Harden lending example after security review

- Price feed PDAs are now seeded [b"price_feed", authority, mint]: a signer
  can only write the feed derived from their own key, removing the
  first-caller-claims race on the previous per-mint feed. Reserves trust
  exactly the feed their market owner registered.
- Lending markets are now isolation boundaries: every obligation handler
  (deposit/withdraw collateral, borrow, repay, liquidate, refresh) rejects
  reserves whose lending_market differs from the obligation's
  (MarketMismatch).
- Liquidation reads the close factor from the repay reserve (a property of
  the debt) and the bonus from the collateral reserve (a property of the
  seized asset), and rejects repayments whose seizure would exceed posted
  collateral (LiquidationTooLarge) instead of silently capping, which made
  the liquidator pay full price for less collateral.
- Withdraw health checks round the removed borrow power up at every step,
  so independent flooring can never let a withdraw pass that an exact
  recompute would reject.
- Documented share_mint_supply drift from direct token-program burns
  (protocol-favourable), the transfer-fee mint limitation, instant config
  changes, and the audit expectation; moved reserve_signer_seeds from
  math.rs to state/reserve.rs.
- New tests: cross-market reserve rejection, foreign-signer feed write
  rejection, over-seizing liquidation rejection (21 tests total).

https://claude.ai/code/session_01RwE8f8ahP5S6SDNTsXmpj9

Author: claude

finance/lending/anchor/CHANGELOG.md

@@ -15,3 +15,12 @@ Initial lending program: a Kamino/Solend-style borrow/lend market.
 - Rust + LiteSVM integration tests covering supply/redeem, borrow/repay,
   withdraw, interest accrual, liquidation, the share-inflation guard, and
   rounding/stale-input edge cases.
+- Lending markets are isolation boundaries: every obligation handler rejects
+  reserves from another market (`MarketMismatch`).
+- Price feed PDAs are seeded by their authority, so no signer can write or
+  pre-claim a feed another authority's reserves trust.
+- Liquidation reads the close factor from the repay reserve, the bonus from the
+  collateral reserve, and rejects repayments whose seizure would exceed the
+  posted collateral (`LiquidationTooLarge`).
+- Withdraw health checks round the removed borrow power up, so independent
+  rounding can never let a withdraw pass that an exact recompute would reject.

finance/lending/anchor/README.md

@@ -69,6 +69,18 @@ Borrowing and withdrawing are gated by `allowed_borrow_value`; an obligation is
 liquidatable once `borrowed_value > unhealthy_borrow_value`. Collateral is valued
 rounding down and debt rounding up, so health is always judged conservatively.
 
+Every handler that pairs an obligation with a reserve requires both to belong to
+the same `LendingMarket` (`MarketMismatch` otherwise), so each market is an
+isolation boundary: positions in one market can never be valued or settled
+against reserves of another.
+
+In a liquidation, the close factor (how much of the borrow one call may repay)
+comes from the **repay reserve**, because it is a property of the debt being
+closed; the liquidation bonus comes from the **collateral reserve**, because it
+prices the collateral being seized. A repayment whose seizure would exceed the
+posted collateral fails with `LiquidationTooLarge` rather than silently seizing
+less, which would make the liquidator overpay.
+
 ### Fixed-point math
 
 All money math is integer-only `u128` — no floats, no fixed-point crates. Ratios
@@ -82,11 +94,17 @@ round-trips.
 `PriceFeed` mirrors a Switchboard On-Demand pull feed: a signed mantissa, an
 exponent (`price = mantissa * 10^exponent`), and the slot the price was written.
 Freshness is checked in **slots** (`MAX_PRICE_STALENESS_SLOTS`), not wall-clock
-time. The `set_price` handler writes the feed directly so the LiteSVM tests are
+time. The feed PDA is seeded by `[b"price_feed", authority, mint]`, so a signer
+can only ever write the feed derived from their own key — there is no shared
+per-mint feed to claim first — and a reserve trusts exactly one feed: the
+account its market owner passed to `init_reserve`.
+
+The `set_price` handler writes the feed directly so the LiteSVM tests are
 deterministic; in production a reserve points at the real Switchboard feed and the
 program decodes `PullFeedAccountData` (`price_mantissa = current_result.value`,
-`exponent = -18`, `last_updated_slot = current_result.slot`) instead. Switchboard
-is used rather than Pyth here for its lower compute cost.
+`exponent = -18`, `last_updated_slot = current_result.slot`) instead, and should
+also reject results whose confidence interval is too wide. Switchboard is used
+rather than Pyth here for its lower compute cost.
 
