fix(native): bind native market writes to PerpMarket discriminator

[SashaMIT]

Summary

The native [0xFF;4] handlers (handle_update_mm_oracle_native, handle_update_amm_spread_adjustment_native) write fixed byte offsets into accounts[0] without verifying that account is a PerpMarket.

Community #2110 adds owner/min-len (and Clock) checks; #2204 binds the State PDA for the kill-switch bit. This PR is additive: before the mutable borrow, require program ownership, PerpMarket::SIZE, and PerpMarket::discriminator() — the same pattern used in PerpMarketMap.

Test plan

• Crank path with a real PerpMarket still updates mm-oracle / spread fields
• Substituting a non-PerpMarket Drift-owned account in slot 0 fails the new assert
• Review merge order with Hardening: validate owners and data lengths in native admin handlers #2110 / fix(native): bind mm-oracle kill switch to State PDA #2204 (same file)

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • Added validation for native market-update operations to ensure required accounts are provided.
  • Added checks confirming market accounts are owned by the correct program, have sufficient data, and contain valid market metadata.
  • Improved validation for native AMM spread updates to prevent invalid or malformed account data from being processed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: dd3e2e50-9752-4a20-9e2e-21f2b16b677f

📥 Commits

Reviewing files that changed from the base of the PR and between dc017cb and c3120e8.

📒 Files selected for processing (1)

• programs/drift/src/instructions/admin.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• programs/drift/src/instructions/admin.rs

---

Walkthrough

Native MM oracle and AMM spread update paths now validate account lists and PerpMarket account data before accessing raw market data.

Changes

Native market validation

Layer / File(s)	Summary
Validate native market accounts programs/drift/src/instructions/admin.rs	The handlers reject insufficient account lists. They validate program ownership, account size, and the expected PerpMarket discriminator before reading market data.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• velocity-exchange/protocol-v2#2204: Both PRs modify handle_update_mm_oracle_native to harden native MM-oracle account validation, but they validate different accounts.

Poem

A rabbit checks the market gate,
Then waits for accounts at the state.
The owner, size, and marker align,
Before raw bytes cross the line.
AMM paths now safely hop,
When valid market accounts arrive.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: binding native market writes to the PerpMarket discriminator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@programs/drift/src/instructions/admin.rs`:
- Around line 5030-5035: Update the account validation immediately before the
indexing in the AMM spread native path to require at least two accounts,
replacing the non-empty check while preserving the existing market-account
validation through require_account_is_perp_market. This must ensure accounts[1]
is only accessed when accounts.len() >= 2 and return the instruction error
instead of panicking for shorter input.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d1ae0f71-1493-4953-95c6-228db54d4bc4

📥 Commits

Reviewing files that changed from the base of the PR and between 13e8e9b and dc017cb.

📒 Files selected for processing (1)

• programs/drift/src/instructions/admin.rs

[SashaMIT]

Addressed CodeRabbit nit: handle_update_amm_spread_adjustment_native now requires accounts.len() >= 2 before indexing accounts[1] (avoids OOB panic on a one-account call).