refactor trait

refactor

remove fetch-accounts

renaming, simplify trait

fomat

excl photon-api submodule

fix: multi-pass cold account lookup in test indexer RPC

Align get_account_interface and get_multiple_account_interfaces with
Photon's lookup strategy: search compressed_accounts by onchain_pubkey,
then by PDA seed derivation, then token_compressed_accounts, then by
token_data.owner. Also fix as_mint() to accept ColdContext::Account
since Photon returns mints as generic compressed accounts.

Co-authored-by: Cursor <cursoragent@cursor.com>

lint

fix lint

fix: reject rent sponsor self-referencing the token account (#2257)

* fix: reject rent sponsor self-referencing the token account

Audit issue #9 (INFO): The rent payer could be the same account as
the target token account being created. Add a check that rejects
this self-reference to prevent accounting issues.

* test: add failing test rent sponsor self reference

fix: process metadata add/remove actions in sequential order (#2256)

* fix: process metadata add/remove actions in sequential order

Audit issue #16 (LOW): should_add_key checked for any add and any
remove independently, ignoring action ordering. An add-remove-add
sequence would incorrectly remove the key. Process actions
sequentially so the final state reflects the actual order.

* chore: format

* test: add randomized test for metadata action processing

Validates that process_extensions_config_with_actions produces correct
AdditionalMetadataConfig for random sequences of UpdateMetadataField
and RemoveMetadataKey actions, covering the add-remove-add bug from
audit issue #16.

* test: add integration test for audit issue #13 (no double rent charge)

Verifies that two compress operations targeting the same compressible
CToken account in a single Transfer2 instruction do not double-charge
the rent top-up budget.

* chore: format extensions_metadata test

fix: validate authority on self-transfer early return (#2252)

* fix: handle self-transfer in ctoken transfer and transfer_checked

Validate that the authority is a signer and is the owner or delegate
before allowing self-transfer early return. Previously the self-transfer
path returned Ok(()) without any authority validation.

* fix: simplify map_or to is_some_and per clippy

* fix: use pubkey_eq for self-transfer check

* refactor: extract self-transfer validation into shared function

Extract duplicate self-transfer check from default.rs and checked.rs
into validate_self_transfer() in shared.rs with cold path for authority
validation.

* chore: format

* fix: deduplicate random metadata keys in test_random_mint_action

Random key generation could produce duplicate keys, causing
DuplicateMetadataKey error (18040) with certain seeds.

fix: enforce mint extension checks in cToken-to-cToken decompress (#2246)

* fix: enforce mint extension checks in cToken-to-cToken decompress hot path

Add enforce_extension_state() to MintExtensionChecks and call it in the
Decompress branch when decompress_inputs is None (hot-path, not
CompressedOnly restore). This prevents cToken-to-cToken transfers from
bypassing pause, transfer fee, and transfer hook restrictions.

* fix test

chore: reject compress for mints with restricted extensions in build_mint_extension_cache (#2240)

* chore: reject compress for mints with restricted extensions in mint check

* Update programs/compressed-token/program/src/compressed_token/transfer2/check_extensions.rs

Co-authored-by: 0xa5df-c <172008956+0xa5df-c@users.noreply.github.com>

* fix: format else-if condition for lint

---------

Co-authored-by: 0xa5df-c <172008956+0xa5df-c@users.noreply.github.com>

fix: token-pool index 0 check (#2239)

fix(programs): add MintCloseAuthority as restricted extension (M-03) (#2263)

* fix: add MintCloseAuthority as restricted extension (M-03)

A mint with MintCloseAuthority can be closed and re-opened with
different extensions. Treating it as restricted ensures compressed
tokens from such mints require CompressedOnly mode.

* test: add MintCloseAuthority compression_only requirement tests

Add test coverage for MintCloseAuthority requiring compression_only mode,
complementing the fix in f2da063.

refactor: light program pinocchio macro (#2247)

* refactor: light program pinocchio macro

* fix: address CodeRabbit review comments on macro codegen

- Fix account order bug in process_update_config (config=0, authority=1)
- Use backend-provided serialize/deserialize derives in LightAccountData
- Remove redundant is_pinocchio() branch for has_le_bytes unpack fields
- DRY doc attribute generation across 4 struct generation methods
- Unify unpack_data path using account_crate re-export for both backends

chore(libs): bump versions (#2272)

fix(programs): allow account-level delegate to compress CToken (M-02) (#2262)

* fix: allow account-level delegate to compress tokens from CToken (M-02)

check_ctoken_owner() only checked owner and permanent delegate.
An account-level delegate (approved via CTokenApprove) could not
compress tokens. Added delegate check after permanent delegate.

