Skip to content

Conversation

@pileks
Copy link
Contributor

@pileks pileks commented Dec 24, 2025

Adds an admin-only instruction that allows the MetaDAO operational multisig to recover USDC from a launch's quote vault by transferring it to a specified recipient.

Motivation

This instruction serves as a recovery mechanism for funds that may have been mistakenly sent directly to a launch's quote vault outside of normal program flows (e.g., accidental transfers). Without this, such funds would be permanently locked since only the launch's PDA signer can authorize transfers from the vault.

Changes

  • New return_funds instruction that transfers a specified amount of USDC from launch_quote_vault to a recipient's associated token account
    • Callable only by the MetaDAO operational multisig in production
  • New LaunchFundsReturnedEvent emitted on each recovery for off-chain tracking
  • New InvalidAdmin error code

Notes

  • The instruction can be called regardless of launch state (live, completed, failed, etc.) - this is intentional since recovery may be needed at any point
  • The admin can specify any recipient address and any amount (up to vault balance)
  • No state changes occur on the Launch account other than incrementing seq_num

@pileks pileks self-assigned this Dec 24, 2025
);

// Transfer wrongly sent USDC to the launch signer
await this.transfer(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Wut?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Launch signer controls the launch USDC vault, so this essentially raw sends USDC to the signer's vault. I've updated the comment to better reflect this.

amount_wrongly_sent.toNumber(),
);

await launchpadClient.launchpad.methods
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should add an idempotent I think...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure thing. Didn't really think about it as USDC is so ubiquitous, but it makes sense.

let signer = &[&seeds[..]];

// Transfer USDC back to the recipient
token::transfer(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does transfer handle the idempotent create?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't (or at least shouldn't).

@pileks pileks requested a review from R-K-H January 2, 2026 17:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants