[sisuresh]

Changes

• Regenerate XDR from stellar-xdr 4f524bba (main). CAP-0084, CAP-0087 and CAP-0088 are all ungated there (Rename TimePointMilliseconds to TimePointMs stellar-xdr#319, Cant build horizon using stellar's go repo #320, Can't get friendbot to work on testnet (local) #321), so XDR_FEATURES is now empty. This adds:
  • CAP-0084: SC_ADDRESS_TYPE_MUXED_CONTRACT / MuxedContract.
  • CAP-0087: the ML-DSA ContractCostType values 86–94. These are names only: cost params are positional, so P30 config settings already decoded without them.
  • CAP-0088: the millisecond close-time StellarValue arms (STELLAR_VALUE_SIGNED_MS, STELLAR_VALUE_EMPTY_TX_SET_MS) and TimePointMs. Every ledger after the P30 upgrade uses one of these arms, so without them none of those ledgers decode.
• strkey: W… muxed contract (VersionByteMuxedContract = 22 << 3, MuxedContract, DecodeMuxedContract, IsValidMuxedContractAddress). The tests now include a real checksum-mismatch vector; the previous "bad checksum" vector differed only in the unused padding bit and is kept as a non-canonical case.
• xdr: ScAddress.String()/Equals for SC_ADDRESS_TYPE_MUXED_CONTRACT.
• processors/token_transfer: skip muxed contract holders in balance deltas.
• protocols/horizon/effects: add contract_muxed / contract_muxed_id to ContractCredited.
• support/contractevents: read the amount from {amount, to_muxed_id} event data. A SAC transfer to a muxed destination (M… since CAP-0067, now also W…) previously parsed as a transfer with Amount 0 and no error.
• ingest/ledger: NodeID and Signature read the close-value signature from every signed StellarValue arm. That covers the CAP-0088 millisecond arms (STELLAR_VALUE_SIGNED_MS, STELLAR_VALUE_EMPTY_TX_SET_MS), which every ledger after the upgrade uses, and STELLAR_VALUE_EMPTY_TX_SET (CAP-0083), which was previously missed, so empty ledgers returned an error and no signature. Whole-second CloseTime is unchanged.

This is the single Protocol 30 PR. It supersedes #6003 (CAP-0087) and #5998 (CAP-0088), whose changes are included here, with #5998's ingest/ledger change renamed to the upstream TimePointMs type.

Upstream

• stellar/stellar-xdr@4f524bb is the commit stellar-core master pins as src/protocol-curr/xdr since Bump to protocol 30 and ungate CAP-0084 and CAP-0087 stellar-core#5478, which made protocol 30 current with CAP-0084 and CAP-0087.
• CAP-0088 isn't in stellar-core yet (Millisecond-resolution close times (MS_CLOSE_TIME, vnext) stellar-core#5423), but its XDR is already ungated upstream for Protocol 30, so it is included here.
• At GA, check that stellar-core 30.0.0 still pins this stellar-xdr commit and repin if not, as Protocol 28 GA: pin stellar-xdr 9c9c1459, clear XDR_FEATURES #5968 did for Protocol 28.

Downstream

stellar/stellar-horizon#237, stellar/stellar-rpc#1050 and stellar/stellar-galexie#98 build against this branch through a replace. Once this merges, they switch to the merged protocol-next commit.

Testing

• CI on this PR.
• go build ./..., plus go test for strkey, support/contractevents, ingest/ledger and support/datastore.
• The three downstream PRs build and pass their unit tests against this branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J5dN6jqdJt52ve9XWyeggH

[Copilot]

Copilot review overview

🟡 Changes recommended

Muxed-contract transfers can be incorrectly recorded as holder balance deltas; the generated comment typo also remains.

Review effort: Lite
Findings: 1

Open (1)

• Reject muxed contract addresses from holder balance deltas · New

What changed in this PR

Adds Protocol 30/CAP-0084 muxed contract (W...) support across XDR, strkey handling, and contract-event processing.

Changes:

• Regenerates XDR bindings with CAP-0084 enabled.
• Adds muxed-contract encoding, decoding, validation, formatting, and equality.
• Updates event processing, tests, generation settings, and changelog.

File	Summary
xdr/​xdr_views_generated.go	Adds generated muxed-contract views.
xdr/​xdr_generated.go	Regenerates Protocol 30 XDR types and serialization; retains a “panicing” typo.
xdr/​xdr_commit_generated.txt	Records the upstream XDR commit.
xdr/​Stellar-contract.x	Defines muxed contract addresses.
xdr/​Stellar-contract-spec.x	Updates contract-spec name limits.
xdr/​scval.go	Supports muxed-contract formatting and equality.
xdr/​scval_test.go	Tests muxed-contract formatting.
support/​contractevents/​generate.go	Accepts muxed-contract addresses in event fixtures.
support/​contractevents/​event_test.go	Tests muxed-contract event addresses.
strkey/​muxed_contract.go	Implements muxed-contract strkey APIs.
strkey/​muxed_contract_test.go	Tests muxed-contract vectors and validation.
strkey/​main.go	Registers the muxed-contract version byte and validation.
strkey/​isvalid_length_test.go	Tests muxed-contract payload lengths.
strkey/​encode_test.go	Tests muxed-contract encoding.
strkey/​decode_test.go	Tests muxed-contract decoding.
strkey/​decode_length_test.go	Tests invalid muxed-contract lengths.
processors/​token_transfer/​contract_events_test.go	Adds muxed-contract transfer coverage; balance-delta filtering still requires correction.
Makefile	Pins Protocol 30 XDR generation settings.
gxdr/​xdr_generated.go	Regenerates alternate XDR bindings.
CHANGELOG.md	Documents breaking changes and new APIs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The protocol-wide generated and address-processing changes require final human review.