 ### Custody
 
@@ -95,6 +113,20 @@ per-obligation vault PDAs whose authority is the obligation PDA. The market owne
 can update reserve risk parameters (`update_reserve_config`) but has no path to
 move user funds — there is no admin withdrawal or escape hatch.
 
+### Known limits
+
+- **Tokens with transfer fees are not supported.** The program uses
+  `token_interface`, so Token Extensions mints are accepted, but a transfer-fee
+  extension would make the vault receive less than the recorded deposit and the
+  accounting would overstate `available_liquidity`. Production protocols
+  whitelist mints; a market owner here must only create reserves for tokens
+  without transfer fees.
+- **Reserve config changes act immediately.** Lowering a reserve's
+  `liquidation_threshold_bps` can make existing obligations liquidatable at
+  once; production governance phases such changes in.
+- This is an example. Deploying any program that custodies funds calls for a
+  professional security audit first.
+
 ### Instruction handlers
 
 Admin: `init_lending_market`, `init_reserve`, `update_reserve_config`, `set_price`.

finance/lending/anchor/programs/lending/src/errors.rs

@@ -32,6 +32,8 @@ pub enum LendingError {
     ReserveNotFound,
     #[msg("A refresh account did not match the obligation's stored reserves")]
     InvalidObligationAccount,
-    #[msg("Signer is not authorized for this price feed")]
-    UnauthorizedPriceFeed,
+    #[msg("Reserve belongs to a different lending market than the obligation")]
+    MarketMismatch,
+    #[msg("Repay amount would seize more collateral than the obligation holds")]
+    LiquidationTooLarge,
 }

finance/lending/anchor/programs/lending/src/instructions/admin/set_price.rs

@@ -2,33 +2,25 @@ use anchor_lang::prelude::*;
 use anchor_spl::token_interface::Mint;
 
 use crate::constants::PRICE_FEED_SEED;
-use crate::errors::LendingError;
 use crate::state::PriceFeed;
 
 /// Test stand-in for a Switchboard On-Demand feed: writes a price directly so
 /// LiteSVM tests are deterministic. In production the reserve points at a real
 /// Switchboard feed instead and this handler is unused.
+///
+/// The feed PDA is seeded by `[b"price_feed", authority, mint]`, so each
+/// authority can only ever write its own feed — there is no shared per-mint
+/// feed to race for. A reserve trusts exactly one feed account: the one the
+/// market owner passed to `init_reserve`.
 pub fn handle_set_price(
     context: Context<SetPrice>,
     price_mantissa: i128,
     exponent: i32,
 ) -> Result<()> {
     let feed = &mut context.accounts.price_feed;
-
-    // On first creation the authority is unset (default Pubkey); claim it for
-    // the signer. On later updates only that authority may write.
-    if feed.authority == Pubkey::default() {
-        feed.authority = context.accounts.authority.key();
-        feed.mint = context.accounts.mint.key();
-        feed.bump = context.bumps.price_feed;
-    } else {
-        require_keys_eq!(
-            feed.authority,
-            context.accounts.authority.key(),
-            LendingError::UnauthorizedPriceFeed
-        );
-    }
-
+    feed.authority = context.accounts.authority.key();
+    feed.mint = context.accounts.mint.key();
+    feed.bump = context.bumps.price_feed;
     feed.price_mantissa = price_mantissa;
     feed.exponent = exponent;
     feed.last_updated_slot = Clock::get()?.slot;
@@ -37,11 +29,13 @@ pub fn handle_set_price(
 
 #[derive(Accounts)]
 pub struct SetPrice<'info> {
+    // The authority is part of the seeds: a signer can only ever address (and
+    // therefore write) the feed derived from their own key.
     #[account(
         init_if_needed,
         payer = authority,
         space = PriceFeed::DISCRIMINATOR.len() + PriceFeed::INIT_SPACE,
-        seeds = [PRICE_FEED_SEED, mint.key().as_ref()],
+        seeds = [PRICE_FEED_SEED, authority.key().as_ref(), mint.key().as_ref()],
         bump,
     )]
     pub price_feed: Account<'info, PriceFeed>,

finance/lending/anchor/programs/lending/src/instructions/borrow_obligation_liquidity.rs

