fix based ottersec report

programs/locker/src/instructions/create_vesting_escrow.rs

@@ -41,7 +41,11 @@ pub struct CreateVestingEscrowCtx<'info> {
     )]
     pub escrow: AccountLoader<'info, VestingEscrow>,
 
-    #[account(mut)]
+    #[account(
+        mut,
+        associated_token::mint = sender_token.mint,
+        associated_token::authority = escrow
+    )]
     pub escrow_token: Box<Account<'info, TokenAccount>>,
 
     #[account(mut)]
@@ -86,16 +90,6 @@ pub fn handle_create_vesting_escrow(
 
     require!(frequency != 0, LockerError::FrequencyIsZero);
 
-    let escrow_token = anchor_spl::associated_token::get_associated_token_address(
-        &ctx.accounts.escrow.key(),
-        &ctx.accounts.sender_token.mint,
-    );
-
-    require!(
-        escrow_token == ctx.accounts.escrow_token.key(),
-        LockerError::InvalidEscrowTokenAddress
-    );
-
     let mut escrow = ctx.accounts.escrow.load_init()?;
     escrow.init(
         vesting_start_time,

programs/locker/src/instructions/update_vesting_escrow_recipient.rs

@@ -2,6 +2,7 @@ use crate::*;
 
 /// Accounts for [locker::update_vesting_escrow_recipient].
 #[derive(Accounts)]
+#[event_cpi]
 pub struct UpdateVestingEscrowRecipientCtx<'info> {
     /// Escrow.
     #[account(mut)]
@@ -85,14 +86,14 @@ pub fn handle_update_vesting_escrow_recipient(
             anchor_lang::system_program::transfer(cpi_context, lamports_diff)?;
 
             // realloc
-            escrow_metadata_info.realloc(new_len, true)?;
+            escrow_metadata_info.realloc(new_len, false)?;
             // update new recipient_email
             escrow_metadata.recipient_email = recipient_email;
         } else {
             return Err(LockerError::InvalidEscrowMetadata.into());
         }
     }
-    emit!(EventUpdateVestingEscrowRecipient {
+    emit_cpi!(EventUpdateVestingEscrowRecipient {
         escrow: ctx.accounts.escrow.key(),
         signer,
         old_recipient,

tests/escrow_metadata.ts

@@ -16,7 +16,8 @@ import {
 import { claimToken, createEscrowMetadata, createLockerProgram, createVestingPlan } from "./locker_utils";
 
 
-const provider = anchor.AnchorProvider.env();
+let provider = anchor.AnchorProvider.env();
+provider.opts.commitment = 'confirmed';
 
 describe("Escrow metadata", () => {
     const tokenDecimal = 8;
@@ -41,7 +42,9 @@ describe("Escrow metadata", () => {
             null,
             tokenDecimal,
             web3.Keypair.generate(),
-            null,
+            {
+                commitment: "confirmed",
+            },
             TOKEN_PROGRAM_ID
         );
 

tests/locker.ts

@@ -16,7 +16,8 @@ import {
 import { claimToken, createLockerProgram, createVestingPlan } from "./locker_utils";
 
 
-const provider = anchor.AnchorProvider.env();
+let provider = anchor.AnchorProvider.env();
+provider.opts.commitment = 'confirmed';
 
 describe("Full flow", () => {
   const tokenDecimal = 8;
@@ -42,7 +43,9 @@ describe("Full flow", () => {
       null,
       tokenDecimal,
       web3.Keypair.generate(),
-      null,
+      {
+        commitment: "confirmed",
+      },
       TOKEN_PROGRAM_ID
     );
 
@@ -110,7 +113,6 @@ describe("Full flow", () => {
       updateRecipientMode: 0,
     });
 
-
     while (true) {
       const currentBlockTime = await getCurrentBlockTime(program.provider.connection);
       if (currentBlockTime > cliffTime.toNumber()) {

tests/locker_utils/index.ts

@@ -16,6 +16,7 @@ export function createLockerProgram(
     const provider = new AnchorProvider(AnchorProvider.env().connection, wallet, {
         maxRetries: 3,
     });
+    provider.opts.commitment = 'confirmed';
     const program = new Program<Locker>(LockerIDL, LOCKER_PROGRAM_ID, provider);
     return program;
 }

tests/update_recipient.ts

@@ -18,6 +18,7 @@ import { claimToken, createEscrowMetadata, createLockerProgram, createVestingPla
 
 
 const provider = anchor.AnchorProvider.env();
+provider.opts.commitment = 'confirmed';
 
 describe("Update recipient", () => {
     const tokenDecimal = 8;
@@ -42,7 +43,9 @@ describe("Update recipient", () => {
             null,
             tokenDecimal,
             web3.Keypair.generate(),
-            null,
+            {
+                commitment: "confirmed",
+            },
             TOKEN_PROGRAM_ID
         );
 
@@ -261,13 +264,22 @@ describe("Update recipient", () => {
             isAssertion: true
         });
 
-        console.log("Update recipient");
+        console.log("Update recipient with bigger email size");
         await updateRecipient({
             escrow,
             newRecipient: ReceipentKP.publicKey,
             isAssertion: true,
             signer: UserKP,
             newRecipientEmail: "[email protected]",
         });
+
+        console.log("Update recipient with smaller email size");
+        await updateRecipient({
+            escrow,
+            newRecipient: ReceipentKP.publicKey,
+            isAssertion: true,
+            signer: UserKP,
+            newRecipientEmail: "[email protected]",
+        });
     });
 });