fix(token-fundraiser): correct time-window checks and verify vault account

Addresses review feedback:
- Flip the contribute/refund day-window comparisons so contributions are
  accepted during the active window and refunds after it ends.
- Record the vault token account in fundraiser state at initialize and
  verify the caller-supplied vault against it in contribute, check, and
  refund, preventing a substituted-vault drain.

Author: MarkFeder

tokens/token-fundraiser/pinocchio/program/src/instructions/check_contributions.rs

@@ -54,6 +54,11 @@ pub fn check_contributions(
     {
         return Err(ProgramError::InvalidAccountData);
     }
+    // The vault must be the fundraiser's recorded vault before we read its
+    // balance to decide the target has been met.
+    if &fundraiser_state.vault != vault.address().as_array() {
+        return Err(ProgramError::InvalidAccountData);
+    }
 
     // The target amount must have been reached.
     let vault_amount = TokenAccount::from_account_view(vault)?.amount();

tokens/token-fundraiser/pinocchio/program/src/instructions/contribute.rs

@@ -58,6 +58,11 @@ pub fn contribute(program_id: &Address, accounts: &[AccountView], data: &[u8]) -
     if &fundraiser_state.mint_to_raise != mint_to_raise.address().as_array() {
         return Err(ProgramError::InvalidAccountData);
     }
+    // The vault must be the fundraiser's recorded vault, otherwise a caller
+    // could record a contribution against an account they control.
+    if &fundraiser_state.vault != vault.address().as_array() {
+        return Err(ProgramError::InvalidAccountData);
+    }
 
     // A contribution must be at least one base unit.
     if amount < 1 {
@@ -77,7 +82,7 @@ pub fn contribute(program_id: &Address, accounts: &[AccountView], data: &[u8]) -
     // The fundraiser must still be within its active window.
     let current_time = Clock::get()?.unix_timestamp;
     let elapsed_days = ((current_time - fundraiser_state.time_started) / SECONDS_TO_DAYS) as u16;
-    if fundraiser_state.duration > elapsed_days {
+    if elapsed_days > fundraiser_state.duration {
         return Err(FundraiserError::FundraiserEnded.into());
     }
 

tokens/token-fundraiser/pinocchio/program/src/instructions/initialize.rs

@@ -106,6 +106,7 @@ pub fn initialize(program_id: &Address, accounts: &[AccountView], data: &[u8]) -
         time_started: Clock::get()?.unix_timestamp,
         duration,
         bump,
+        vault: *vault.address().as_array(),
     };
     fundraiser_state.serialize(&mut fundraiser.try_borrow_mut()?)?;
 

tokens/token-fundraiser/pinocchio/program/src/instructions/refund.rs

@@ -55,11 +55,16 @@ pub fn refund(program_id: &Address, accounts: &[AccountView], _data: &[u8]) -> P
     {
         return Err(ProgramError::InvalidAccountData);
     }
+    // The vault must be the fundraiser's recorded vault, otherwise refund
+    // eligibility could be judged from an unrelated token account.
+    if &fundraiser_state.vault != vault.address().as_array() {
+        return Err(ProgramError::InvalidAccountData);
+    }
 
     // The fundraiser must have ended.
     let current_time = Clock::get()?.unix_timestamp;
     let elapsed_days = ((current_time - fundraiser_state.time_started) / SECONDS_TO_DAYS) as u16;
-    if fundraiser_state.duration < elapsed_days {
+    if elapsed_days < fundraiser_state.duration {
         return Err(FundraiserError::FundraiserNotEnded.into());
     }
 

tokens/token-fundraiser/pinocchio/program/src/state.rs

@@ -10,7 +10,7 @@ use pinocchio::error::ProgramError;
 /// Serialized byte layout (little-endian), matching the field order below so a
 /// Borsh client can deserialize it directly:
 /// `[maker: 32][mint_to_raise: 32][amount_to_raise: u64][current_amount: u64]
-///  [time_started: i64][duration: u16][bump: u8]`
+///  [time_started: i64][duration: u16][bump: u8][vault: 32]`
 pub struct Fundraiser {
     /// The wallet that created the fundraiser; part of the PDA seeds.
     pub maker: [u8; 32],
@@ -26,14 +26,18 @@ pub struct Fundraiser {
     pub duration: u16,
     /// Canonical bump for the fundraiser PDA.
     pub bump: u8,
+    /// The fundraiser's vault token account (the PDA's associated token account
+    /// for `mint_to_raise`), recorded at creation. Later instructions check the
+    /// caller-supplied vault against this to reject a substituted account.
+    pub vault: [u8; 32],
 }
 
 impl Fundraiser {
     /// Seed prefix for the fundraiser PDA: `[SEED_PREFIX, maker]`.
     pub const SEED_PREFIX: &'static [u8] = b"fundraiser";
 
     /// Serialized size of a `Fundraiser` in bytes.
-    pub const LEN: usize = 32 + 32 + 8 + 8 + 8 + 2 + 1;
+    pub const LEN: usize = 32 + 32 + 8 + 8 + 8 + 2 + 1 + 32;
 
     /// Writes the fundraiser into `dst` using the layout documented above.
     pub fn serialize(&self, dst: &mut [u8]) -> Result<(), ProgramError> {
@@ -47,6 +51,7 @@ impl Fundraiser {
         dst[80..88].copy_from_slice(&self.time_started.to_le_bytes());
         dst[88..90].copy_from_slice(&self.duration.to_le_bytes());
         dst[90] = self.bump;
+        dst[91..123].copy_from_slice(&self.vault);
         Ok(())
     }
 
@@ -65,6 +70,7 @@ impl Fundraiser {
             time_started: i64::from_le_bytes(src[80..88].try_into().unwrap()),
             duration: u16::from_le_bytes(src[88..90].try_into().unwrap()),
             bump: src[90],
+            vault: src[91..123].try_into().unwrap(),
         })
     }
 }

tokens/token-fundraiser/pinocchio/tests/account.ts

@@ -8,6 +8,7 @@ export const FundraiserSchema = {
     time_started: "i64",
     duration: "u16",
     bump: "u8",
+    vault: { array: { type: "u8", len: 32 } },
   },
 };
 
@@ -19,6 +20,7 @@ export type FundraiserRaw = {
   time_started: bigint;
   duration: number;
   bump: number;
+  vault: Uint8Array;
 };
 
 // Mirrors the on-chain `Contributor` layout in `program/src/state.rs`.

tokens/token-fundraiser/pinocchio/tests/test.ts

@@ -74,6 +74,7 @@ describe("Fundraiser (Pinocchio)", async () => {
     assert(fundraiser.current_amount.toString() === "0", "current amount should start at 0");
     assert(fundraiser.duration === values.duration, "wrong duration");
     assert(fundraiser.bump === values.fundraiserBump, "wrong bump");
+    assert(new PublicKey(fundraiser.vault).toBase58() === values.vault.toBase58(), "wrong vault recorded");
 
     const vaultInfo = await client.getAccount(values.vault);
     if (vaultInfo === null) throw new Error("Vault account not found");