A recurring pull before the delegation period begins is refused

Source: subscriptions/tests/audit_high_3_1_1.rs L108

• When: the user initializes a subscription authority
• When: a recurring delegation is created
• Then: the recurring delegation is granted (it starts tomorrow) ✓
• When: the delegatee pulls against the delegation
• Then: the pre-start pull is refused ✓

Result: ✗ failed — 949 CU · claims 2/2 ✓

sequenceDiagram
    participant p0 as bob
    participant p1 as Subscriptions
    p0->>p1: transferRecurring
    activate p1
    note over p1: 🚩 custom program error  0x197
    p1-->>p0: ✗ 949cu
    deactivate p1

Authority

flowchart LR
    Subscriptions["Subscriptions"]:::program
    B1u4[("B1u4…")]:::state
    aliceATAMint[("alice/ATA(Mint)")]:::state
    bobATAMint[("bob/ATA(Mint)")]:::state
    bob(["bob"]):::signer
    Subscriptions -->|writes| B1u4
    Subscriptions -->|writes| aliceATAMint
    Subscriptions -->|writes| bobATAMint
    bob -->|signs| Subscriptions
    classDef program fill:#dae8fc,stroke:#6c8ebf;
    classDef signer fill:#d5e8d4,stroke:#82b366;
    classDef state fill:#ffe6cc,stroke:#d79b00;

Ownership

flowchart LR
    Subscriptions["Subscriptions"]:::program
    B1u4[("B1u4…")]:::state
    token["token"]:::program
    aliceATAMint[("alice/ATA(Mint)")]:::state
    bobATAMint[("bob/ATA(Mint)")]:::state
    system["system"]:::program
    bob[("bob")]:::state
    Subscriptions -->|owns| B1u4
    token -->|owns| aliceATAMint
    token -->|owns| bobATAMint
    system -->|owns| bob
    classDef program fill:#dae8fc,stroke:#6c8ebf;
    classDef signer fill:#d5e8d4,stroke:#82b366;
    classDef state fill:#ffe6cc,stroke:#d79b00;

Accounts

A recurring pull before the delegation period begins is refused
bob (949cu)
└─ Subscriptions::transferRecurring ✗ 949cu

Program De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44 invoke [1]
Program De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44 consumed 949 of 200000 compute units
Program De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44 failed: custom program error: 0x197

Integration

What an integrator writes: the derivations and the instruction, byte-identical to the transaction this page witnessed. Addresses are this scenario’s; supply your own.

#![allow(unused)]
fn main() {
use solana_instruction::{AccountMeta, Instruction};
use solana_pubkey::{pubkey, Pubkey};

// --- transferRecurring ---
let program_id: Pubkey = pubkey!("De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44");
let delegation_pda: Pubkey = pubkey!("B1u4dvZ4DrFrUm3tm4K7zqN1Nb9fu2NuAFExDfyDocqg"); // supply your own
let subscription_authority: Pubkey = pubkey!("4RDKDQRnKtZC5ti4wunSAayArwxdZida5St595CiKJ7i"); // SA(alice, Mint): this scenario's value; supply your own
let delegator_ata: Pubkey = pubkey!("3fVRopUs1BsF6RqteSmcyctBCx2YQ6Zkv7prsUz95VHY"); // supply your own
let receiver_ata: Pubkey = pubkey!("5UJQzG1wu6euuhQRnsHbqjKC8DHmfS4jVNzghS3PL4Hx"); // supply your own
let token_mint: Pubkey = pubkey!("HhbhtPWNt5Rd2gvrjhGCekommdNQwVLY6ZMp3aBv4xtG"); // Mint: this scenario's value; supply your own
let token_program: Pubkey = pubkey!("TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"); // the token program
let delegatee: Pubkey = pubkey!("6DAhWE3pSJQrSFRNjkGQznpUi7wWnqWf3FnRyZQqxbvu"); // bob: this scenario's value; supply your own
let event_authority = Pubkey::find_program_address(&[b"event_authority"], &program_id).0;
let ix = Instruction {
    program_id,
    accounts: vec![
        AccountMeta::new(delegation_pda, false), // delegationPda
        AccountMeta::new_readonly(subscription_authority, false), // subscriptionAuthority
        AccountMeta::new(delegator_ata, false), // delegatorAta
        AccountMeta::new(receiver_ata, false), // receiverAta
        AccountMeta::new_readonly(token_mint, false), // tokenMint
        AccountMeta::new_readonly(token_program, false), // tokenProgram
        AccountMeta::new_readonly(delegatee, true), // delegatee
        AccountMeta::new_readonly(event_authority, false), // eventAuthority
        AccountMeta::new_readonly(program_id, false), // selfProgram
    ],
    // discriminator ++ borsh(transferData: {amount: 10000000, delegator: 2rj1…, mint: Hhbh…})
    data: vec![0x05, 0x80, 0x96, 0x98, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1b, 0x98, 0xa3, 0xfc, 0x7a, 0x9f, 0x8b, 0x5c, 0x8b, 0x0e, 0xad, 0xe0, 0x77, 0x5a, 0x59, 0x3e, 0x44, 0x99, 0xa9, 0x76, 0x55, 0x97, 0xcd, 0x1b, 0xdc, 0xae, 0x63, 0xcd, 0x00, 0xf5, 0x19, 0xbc, 0xf8, 0x21, 0x76, 0xd4, 0x30, 0xe3, 0x1b, 0x7f, 0x8d, 0xe5, 0x16, 0xa8, 0xf6, 0xa3, 0x97, 0xc4, 0x57, 0x80, 0x12, 0x98, 0x73, 0x7a, 0xb3, 0x11, 0x69, 0xc0, 0x99, 0x8f, 0x1c, 0x02, 0x2b, 0xa1],
};
}

