fix(stake): verify wrapper_vault SPL Token ownership before raw mint read in FlushToInsurance

[Ayomisco]

Fixes #226

Change

Adds wrapper_vault.owner == spl_token::id() check in process_flush_to_insurance before the raw data[0..32] mint read, matching the guard already present in pre_accrue_mode1, process_accrue_fees, and process_return_insurance.

Why

A non-token account with forged bytes at offset [0..32] matching pool.collateral_mint passes the existing mint check. The SPL Token program's CPI validates the account on its side, but an explicit owner check here is consistent with every other vault-touching handler in the file and eliminates the inconsistency.

Test plan

• Existing test suite passes (cargo test)
• Passing a non-SPL-Token-owned account as wrapper_vault now returns StakeError::InvalidAccount instead of propagating to the CPI

Summary by CodeRabbit

• Bug Fixes
  • Added validation to verify token account ownership before processing, preventing potential errors when handling invalid accounts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b150702d-47b4-4052-b9d2-e59bd0124b5e

📥 Commits

Reviewing files that changed from the base of the PR and between 5f6ffa7 and 00ceba8.

📒 Files selected for processing (1)

• src/processor.rs

---

📝 Walkthrough

Walkthrough

In process_flush_to_insurance within src/processor.rs, a seven-line early guard is added that checks whether wrapper_vault.owner equals crate::spl_token::id() before borrowing raw account data and comparing mint bytes. Non-token accounts now fail immediately with StakeError::InvalidAccount.

Changes

SPL Token owner guard in process_flush_to_insurance

Layer / File(s)	Summary
Early SPL Token owner check for wrapper_vault src/processor.rs	Before the raw [0..32] mint-byte read, a guard now verifies wrapper_vault.owner == spl_token::id() and returns StakeError::InvalidAccount on mismatch, matching the ownership checks already present in other vault-touching handlers.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

• [M] FlushToInsurance: wrapper_vault SPL Token ownership not verified before raw mint read #226 — This PR directly implements the exact fix prescribed in the issue: adding the wrapper_vault SPL Token owner check before the raw mint read in process_flush_to_insurance.
• [L-1] process_return_insurance missing SPL Token owner check on vault #223 — Related in that it identifies the same pattern of missing vault ownership checks across handlers in processor.rs; this PR addresses one instance of that pattern.

Possibly related PRs

• dcccrypto/percolator-stake#99: Adds SPL token-program ownership verification in a different handler (process_admin_withdraw_insurance) in the same src/processor.rs file, following the same defensive pattern.
• dcccrypto/percolator-stake#208: Strengthens SPL Token program owner checks before raw token-account byte reads in deposit/withdraw paths of src/processor.rs, directly analogous to this fix.

Poem

🐇 Hoppy the rabbit checked the vault one day,
"Is this SPL Token? Let me check, I say!"
If the owner's wrong, we bounce right out,
No forged bytes sneaking past my snout.
InvalidAccount! Off you go!
Only real token vaults allowed below. 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main security fix: adding SPL Token ownership verification for wrapper_vault before the raw mint read in process_flush_to_insurance.
Description check	✅ Passed	The description provides clear context about the fix, why it's needed, and includes a test plan. However, it lacks the 'How to test' section from the template with specific testing instructions.
Linked Issues check	✅ Passed	The PR directly addresses issue #226 by adding the missing SPL Token ownership check before the raw mint read, matching the implementation in other vault-touching handlers.
Out of Scope Changes check	✅ Passed	All changes are directly related to issue #226: adding the wrapper_vault SPL Token ownership verification in process_flush_to_insurance. No out-of-scope modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}