fix: validate authority on self-transfer early return

[ananas-block]

Summary

• Add signer + owner/delegate validation in the self-transfer early return path for both CTokenTransfer and CTokenTransferChecked. Previously the self-transfer path returned Ok(()) without any authority validation, allowing anyone to call self-transfer on any account.
• Extract shared validate_self_transfer() to avoid duplicate code across both transfer variants.

Summary by CodeRabbit

• Bug Fixes
  • Added validation to detect and safely handle token self-transfers, preventing erroneous state changes.
  • Short-circuited redundant processing for self-transfers to avoid runtime conflicts and improve stability.
  • Enforced authority checks for self-transfer operations to ensure only authorized callers can perform them.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds self-transfer validation: a new public validate_self_transfer (and private authority helper) detects identical source/destination, verifies authority, and short-circuits both checked and default transfer paths to return early for authorized self-transfers.

Changes

Cohort / File(s)	Summary
Self-Transfer Validation Logic programs/compressed-token/program/src/ctoken/transfer/shared.rs	Adds pub fn validate_self_transfer(...) -> Result<bool, ProgramError> and fn validate_self_transfer_authority(...) to detect self-transfers and verify authority (signer + owner or delegate). Uses msg and marks authority check as #[cold].
Checked Transfer Integration programs/compressed-token/program/src/ctoken/transfer/checked.rs	Imports and calls validate_self_transfer(...) at function entry; returns Ok(()) immediately when it indicates an authorized self-transfer, before hot-path logic.
Default Transfer Integration programs/compressed-token/program/src/ctoken/transfer/default.rs	Imports and calls validate_self_transfer(...) early; short-circuits for authorized self-transfers before the 165-byte account hot-path check.

Sequence Diagram(s)

sequenceDiagram
    actor Caller
    participant Transfer as Transfer Handler
    participant Validator as Self-Transfer Validator
    participant Processor as Transfer Processor

    Caller->>Transfer: initiate_transfer(source, destination, authority)
    Transfer->>Validator: validate_self_transfer(source, destination, authority)
    
    alt source == destination
        Validator->>Validator: validate authority (signer & owner/delegate)
        alt authority valid
            Validator-->>Transfer: Ok(true)
            Transfer-->>Caller: Ok(())  rgba(0,128,0,0.5)
        else authority invalid
            Validator-->>Transfer: Err(InvalidAccountData)
            Transfer-->>Caller: Err(InvalidAccountData)  rgba(255,0,0,0.5)
        end
    else source != destination
        Validator-->>Transfer: Ok(false)
        Transfer->>Processor: continue_normal_transfer_flow()
        Processor-->>Caller: Ok(())  rgba(0,0,255,0.5)
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested labels

ai-review

Suggested reviewers

• sergeytimoshin
• SwenSchaeferjohann

Poem

✨ When source meets destination in mirrored light,
A guardian checks the authority right,
If owner or delegate signs with grace,
The transfer halts gently—no borrow to chase,
Code sings safe returns, neat and bright.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main change: adding authority validation to the self-transfer early return path, which is a security fix addressing the core issue of insufficient authorization checks.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 70.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/audit-issue-11-self-transfer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@programs/compressed-token/program/src/ctoken/transfer/default.rs`:
- Around line 46-51: The self-transfer authority check currently implemented in
shared.rs as validate_self_transfer_authority should be refactored to call the
shared utility verify_owner_or_delegate_signer from shared/owner_validation.rs
instead of reimplementing owner/delegate checks; update
validate_self_transfer_authority to invoke verify_owner_or_delegate_signer with
the same account slices/authority arguments used elsewhere (matching usages in
token_input.rs and compress_or_decompress_ctokens.rs), propagate and return its
Result/error directly, and remove the duplicated manual owner/delegate logic so
callers (like the code that currently calls validate_self_transfer) keep the
same behavior but rely on the centralized verifier.

[tnquanghuy0512]

In SPL, it will check if the delegate amount is greater than the transferred amount, even when self-transferring. So there's a bit of inconsistency here