The same call through the Codama-generated TypeScript client (the async builder derives every PDA the resolver derived here, so only the free inputs appear):

import { address } from "@solana/kit";
import { getTransferRecurringInstructionAsync } from "your-generated-client";

const ix = await getTransferRecurringInstructionAsync({
  delegationPda: address("B1u4dvZ4DrFrUm3tm4K7zqN1Nb9fu2NuAFExDfyDocqg"),
  subscriptionAuthority: address("4RDKDQRnKtZC5ti4wunSAayArwxdZida5St595CiKJ7i"), // SA(alice, Mint)
  delegatorAta: address("3fVRopUs1BsF6RqteSmcyctBCx2YQ6Zkv7prsUz95VHY"),
  receiverAta: address("5UJQzG1wu6euuhQRnsHbqjKC8DHmfS4jVNzghS3PL4Hx"),
  tokenMint: address("HhbhtPWNt5Rd2gvrjhGCekommdNQwVLY6ZMp3aBv4xtG"), // Mint
  // tokenProgram defaults to the token program
  delegatee: delegateeSigner, // bob (a TransactionSigner)
  transferData: {
    amount: 10000000n,
    delegator: address("2rj1EEgg32bupe12mMYnPFaKQCPPyYBhKYmDFZ8cXxpT") /* alice */,
    mint: address("HhbhtPWNt5Rd2gvrjhGCekommdNQwVLY6ZMp3aBv4xtG") /* Mint */
  },
});

#![allow(unused)]
fn main() {
#[test]
fn finding_3_1_1_recurring_pull_before_start_ts_is_refused() {
    let mut story = Story::load(SO, IDL);
    let alice = story.cast("alice"); // delegator
    let bob = story.cast("bob"); // delegatee (the attacker pulling early)
    let mint = story.mint(&alice, MINT_DECIMALS);
    story.fund(&alice, &[(mint, 100_000_000)]);
    story.fund(&bob, &[(mint, 0)]); // create Bob's receiver ATA
    story.init_authority(&alice, mint);

    const DAY: i64 = 86_400;
    const HOUR_S: u64 = 3_600;
    let now = story.now();
    let start_ts = now + DAY; // the delegation opens TOMORROW
    let expiry_ts = now + 7 * DAY;

    // 50 tokens/hour, but the delegation does not start until tomorrow.
    let authority = story.subscription_authority_pda(&alice.pubkey(), &mint);
    let create = story.create_recurring_delegation(CreateRecurringArgs {
        delegator: &alice,
        mint,
        delegatee: bob.pubkey(),
        nonce: 0,
        amount_per_period: 50_000_000,
        period_length_s: HOUR_S,
        start_ts,
        expiry_ts,
        sponsor: None,
        expected_init_id: None,
    });
    story.then_holds(
        "the recurring delegation is granted (it starts tomorrow)",
        create.success,
    );

    let delegation_pda =
        story.recurring_delegation_pda(&authority, &alice.pubkey(), &bob.pubkey(), 0);

    // The attack: Bob pulls 10 tokens NOW, a full day before start_ts.
    let alice_before = story.token_balance(&alice.ata(mint));
    let pull = story.transfer_recurring(TransferArgs {
        delegatee: &bob,
        delegation_pda,
        delegator: alice.pubkey(),
        mint,
        amount: 10_000_000,
        to: None,
        from: None,
    });

    story.then_holds("the pre-start pull is refused", !pull.success);
    emit_scenario(
        &story,
        &pull,
        "A recurring pull before the delegation period begins is refused",
    );
    story.then(
        "refusal carries custom error code for DelegationNotStarted",
        move |_s| refused_with(&pull, DELEGATION_NOT_STARTED),
    );
    story.then("no tokens move before the delegation starts", move |s| {
        s.token_balance(&alice.ata(mint)) == alice_before
    });
}
}