fix(meteora): on-chain positions, WSOL wrap, close fix, retry logic (v0.3.3)#153
fix(meteora): on-chain positions, WSOL wrap, close fix, retry logic (v0.3.3)#153
Conversation
…v0.3.3) - get-user-positions: replace Meteora REST API with pure on-chain BinArray computation; token amounts derived from proportional share formula - add-liquidity: auto-wrap SOL→WSOL; 600k compute budget; retry once on simulation errors (ProgramAccountNotFound/stale RPC state) - add-liquidity: fix bin_array_bitmap_extension sentinel (new→new_readonly) to prevent ProgramAccountNotFound simulation failure - remove-liquidity --close: replace ix_close_position with claim_fee + close_position_if_empty to satisfy fee_infos==0 requirement - solana_rpc: add parse_position_shares, parse_bin_at; dual-RPC fallback in account_exists to avoid spurious init instructions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
meteora get-pools |
Search and list DLMM pools with filtering and sorting options |
meteora get-pool-detail --address <pool> |
Get detailed information for a specific pool |
meteora get-swap-quote --from-token <mint> --to-token <mint> --amount <amount> |
Get swap quote between tokens |
meteora get-user-positions [--wallet <address>] [--pool <pool>] |
View user's LP positions |
meteora swap --from-token <mint> --to-token <mint> --amount <amount> [--dry-run] |
Execute token swap with optional preview |
meteora add-liquidity --pool <pool> [--amount-x <x>] [--amount-y <y>] [--dry-run] |
Add liquidity to DLMM pool |
meteora remove-liquidity --pool <pool> --position <pos> [--pct <pct>] [--close] [--dry-run] |
Remove liquidity from position |
Triggers
Activate this skill when users want to trade tokens on Solana, provide liquidity to earn fees, check their LP positions, or discover high-yield pools on Meteora DLMM. Use for both read-only operations like pool discovery and transactional operations like swapping and liquidity management.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --globalInstall meteora binary (auto-injected)
if ! command -v meteora >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_i686) TARGET="i686-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
linux_armv7l) TARGET="armv7-unknown-linux-gnueabihf" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
mingw*_i686|msys*_i686|cygwin*_i686) TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
mingw*_aarch64|msys*_aarch64|cygwin*_aarch64) TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/meteora@0.3.3/meteora-${TARGET}${EXT}" -o ~/.local/bin/meteora${EXT}
chmod +x ~/.local/bin/meteora${EXT}
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/meteora"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"meteora","version":"0.3.3"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"meteora","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 79/100
1. Plugin Overview
Summary: This plugin provides a CLI binary ( Target Users: DeFi users and LP providers on Solana who want to interact with Meteora DLMM pools through an AI agent interface. 2. Architecture AnalysisComponents:
Skill Structure:
Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin can read Meteora DLMM pool data, query Solana RPC for on-chain account state, resolve the user's wallet address, and execute on-chain operations (token swaps via DEX aggregator, add/remove liquidity to DLMM pools) through onchainos. The binary builds unsigned Solana transactions locally and delegates signing to onchainos's TEE-backed wallet. It has full write access to the user's Solana wallet for swap and liquidity operations. The SKILL.md includes dry-run modes and instructs the agent to seek user confirmation before write operations. 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations are delegated to onchainos CLI. The binary constructs unsigned transactions and passes them to onchainos for signing and broadcasting. 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)TF006 — External data no boundary + financial operations:
No other toxic flows detected. Prompt Injection ScanNo instruction overrides, identity manipulation, hidden behavior, confirmation bypass, unauthorized operations, or hidden content (base64, invisible chars) detected in SKILL.md or source code. Result: ✅ Clean Dangerous Operations CheckThe plugin performs:
Both have explicit user confirmation steps documented in SKILL.md (dry-run preview → user confirmation → execute). The Result: ✅ Safe Data Exfiltration RiskNo evidence of data exfiltration. The binary only communicates with:
No user credentials, private keys, or sensitive data are sent to external endpoints. Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskTF006 toxic flow (external data boundary missing + financial operations) warrants a WARN. The plugin handles real money operations (swaps, liquidity) while processing untrusted external data without explicit boundary declarations. 6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisKey dependencies (all from crates.io):
No suspicious, unmaintained, or known-vulnerable dependencies identified. All are mainstream Rust ecosystem crates. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes. The SKILL.md accurately describes all 7 commands, their parameters, and behavior. The dry-run modes, confirmation flows, and delegation to onchainos are all correctly documented. The architecture section correctly describes the read vs. write operation flows. Verdict: ✅ Source Safe7. Code ReviewQuality Score: 79/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-architected Meteora DLMM plugin with proper onchainos delegation for all write operations, but missing untrusted data boundary declarations for external API data flowing into agent context alongside financial operations. Merge recommendation: The following should be addressed:
Generated by Claude AI via Anthropic API — review the full report before approving. |
2 participants
Summary
user_amount = bin_amount × shares / supply)sol_transfer + sync_native; 600k compute budget; automatic retry on simulation errors (re-checks account states before retry)bin_array_bitmap_extensionsentinel fromAccountMeta::new→AccountMeta::new_readonly(was causingProgramAccountNotFoundsimulation failure)--close: Replaceix_close_positionwithix_claim_fee + ix_close_position_if_emptyto satisfyfee_infos == 0requirement before closingparse_position_shares,parse_bin_at; dual-RPC fallback inaccount_existsto prevent spurious bin array init instructionsTest plan
get-user-positionsreturns token amounts from on-chain BinArray state (verified on mainnet)add-liquidity --amount-x 0.001 --amount-y 0.1succeeds with WSOL wrap on SOL/USDC poolremove-liquidity --pct 100 --closesuccessfully claims fees and closes position, reclaims ~0.057 SOL rentProgramAccountNotFoundafter rapid close→add sequencecargo build --releasepasses0.3.3🤖 Generated with Claude Code