Audit fixes: critical security bugs, truthful docs, and skill-standards sweep

.gitignore

@@ -19,6 +19,10 @@ node_modules/
 **/*/target
 **/*/tests/fixtures/*
 !**/*/tests/fixtures/*.so
+# Exception to the exception: escrow native's fixture .so is OUR program's
+# build output (cargo build-sbf --sbf-out-dir=tests/fixtures regenerates it),
+# not a third-party dump, so it stays untracked.
+finance/escrow/native/tests/fixtures/escrow_native_program.so
 **/*.rs.bk
 **/*/test-ledger
 **/*/yarn.lock

.reference/ANCHOR-1.0-MIGRATION.md

@@ -5,8 +5,8 @@
 ### Cargo.toml
 - Change `anchor-lang = "0.32.1"` → `anchor-lang = "1.0.0"`
 - Change `anchor-lang = { version = "0.32.1", ... }` → `anchor-lang = { version = "1.0.0", ... }`
-- Same for `anchor-spl` if present — change to `1.0.0`
-- Add comment: `# Anchor 1.0.0 — pin to RC until stable release`
+- Same for `anchor-spl` if present - change to `1.0.0`
+- Add comment: `# Anchor 1.0.0 - pin to RC until stable release`
 - **REMOVE `interface-instructions` feature** if present (removed in Anchor 1.0). This affects transfer-hook projects.
 - Keep all other features as-is (`idl-build`, `init-if-needed`, `cpi`, etc.)
 
@@ -37,5 +37,5 @@
 ### interface-instructions removal (transfer-hook projects)
 For projects that had `features = ["interface-instructions"]`:
 - Remove that feature from Cargo.toml
-- The `#[interface]` attribute is removed — check if the program source uses it
+- The `#[interface]` attribute is removed - check if the program source uses it
 - If it does, this needs manual intervention to refactor

CHANGELOG.md

@@ -4,21 +4,21 @@ All notable changes to this repository are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [2026-04-08] — Quicknode fork modernization (Mike MacCana)
+## [2026-04-08] - Quicknode fork modernization (Mike MacCana)
 
 Mike MacCana led the Quicknode fork of the [Solana Foundation program examples](https://github.com/solana-developers/program-examples) from late 2025. The first commits on this repository lineage are dated **8 April 2026**; the summary below covers that work through the initial merge.
 
 ### What changed (high level)
 
 **Toolchain and frameworks.** The tree had accumulated examples from several years of Solana development (including Anchor releases going back to the ~0.26 era in 2022 and many intermediate versions). The fork brought the Anchor examples up to **Anchor 1.0.0** stable (from 1.0.0-rc.5), refreshed Agave/Solana CLI pins, standardized on **pnpm**, and added parallel implementations in **[Quasar](https://quasar-lang.com/docs)**, **Pinocchio**, **Native Rust**, and **ASM** where applicable. Token-2022 examples were renamed to **`token-extensions`**.
 
-**Testing.** Replaced the old pattern of local validators, Bankrun, and scattered TypeScript `anchor test` flows with **LiteSVM in-process tests** for most Anchor programs — matching current Anchor defaults (`cargo test` wired through `Anchor.toml` / `pnpm test`). Fixed broken or flaky tests across Native, Pinocchio, and Anchor; added missing harnesses (e.g. block-list Pinocchio). CI was reworked for a repo this size: path filtering, caching, matrix sharding, and reliable detection of framework roots.
+**Testing.** Replaced the old pattern of local validators, Bankrun, and scattered TypeScript `anchor test` flows with **LiteSVM in-process tests** for most Anchor programs - matching current Anchor defaults (`cargo test` wired through `Anchor.toml` / `pnpm test`). Fixed broken or flaky tests across Native, Pinocchio, and Anchor; added missing harnesses (e.g. block-list Pinocchio). CI was reworked for a repo this size: path filtering, caching, matrix sharding, and reliable detection of framework roots.
 