@@ -5,8 +5,8 @@ use anchor_spl::token_interface::{
 
 use crate::constants::FIXED_POINT_SCALE;
 use crate::errors::LendingError;
-use crate::math::{market_value, mul_div_ceil, reserve_signer_seeds, Rounding};
-use crate::state::{Obligation, PriceFeed, Reserve};
+use crate::math::{market_value, mul_div_ceil, Rounding};
+use crate::state::{reserve_signer_seeds, Obligation, PriceFeed, Reserve};
 
 /// Borrow liquidity against the obligation's collateral. The new debt's value
 /// (rounded up) plus the existing debt must stay within the obligation's
@@ -103,6 +103,7 @@ pub struct BorrowObligationLiquidity<'info> {
         has_one = liquidity_mint,
         has_one = liquidity_vault,
         has_one = price_feed,
+        constraint = reserve.lending_market == obligation.lending_market @ LendingError::MarketMismatch,
     )]
     pub reserve: Account<'info, Reserve>,
 

finance/lending/anchor/programs/lending/src/instructions/deposit_obligation_collateral.rs

@@ -51,7 +51,10 @@ pub struct DepositObligationCollateral<'info> {
     #[account(mut)]
     pub owner: Signer<'info>,
 
-    #[account(has_one = share_mint)]
+    #[account(
+        has_one = share_mint,
+        constraint = reserve.lending_market == obligation.lending_market @ LendingError::MarketMismatch,
+    )]
     pub reserve: Account<'info, Reserve>,
 
     pub share_mint: InterfaceAccount<'info, Mint>,

finance/lending/anchor/programs/lending/src/instructions/deposit_reserve_liquidity.rs

@@ -4,8 +4,8 @@ use anchor_spl::token_interface::{
 };
 
 use crate::errors::LendingError;
-use crate::math::{mul_div_floor, reserve_signer_seeds};
-use crate::state::Reserve;
+use crate::math::mul_div_floor;
+use crate::state::{reserve_signer_seeds, Reserve};
 
 /// Supply liquidity to a reserve and receive share tokens. The first deposit
 /// mints share tokens 1:1; later deposits mint

finance/lending/anchor/programs/lending/src/instructions/liquidate_obligation.rs

@@ -3,16 +3,23 @@ use anchor_spl::token_interface::{
     transfer_checked, Mint, TokenAccount, TokenInterface, TransferChecked,
 };
 
-use crate::constants::{BPS_DENOMINATOR, FIXED_POINT_SCALE, OBLIGATION_SEED, OBLIGATION_SHARE_VAULT_SEED};
+use crate::constants::{
+    BPS_DENOMINATOR, FIXED_POINT_SCALE, OBLIGATION_SEED, OBLIGATION_SHARE_VAULT_SEED,
+};
 use crate::errors::LendingError;
 use crate::math::{market_value, mul_div_ceil, mul_div_floor, value_to_amount, Rounding};
 use crate::state::{Obligation, PriceFeed, Reserve};
 
-/// Repay part of an unhealthy obligation's debt and seize a matching amount of
-/// its collateral share tokens plus a bonus. A single liquidation may repay at
-/// most the collateral reserve's close factor of the borrow. The seized
-/// collateral is valued at the borrow repaid plus the liquidation bonus, all
-/// rounded toward the borrower so the obligation is never over-seized.
+/// Repay part of an unhealthy obligation's debt and seize collateral share
+/// tokens worth the repayment plus the liquidation bonus.
+///
+/// The close factor caps how much of the borrow one call may repay; it comes
+/// from the repay (borrow) reserve because it is a property of the debt being
+/// closed. The liquidation bonus comes from the collateral reserve because it
+/// prices the collateral being seized. If the requested repayment would seize
+/// more collateral than the obligation holds, the call fails with
+/// `LiquidationTooLarge` — silently capping the seizure would make the
+/// liquidator pay full price for less collateral.
 ///
 /// Self-liquidation (the owner liquidating their own position) is not blocked:
 /// it is only possible while unhealthy and is economically pointless, matching
@@ -28,64 +35,69 @@ pub fn handle_liquidate_obligation(
     context.accounts.repay_reserve.require_refreshed()?;
     context.accounts.collateral_reserve.require_refreshed()?;
 
