feat(minter): read deposit address balances in batches with the typed getMultipleAccounts by gregorydemay · Pull Request #282 · dfinity/cksol

gregorydemay · 2026-10-14T08:49:01Z

Reads up to 100 deposit address balances at once for the scans of the automatic deposit flow of #272 with the typed getMultipleAccounts of the SOL RPC canister, with cycles sized by the number of addresses. The function is only used by the scan timer, which lands next.

The typed method ships with the SOL RPC canister v1.4.0 (dfinity/sol-rpc-canister#394), whose sol_rpc_client 7.0.0 and sol_rpc_types 4.0.0 crates this PR depends on, and which the production SOL RPC canister already runs.

🤖 Generated with Claude Code

Replace the outdated section 3.1.1, which described per-transaction crediting with getSignaturesForAddress and quotas replenished by the removed process_deposit endpoint, with a design that builds on the balance sweep of deposit_sol: a free registration endpoint, a scan timer reading watched deposit addresses in batches with getMultipleAccounts, a schedule adapted from the ckETH minter, a fixed fee in SOL deducted from the minted amount, and a watchlist persisted only as a bounded snapshot at pre_upgrade. Every change to the interface, the arguments and the event log is additive, since the minter is deployed on mainnet. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

State that a re-armed account is reported as watching again, that the main account receives the sweepable amount minus the fee share, correct the worst-case cost arithmetic and state its success assumption, and distinguish a failed upgrade from a reinstallation. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ring Move the sequence diagram of the automatic flow ahead of its explanation, remove the semicolon that broke the mermaid parser on GitHub, and define the deposit id where it is first used in the section. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…he constraint State that scan ticks are guarded like the other timers so that they never overlap, and base the automatic deposit fee constraint on the single-signature fee share that a pending mint actually bears. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Drop the separate status query: calling the registration endpoint again returns the stored registration or the id of the deposit in flight, as deposit_eth does in the ckETH minter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

… signature lookup Spell out that scan ticks never overlap, that the fee derivation is a single-attempt estimate with re-arm costs absorbed by the minter, and that only manual deposits are retried by the caller. Remove getSignaturesForAddress from the RPC inventory and cost tables, since the minter no longer uses it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

A re-armed entry restarts its schedule from the first gap, bounded by the remaining window, and a re-arm only ever follows a detection. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Record the watchlist snapshot on every upgrade so that an older one cannot be replayed after the watchlist emptied, and let the transaction submission section account for deposits queued by the balance scan. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

The window ends with the last scan, and the next registration call starts a new window rather than reporting a registration without a next scan. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…it ids Follow the ckETH minter: a registration freezes neither the minimum deposit amount nor the automatic deposit fee, both are quoted and the values in force at detection apply, the fee being recorded with the queued deposit. deposit_sol compares the latest deposit id of the account before and after its balance read, and a registration is allowed while a deposit_sol call is in progress. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…edule Measure gaps from the previous scan as before, but end the window at a fixed 24 hours after registration, as the ckETH minter does, so that the accumulated tick and call delays have slack and clients and the re-arm share one unambiguous boundary. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ence Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…owner rationale The fee recorded at detection matters for deposits an upgrade finds not yet credited; a credited deposit has its mint amount in CreditedSweep. The minter's principal is excluded as a deposit owner because its default account is the ledger's minting account, not because of an address collision. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…xample with the automatic flow Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…er a concurrent scan Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…n delay and the fee worst case Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…or to new registrations Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…vents the automatic flow adds Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Copilot

🟡 Changes recommended

Raw provider-specific response context prevents reliable 3-of-4 consensus through jsonRequest.

1 open finding

Strip provider-specific RPC context before consensus · New

What changed in this PR

Adds batched Solana deposit-balance reads through getMultipleAccounts.

Changes:

Adds generic JSON-RPC batching with dynamic cycles and response sizing.
Parses balances and handles malformed/inconsistent responses.
Expands RPC test fixtures and coverage.

File	Description
`minter/src/rpc/mod.rs`	Implements batched balance retrieval.
`minter/src/rpc/tests.rs`	Tests requests, sizing, and errors.
`minter/src/constants.rs`	Defines batch limits and cost estimates.
`minter/src/test_fixtures/mod.rs`	Generates RPC response fixtures.
`minter/src/test_fixtures/runtime.rs`	Records cycles and stubs responses.
`minter/Cargo.toml`	Promotes `serde_json` to a runtime dependency.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🔵 Needs a closer look

Provider-specific response context can prevent consensus even when returned balances agree.

2 open findings

🧠 Review effort: Balanced

… mints The deposits hand the credited sweep back to the state, which reads the fees it collects; the fee accessor of a queued deposit is named after the fee alone; the mints of a sweep fail with their own error type; and the count of automatic deposits, which a fee does not establish, is dropped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

The plan-level fee test and the decode test of the old queued deposit encoding go, the state test asserts the amount received, the rejected Candid deposit carries an arbitrary fee, and the replay of the recorded log takes no extra events. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…leAccounts Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The previously reported consensus issue remains unresolved: differing provider contexts can cause matching balances to be rejected.

2 open findings

🧠 Review effort: Balanced

The typed `getMultipleAccounts` of dfinity/sol-rpc-canister#394 is not released yet, so the client and types crates are patched to that commit until it is. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…tMultipleAccounts Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…the pinned commit Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The unreleased RPC dependency requires human confirmation of compatibility with existing minter calls and successful integration results.

