fix: add validate_account_owner to Withdraw and admin config handlers

[0x-SquidSol]

Summary

• process_withdraw, process_update_config, process_admin_set_hwm_config, and process_admin_set_tranche_config all read/write pool_pda without verifying it is owned by the stake program
• All four had _program_id (underscore = explicitly unused), confirming the oversight
• While vault_auth PDA derivation (Withdraw) and admin field checks (config handlers) provide partial protection, explicit ownership validation is required for defense-in-depth
• Same class of bug as PRs fix: add missing account ownership validation in AccrueFees #100 and fix: add missing account validation in process_deposit_junior #101, but in different handlers

Severity

MEDIUM — defense-in-depth gap; inconsistent with process_deposit (line 390) which validates ownership

Fix

• Changed _program_id → program_id in all four handlers
• Added validate_account_owner(pool_pda, program_id)?; before data borrow
• Added validate_account_writable(pool_pda)?; in process_withdraw (mutates state)

Test plan

• cargo build — compiles cleanly
• cargo clippy — zero warnings
• CI tests

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@0x-SquidSol has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 17 minutes and 20 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 17 minutes and 20 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 03b891ba-bf8e-45ec-89f1-b5815e97e789

📥 Commits

Reviewing files that changed from the base of the PR and between b1f14d2 and 278e977.

📒 Files selected for processing (1)

• src/processor.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dcccrypto]

Sentinel security review — MERGE

Fix is correct. Current master has _program_id (underscore = unused) in process_withdraw, process_update_config, process_admin_set_hwm_config, and process_admin_set_tranche_config — confirming no ownership validation on pool_pda in those handlers. An attacker can pass any account owned by a different program that passes the discriminator/initialized checks, causing those handlers to read/write unvalidated account data.

This is a defense-in-depth gap consistent with what PR #100 and #101 fix in their respective handlers. The Solana runtime prevents cross-program data writes, but same-program type confusion (a StakeDeposit PDA passed as pool_pda) remains a vector for state corruption.

No conflicts with other open PRs — these handlers are not touched by #113 (which handles accrue_fees only).

Severity confirmed: MEDIUM (CVSS ~5.9 — defense-in-depth gap, partial protection exists via PDA derivation and field checks).

Security APPROVED PR #106 — findings: none | ownership validation on Withdraw and admin config handlers, consistent with process_deposit pattern