramError::GenericError;
|
|
|
|
let expected_other_error = other_error.clone(); // non-CustomError errors should be untouched
|
|
|
|
assert_eq!(verify_error(other_error), expected_other_error);
|
|
|
|
}
|
2019-02-18 22:26:22 -08:00
|
|
|
}
|