+    let obligation = &context.accounts.obligation;
+    let repay_reserve = &context.accounts.repay_reserve;
+    let collateral_reserve = &context.accounts.collateral_reserve;
+
     require!(
-        context.accounts.obligation.borrowed_value > context.accounts.obligation.unhealthy_borrow_value,
+        obligation.borrowed_value > obligation.unhealthy_borrow_value,
         LendingError::ObligationHealthy
     );
 
-    let repay_reserve_key = context.accounts.repay_reserve.key();
-    let collateral_reserve_key = context.accounts.collateral_reserve.key();
     let repay_price = context.accounts.repay_price_feed.price_scaled(slot)?;
     let collateral_price = context.accounts.collateral_price_feed.price_scaled(slot)?;
 
-    let borrow_index = context.accounts.obligation.find_borrow(repay_reserve_key)?;
-    let collateral_index = context.accounts.obligation.find_collateral(collateral_reserve_key)?;
-    let borrowed_scaled = context.accounts.obligation.borrows[borrow_index].borrowed_scaled;
-    let deposited_shares = context.accounts.obligation.deposits[collateral_index].deposited_shares;
+    let borrow_index = obligation.find_borrow(repay_reserve.key())?;
+    let collateral_index = obligation.find_collateral(collateral_reserve.key())?;
+    let borrowed_scaled = obligation.borrows[borrow_index].borrowed_scaled;
+    let deposited_shares = obligation.deposits[collateral_index].deposited_shares;
 
     // How much debt this liquidation repays, capped by the close factor.
-    let interest_index = context.accounts.repay_reserve.cumulative_borrow_rate_index;
+    let interest_index = repay_reserve.cumulative_borrow_rate_index;
     let debt_now = mul_div_ceil(borrowed_scaled, interest_index, FIXED_POINT_SCALE)?;
     let debt_now = u64::try_from(debt_now).map_err(|_| LendingError::MathOverflow)?;
     let max_repay = mul_div_floor(
         debt_now as u128,
-        context.accounts.collateral_reserve.config.close_factor_bps as u128,
+        repay_reserve.config.close_factor_bps as u128,
         BPS_DENOMINATOR,
     )?;
     let repay = liquidity_amount.min(u64::try_from(max_repay).map_err(|_| LendingError::MathOverflow)?);
     require!(repay > 0, LendingError::ZeroAmount);
 
     // Collateral to seize: value of the repayment plus the bonus, converted into
-    // the collateral token and then into share tokens. Every step rounds down.
+    // the collateral token and then into share tokens. Every step rounds down,
+    // toward the borrower, so the obligation is never over-seized by rounding.
     let repay_value = market_value(
         repay,
-        context.accounts.repay_reserve.liquidity_decimals,
+        repay_reserve.liquidity_decimals,
         repay_price,
         Rounding::Down,
     )?;
     let bonus_value = mul_div_floor(
         repay_value,
-        context.accounts.collateral_reserve.config.liquidation_bonus_bps as u128,
+        collateral_reserve.config.liquidation_bonus_bps as u128,
         BPS_DENOMINATOR,
     )?;
     let seize_value = repay_value
         .checked_add(bonus_value)
         .ok_or(LendingError::MathOverflow)?;
     let seize_liquidity = value_to_amount(
         seize_value,
-        context.accounts.collateral_reserve.liquidity_decimals,
+        collateral_reserve.liquidity_decimals,
         collateral_price,
         Rounding::Down,
     )?;
     let seize_shares = mul_div_floor(
         seize_liquidity as u128,
-        context.accounts.collateral_reserve.share_mint_supply as u128,
-        context.accounts.collateral_reserve.total_liquidity()?.max(1),
+        collateral_reserve.share_mint_supply as u128,
+        collateral_reserve.total_liquidity()?.max(1),
     )?;
-    let seize_shares = u64::try_from(seize_shares)
-        .map_err(|_| LendingError::MathOverflow)?
-        .min(deposited_shares);
+    let seize_shares = u64::try_from(seize_shares).map_err(|_| LendingError::MathOverflow)?;
     require!(seize_shares > 0, LendingError::ZeroAmount);
+    require!(
+        seize_shares <= deposited_shares,
+        LendingError::LiquidationTooLarge
+    );
 
     let scaled_removed =
         mul_div_floor(repay as u128, FIXED_POINT_SCALE, interest_index)?.min(borrowed_scaled);
@@ -166,9 +178,15 @@ pub struct LiquidateObligation<'info> {
 
     pub liquidator: Signer<'info>,
 
-    #[account(mut)]
+    #[account(
+        mut,
+        constraint = repay_reserve.lending_market == obligation.lending_market @ LendingError::MarketMismatch,
+    )]
     pub repay_reserve: Box<Account<'info, Reserve>>,
 
