Prevent randomness overflow.

.github/workflows/build-programs.yml

@@ -57,7 +57,7 @@ jobs:
           PROGRAMS: ${{ env.PROGRAMS }}
 
       - name: Upload program builds
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: program-builds
           # First wildcard ensures exported paths are consistently under the programs folder.

.github/workflows/build-rust-client.yml

@@ -63,7 +63,7 @@ jobs:
         run: cargo build --all-features --release
 
       - name: Upload Rust client builds
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: rust-client-builds
           # First wildcard ensures exported paths are consistently under the clients folder.

.github/workflows/deploy-program.yml

@@ -129,7 +129,7 @@ jobs:
           echo PROGRAM_VERSION="${PROGRAM_VERSION}" >> $GITHUB_ENV
 
       - name: Download program builds
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: program-builds
 

.github/workflows/test-rust-client.yml

@@ -38,11 +38,11 @@ jobs:
           key: rust-client-test
 
       - name: Download program builds
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: program-builds
 
       - name: Run tests
         shell: bash
         working-directory: configs/scripts/client
-        run: RUST_LOG=error ./test-rust.sh
+        run: RUST_LOG=error ./test-rust.sh

Anchor.toml

@@ -4,3 +4,10 @@ mpl-hybrid = "MPL4o4wMzndgh8T1NVDxELQCj5UQfYTYEkabX3wNKtb"
 [provider]
 cluster = "localnet"
 wallet = "~/.config/solana/id.json"
+
+[profile.release]
+overflow-checks = true # Enable integer overflow checks.
+strip = true           # Automatically strip symbols from the binary.
+opt-level = 3          # Optimize for speed.
+lto = true
+codegen-units = 1

programs/mpl-hybrid/src/instructions/capture.rs

@@ -116,10 +116,6 @@ pub fn handler_capture_v1(ctx: Context<CaptureV1Ctx>) -> Result<()> {
     let system_program = &mut ctx.accounts.system_program;
     let token_program = &mut ctx.accounts.token_program;
 
-    let recent_slothashes = &ctx.accounts.recent_blockhashes;
-    let data = recent_slothashes.data.borrow();
-    let most_recent = array_ref![data, 12, 8];
-
     let collection_info = &collection.to_account_info();
     let authority_info = &authority.to_account_info();
     let escrow_info = &escrow.to_account_info();
@@ -132,12 +128,19 @@ pub fn handler_capture_v1(ctx: Context<CaptureV1Ctx>) -> Result<()> {
         return Err(MplHybridError::InvalidCollection.into());
     }
 
-    //If the path is 0, we need to update the metadata onchain
+    //If the path has bit 0 set, we need to update the metadata onchain
     if Path::RerollMetadata.check(escrow.path) {
         let clock = Clock::get()?;
         // seed for the random number is a combination of the slot_hash - timestamp
-        let seed = u64::from_le_bytes(*most_recent).saturating_sub(clock.unix_timestamp as u64)
-            * escrow.count;
+        let recent_slothashes = &ctx.accounts.recent_blockhashes;
+        let data = recent_slothashes.data.borrow();
+        let most_recent = array_ref![data, 12, 8];
+
+        let initial_seed =
+            u64::from_le_bytes(*most_recent).saturating_sub(clock.unix_timestamp as u64);
+        let seed = initial_seed
+            .checked_mul(escrow.count)
+            .unwrap_or(initial_seed);
         // remainder is the random number between the min and max
         let remainder = seed
             .checked_rem(escrow.max - escrow.min)

programs/mpl-hybrid/src/instructions/release.rs

@@ -128,7 +128,7 @@ pub fn handler_release_v1(ctx: Context<ReleaseV1Ctx>) -> Result<()> {
         return Err(MplHybridError::InvalidCollection.into());
     }
 
-    //If the path is 0, we need to update the metadata onchain
+    //If the path has bit 0 set, we need to update the metadata onchain
     if Path::RerollMetadata.check(escrow.path) {
         //construct the captured uri
         let mut uri = escrow.uri.clone();