0 open findings

2 resolved since last review

🧠 Review effort: Balanced

… of building it Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The unreleased RPC dependencies and separately hosted canister artifact need end-to-end compatibility verification before approval.

0 open findings

🧠 Review effort: Balanced

…nts response The parameters, the cycles and the response size estimate the SOL RPC client sends are its own to test, and the one account per requested address is the SOL RPC canister's contract, so the count check goes with its tests. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

zeropath-ai · 2026-10-15T13:55:10Z

✅ No security or compliance issues detected. Reviewed everything up to 1f35c9d.

Security Overview

🔎 Scanned files: 8 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/58f1cdfe-c0c2-41c1-8d28-3d6efcaf3266?scanId=900815f8-5563-4291-af06-e1663e1561f0&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► minter/src/rpc/mod.rs Add balances retrieval via getMultipleAccounts integration ► minter/src/rpc/tests.rs Add tests for get_balances and getMultipleAccounts behavior ► minter/src/constants.rs Add constants for getMultipleAccounts: MAX_ADDRESSES_PER_GET_MULTIPLE_ACCOUNTS, GET_MULTIPLE_ACCOUNTS_BASE_CYCLES, GET_MULTIPLE_ACCOUNTS_CYCLES_PER_ADDRESS ► minter/src/test_fixtures/mod.rs Add accounts_with_balances helper for getMultipleAccounts responses ► minter/src/test_fixtures/runtime.rs Add helper add_get_multiple_accounts_response and wire in SentUpdateCall cycles tracking
Refactor	► Cargo.toml Bump sol_rpc_client to 7.0.0 and sol_rpc_types to 4.0.0 to align with new getMultipleAccounts integration
Bug Fix / Other	► integration_tests/src/lib.rs Update SOL RPC canister wasm path and URL to v1.4.0 for getMultipleAccounts testing functionality

Copilot

🟢 Approval recommended

The remaining test-coverage improvement is non-blocking, with no demonstrated correctness defect.

1 open finding

Add outgoing request assertions for batch-dependent RPC budgets · New

🧠 Review effort: Balanced

…t per address The balances are paired with the addresses by position, and the SOL RPC canister does not guarantee one account per requested address in the pinned version, so a short response would leave the addresses past its end unread. A response with the wrong number of accounts is now an error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Pins the parameters, the response size estimate and the cycles the minter chooses for 1 and 100 addresses, which the tests of the response alone leave unchecked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…e to the SOL RPC canister As for every other call, the SOL RPC canister prices the call with its own default estimate, which allows 192 bytes per account without data in its upcoming release, close to what the minter estimated, so the minter no longer mirrors the canister's internal sizes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

Compatibility of the unreleased RPC dependencies and replacement canister artifact still needs build and integration validation before human approval.

1 open issue

Add outgoing request assertions for batch-dependent RPC budgets

_{Review effort: Balanced}

Replace the pins to the dfinity/sol-rpc-canister#394 commit with the released sol_rpc_client 7.0.0 and sol_rpc_types 4.0.0, and run the integration tests against the SOL RPC canister v1.4.0 release wasm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

Human assessment is needed to evaluate the unverified RPC response decoding, sizing, and cycle budget for full-batch requests.

1 open issue

Add outgoing request assertions for batch-dependent RPC budgets

_{Review effort: Balanced}

gregorydemay and others added 22 commits October 14, 2026 06:41

docs(design): define the scan schedule of a re-armed deposit address

257b359

A re-armed entry restarts its schedule from the first gap, bounded by the remaining window, and a re-arm only ever follows a detection. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): say what happens after the last scan of a watched address

f8a8a29

The window ends with the last scan, and the next registration call starts a new window rather than reporting a registration without a next scan. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): mention the automatic flow in the withdrawal delay sent…

e513dfd

…ence Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): add the state diagram of an account in the automatic flow

ea186e2

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): let the scan discard a read whose window closed meanwhile

1163210

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): make the re-arm subject to the watchlist capacity

0519a29

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): align the diagram, the delay sentence and the minimum e…

c658da2

…xample with the automatic flow Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): state the hard cost bound and the deposit_sol reply aft…

790ad8e

…er a concurrent scan Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): exclude the minter principal from automatic registrations

b52f2d7

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): qualify the re-arm, the concurrency bound, the detectio…

4c0715b

…n delay and the fee worst case Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): show the full Watching reply and scope the capacity err…

cb528cb

…or to new registrations Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(design): define the next scan time as a due time and scope the e…

3ab9a97

…vents the automatic flow adds Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

gregorydemay added this pull request to stack #288 October 14, 2026 08:50

Copilot AI balanced review requested due to automatic review settings October 14, 2026 09:04

gregorydemay force-pushed the DEFI-2780-07-get-multiple-accounts branch from 22f1571 to 194a84c Compare October 14, 2026 09:04

Copilot started reviewing on behalf of gregorydemay October 14, 2026 09:05

View session

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Comment thread minter/src/rpc/mod.rs Resolved

Copilot AI balanced review requested due to automatic review settings October 14, 2026 09:18

gregorydemay force-pushed the DEFI-2780-07-get-multiple-accounts branch from 194a84c to 88ec974 Compare October 14, 2026 09:18

Copilot started reviewing on behalf of gregorydemay October 15, 2026 11:29

View session