fix(execution): prevent reentrancy attacks with cancelling proposal d…

…uring execution

programs/multisig/src/instructions/batch_execute_transaction.rs

@@ -1,4 +1,5 @@
 use anchor_lang::prelude::*;
+use std::borrow::Borrow;
 
 use crate::errors::*;
 use crate::state::*;
@@ -146,6 +147,10 @@ impl BatchExecuteTransaction<'_> {
             &ephemeral_signer_keys,
         )?;
 
+        let current_status = proposal.status.clone();
+        // Set the proposal state to Executing to prevent reentrancy attacks (e.g. cancelling proposal) in the middle of execution.
+        proposal.status = ProposalStatus::Executing;
+
         // Execute the transaction message instructions one-by-one.
         executable_message.execute_message(
             &vault_seeds
@@ -155,6 +160,9 @@ impl BatchExecuteTransaction<'_> {
             &ephemeral_signer_seeds,
         )?;
 
+        // Restore the proposal status after execution.
+        proposal.status = current_status;
+
         // Increment the executed transaction index.
         batch.executed_transaction_index = batch
             .executed_transaction_index

programs/multisig/src/instructions/vault_transaction_execute.rs

@@ -128,6 +128,9 @@ impl VaultTransactionExecute<'_> {
             &ephemeral_signer_keys,
         )?;
 
+        // Set the proposal state to Executing to prevent reentrancy attacks (e.g. cancelling proposal) in the middle of execution.
+        proposal.status = ProposalStatus::Executing;
+
         // Execute the transaction message instructions one-by-one.
         executable_message.execute_message(
             &vault_seeds

programs/multisig/src/state/proposal.rs

@@ -136,6 +136,8 @@ pub enum ProposalStatus {
     Rejected { timestamp: i64 },
     /// Proposal has been approved and is pending execution.
     Approved { timestamp: i64 },
+    /// Proposal is being executed. This is a transient state that always transitions to `Executed` in the span of a single transaction.
+    Executing,
     /// Proposal has been executed.
     Executed { timestamp: i64 },
     /// Proposal has been cancelled.

sdk/multisig/idl/multisig.json

@@ -1988,6 +1988,9 @@
               }
             ]
           },
+          {
+            "name": "Executing"
+          },
           {
             "name": "Executed",
             "fields": [