Various minor fixes

jup-sdk/src/futarchy_amm.rs

@@ -1,7 +1,7 @@
 use anchor_lang::prelude::{
-    AccountMeta, AnchorDeserialize, AnchorSerialize, InitSpace, Pubkey, borsh,
+    borsh, AccountMeta, AnchorDeserialize, AnchorSerialize, InitSpace, Pubkey,
 };
-use anyhow::{Result, anyhow, bail};
+use anyhow::{anyhow, bail, Result};
 
 use crate::FutarchyAmmError;
 
@@ -206,18 +206,18 @@ impl Pool {
             bail!(FutarchyAmmError::InvalidReserves);
         }
 
-        let input_amount_with_lp_fee = (input_amount_after_protocol_fee as u128)
+        let input_amount_after_lp_fee = (input_amount_after_protocol_fee as u128)
             .checked_mul((MAX_BPS - LP_TAKER_FEE_BPS) as u128)
             .ok_or_else(|| anyhow!(FutarchyAmmError::MathOverflow))?;
 
-        let numerator = input_amount_with_lp_fee
+        let numerator = input_amount_after_lp_fee
             .checked_mul(output_reserve as u128)
             .ok_or_else(|| anyhow!(FutarchyAmmError::MathOverflow))?;
 
         let denominator = (input_reserve as u128)
             .checked_mul(MAX_BPS as u128)
             .ok_or_else(|| anyhow!(FutarchyAmmError::MathOverflow))?
-            .checked_add(input_amount_with_lp_fee as u128)
+            .checked_add(input_amount_after_lp_fee as u128)
             .ok_or_else(|| anyhow!(FutarchyAmmError::MathOverflow))?;
 
         let output_amount = (numerator

programs/bid_wall/src/error.rs

@@ -16,4 +16,6 @@ pub enum BidWallError {
     InvalidInputAmount,
     #[msg("Invalid crank address")]
     InvalidCrankAddress,
+    #[msg("Insufficient output amount")]
+    InsufficientOutputAmount,
 }

programs/bid_wall/src/instructions/cancel_bid_wall.rs

@@ -3,6 +3,7 @@ use anchor_spl::token::{self, Mint, Token, TokenAccount, Transfer};
 
 use crate::{
     events::{BidWallCanceledEvent, CommonFields},
+    metadao_multisig_vault,
     state::BidWall,
     usdc_mint,
 };
@@ -24,8 +25,8 @@ pub struct CancelBidWall<'info> {
     #[account(address = bid_wall.authority)]
     pub authority: Signer<'info>,
 
-    /// CHECK: used for constraints
-    #[account(address = bid_wall.fee_recipient)]
+    /// CHECK: the fee recipient is always the metadao multisig vault
+    #[account(address = metadao_multisig_vault::ID)]
     pub fee_recipient: UncheckedAccount<'info>,
 
     #[account(mut, associated_token::mint = quote_mint, associated_token::authority = bid_wall)]

programs/bid_wall/src/instructions/close_bid_wall.rs

@@ -4,6 +4,7 @@ use anchor_spl::token::{self, Mint, Token, TokenAccount, Transfer};
 use crate::{
     error::BidWallError,
     events::{BidWallClosedEvent, CommonFields},
+    metadao_multisig_vault,
     state::BidWall,
     usdc_mint,
 };
@@ -13,7 +14,7 @@ use crate::{
 pub struct CloseBidWall<'info> {
     #[account(
         mut,
-        close=payer,
+        close=authority,
         has_one = authority
     )]
     pub bid_wall: Account<'info, BidWall>,
@@ -22,11 +23,11 @@ pub struct CloseBidWall<'info> {
     pub payer: Signer<'info>,
 
     /// CHECK: used for constraints
-    #[account(address = bid_wall.authority)]
+    #[account(mut, address = bid_wall.authority)]
     pub authority: UncheckedAccount<'info>,
 
-    /// CHECK: used for constraints
-    #[account(address = bid_wall.fee_recipient)]
+    /// CHECK: the fee recipient is always the metadao multisig vault
+    #[account(address = metadao_multisig_vault::ID)]
     pub fee_recipient: UncheckedAccount<'info>,
 
     #[account(mut, associated_token::mint = quote_mint, associated_token::authority = bid_wall)]

programs/bid_wall/src/instructions/collect_fees.rs

@@ -5,17 +5,11 @@ use anchor_spl::token::{self, Mint, Token, TokenAccount, Transfer};
 use crate::error::BidWallError;
 use crate::{
     events::{BidWallFeesCollectedEvent, CommonFields},
+    metadao_multisig_vault,
     state::BidWall,
     usdc_mint,
 };
 
