[MarkFeder]

Linked issue

Fixes #786

Replaces #701, which the PR-hygiene bot closed before the issue was accepted; GitHub doesn't let the author reopen it.

What and why

Adds a Pinocchio version of tokens/token-2022/cpi-guard, which only had an Anchor one, following the same kit + LiteSVM template as the other Token-2022 Pinocchio examples.

CpiGuard stops privileged token operations (transfer, burn, approve, close) authorized by the account owner from running through a CPI. Token-2022 doesn't allow enabling or disabling the guard through a CPI either, so unlike the other extension examples the program can't initialize it. Instead:

• The program exposes one cpi_transfer instruction: a Token-2022 TransferChecked CPI (variant 12) from source to destination, signed by the source's owner. It checks that Token-2022 owns the mint account, then reads decimals from it (offset 44) so the checked transfer matches the mint.
• The test enables and disables the guard client-side and shows its effect on that CPI.

The JS dependencies match the versions #765 set for the other non-anchor examples.

Testing

pnpm install --frozen-lockfile, tsc --noEmit, pnpm build, pnpm build-and-test and pnpm audit in a Linux container, plus cargo fmt --check, cargo clippy -D warnings and prettier --check:

Token-2022 CPI Guard (Pinocchio)
  ✔ Blocks a CPI transfer while CpiGuard is enabled and allows it once disabled
  ✔ Rejects a mint that Token-2022 does not own, before any CPI
2 passing
No known vulnerabilities found

The test creates a mint and a funded source account with CpiGuard enabled, asserts cpi_transfer fails (FailedTransactionMetadata), disables the guard, and asserts the same call succeeds and the destination balance is 1. The success after disabling shows the guard caused the rejection.

The second test passes a byte-for-byte copy of a real mint owned by the System Program, and asserts the program fails before any Token-2022 CPI and no tokens move. With the owner check deleted, this test fails (the fake mint reaches TransferChecked).

bash cicd.sh and pnpm run deploy both name token_2022_cpi_guard_pinocchio_program.so, the file cargo build-sbf writes; checked in Linux with a real build (same check as #794). The name is explicit rather than a *.so glob because pnpm runs scripts through cmd.exe on Windows, which doesn't expand globs.

AI disclosure

Check exactly one. See CONTRIBUTING.md.

• No AI tooling was used beyond editor autocomplete.
• AI tooling was used. Tool and extent: Claude Code helped write the program, the tests and this description; I reviewed the changes and the build and test results.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issues were found.

Summary

Adds a Pinocchio example showing how Token-2022’s CpiGuard blocks transfers made through another program.

• Pinocchio's one-unit token transfer shows when CpiGuard blocks a CPI.
• The example rejects mints that Token-2022 does not own.

_{Reviews (4) · Last reviewed commit: "token-2022 cpi-guard pinocchio: check th..." · Reviewed by Greptile}