fix: add missing verify_token_program in AdminWithdrawInsurance

[0x-SquidSol]

Summary

• process_admin_withdraw_insurance passes token_program through to cpi_withdraw_insurance_limited without calling verify_token_program() first
• Every other CPI-invoking handler (InitPool, Deposit, Withdraw, DepositJunior) validates the token program before use
• Without this check, an attacker could substitute a malicious program for SPL Token during the CPI

Severity

CRITICAL — missing token program verification on a CPI that moves funds

Fix

Added verify_token_program(token_program)?; before the vault_auth PDA derivation, consistent with all other handlers.

Test plan

• cargo build — compiles cleanly
• cargo clippy — zero warnings
• CI tests

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Enhanced security validation for insurance withdrawal operations to prevent token program substitution attacks. The system now verifies the token program account before processing withdrawals, rejecting invalid program substitutions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 853664a1-92f0-41bd-b747-cd5c043e0083

📥 Commits

Reviewing files that changed from the base of the PR and between b1f14d2 and 4ce1a71.

📒 Files selected for processing (1)

• src/processor.rs

---

📝 Walkthrough

Walkthrough

A security validation check is added to process_admin_withdraw_insurance in src/processor.rs. The function now verifies that the provided token_program account key matches the expected SPL Token program ID before proceeding with CPI calls, using a pre-CPI guard that rejects invalid program IDs.

Changes

Cohort / File(s)	Summary
Token Program Validation src/processor.rs	Added verify_token_program(token_program)? guard check in process_admin_withdraw_insurance to prevent CPIs with substituted malicious token programs.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• dcccrypto/percolator-stake#98: Related modification to process_admin_withdraw_insurance that adds another pre-CPI validation check for stake_vault against pool.vault.

Poem

🐰 A token guard hops in the way,
"Invalid program? No way, no way!"
With one swift check, the vault stays tight,
Security's whiskers shine so bright! ✨

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	❓ Inconclusive	The PR description covers the problem, severity, and fix, but lacks the required sections (How to test, Checklist) from the template.	Add the 'How to test' section and complete the 'Checklist' section from the template to confirm all validation steps have been performed.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely summarizes the main change: adding a missing token program verification in the AdminWithdrawInsurance handler.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dcccrypto]

Sentinel security review — MERGE

Fix is correct and necessary. Current master at process_admin_withdraw_insurance (processor.rs:1215) calls validate_admin_cpi then proceeds directly to PDA derivation without verify_token_program. Every other CPI-invoking handler (Deposit:446, Withdraw:646, DepositJunior:1586) validates the token program first. Without this check an attacker substitutes a malicious program for SPL Token, gaining PDA signer authority over the vault.

Diff is minimal and surgical — 4 lines added, no behaviour change on the happy path. No conflicts with batch-2 (PR #98 already merged). No new findings introduced by this PR.

Severity confirmed: CRITICAL (CPI with PDA signer, no token program validation, direct fund movement). CVSS ~9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

findings: none introduced — pure fix
Security APPROVED PR #99 — findings: none | this resolves a critical token-program substitution vector on AdminWithdrawInsurance