fix: return StakeError::InvalidPda for vault_auth mismatch in AdminWithdrawInsurance

[0x-SquidSol]

Summary

• process_admin_withdraw_insurance returned ProgramError::InvalidArgument when vault_auth PDA derivation failed
• Every other PDA validation in the codebase returns StakeError::InvalidPda (code 10), including the identical vault_auth check in process_flush_to_insurance (line 938)
• This was the sole outlier, breaking off-chain error parsing consistency

Severity

MEDIUM — error type inconsistency for identical check across two handlers

Test plan

• cargo build — compiles cleanly
• cargo clippy — zero warnings

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@0x-SquidSol has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 18 minutes and 7 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 18 minutes and 7 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e275cbfb-0162-4d8c-81d9-4866c2c6079f

📥 Commits

Reviewing files that changed from the base of the PR and between b1f14d2 and 9c4a65a.

📒 Files selected for processing (1)

• src/processor.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dcccrypto]

Sentinel security review — MERGE

Fix is correct. Current master at processor.rs:1224 returns ProgramError::InvalidArgument for vault_auth PDA mismatch in process_admin_withdraw_insurance, while every other PDA validation in the codebase (including the identical vault_auth check in process_flush_to_insurance) returns StakeError::InvalidPda (code 10). This was confirmed by reading the current master file.

Minimal diff — 1 line changed. No conflicts with any other open PR. PR #99 adds verify_token_program to the same function but on different lines — both can merge cleanly.

Severity confirmed: MEDIUM (CVSS ~3.1 — error type inconsistency, sole outlier breaking off-chain error parsing consistency for PDA validation failures).

Security APPROVED PR #110 — findings: none | error code consistency for vault_auth PDA mismatch in AdminWithdrawInsurance