* test: compress by delegate

fix: accumulate delegated amount at decompression (#2242)

* fix: accumulate delegated amount at decompression

* fix lint

* refactor: simplify apply_delegate to single accumulation path

* fix: ignore delegated_amount without delegate

* restore decompress amount check

fix programtest, wallet owner tracking for ata

fmt and lint

Author: SwenSchaeferjohann

Cargo.lock

@@ -200,8 +200,8 @@ light-hash-set = { version = "4.0.0", path = "program-libs/hash-set" }
 light-indexed-merkle-tree = { version = "5.0.0", path = "program-libs/indexed-merkle-tree" }
 light-concurrent-merkle-tree = { version = "5.0.0", path = "program-libs/concurrent-merkle-tree" }
 light-sparse-merkle-tree = { version = "0.3.0", path = "sparse-merkle-tree" }
-light-client = { path = "sdk-libs/client", version = "0.20.0" }
-light-event = { path = "sdk-libs/event", version = "0.20.0" }
+light-client = { path = "sdk-libs/client", version = "0.21.0" }
+light-event = { path = "sdk-libs/event", version = "0.21.0" }
 light-hasher = { path = "program-libs/hasher", version = "5.0.0", default-features = false }
 light-macros = { path = "program-libs/macros", version = "2.2.0" }
 light-merkle-tree-reference = { path = "program-tests/merkle-tree", version = "4.0.0" }
@@ -213,7 +213,7 @@ light-sdk = { path = "sdk-libs/sdk", version = "0.20.0" }
 light-sdk-pinocchio = { path = "sdk-libs/sdk-pinocchio", version = "0.20.0" }
 light-sdk-macros = { path = "sdk-libs/macros", version = "0.20.0" }
 light-sdk-types = { path = "sdk-libs/sdk-types", version = "0.20.0", default-features = false }
-light-compressed-account = { path = "program-libs/compressed-account", version = "0.10.0", default-features = false }
+light-compressed-account = { path = "program-libs/compressed-account", version = "0.10.1", default-features = false }
 light-compressible = { path = "program-libs/compressible", version = "0.5.0", default-features = false }
 light-token-interface = { path = "program-libs/token-interface", version = "0.4.0" }
 light-account-checks = { path = "program-libs/account-checks", version = "0.8.0", default-features = false }
@@ -233,7 +233,7 @@ light-token-types = { path = "sdk-libs/token-types", version = "0.20.0" }
 light-token = { path = "sdk-libs/token-sdk", version = "0.20.0" }
 light-token-pinocchio = { path = "sdk-libs/token-pinocchio", version = "0.20.0" }
 light-compressed-token-sdk = { path = "sdk-libs/compressed-token-sdk", version = "0.20.0" }
-light-token-client = { path = "sdk-libs/token-client", version = "0.20.0" }
+light-token-client = { path = "sdk-libs/token-client", version = "0.21.0" }
 light-system-program-anchor = { path = "anchor-programs/system", version = "2.0.0", features = [
     "cpi",
 ] }
@@ -244,7 +244,7 @@ light-registry = { path = "programs/registry", version = "2.0.0", features = [
 create-address-test-program = { path = "program-tests/create-address-test-program", version = "1.0.0", features = [
     "cpi",
 ] }
-light-program-test = { path = "sdk-libs/program-test", version = "0.20.0" }
+light-program-test = { path = "sdk-libs/program-test", version = "0.21.0" }
 light-instruction-decoder = { path = "sdk-libs/instruction-decoder", version = "0.20.0" }
 light-instruction-decoder-derive = { path = "sdk-libs/instruction-decoder-derive", version = "0.2.0" }
 light-batched-merkle-tree = { path = "program-libs/batched-merkle-tree", version = "0.10.0" }

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "light-compressed-account"
-version = "0.10.0"
+version = "0.10.1"
 description = "Compressed account struct and common utility functions used in Light Protocol."
 readme = "README.md"
 repository = "https://github.com/Lightprotocol/light-protocol"

program-libs/compressed-account/Cargo.toml

@@ -6,12 +6,13 @@ use crate::state::ExtensionStructConfig;
 /// Restricted extension types that require compression_only mode.
 /// These extensions have special behaviors (pausable, permanent delegate, fees, hooks,
 /// default frozen state) that are incompatible with standard compressed token transfers.
-pub const RESTRICTED_EXTENSION_TYPES: [ExtensionType; 5] = [
+pub const RESTRICTED_EXTENSION_TYPES: [ExtensionType; 6] = [
     ExtensionType::Pausable,
     ExtensionType::PermanentDelegate,
     ExtensionType::TransferFeeConfig,
     ExtensionType::TransferHook,
     ExtensionType::DefaultAccountState,
+    ExtensionType::MintCloseAuthority,
 ];
 
 /// Allowed mint extension types for Token accounts.
@@ -53,6 +54,7 @@ pub const fn is_restricted_extension(ext: &ExtensionType) -> bool {
             | ExtensionType::TransferFeeConfig
             | ExtensionType::TransferHook
             | ExtensionType::DefaultAccountState
+            | ExtensionType::MintCloseAuthority
     )
 }
 
@@ -71,6 +73,8 @@ pub struct MintExtensionFlags {
     pub has_transfer_fee: bool,
     /// Whether the mint has the TransferHook extension (with nil program_id)
     pub has_transfer_hook: bool,
+    /// Whether the mint has the MintCloseAuthority extension
+    pub has_mint_close_authority: bool,
 }
 
 impl MintExtensionFlags {
@@ -152,5 +156,6 @@ impl MintExtensionFlags {
             || self.has_transfer_fee
             || self.has_transfer_hook
             || self.has_default_account_state
+            || self.has_mint_close_authority
     }
 }