Review effort: Lite
Findings: 1

Open (1)

• Reject muxed contract addresses from holder balance deltas

[Copilot]

Copilot review overview

🔵 Needs a closer look

Protocol 30 changes span generated bindings and multiple address-processing paths, warranting final human review.

Review effort: Lite
Findings: 1

Open (1)

• Reject muxed contract addresses from holder balance deltas

[karthikiyer56]

thank you for this fix

[karthikiyer56]

SC_SPEC_TYPE_NAME_LIMIT widening and ScSpecEventV0.Name ScSymbol to string change are attributed to the three CAPs. They come from stellar/stellar-xdr#312 ("Widen contract spec type and event name limits", 2026-09-09), a non-CAP change for the Rust SDK fully-qualified type names (stellar/stellar-protocol#2014).
Doc fix: split into its own bullet citing #312

[tamirms]

Done in f981faf. It is now its own Breaking Changes entry citing stellar/stellar-xdr#312, and says it is not part of any CAP.

[karthikiyer56]

this update to the endpoint also needs to be added to changelog

[tamirms]

Added under New Features in f981faf.

[karthikiyer56]

the vectors here come from rs-stellar-strkey output. SEP-23 PR #2020 publishes its own W vectors: 2 valid and 5 invalid.

Can we add them so the test checks the spec, not the Rust implementation?
The two rejection cases not covered today are length 6 mod 8 and version byte low bits set.

[tamirms]

Added TestMuxedContractSEP23Vectors in f981faf with the 2 valid and 5 invalid W vectors from stellar/stellar-protocol#2020. All 7 pass against the current implementation, including the length 6 mod 8 and version byte low bits cases. The valid ones also re-encode to the same strkey.

[karthikiyer56]

this tests one case but not the other.
This case has the W.... address in the to topic and a bare i128 in data.
Only a custom SEP-41 token emits that shape. The SAC never does.

Per CAP-0084 Events, a SAC transfer to a W... address looks like this:

topics: ["transfer", from: G..., to: C... (plain, mux stripped), "USDC:GA..."]
data:   { amount: 1000, to_muxed_id: 7 }

The processor already handles it (same path as M destinations) but no test pins it.

Can we add this case, plus a a test for mint as well?

{
    name: "SAC transfer to muxed contract: plain C in topic, to_muxed_id in data",
    setupEvent: func() xdr.ContractEvent {
        topics := []xdr.ScVal{
            createSymbol(TransferEvent),
            createAddress(randomAccount),              // from
            createAddress(someContract1),              // to: plain C, not W
            createString(usdcAsset.StringCanonical()), // sep0011 asset
        }
        data := createScMap("amount", createInt128(thousand), "to_muxed_id", uint64(7))
        return createContract(contractIdFromAsset(usdcAsset), topics, data)
    },
    validateEvent: func(t *testing.T, event *TokenTransferEvent) {
        assert.Equal(t, someContract1, event.GetTransfer().To)
        assert.EqualValues(t, 7, event.Meta.GetToMuxedInfo().GetId())
        assert.NotNil(t, event.GetTransfer().Asset)
    },
},

[tamirms]

Added TestSacEventsToMuxedContractV4 in f981faf. It covers a SAC transfer and a SAC mint with the plain C... address in the topics and {amount, to_muxed_id: 7} as data, and checks To, Amount, the asset and ToMuxedInfo. The existing "V4 Transfer SAC Event - With Memo" case already had the transfer shape, but nothing tied it to CAP-0084, and mint was not covered.

[karthikiyer56]

Could scpValueSignature be exported?
stellar-etl has the exact bug this fixes: internal/transform/ledger.go:95 calls GetLcValueSignature() directly, so from the first P30 ledger its node_id and signature columns go empty.
If the SDK exports the 4-arm helper, etl and others call it instead of re-writing the switch.

cc @chowbao

[tamirms]

Exported it as a method on the XDR type in f981faf, so callers that only have a header can use it too: StellarValueExt.LedgerCloseValueSignature(). etl can replace ledgerHeader.ScpValue.Ext.GetLcValueSignature() with ledgerHeader.ScpValue.Ext.LedgerCloseValueSignature(). ledger.NodeID and ledger.Signature now use it as well, and since TransformLedger already receives the lcm, those would also work there.

[Copilot]

🔵 Needs a closer look

The broad Protocol 30 and cross-component changes require final human review.

6 open findings

• Avoid closing source before EOF hash validation
• Cancel active stream and wait for producer shutdown
• Extend signature accessor for Protocol 30 union arms
• Ingestion helpers fail to extract Protocol 30 signatures
• Reject muxed contract addresses from holder balance deltas
• Generated XDR commit and feature set mismatch

🧠 Review effort: Lite