Require frozen ALTs in proposal vault transactions

[metapileks]

A proposal's Squads vault transaction may load accounts through Address Lookup Tables. This PR requires every ALT such a transaction references to be frozen. A frozen table's contents are permanently final, so the full account set of a proposal's transaction is fixed from the moment it gets created - the transaction the market evaluates is exactly the one that will execute.

Changes

• New shared validator validate_address_lookup_tables in programs/futarchy/src/squads.rs. For each address_table_lookups entry it checks the ALT account (passed via remaining accounts, in lookup order) matches the referenced key, is owned by the ALT program, is frozen (authority == None), and contains every index the message references.
• initialize_proposal and launch_proposal gain a required squads_vault_transaction account. Launch re-checks to cover proposals initialized before this change ships.
• New error variant UnfrozenAddressLookupTable.
• SDK: initializeProposalIx / launchProposalIx are updated to take the new PDAs. The new getSquadsVaultTransactionAccounts(squadsProposal) helper resolves the vault transaction PDA and its ALT keys, and squadsProposalCreateTx now also returns the vault transaction PDA.

Breaking

Both instructions require the new account, so every caller must pass it. Vault transactions that reference no ALTs (the common case) need no remaining accounts and pass validation trivially.

Greptile Summary

Requires Address Lookup Tables referenced by Squads vault transactions to be frozen and valid before proposal initialization or launch.

• Adds on-chain validation for ALT ownership, identity, frozen authority, and referenced index bounds.
• Binds initialization and launch to the corresponding Squads vault transaction PDA.
• Extends the SDK to resolve and pass vault transaction and lookup-table accounts.
• Adds ALT validation coverage and updates affected tests and helpers.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness or security defects identified in the changed paths.

The new PDA constraints bind validation to the proposal’s Squads transaction, while the shared validator consistently verifies every referenced lookup table and the SDK propagates the required accounts.

Important Files Changed

Filename	Overview
programs/futarchy/src/squads.rs	Adds a shared validator that checks each referenced lookup table’s key, owner, frozen status, and index bounds.
programs/futarchy/src/instructions/initialize_proposal.rs	Requires the proposal’s derived Squads vault transaction and validates all referenced lookup tables at initialization.
programs/futarchy/src/instructions/launch_proposal.rs	Repeats vault transaction and lookup-table validation at launch for compatibility with previously initialized drafts.
programs/futarchy/src/lib.rs	Passes remaining lookup-table accounts into initialization and launch validation.
sdk/src/futarchy/v0.6/FutarchyClient.ts	Resolves vault transaction and ALT addresses and exposes the new required accounts through proposal instruction builders.
sdk/src/futarchy/v0.6/types/futarchy.ts	Updates the generated client types and IDL with the vault transaction accounts and new validation error.

_{Reviews (1): Last reviewed commit: "require frozen ALTs in proposal vault tr..." | Re-trigger Greptile}

[github-actions]

Repository Guard

• Cargo.lock: pass
• yarn.lock (root): pass
• yarn.lock (sdk): pass
• Repo guard: pass

Repository Guard

Cargo dependency pinning

• Status: pass
• Every programs/*/Cargo.toml dep uses =x.y.z, a path = .. workspace ref, or a git dep with a 40-char rev.

Cross-program Anchor/Solana version consistency

• Status: pass
• anchor-lang and anchor-spl are pinned to the version declared in repo-guard.toml across every program.

solana-program crate pin

• Status: pass
• Every solana-program = "=X" declaration is =1.17.14 (locked to match Cargo.lock).

Anchor.toml solana_version

• Status: pass
• Anchor.toml declares solana_version = "1.17.34" (local-dev install for anchor test).

Crate minimum age

• Status: pass
• All Cargo deps changed by this PR are at least 14 days old on crates.io.

Yarn package.json pinning

• Status: pass
• All package.json deps use exact versions (no ^, ~, ranges).

npm minimum age

• Status: pass
• All npm deps changed by this PR are at least 14 days old.

Workflow toolchain consistency

• Status: pass
• Every workflow declares anchor-version: 0.29.0.
• Per-file solana-cli-version values match [toolchain.workflow_solana_cli] in repo-guard.toml.

GitHub Action SHA pinning

• Status: pass
• Every third-party action is pinned to a SHA in [actions.sha_allowlist].

Sensitive program / config changes

• Status: pass
• No suspicious changes to program IDs, error enums, or sensitive files detected.

Overall status: pass

Lockfile freshness (Cargo.lock + yarn.lock) is checked by the workflow directly and cannot be bypassed. The sensitive-diff section is a review hint - CODEOWNERS handles the actual merge gate.