Fix panics on malformed transaction data in legacy instruction decoding

[shahan-khatchadourian-anchorage]

Summary

Fixes two panic sites in the legacy transaction path found by cargo-fuzz targets introduced in PR #204.

Bug 1: Unchecked array indexing in instructions.rs

decode_instructions indexes into account_keys using program_id_index and account indices from compiled instructions without bounds checks. Malformed transactions where these indices exceed the account keys array cause index-out-of-bounds panics.

thread panicked at src/core/instructions.rs:33:37:
index out of bounds: the len is 2 but the index is 255

Fix: Use filter_map with bounds checks, matching the pattern already used in v0.rs (lines 137-165). Instructions with out-of-bounds program_id_index are skipped; accounts with out-of-bounds indices are dropped from the instruction. An explicit Err is returned for empty account keys.

Bug 2: Arithmetic underflow in accounts/decode.rs

decode_accounts and decode_v0_accounts subtract header values (num_readonly_signed_accounts, num_readonly_unsigned_accounts) from array lengths without checking that the header values are consistent. Malformed transactions where header counts exceed the actual account keys length cause underflow panics in debug builds and wrapping in release builds.

thread panicked at src/core/accounts/decode.rs:27:45:
attempt to subtract with overflow

Fix: Replace bare subtraction with saturating_sub. On inconsistent headers, the writable/readonly classification degrades gracefully (accounts may be misclassified as writable or readonly) rather than panicking.

Silent failure trade-offs

Both fixes align with the existing v0 transaction handling strategy: silently skip or degrade on malformed data rather than returning errors. This is the pragmatic choice for a visualization tool — showing partial results is better than crashing — but it has risks:

Scenario	Current behavior (after fix)	Risk
Instruction with OOB program_id_index	Instruction silently dropped	User sees fewer instructions than the transaction contains
Instruction with OOB account index	Account silently dropped from instruction	Named accounts may be missing from the display
Inconsistent message header	Accounts misclassified as writable/readonly	Signer/writable badges may be wrong

Future option: These could be surfaced as VisualSignError variants or as warning fields in the SignablePayload output, so callers can distinguish "clean parse" from "degraded parse". This would require a new error variant or a warnings field in the output type.

Test plan

• All 98 existing tests pass (cargo test -p visualsign-solana)
• cargo +nightly fuzz run fuzz_transaction_string -- -max_total_time=30 — ~420,000 runs, zero crashes
• cargo +nightly fuzz run fuzz_versioned_transaction -- -max_total_time=30 — ~510,000 runs, zero crashes
• cargo clippy -p visualsign-solana --tests -- -D warnings — clean
• cargo fmt -- --check — clean

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens the legacy Solana transaction decoding path to avoid panics on malformed input, aligning behavior more closely with the existing v0 transaction handling strategy.

Changes:

• Add bounds checks when expanding legacy compiled instructions to prevent index-out-of-bounds panics.
• Prevent arithmetic underflow in account writable/readonly classification by switching to saturating_sub in both legacy and v0 account decoding.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
src/chain_parsers/visualsign-solana/src/core/instructions.rs	Adds guard for empty account keys and bounds-checks compiled instruction indices to avoid panics during instruction expansion.
src/chain_parsers/visualsign-solana/src/core/accounts/decode.rs	Replaces potentially-underflowing header arithmetic with saturating_sub for safer account classification on malformed headers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[prasanna-anchorage]

nice, I always forget about saturating_sub