fix based ottersec report

programs/locker/src/instructions/create_vesting_escrow.rs

@@ -41,7 +41,11 @@ pub struct CreateVestingEscrowCtx<'info> {
     )]
     pub escrow: AccountLoader<'info, VestingEscrow>,
 
-    #[account(mut)]
+    #[account(
+        mut,
+        associated_token::mint = sender_token.mint,
+        associated_token::authority = escrow
+    )]
     pub escrow_token: Box<Account<'info, TokenAccount>>,
 
     #[account(mut)]
@@ -86,16 +90,6 @@ pub fn handle_create_vesting_escrow(
 
     require!(frequency != 0, LockerError::FrequencyIsZero);
 
-    let escrow_token = anchor_spl::associated_token::get_associated_token_address(
-        &ctx.accounts.escrow.key(),
-        &ctx.accounts.sender_token.mint,
-    );
-
-    require!(
-        escrow_token == ctx.accounts.escrow_token.key(),
-        LockerError::InvalidEscrowTokenAddress
-    );
-
     let mut escrow = ctx.accounts.escrow.load_init()?;
     escrow.init(
         vesting_start_time,

programs/locker/src/instructions/update_vesting_escrow_recipient.rs

@@ -2,6 +2,7 @@ use crate::*;
 
 /// Accounts for [locker::update_vesting_escrow_recipient].
 #[derive(Accounts)]
+#[event_cpi]
 pub struct UpdateVestingEscrowRecipientCtx<'info> {
     /// Escrow.
     #[account(mut)]
@@ -85,14 +86,14 @@ pub fn handle_update_vesting_escrow_recipient(
             anchor_lang::system_program::transfer(cpi_context, lamports_diff)?;
 
             // realloc
-            escrow_metadata_info.realloc(new_len, true)?;
+            escrow_metadata_info.realloc(new_len, false)?;
             // update new recipient_email
             escrow_metadata.recipient_email = recipient_email;
         } else {
             return Err(LockerError::InvalidEscrowMetadata.into());
         }
     }
-    emit!(EventUpdateVestingEscrowRecipient {
+    emit_cpi!(EventUpdateVestingEscrowRecipient {
         escrow: ctx.accounts.escrow.key(),
         signer,
         old_recipient,

tests/locker.ts

@@ -110,7 +110,6 @@ describe("Full flow", () => {
       updateRecipientMode: 0,
     });
 
-
     while (true) {
       const currentBlockTime = await getCurrentBlockTime(program.provider.connection);
       if (currentBlockTime > cliffTime.toNumber()) {

tests/update_recipient.ts

@@ -261,13 +261,22 @@ describe("Update recipient", () => {
             isAssertion: true
         });
 
-        console.log("Update recipient");
+        console.log("Update recipient with bigger email size");
         await updateRecipient({
             escrow,
             newRecipient: ReceipentKP.publicKey,
             isAssertion: true,
             signer: UserKP,
             newRecipientEmail: "[email protected]",
         });
+
+        console.log("Update recipient with smaller email size");
+        await updateRecipient({
+            escrow,
+            newRecipient: ReceipentKP.publicKey,
+            isAssertion: true,
+            signer: UserKP,
+            newRecipientEmail: "[email protected]",
+        });
     });
 });