From f1b355009a542ba002ec3b438c12eaaffb3dbb2b Mon Sep 17 00:00:00 2001 From: Morenikeoa Date: Fri, 26 Jun 2026 23:17:43 +0100 Subject: [PATCH] fix(stake): remove silent mainnet default in getStakeProgramId for browser bundles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit getStakeProgramId()'s network-resolution IIFE defaulted to 'mainnet' whenever it ran in a browser bundle with no explicit network argument and no NETWORK/NEXT_PUBLIC_DEFAULT_NETWORK env var set (process.env is empty in browser bundles since env vars aren't inlined into third-party SDK code). This is the exact opposite of the sibling getCurrentNetwork() in program-ids.ts, which was hardened under PERC-697 specifically to remove this same class of silent-mainnet- default bug and now fails open to devnet. Any frontend/wallet-integration code built on this SDK (the natural consumption pattern for a trading SDK) that calls getStakeProgramId() or the PDA helpers that default to it (deriveStakePool, deriveStakeVaultAuth, deriveDepositPda) without an explicit network or programId, in an environment where the bundler didn't inline a NETWORK env var, silently derives mainnet PDAs and targets the mainnet stake program — risking a devnet-testing flow executing against mainnet, or a real deposit/withdraw/stake transaction going to the wrong program. Fix: the browser-context branch now returns 'devnet', matching getCurrentNetwork()'s fail-open-to-devnet policy exactly. Mainnet still requires an explicit `network` argument or env var — this only removes the silent default, it does not change explicit-network behavior. Added a regression test that simulates a browser context (temporary global `window`) with no env vars set and asserts getStakeProgramId() returns the devnet address, not mainnet. Confirmed it fails against the prior code (returns the mainnet address) and passes against this fix. Full suite: 852 passed | 31 skipped (883 total, +1 new test). --- src/solana/stake.ts | 11 +++++++---- test/drift-check.test.ts | 25 +++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 4 deletions(-) diff --git a/src/solana/stake.ts b/src/solana/stake.ts index 0a4cb60..fe53d41 100644 --- a/src/solana/stake.ts +++ b/src/solana/stake.ts @@ -71,10 +71,13 @@ export function getStakeProgramId(network?: 'devnet' | 'mainnet'): PublicKey { safeEnv('NETWORK')?.toLowerCase() ?? ''; if (n === 'mainnet' || n === 'mainnet-beta') return 'mainnet' as const; if (n === 'devnet') return 'devnet' as const; - // In browser bundles, process.env is empty (env vars aren't inlined into - // third-party SDK code). Default to mainnet to match the app's fail-closed - // behavior — devnet must be opted into explicitly. - if (typeof window !== 'undefined') return 'mainnet' as const; + // SECURITY: previously defaulted to 'mainnet' in browser bundles (where + // process.env is empty — env vars aren't inlined into third-party SDK code), + // which could silently target the live mainnet stake program for any + // frontend caller that didn't pass an explicit network. Mirrors the same + // class of bug fixed in program-ids.ts getCurrentNetwork() (PERC-697): fail + // open to devnet, not mainnet. Mainnet must be opted into explicitly via an + // explicit `network` argument or the NETWORK/NEXT_PUBLIC_DEFAULT_NETWORK env var. return 'devnet' as const; })(); diff --git a/test/drift-check.test.ts b/test/drift-check.test.ts index 71fe8b5..3b37ad9 100644 --- a/test/drift-check.test.ts +++ b/test/drift-check.test.ts @@ -608,6 +608,31 @@ describe("STAKE_PROGRAM_ID — address constants", () => { expect(STAKE_PROGRAM_IDS.devnet).toBe("6aJb1F9CDCVWCNYFwj8aQsVb696YnW6J1FznteHq4Q6k"); }); + it("getStakeProgramId() with no args, no env, in a browser context fails open to devnet (not mainnet)", () => { + // Mirrors the PERC-697 hardening in program-ids.ts getCurrentNetwork(): an + // unconfigured frontend caller must never be silently pointed at mainnet. + const savedStakeId = process.env.STAKE_PROGRAM_ID; + const savedNetwork = process.env.NETWORK; + const savedDefaultNetwork = process.env.NEXT_PUBLIC_DEFAULT_NETWORK; + delete process.env.STAKE_PROGRAM_ID; + delete process.env.NETWORK; + delete process.env.NEXT_PUBLIC_DEFAULT_NETWORK; + const hadWindow = "window" in globalThis; + const savedWindow = (globalThis as any).window; + (globalThis as any).window = {}; + try { + const pk = getStakeProgramId(); + expect(pk.toBase58()).toBe(STAKE_PROGRAM_IDS.devnet); + expect(pk.toBase58()).not.toBe(STAKE_PROGRAM_IDS.mainnet); + } finally { + if (hadWindow) (globalThis as any).window = savedWindow; + else delete (globalThis as any).window; + if (savedStakeId !== undefined) process.env.STAKE_PROGRAM_ID = savedStakeId; + if (savedNetwork !== undefined) process.env.NETWORK = savedNetwork; + if (savedDefaultNetwork !== undefined) process.env.NEXT_PUBLIC_DEFAULT_NETWORK = savedDefaultNetwork; + } + }); + it("mainnet and devnet addresses are different", () => { expect(STAKE_PROGRAM_IDS.mainnet).not.toBe(STAKE_PROGRAM_IDS.devnet); });