fix: patch 8 security vulnerabilities in escrow and fundraiser programs

[Potdealer]

Summary

Security audit identifying and fixing 8 vulnerabilities (3 Critical, 4 High, 1 Medium) across the Anchor escrow and Pinocchio fundraiser programs.

Escrow Program (Anchor) — 5 findings

• [CRITICAL] Missing deposit() call in make instruction — vault is created empty, escrow is non-functional
• [CRITICAL] Wrong mint account (maker_ata_y instead of mint_y) passed to transfer_checked CPI in take — runtime failure
• [HIGH] Incorrect mint constraint on maker_ata_y — validated against mint_x instead of mint_y
• [HIGH] PDA seed endianness mismatch — to_be_bytes() in withdraw/close vs to_le_bytes() used at PDA creation, causing signer verification failure
• [HIGH] Vault closure rent lamports sent to taker instead of maker — systematic rent theft from escrow creators

Fundraiser Program (Pinocchio) — 3 findings

• [CRITICAL] Inverted comparison in checker — allows fund withdrawal before target is met, blocks withdrawal after target is met
• [MEDIUM] Missing ? on invoke_signed CPI in checker — transfer errors silently discarded
• [HIGH] Missing contributor PDA validation in refund — any signer can claim another contributor's refund

Files Changed

• anchor/escrow/programs/escrow/src/lib.rs — Added deposit call
• anchor/escrow/programs/escrow/src/instructions/make.rs — Fixed mint constraint
• anchor/escrow/programs/escrow/src/instructions/take.rs — Fixed mint in CPI, endianness, close destination, added maker account
• pinocchio/fundraiser/src/instructions/checker.rs — Fixed comparison, added error propagation
• pinocchio/fundraiser/src/instructions/refund.rs — Added contributor PDA validation

Full detailed audit report with severity ratings, impact analysis, and proof of concept for each finding is included in SECURITY-AUDIT.md.

Test plan

• Verify escrow make instruction deposits tokens into vault
• Verify escrow take instruction completes full exchange lifecycle
• Verify fundraiser checker only allows withdrawal when target is met
• Verify fundraiser refund rejects contributor accounts not derived from signer
• Run existing test suites to confirm no regressions

🤖 Generated with Claude Code

[bytetwt]

@Potdealer can you please provide the test cases results.