Emit one canary packet.
max_fee is a hard ceiling in stroops. Passing 0 disables the check, which
is deliberately not the default in the runner: an unattended hourly job with
no ceiling is an unbounded standing authorisation against the submitter.
FEE MECHANICS — the thing that is not in any Stellar OApp doc.
EndpointV2::send does NOT pull the fee from the sender. pay_messaging_fees
reads native_token.balance(<endpoint>) — the ENDPOINT's own balance — and
pays each worker out of it, refunding whatever is left to refund_address.
So the OApp must PUSH the fee to the endpoint before calling send;
holding the balance itself yields EndpointError::InsufficientNativeFee (#6)
no matter how rich the OApp is. The endpoint's own source says it in one line
and nowhere else: "OApp sender needs to transfer the fees to the endpoint
before sending the message".
The transfer is a direct call from this contract to the native SAC, so
from.require_auth() inside the token is satisfied by the direct-invo
fn ping(
env: soroban_sdk::Env,
dst_eid: u32,
payload: soroban_sdk::Bytes,
options: soroban_sdk::Bytes,
max_fee: i128,
) -> soroban_sdk::BytesN<32>fn runs(env: soroban_sdk::Env) -> u64fn admin(env: soroban_sdk::Env) -> OptionQuote a loopback packet without sending. Used by the runner to enforce a spend ceiling before committing, so a price-feed excursion cannot silently drain the submitter.
fn quote(
env: soroban_sdk::Env,
dst_eid: u32,
payload: soroban_sdk::Bytes,
options: soroban_sdk::Bytes,
) -> MessagingFeefn p_auth(env: soroban_sdk::Env) -> u32fn p_noop(env: soroban_sdk::Env) -> u32fn p_bytes(env: soroban_sdk::Env, b: soroban_sdk::Bytes) -> u32Configure this OApp's own security stack on the endpoint.
This exists because an OApp that cannot configure itself is unusable on
Stellar. The default send/receive configs point at DVNs with no dst_config
(and on mainnet, at the zero-address "Dead DVN"), so every OApp MUST set a
custom config — and endpoint.set_config(caller, oapp, ...) requires
caller to be authorised for oapp.
Passing the contract itself as BOTH caller and oapp sidesteps the
delegate mechanism entirely: a contract is inherently authorised over its
own configuration, so no set_delegate round trip is needed. The admin
gate here is what stops anyone else driving it.
config_type: 2 = CONFIG_TYPE_SEND_ULN, 3 = CONFIG_TYPE_RECEIVE_ULN.
fn configure(
env: soroban_sdk::Env,
lib: soroban_sdk::Address,
eid: u32,
config_type: u32,
config: soroban_sdk::Bytes,
)Receiving side. A loopback packet is never executed — we need packet_sent
and the resulting attestation, not delivery — so this exists only so the
contract presents a complete OApp surface if anything ever does deliver.
fn lz_receive(
env: soroban_sdk::Env,
guid: soroban_sdk::BytesN<32>,
message: soroban_sdk::Bytes,
)configure() minus require_auth, to test whether the auth call is the fault.
fn p_cfg_noauth(
env: soroban_sdk::Env,
lib: soroban_sdk::Address,
eid: u32,
config_type: u32,
config: soroban_sdk::Bytes,
)fn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
endpoint: soroban_sdk::Address,
)fn endpoint_address(env: soroban_sdk::Env) -> Option