fix: init v1 tree with custom forester

program-tests/registry-test/tests/tests.rs

@@ -453,6 +453,30 @@ async fn test_initialize_protocol_config() {
         .await
         .unwrap();
     }
+    // FAIL: initialize a Merkle tree with network_fee + forester (must be rejected)
+    {
+        let merkle_tree_keypair = Keypair::new();
+        let nullifier_queue_keypair = Keypair::new();
+        let cpi_context_keypair = Keypair::new();
+        let result = create_state_merkle_tree_and_queue_account(
+            &payer,
+            true,
+            &mut rpc,
+            &merkle_tree_keypair,
+            &nullifier_queue_keypair,
+            Some(&cpi_context_keypair),
+            None,
+            Some(Pubkey::new_unique()),
+            1,
+            &StateMerkleTreeConfig {
+                network_fee: Some(5000),
+                ..Default::default()
+            },
+            &NullifierQueueConfig::default(),
+        )
+        .await;
+        assert_rpc_error(result, 3, RegistryError::ForesterDefined.into()).unwrap();
+    }
     // FAIL: initialize a Merkle tree with network fee != 0 || 5000
     {
         let merkle_tree_keypair = Keypair::new();

programs/registry/src/lib.rs

@@ -341,6 +341,10 @@ pub mod light_registry {
             if network_fee != ctx.accounts.protocol_config_pda.config.network_fee {
                 return err!(RegistryError::InvalidNetworkFee);
             }
+            if forester.is_some() {
+                msg!("Forester pubkey must not be defined for trees serviced by light foresters.");
+                return err!(RegistryError::ForesterDefined);
+            }
         } else if forester.is_none() {
             msg!("Forester pubkey required for trees without a network fee.");
             msg!("Trees without a network fee will not be serviced by light foresters.");
@@ -826,6 +830,9 @@ pub fn check_forester(
         }
         Ok(())
     } else if metadata.access_metadata.forester == authority {
+        if metadata.rollover_metadata.network_fee != 0 {
+            return err!(RegistryError::InvalidNetworkFee);
+        }
         Ok(())
     } else {
         err!(RegistryError::InvalidSigner)