-pub mod metadao_multisig_vault {
-    use anchor_lang::prelude::declare_id;
-
-    // MetaDAO operations multisig vault - hardcoded fee destination
-    declare_id!("6awyHMshBGVjJ3ozdSJdyyDE1CTAXUwrpNMaRGMsb4sf");
-}
-
 pub mod metadao_cranker {
     use anchor_lang::prelude::declare_id;
 

programs/bid_wall/src/instructions/initialize_bid_wall.rs

@@ -6,6 +6,7 @@ use anchor_spl::{
 
 use crate::{
     events::{BidWallInitializedEvent, CommonFields},
+    metadao_multisig_vault,
     state::BidWall,
     usdc_mint,
 };
@@ -34,8 +35,9 @@ pub struct InitializeBidWall<'info> {
     #[account(mut)]
     pub payer: Signer<'info>,
 
-    /// CHECK: This is the recipient of the fees collected by the bid wall, no need to validate
-    pub fee_recipient: AccountInfo<'info>,
+    /// CHECK: The fee recipient is always the metadao multisig vault
+    #[account(address = metadao_multisig_vault::ID)]
+    pub fee_recipient: UncheckedAccount<'info>,
 
     // Creator must sign to prevent unauthorized bid wall initialization on their behalf
     pub creator: Signer<'info>,

programs/bid_wall/src/instructions/sell_tokens.rs

@@ -11,6 +11,7 @@ use anchor_spl::token::{self, Burn, Mint, Token, TokenAccount, Transfer};
 #[derive(AnchorSerialize, AnchorDeserialize, Clone)]
 pub struct SellTokensArgs {
     pub amount_in: u64,
+    pub min_amount_out: u64,
 }
 
 #[event_cpi]
@@ -85,7 +86,10 @@ impl SellTokens<'_> {
     }
 
     pub fn handle(ctx: Context<Self>, args: SellTokensArgs) -> Result<()> {
-        let SellTokensArgs { amount_in } = args;
+        let SellTokensArgs {
+            amount_in,
+            min_amount_out,
+        } = args;
 
         // We calculate the total NAV as as sum of:
         // - The initial quote reserves of the Futarchy AMM
@@ -103,16 +107,22 @@ impl SellTokens<'_> {
         let amount_out_before_fee =
             (amount_in as u128 * total_nav as u128 / remaining_base as u128) as u64;
 
+        // Ceiling division: ensures rounding dust is debited from quote_amount
+        // rather than accumulating and inflating total_nav on subsequent sells.
+        let quote_amount_debit = ((amount_in as u128 * total_nav as u128 + remaining_base as u128
+            - 1)
+            / remaining_base as u128) as u64;
+
         require_gte!(
             ctx.accounts.bid_wall.quote_amount,
-            amount_out_before_fee,
+            quote_amount_debit,
             BidWallError::InsufficientQuoteReserves
         );
 
         let amount_out_after_fee =
             ((10_000_u128 - FEE_BPS as u128) * amount_out_before_fee as u128 / 10_000_u128) as u64;
 
-        let fee = amount_out_before_fee - amount_out_after_fee;
+        let fee = quote_amount_debit - amount_out_after_fee;
 
         // Burn base tokens
         token::burn(
@@ -147,8 +157,21 @@ impl SellTokens<'_> {
             amount_out_after_fee,
         )?;
 
-        // Fees can't be used for future token buys, so we subtract the quote amount before fees.
-        ctx.accounts.bid_wall.quote_amount -= amount_out_before_fee;
+        require_gte!(
+            amount_out_after_fee,
+            min_amount_out,
+            BidWallError::InsufficientOutputAmount
+        );
+
+        require_gt!(
+            amount_out_after_fee,
+            0,
+            BidWallError::InsufficientOutputAmount
+        );
+
+        // Fees can't be used for future token buys, so we subtract
+        // the quote amount debit (total amount of quote debited from the bid wall).
+        ctx.accounts.bid_wall.quote_amount -= quote_amount_debit;
         // Track fees collected for fee distribution.
         ctx.accounts.bid_wall.fees_collected += fee;
         // Track base tokens bought up by the bid wall for NAV calculation.

programs/bid_wall/src/lib.rs

@@ -34,6 +34,13 @@ pub mod usdc_mint {
     declare_id!("EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v");
 }
 