 **Programs and layout.** Broke large monolithic `lib.rs` files into **instruction handler modules**; adopted **`InitSpace`** and explicit PDA bumps instead of magic account sizes; corrected several logic bugs (escrow, token swap invariant, counter authority checks, compression Bubblegum program id, and more). Expanded finance and token-extension coverage; reorganized transfer-hook examples (including block-list under Pinocchio).
 
 **Documentation.** Rewrote the root README (framework badges, clearer example blurbs, ASM links), ran a style and **truth audit** on READMEs, and linked canonical [Solana terminology](https://solana.com/docs/references/terminology) on first mention. Added this changelog, `CONTRIBUTING.md` (aligned with LiteSVM testing), README templates, per-example Anchor and Quasar READMEs, fixed Husky for GUI git clients, removed unused maintainer scripts (`sync-package-json`, `cicd.sh`, local-validator helpers for the allow/block-list UI), dropped the orphan `tokens/spl-token-minter/` tree, and removed legacy root `package.json` dependencies (web3.js, Bankrun, chai).
 
-**Removed / deferred.** Dropped duplicate or WIP trees (duplicate block-list Pinocchio copy, Quasar metadata example blocked on `sol_realloc`, root `yarn.lock`). Some examples remain excluded from CI via `.ghaignore` until they build cleanly again (compression, escrow, pyth, and others — see that file for the live list).
+**Removed / deferred.** Dropped duplicate or WIP trees (duplicate block-list Pinocchio copy, Quasar metadata example blocked on `sol_realloc`, root `yarn.lock`). Some examples remain excluded from CI via `.ghaignore` until they build cleanly again (compression, escrow, pyth, and others - see that file for the live list).
 
 ## Before June 2026
 

CONTRIBUTING.md

@@ -20,28 +20,24 @@ Thank you for considering a contribution to this repository. We welcome new exam
 
 ## Testing
 
-This repo uses an in-process test runtime — no local validator boot, no `solana-test-validator`, no `anchor test --validator legacy`.
+This repo uses an in-process test runtime - no local validator boot, no `solana-test-validator`, no `anchor test --validator legacy`.
 
-For Anchor and Quasar examples, tests are written in TypeScript and run with `node:test` via `tsx`:
-
-```bash
-npx tsx --test --test-reporter=spec tests/*.ts
-```
-
-The conventional `Anchor.toml` `[scripts]` entry is:
+**Anchor examples** are tested in Rust with [LiteSVM](https://www.anchor-lang.com/docs/testing/litesvm). Tests live in `programs/<name>/tests/`, load the compiled program with `include_bytes!("../../../target/deploy/<name>.so")`, and run with `cargo test` (build the `.so` first with `cargo build-sbf` or `anchor build`). The conventional `Anchor.toml` `[scripts]` entry is:
 
 ```toml
 [scripts]
-test = "npx create-codama-clients; npx tsx --test --test-reporter=spec tests/*.ts"
+test = "cargo test"
 ```
 
-The TypeScript tests use:
+Optional helpers come from the [`solana-kite`](https://crates.io/crates/solana-kite) crate (wallet creation, token mint helpers, `send_transaction_from_instructions`).
+
+**Quasar examples** are tested in Rust with QuasarSVM. Run `quasar build` (which also generates the Rust client crate under `target/client/rust/` that the tests import), then `quasar test` or `cargo test`.
+
+**Native and Pinocchio examples** use `litesvm` directly from Rust, except for a few that keep TypeScript tests (`tsx --test` with [`solana-kite`](https://solanakite.org) and [`@solana/kit`](https://solanakit.com)) where the example is specifically about client-side tooling.
 
-- [`solana-kite`](https://solanakite.org) for the connection, wallet creation, token mint helpers, PDA derivation, and `sendTransactionFromInstructions`.
-- [`@solana/kit`](https://solanakit.com) for the core types (`KeyPairSigner`, `Address`, `lamports`).
-- A [Codama](https://github.com/codama-idl/codama)-generated client (via `npx create-codama-clients`) for invoking the program instructions. Do **not** use `anchor.workspace` or `program.methods.X().rpc()`.
+Do not write TypeScript tests for Anchor or Quasar programs, and do not use `anchor.workspace` or `program.methods.X().rpc()`.
 
