feat(test-cli): Settlement with on chain liquidity

[kaze-cow]

Description

Adds ability to use Orca Whirlpools to fulfill swap outputs in cow settle commands

Motivation

Up til now it has only been possible to trade CoW only orders (settlements whose order's swap outputs were less than all swap inputs)

Now the funds can actually be traded on an on-chain DEX. CoW + DEX transactions are supported and they look great.

Example transactions:

• plain swap (no CoW) https://solscan.io/tx/29hSuhUcUmsDMJXTiezk7reRC8BFQL3ZYAi4fPCZdpwLzhiMabTHDHA9npC1ZWpi1hoKBYdJu7qYsAWQeGjeyM8P?cluster=devnet
• swap and CoW combo https://solscan.io/tx/5bpPkFPWc3f3HarzrAqy6yq8RyJqML9QxRUS6K51sShjLPHNKByhc4a3dYVwXj9aWqQvqJBDjo795DnyscAwFCt3?cluster=devnet
  • Order Fym2NNEw7S4sjukTr5JXCmA29Rhywk54k67L7UGe952u sells 0.3 WSOL for 3 USDC
  • Order G3gex9BqZHWRb95J4Mhzf2cdEuEpRnbBJJtM5vKj18v5 sells 1 USDC for 0.1 WSOL
  • The difference to cover is 2 USDC for the first order using 0.2 WSOL, so the resulting swap on orca is 0.2 WSOL for 2 USDC!

Changes Overview

A new folder src/liquidity was added which contains orca.rs.

In order to send needed swap funds to the orca, the settle internals were updated to generate Pull to route funds to the necessary orca swap signer.

Additional swap backends could be added in the future by adding new modules to the liquidity folder and updating the settle command's run function to try all liquidity sources, picking the one with the most favorable overall outcome.

Issues

orca-whirlpools package was added to the test-cli in order to simplify the integration of Orca. However, this library drags in the use of tokio (the async library which we haven't used anywhere yet) and solana-client, . Additionally, solana-client = 4 is not supported, so we have to use solana-client = 3 even though all the other solana library packages we currently consume have been migrated to v4.

Orca necessarily uses tokio so the tokio runtime is kept self-contained in orca.rs and the rest of the codebase remains synchronous as before.

It also needs a couple hacks to work with our less than general requirements:

• we have to rewrite the generated swap transaction to allow for depositing in the buffer PDA rather than the ATA account, which it hardwires in the library for some reason
• The lib will try and create the necessary destination ATA if it doesn't exist, so we need to manually remove that instruction from the transaction.

Surplus

As was the case in the previous test-cli PR to add settlements, sending of surplus to the user is not currently supported. Only the minimum amount of funds required to satisfy the limit price is sent. This continues to be reflected in the behavior of the orca code, swapping only the minimum amount necessary to fulfill the order.

How to test

It is now possible to execute a swap with the test cli with only one transaction. Orca does support the existing test tokens WSOL and USDC on devnet that have been used up til now (see )

So armed with:

• a "trader" account which has SOL
• a "solver" account which has SOL

As there have been a lot of breaking changes, I have deployed a temporary settlement program at a new address for testing of this program for the current branch at 59QTx9Di2dGNLgvwgd2eRisGmymVveqNGHmyuWLwcawb, so please ensure to use --program-id 59QTx9Di2dGNLgvwgd2eRisGmymVveqNGHmyuWLwcawb

Execute a swap:

# Create an order
➜ ./target/debug/cow sell 0.3 SOL for 3 USDC --keypair trader.json --program-id 59QTx9Di2dGNLgvwgd2eRisGmymVveqNGHmyuWLwcawb
signature = 5hhCmfdnDUvRj6GWNBqEcJD7ir2b7ShbRyakhxutBCncaixBcfRL1y8wYzSQAFu7tnmJMWxFcqrjh74K8z2zzKMg
 orderPda = 4D7KqfVJBs9E99E5G7EgPnYadeHgReV7UKchQY8ESL9C
 orderUid = 452d35958efdf16179c077b589fb6dd9490274dc51b635cec80112acf808a145
# Settle the order
➜  ./target/debug/cow settle 4D7KqfVJBs9E99E5G7EgPnYadeHgReV7UKchQY8ESL9C --keypair solver.json --program-id 59QTx9Di2dGNLgvwgd2eRisGmymVveqNGHmyuWLwcawb
settle: CAeZha9aeU5UqDZNJUzUsbTaeHGdZMiHTWrVirLx7ubKHZT89dFHFkFYNycRPDJ92dkUw4BnKeWDNQE2Z2s79k1 (76980 CU)
  order 0: pulled 300000000 (sell So11111111111111111111111111111111111111112), pushed 3000000 (buy 4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU)

You can also CoW with another order (optionally from a separate trader account)

Be sure to set the output limit price! Otherwise, no surplus will be sent and your swap input will simply be consumed.

[linear-code]

SC-144

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	solana-client@​3.1.14
	solana-rpc-client@​3.1.14
	orca_whirlpools@​8.0.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo anza-quinn-proto is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/solana-client@3.1.14 → cargo/anza-quinn-proto@0.11.13-rustsec20260037 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/anza-quinn-proto@0.11.13-rustsec20260037. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo solana-tls-utils is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/solana-client@3.1.14 → cargo/solana-tls-utils@3.1.14 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/solana-tls-utils@3.1.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report