pyth2wormhole - Solana

In program pyth2wormhole, the role `owner` has authority over the following functions: - `migrate()` will migrate on-chain configuration from an older format. - `set_config()` will update current settings of `pyth2wormhole`. Any compromise to the `owner` account may allow a hacker to take advantage of this authority and manipulate the program settings. Additionally, the Solana program could be upgradeable, and the upgrade authority is the deployer by default. Therefore, if the program is upgradable, and the upgrade authority account is compromised, it could lead to a malicious program upgrade, thus introducing centralization risk.

The function `attest()`, requires a `config` account, which is stated to be a `Derive` type. ```rust=67 pub config: P2WConfigAccount<'b, { AccountState::Initialized }>, ``` ```rust=38 pub type P2WConfigAccount<'b, const IsInitialized: AccountState> = P2WConfigAccountV2<'b, IsInitialized>; ``` ```rust=94 pub type P2WConfigAccountV2<'b, const IsInitialized: AccountState> = Derive<Data<'b, Pyth2WormholeConfigV2, { IsInitialized }>, "pyth2wormhole-config-v2">; ``` Since `Derive` types automatically have their PDA checked through the `peel()` function acquired from the `FromAccounts` macro, it does not need to be checked again. ```rust=72 impl<'a, 'b: 'a, 'c, T: Peel<'a, 'b, 'c>, const Seed: &'static str> Peel<'a, 'b, 'c> for Derive<T, Seed> { fn peel<I>(ctx: &'c mut Context<'a, 'b, 'c, I>) -> Result<Self> { // Attempt to Derive Seed let (derived, bump) = Pubkey::find_program_address(&[Seed.as_ref()], ctx.this); match derived == *ctx.info().key { true => T::peel(ctx).map(|v| Derive(v)), _ => Err(SolitaireError::InvalidDerive(*ctx.info().key, derived).into()), } ```

The `pyth2wormhole` project is built depending on the `Wormhole Solana`. The Solana module of the `pyth2wormhole` are derived from `Wormhole Solana` and remain not updated after `Wormhole Solana` commit [064228869731428e6443c761cb753cf8d1ab01e3](https://github.com/certusone/wormhole/commit/064228869731428e6443c761cb753cf8d1ab01e3). For `Wormhole Solana`, some important components for `pyth2wormhole` like `solitaire` keep updating after the project branched. For example, some important updates in `solitare` are shown as below: - Fix pre-funded account block in commit [2b56fcc7da4422f2270431f0f9c996021115acc0](https://github.com/certusone/wormhole/commit/2b56fcc7da4422f2270431f0f9c996021115acc0) - Fix initialization check in commit [da479cf4c18b024a55ab3db87d027178fd319344](https://github.com/certusone/wormhole/commit/da479cf4c18b024a55ab3db87d027178fd319344) Additionally, it should be noticed that, in the `Wormhole Solana` commit [9aad49d631167e59790fcbc315985fd107adfbcf](https://github.com/certusone/wormhole/commit/9aad49d631167e59790fcbc315985fd107adfbcf), `deps()` functions and `ToInstruction` macro are removed from `solitaire`, which will affect the client code that are using `to_ix` function.