-Native and Pinocchio examples may use `litesvm` directly from Rust where appropriate.
+Tests must exercise the program for real: initialize accounts, send transactions through the program's instruction handlers, and assert resulting state and balances. Placeholder tests (`assert!(true)`, build-only checks) don't count.
 
 ## Style
 
@@ -54,7 +50,7 @@ Other conventions:
 - Use full words rather than abbreviations (`transaction`, not `tx` or `txn`; `account`, not `acc`).
 - Prefer `async`/`await` over `.then()`/`.catch()`.
 - Use `Array<T>` rather than `T[]` in TypeScript.
-- Avoid magic numbers — name or explain them.
+- Avoid magic numbers - name or explain them.
 - Write "onchain" / "offchain" as single words (no hyphen).
 
 ## Excluding an example from CI

README.md

@@ -6,11 +6,11 @@
 
 Each example is available in one or more of the following frameworks:
 
-- [⚓ Anchor](https://www.anchor-lang.com/) — the most popular framework for Solana development. Build with `anchor build`, test with `pnpm test` as defined in `Anchor.toml`.
-- [💫 Quasar](https://quasar-lang.com/docs) — a newer, more performant framework with Anchor-compatible ergonomics. Run `pnpm test` to execute tests.
-- [🤥 Pinocchio](https://github.com/anza-xyz/pinocchio) — a zero-copy, zero-allocation library for Solana programs. Run `pnpm test` to execute tests.
-- [🦀 Native Rust](https://docs.anza.xyz/) — vanilla Rust using Solana's native crates. Run `pnpm test` to execute tests.
-- [🧬 ASM](https://github.com/blueshift-gg/sbpf) — hand-written sBPF assembly built with the `sbpf` toolchain. Run `pnpm build-and-test` to build and test.
+- [⚓ Anchor](https://www.anchor-lang.com/) - the most popular framework for Solana development. Build with `anchor build`, test with `pnpm test` as defined in `Anchor.toml`.
+- [💫 Quasar](https://quasar-lang.com/docs) - a newer, more performant framework with Anchor-compatible ergonomics. Run `pnpm test` to execute tests.
+- [🤥 Pinocchio](https://github.com/anza-xyz/pinocchio) - a zero-copy, zero-allocation library for Solana programs. Run `pnpm test` to execute tests.
+- [🦀 Native Rust](https://docs.anza.xyz/) - vanilla Rust using Solana's native crates. Run `pnpm test` to execute tests.
+- [🧬 ASM](https://github.com/blueshift-gg/sbpf) - hand-written sBPF assembly built with the `sbpf` toolchain. Run `pnpm build-and-test` to build and test.
 
 > [!NOTE]
 > You don't need to write your own program for basic tasks like creating [accounts](https://solana.com/docs/terminology#account), transferring SOL, or minting tokens. These are handled by existing programs like the System Program and Token Program.
@@ -19,7 +19,7 @@ Each example is available in one or more of the following frameworks:
 
 ### Escrow
 
-**Start here — the best first finance program to learn on Solana.** A neutral account that holds funds until both sides deliver, like a real-estate escrow or a lawyer's trust account. The maker deposits token A and names how much token B they want; when a taker supplies token B, the program swaps both in a single all-or-nothing transaction. This swap is the core idea behind every onchain exchange.
+**Start here - the best first finance program to learn on Solana.** A neutral account that holds funds until both sides deliver, like a real-estate escrow or a lawyer's trust account. The maker deposits token A and names how much token B they want; when a taker supplies token B, the program swaps both in a single all-or-nothing transaction. This swap is the core idea behind every onchain exchange.
 
