Merge pull request #123 from Squads-Protocol/fix-buffer-close-seeds

Audit Findings: Fix transaction_buffer_close seed constraints
Squads-Protocol · Sep 24, 2024 · 714f71e · 714f71e
2 parents a761ea7 + bfd31d8
commit 714f71e
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/programs/squads_multisig_program/src/instructions/transaction_buffer_close.rs b/programs/squads_multisig_program/src/instructions/transaction_buffer_close.rs
@@ -18,11 +18,13 @@ pub struct TransactionBufferClose<'info> {
         close = creator,
         // Only the creator can close the buffer
         constraint = transaction_buffer.creator == creator.key() @ MultisigError::Unauthorized,
+        // Account can be closed anytime by the creator, regardless of the
+        // current multisig transaction index
         seeds = [
             SEED_PREFIX,
             multisig.key().as_ref(),
             SEED_TRANSACTION_BUFFER,
-            &multisig.transaction_index.checked_add(1).unwrap().to_le_bytes(),
+            &transaction_buffer.transaction_index.to_le_bytes(),
         ],
         bump
     )]

diff --git a/programs/squads_multisig_program/src/instructions/transaction_buffer_extend.rs b/programs/squads_multisig_program/src/instructions/transaction_buffer_extend.rs
@@ -23,6 +23,8 @@ pub struct TransactionBufferExtend<'info> {
         mut,
         // Only the creator can extend the buffer
         constraint = transaction_buffer.creator == creator.key() @ MultisigError::Unauthorized,
+        // Extending the buffer only work if it still represents the next
+        // transaction index in the multisig
         seeds = [
             SEED_PREFIX,
             multisig.key().as_ref(),