+    #[account(
+        constraint = collateral_reserve.lending_market == obligation.lending_market @ LendingError::MarketMismatch,
+    )]
     pub collateral_reserve: Box<Account<'info, Reserve>>,
 
     #[account(address = repay_reserve.price_feed)]

finance/lending/anchor/programs/lending/src/instructions/redeem_reserve_collateral.rs

@@ -4,8 +4,8 @@ use anchor_spl::token_interface::{
 };
 
 use crate::errors::LendingError;
-use crate::math::{mul_div_floor, reserve_signer_seeds};
-use crate::state::Reserve;
+use crate::math::mul_div_floor;
+use crate::state::{reserve_signer_seeds, Reserve};
 
 /// Burn share tokens and withdraw the underlying liquidity they represent:
 /// `share_amount * total_liquidity / share_supply`, floored so the protocol

finance/lending/anchor/programs/lending/src/instructions/refresh_obligation.rs

@@ -18,6 +18,7 @@ use crate::state::{Obligation, PriceFeed, Reserve};
 pub fn handle_refresh_obligation(context: Context<RefreshObligation>) -> Result<()> {
     let slot = Clock::get()?.slot;
     let obligation = &mut context.accounts.obligation;
+    let lending_market = obligation.lending_market;
     let accounts = context.remaining_accounts;
     let mut cursor = 0usize;
 
@@ -26,7 +27,8 @@ pub fn handle_refresh_obligation(context: Context<RefreshObligation>) -> Result<
     let mut unhealthy_borrow_value: u128 = 0;
 
     for collateral in obligation.deposits.iter_mut() {
-        let (reserve, price_scaled) = read_pair(accounts, &mut cursor, collateral.reserve, slot)?;
+        let (reserve, price_scaled) =
+            read_pair(accounts, &mut cursor, collateral.reserve, lending_market, slot)?;
 
         let liquidity = mul_div_floor(
             collateral.deposited_shares as u128,
@@ -58,7 +60,8 @@ pub fn handle_refresh_obligation(context: Context<RefreshObligation>) -> Result<
 
     let mut borrowed_value: u128 = 0;
     for borrow in obligation.borrows.iter_mut() {
-        let (reserve, price_scaled) = read_pair(accounts, &mut cursor, borrow.reserve, slot)?;
+        let (reserve, price_scaled) =
+            read_pair(accounts, &mut cursor, borrow.reserve, lending_market, slot)?;
 
         let debt = mul_div_ceil(
             borrow.borrowed_scaled,
@@ -89,12 +92,14 @@ pub fn handle_refresh_obligation(context: Context<RefreshObligation>) -> Result<
 }
 
 /// Read the next `[reserve, price_feed]` pair from `remaining_accounts`,
-/// checking it matches the obligation's stored reserve and that both the
-/// reserve (refreshed this slot) and the price (fresh) are usable.
+/// checking it matches the obligation's stored reserve, belongs to the
+/// obligation's lending market, and that both the reserve (refreshed this
+/// slot) and the price (fresh) are usable.
 fn read_pair<'a, 'info>(
     accounts: &'a [AccountInfo<'info>],
     cursor: &mut usize,
     expected_reserve: Pubkey,
+    lending_market: Pubkey,
     slot: u64,
 ) -> Result<(Reserve, u128)>
 where
@@ -114,6 +119,11 @@ where
         LendingError::InvalidObligationAccount
     );
     let reserve = Account::<Reserve>::try_from(reserve_info)?;
+    require_keys_eq!(
+        reserve.lending_market,
+        lending_market,
+        LendingError::MarketMismatch
+    );
     reserve.require_refreshed()?;
 
     require_keys_eq!(