 [⚓ Anchor](./finance/escrow/anchor) [💫 Quasar](./finance/escrow/quasar) [🦀 Native](./finance/escrow/native)
 
@@ -49,7 +49,7 @@ A managed investment fund onchain, like an ETF or mutual fund. Investors deposit
 
 ### Betting Market
 
-Parimutuel (pooled) prediction market — an admin opens an event with multiple outcomes, bettors stake tokens on an outcome, and at settlement the losing pool (minus a protocol fee) is split among winners in proportion to their stake.
+Parimutuel (pooled) prediction market - an admin opens an event with multiple outcomes, bettors stake tokens on an outcome, and at settlement the losing pool (minus a protocol fee) is split among winners in proportion to their stake.
 
 [⚓ Anchor](./tokens/betting-market/anchor)
 
@@ -70,7 +70,7 @@ Store and retrieve data using Solana accounts.
 
 ### Counter
 
-Use a [PDA](https://solana.com/docs/terminology#program-derived-address-pda) to store global state — a counter that increments when called.
+Use a [PDA](https://solana.com/docs/terminology#program-derived-address-pda) to store global state - a counter that increments when called.
 
 [⚓ Anchor](./basics/counter/anchor) [💫 Quasar](./basics/counter/quasar) [🤥 Pinocchio](./basics/counter/pinocchio) [🦀 Native](./basics/counter/native)
 
@@ -100,7 +100,7 @@ Create new accounts on the blockchain.
 
 ### Cross-Program Invocation
 
-Call one program from another — the hand program invokes the lever program to toggle a switch.
+Call one program from another - the hand program invokes the lever program to toggle a switch.
 
 [⚓ Anchor](./basics/cross-program-invocation/anchor) [💫 Quasar](./basics/cross-program-invocation/quasar) [🦀 Native](./basics/cross-program-invocation/native)
 
@@ -148,7 +148,7 @@ Send SOL between two accounts.
 
 ### Pyth Price Feeds
 
-An **oracle** brings real-world market prices — a dollar, a stock, a token — [onchain](https://solana.com/docs/terminology#onchain), like a Bloomberg terminal feeding live quotes. [Pyth](https://pyth.network/) publishes low-latency prices from institutional sources, each in its own price feed account. This example reads a feed and logs its price, confidence interval, and exponent — the building block an AMM, lending market, or vault uses to value assets.
+An **oracle** brings real-world market prices - a dollar, a stock, a token - [onchain](https://solana.com/docs/terminology#onchain), like a Bloomberg terminal feeding live quotes. [Pyth](https://pyth.network/) publishes low-latency prices from institutional sources, each in its own price feed account. This example reads a feed and logs its price, confidence interval, and exponent - the building block an AMM, lending market, or vault uses to value assets.
 
 [⚓ Anchor](./basics/pyth/anchor) [💫 Quasar](./basics/pyth/quasar)
 
@@ -282,43 +282,43 @@ Create tokens with a built-in transfer fee.
 
 [⚓ Anchor](./tokens/token-extensions/transfer-fee/anchor) [💫 Quasar](./tokens/token-extensions/transfer-fee/quasar) [🦀 Native](./tokens/token-extensions/transfer-fee/native)
 
-### Transfer Hook — Hello World
+### Transfer Hook - Hello World
 
 A minimal transfer hook that executes custom logic on every token transfer.
 
 [⚓ Anchor](./tokens/token-extensions/transfer-hook/hello-world/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/hello-world/quasar)
 
-### Transfer Hook — Counter
+### Transfer Hook - Counter
 
 Count how many times tokens have been transferred.
 
 [⚓ Anchor](./tokens/token-extensions/transfer-hook/counter/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/counter/quasar)
 
-### Transfer Hook — Account Data as Seed
+### Transfer Hook - Account Data as Seed
 
 Use token account owner data as seeds to derive extra accounts in a transfer hook.
 
 [⚓ Anchor](./tokens/token-extensions/transfer-hook/account-data-as-seed/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/account-data-as-seed/quasar)
 
-### Transfer Hook — Allow/Block List
+### Transfer Hook - Allow/Block List
 
 Restrict or allow token transfers using an onchain list managed by a list authority.
 
