[mikemaccana]

What changes

The escrow program defends against a taker passing the wrong account to take_offer, but no test ran those attacks. Each version now has three tests.

Each test asserts the exact error the defense raises, and checks that the vault and both parties' token balances are unchanged.

• test_take_offer_rejects_taker_account_as_maker_token_account_b: Bob names a TSLAx account he owns as maker_token_account_b, so his payment would come back to him.
  • anchor-v1: ConstraintTokenOwner
  • anchor: ConstraintAddress
  • native: TokenAccountMismatch
  • quasar: HasOneMismatch
• test_take_offer_rejects_vault_of_another_offer: Alice has two offers open, and Bob passes the first offer with the second offer's vault.
  • anchor-v1: ConstraintTokenOwner
  • anchor: ConstraintAddress
  • native: TokenAccountMismatch
  • quasar: HasOneMismatch
• test_take_offer_rejects_worthless_token_mint_b: Bob mints a worthless token of his own and passes it as token_mint_b.
  • anchor-v1: ConstraintHasOne
  • anchor: ConstraintAddress, because that version checks address = offer.token_mint_b
  • native: MintMismatch
  • quasar: HasOneMismatch

Two details:

• First test, Anchor versions: if Bob names his own TSLAx associated token account, Anchor refuses it first as a duplicate mutable account, and the owner check never runs. So the test uses a second TSLAx account Bob owns. Native has no duplicate check, so it uses his associated token account.
• Mint test, quasar: Bob names Alice's real TSLAx account. The mint check is then the only thing that can refuse the take.

Each version's CHANGELOG.md has an entry. No program source changes.

Testing

• cargo test passes in every version:

  • anchor-v1: 12 tests
  • anchor: 12, plus 1 unit test
  • native: 11
  • quasar: 15

• Each test fails without its defense. For each test, the check was removed from the program, the program rebuilt, and the test failed:

  • The first and third tests in the Anchor versions: the take succeeds.
  • The vault test in every version: the Token program then refuses the transfer.
  • Native first test: the program's token-conservation check catches it.
  • Native third test: the take succeeds.
  • Quasar third test: the Token program refuses it with a mint mismatch.

  The programs were restored afterwards.

---

Generated by Claude Code