+pub mod metadao_multisig_vault {
+    use anchor_lang::prelude::declare_id;
+
+    // MetaDAO operations multisig vault - hardcoded fee destination
+    declare_id!("6awyHMshBGVjJ3ozdSJdyyDE1CTAXUwrpNMaRGMsb4sf");
+}
+
 pub const FEE_BPS: u16 = 300;
 
 pub const TOKEN_SCALE: u64 = 1_000_000;

programs/conditional_vault/src/instructions/merge_tokens.rs

@@ -1,6 +1,14 @@
 use super::*;
 
 impl<'info, 'c: 'info> InteractWithVault<'info> {
+    pub fn validate_merge_tokens(&self) -> Result<()> {
+        require!(
+            !self.question.is_resolved(),
+            VaultError::QuestionAlreadyResolved
+        );
+        Ok(())
+    }
+
     pub fn handle_merge_tokens(ctx: Context<'_, '_, 'c, 'info, Self>, amount: u64) -> Result<()> {
         let accs = &ctx.accounts;
 

programs/conditional_vault/src/instructions/split_tokens.rs

@@ -1,6 +1,14 @@
 use super::*;
 
 impl<'info, 'c: 'info> InteractWithVault<'info> {
+    pub fn validate_split_tokens(&self) -> Result<()> {
+        require!(
+            !self.question.is_resolved(),
+            VaultError::QuestionAlreadyResolved
+        );
+        Ok(())
+    }
+
     pub fn handle_split_tokens(ctx: Context<'_, '_, 'c, 'info, Self>, amount: u64) -> Result<()> {
         let accs = &ctx.accounts;
 

programs/conditional_vault/src/lib.rs

@@ -59,13 +59,15 @@ pub mod conditional_vault {
         InitializeConditionalVault::handle(ctx)
     }
 
+    #[access_control(ctx.accounts.validate_split_tokens())]
     pub fn split_tokens<'c: 'info, 'info>(
         ctx: Context<'_, '_, 'c, 'info, InteractWithVault<'info>>,
         amount: u64,
     ) -> Result<()> {
         InteractWithVault::handle_split_tokens(ctx, amount)
     }
 
+    #[access_control(ctx.accounts.validate_merge_tokens())]
     pub fn merge_tokens<'c: 'info, 'info>(
         ctx: Context<'_, '_, 'c, 'info, InteractWithVault<'info>>,
         amount: u64,

programs/futarchy/src/instructions/admin_approve_execute_multisig_proposal.rs

@@ -15,7 +15,7 @@ pub struct AdminApproveExecuteMultisigProposal<'info> {
     #[account(mut)]
     pub admin: Signer<'info>,
 
-    /// CHECK: checked by autocrat program
+    /// CHECK: checked by futarchy program
     #[account(mut, seeds = [squads_multisig_program::SEED_PREFIX, squads_multisig_program::SEED_MULTISIG, dao.key().as_ref()], bump, seeds::program = squads_multisig_program)]
     pub squads_multisig: Account<'info, squads_multisig_program::Multisig>,
     /// CHECK: squads proposal, initialized by squads multisig program, checked by squads multisig program

programs/futarchy/src/instructions/collect_meteora_damm_fees.rs

@@ -38,7 +38,7 @@ pub struct CollectMeteoraDammFees<'info> {
     #[account(mut)]
     pub admin: Signer<'info>,
 
-    /// CHECK: checked by autocrat program
+    /// CHECK: checked by futarchy program
     #[account(mut, seeds = [squads_multisig_program::SEED_PREFIX, squads_multisig_program::SEED_MULTISIG, dao.key().as_ref()], bump, seeds::program = squads_program)]
     pub squads_multisig: Account<'info, squads_multisig_program::Multisig>,
     /// CHECK: signer for the squads transaction, checked by squads program

programs/futarchy/src/instructions/finalize_proposal.rs

@@ -197,6 +197,19 @@ impl FinalizeProposal<'_> {
             spot.base_protocol_fee_balance += pass.base_protocol_fee_balance;
             spot.quote_protocol_fee_balance += pass.quote_protocol_fee_balance;
         } else {
+            squads_multisig_program::cpi::proposal_reject(
+                CpiContext::new_with_signer(
+                    squads_multisig_program.to_account_info(),
+                    squads_multisig_program::cpi::accounts::ProposalVote {
+                        proposal: squads_proposal.to_account_info(),
+                        multisig: squads_multisig.to_account_info(),
+                        member: dao.to_account_info(),
+                    },
+                    dao_signer,
+                ),
+                squads_multisig_program::ProposalVoteArgs { memo: None },
+            )?;
+
             spot.base_reserves += fail.base_reserves;
             spot.quote_reserves += fail.quote_reserves;
             spot.base_protocol_fee_balance += fail.base_protocol_fee_balance;