 [⚓ Anchor](./tokens/token-extensions/transfer-hook/allow-block-list-token/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/allow-block-list-token/quasar)
 
-### Transfer Hook — Transfer Cost
+### Transfer Hook - Transfer Cost
 
 Charge an additional fee on every token transfer.
 
 [⚓ Anchor](./tokens/token-extensions/transfer-hook/transfer-cost/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/transfer-cost/quasar)
 
-### Transfer Hook — Transfer Switch
+### Transfer Hook - Transfer Switch
 
 Enable or disable token transfers with an onchain switch.
 
 [⚓ Anchor](./tokens/token-extensions/transfer-hook/transfer-switch/anchor) [💫 Quasar](./tokens/token-extensions/transfer-hook/transfer-switch/quasar)
 
-### Transfer Hook — Whitelist
+### Transfer Hook - Whitelist
 
 Restrict transfers so only whitelisted accounts can receive tokens.
 
@@ -344,6 +344,14 @@ Work with Metaplex compressed NFTs.
 
 [⚓ Anchor](./compression/cutils/anchor) [💫 Quasar](./compression/cutils/quasar)
 
+## Tools
+
+### Shank and Codama
+
+Generate an IDL from a native Rust program with [Shank](https://github.com/metaplex-foundation/shank), then generate a TypeScript client from that IDL with [Codama](https://github.com/codama-idl/codama).
+
+[🦀 Native](./tools/shank-and-codama/native)
+
 ---
 
 **PRs welcome!** Follow the [contributing guidelines](./CONTRIBUTING.md) and see [CHANGELOG.md](./CHANGELOG.md) for release history.

basics/account-data/anchor/Anchor.toml

@@ -8,12 +8,9 @@ skip-lint = false
 [programs.localnet]
 account_data_anchor_program = "GpVcgWdgVErgLqsn8VYUch6EqDerMgNqoLSmGyKrd6MR"
 
-# [registry] section removed — no longer used in Anchor 1.0
-
 [provider]
 cluster = "Localnet"
 wallet = "~/.config/solana/id.json"
 
 [scripts]
-test = "cargo test" 
-litesvm-test = "pnpm ts-mocha -p ./tsconfig.json -t 1000000 tests/litesvm.test.ts" #For litesvm test
+test = "cargo test"

basics/account-data/anchor/programs/anchor-program-example/src/instructions/create.rs

@@ -2,7 +2,7 @@ use crate::state::AddressInfo;
 use anchor_lang::prelude::*;
 
 #[derive(Accounts)]
-pub struct CreateAddressInfo<'info> {
+pub struct CreateAddressInfoAccountConstraints<'info> {
     #[account(mut)]
     payer: Signer<'info>,
 
@@ -16,7 +16,7 @@ pub struct CreateAddressInfo<'info> {
 }
 
 pub fn handle_create_address_info(
-    context: Context<CreateAddressInfo>,
+    context: Context<CreateAddressInfoAccountConstraints>,
     name: String,
     house_number: u8,
     street: String,

basics/account-data/anchor/programs/anchor-program-example/src/lib.rs

@@ -11,7 +11,7 @@ pub mod account_data_anchor_program {
     use super::*;
 
     pub fn create_address_info(
-        context: Context<CreateAddressInfo>,
+        context: Context<CreateAddressInfoAccountConstraints>,
         name: String,
         house_number: u8,
         street: String,

basics/account-data/anchor/programs/anchor-program-example/tests/test_account_data.rs

@@ -39,7 +39,7 @@ fn test_create_address_info() {
             city: "Solana Beach".to_string(),
         }
         .data(),
-        account_data_anchor_program::accounts::CreateAddressInfo {
+        account_data_anchor_program::accounts::CreateAddressInfoAccountConstraints {
             payer: payer.pubkey(),
             address_info: address_info_keypair.pubkey(),
             system_program: system_program::id(),