Skip to content

Subscriptions Program v0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@dev-jodee dev-jodee released this 10 Aug 17:13
program-v0.5.0
364a419
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Third audited release of the Subscriptions program, tagged program-v0.5.0. Cantina delta review over 64dc085…debb4f7 — no critical findings; all findings addressed and re-verified at debb4f7. SDKs published at 0.5.0: subscriptions (crates.io) and @solana/subscriptions (npm).

Highlights

  • CancelSubscriptionNow (discriminator 17): merchant-approved immediate cancellation — the subscription expires at cancellation time instead of the end of the billing period. The existing grace-period CancelSubscription is unchanged.
  • Gasless CreatePlan: an optional trailing payer funds plan rent while the merchant remains the plan owner (mirrors the sponsor pattern of init_subscription_authority, subscribe, and the delegation creators). Sponsored rent is not recoverable by the payer — delete_plan refunds the owner — so gate sponsorship off-chain.
  • 1-step signup: Subscribe, CreateFixedDelegation, and CreateRecurringDelegation accept the sentinel UNKNOWN_INIT_ID (i64::MIN, exported by the TS SDK), so authority init + subscribe/create-delegation can be bundled into a single transaction. The sentinel is slot-scoped: authorities created in an earlier slot must pass the real init_id (fails closed with StaleSubscriptionAuthority).

Breaking

  • ResumeSubscription instruction data appends expected_expires_at_ts (the expiry observed at signing); a mismatch is rejected with StaleSubscriptionApproval (521).
  • UpdatePlan instruction data appends the observed plan state (expected_created_at, expected_end_ts, expected_pullers, expected_metadata_uri); a mismatch is rejected with StalePlanApproval (522).
  • The 0.5.0 SDKs build the new instruction data automatically (the TS plugin auto-fetches plan state for updatePlan); raw instruction builders must append the new fields.

Security

  • Stale-approval guards on ResumeSubscription and UpdatePlan (see Breaking): old signed transactions (durable nonce, pending multisig) cannot execute after the approved state has changed.
  • CancelSubscriptionNow binds the dual approval to the observed period start; a signed cancellation replayed against a later re-subscription at the same PDA is rejected with StaleSubscriptionApproval (521).
  • RevokeAbandonedDelegation and RevokeAbandonedSubscription treat a closed SubscriptionAuthority as terminal only once its init_id slot has passed (same-slot re-init guard).

Links

  • Full changelog: CHANGELOG.md
  • Audit status & verification: audits/AUDIT_STATUS.md
  • Program ID: De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44
  • Release commit: 364a41976c33347d092902443bbec2def9227e75
Assets 2
Loading