programs/futarchy/src/instructions/initialize_proposal.rs

@@ -13,7 +13,7 @@ pub struct InitializeProposal<'info> {
     pub proposal: Box<Account<'info, Proposal>>,
     pub squads_proposal: Box<Account<'info, squads_multisig_program::Proposal>>,
     pub squads_multisig: Box<Account<'info, squads_multisig_program::Multisig>>,
-    #[account(mut)]
+    #[account(mut, has_one = squads_multisig)]
     pub dao: Box<Account<'info, Dao>>,
     #[account(
         constraint = question.oracle == proposal.key()

programs/futarchy/src/instructions/provide_liquidity.rs

@@ -79,13 +79,12 @@ impl ProvideLiquidity<'_> {
             quote_amount,
             max_base_amount,
             min_liquidity,
-            position_authority: _,
+            position_authority,
         } = params;
 
         let total_liquidity = dao.amm.total_liquidity;
         let PoolState::Spot { ref mut spot } = dao.amm.state else {
-            // TODO: check that pool is already in right state
-            unreachable!();
+            return err!(FutarchyError::PoolNotInSpotState);
         };
 
         let (liquidity_to_mint, base_amount) = if total_liquidity > 0 {
@@ -95,8 +94,11 @@ impl ProvideLiquidity<'_> {
             let quote_reserves = spot.quote_reserves as u128;
             let base_reserves = spot.base_reserves as u128;
 
-            // this should only panic in an extreme scenario: when (quote_amount * base_reserve) / quote_reserve > u64::MAX
-            let base_amount: u64 = (((quote_amount as u128 * base_reserves) / quote_reserves) + 1)
+            // Use ceiling division to ensure the depositor provides at least their fair
+            // share of base tokens, protecting existing LPs from rounding-based value extraction.
+            // Formula: ceil(a / b) = (a + b - 1) / b
+            let numerator = quote_amount as u128 * base_reserves;
+            let base_amount: u64 = ((numerator + quote_reserves - 1) / quote_reserves)
                 .try_into()
                 .map_err(|_| FutarchyError::CastingOverflow)?;
 
@@ -122,17 +124,35 @@ impl ProvideLiquidity<'_> {
 
             let initial_liquidity = quote_amount as u128 * 1_000_000_000;
 
+            require_gte!(
+                initial_liquidity,
+                min_liquidity,
+                // AmmError::AddLiquiditySlippageExceeded
+            );
+
             (initial_liquidity, base_amount)
         };
 
         spot.base_reserves += base_amount;
         spot.quote_reserves += quote_amount;
 
-        amm_position.set_inner(AmmPosition {
-            dao: dao.key(),
-            position_authority: liquidity_provider.key(),
-            liquidity: amm_position.liquidity + liquidity_to_mint,
-        });
+        // Check `dao` instead of `position_authority` to detect new accounts.
+        // A valid DAO is always a PDA, never Pubkey::default(). Using `position_authority`
+        // would fail for donations where position_authority = Pubkey::default(), causing
+        // subsequent donations to overwrite liquidity instead of accumulating it.
+        if amm_position.dao == Pubkey::default() {
+            // New account - initialize all fields
+            // Use position_authority to ensure consistency with PDA derivation
+            amm_position.set_inner(AmmPosition {
+                dao: dao.key(),
+                position_authority,
+                liquidity: liquidity_to_mint,
+            });
+        } else {
+            // Existing account - only update liquidity
+            // The position_authority is immutable once set
+            amm_position.liquidity += liquidity_to_mint;
+        }
 
         dao.amm.total_liquidity += liquidity_to_mint;
 
@@ -168,7 +188,7 @@ impl ProvideLiquidity<'_> {
             common: CommonFields::new(&clock, dao.seq_num),
             dao: dao.key(),
             liquidity_provider: liquidity_provider.key(),
-            position_authority: params.position_authority,
+            position_authority,
             quote_amount,
             base_amount,
             liquidity_minted: liquidity_to_mint,

programs/futarchy/src/instructions/update_dao.rs

@@ -23,6 +23,14 @@ pub struct UpdateDao<'info> {
 }
 
 impl UpdateDao<'_> {
+    pub fn validate(&self) -> Result<()> {
+        // Prevent parameter updates during active futarchy markets
+        if !matches!(self.dao.amm.state, PoolState::Spot { .. }) {
+            return Err(FutarchyError::PoolNotInSpotState.into());
+        }
+        Ok(())
+    }
+
     pub fn handle(ctx: Context<Self>, dao_params: UpdateDaoParams) -> Result<()> {
         let dao = &mut ctx.accounts.dao;