Fix code inconsistencies across various programs

[mikemaccana]

Fixes the 11 code inconsistencies flagged in the 2026-04-22 audit across various program examples. One commit per logically-grouped fix.

Fixes

1. tokens/token-swap - TutorialError::InvalidMint was defined but never emitted (Anchor has_one already handles the mint-mismatch check upstream). Remove the dead variant. (66d2dee)
2. tokens/token-swap - migrate token::transfer to token::transfer_checked across deposit_liquidity, swap_exact_tokens_for_tokens, and withdraw_liquidity so the mint and decimals are validated on every transfer. (66d2dee)
3. tokens/token-swap - silent clamp-to-balance broke slippage protection for callers built on top. Return a new InsufficientBalance error when the requested amount exceeds the available balance. (66d2dee)
4. basics/counter (native + pinocchio) - unknown / empty instruction bytes used to fall through to Ok(()). Both variants now return ProgramError::InvalidInstructionData. (2cf93df)
5. basics/counter/native - the program accepted any 8-byte account as the counter. Add an owner check (account.owner == program_id) that returns ProgramError::IncorrectProgramId on mismatch. (2cf93df)
6. compression/cnft-burn, compression/cnft-vault - bubblegum_program was an UncheckedAccount with no program id check. Pin it via #[account(address = MPL_BUBBLEGUM_ID)] (the constant already lives in the crate). (f90ac8e)
7. tokens/escrow/anchor - no way to cancel an offer, abandoned offers locked maker funds forever. Add a cancel_offer instruction: maker-signed, returns vault tokens to the maker, closes the vault, closes the offer account (rent refunded to maker via close = maker). (b0da596)
8. tokens/escrow/anchor - init_if_needed on maker_token_account_b on the take side meant the taker paid the maker's rent. Move the init to make_offer with payer = maker, treat as plain mut on take_offer. (b0da596)
9. tokens/token-extensions/default-account-state/native - update_default_account_state was signed by payer, but the freeze authority recorded on the mint is mint_authority. The CPI only worked by coincidence when the caller used the same account for both. Sign with mint_authority to make the requirement explicit. (6a1c095)
10. basics/repository-layout/anchor - error.rs was empty and every refusal branch in the carnival handlers logged a message and returned Ok(()). Tests batched valid + invalid attempts through .unwrap() and "passed" because rejections silently succeeded. Add a CarnivalError enum (NotEnoughTickets, RiderTooShort), return real errors from the refusal branches, and split the tests into one-success-or-one-rejection cases that actually assert is_err() on rejections. (d2f0320)
11. tokens/token-extensions/nft-meta-data-pointer/anchor-example - the unaudited session-keys crate is used without any warning. Add a comment block above declare_id! explicitly flagging it as educational only and pointing at what to harden before any production use. (88f0380)

Verification

For every program touched I ran the local LiteSVM / node:test suites and confirmed they pass before pushing:

• tokens/token-swap - cargo test: 4 passed.
• basics/counter/native - pnpm build-and-test: 3 passed (existing 2 + new test_unknown_instruction_fails and test_wrong_owner_fails).
• basics/counter/pinocchio - pnpm build-and-test: 2 passed (existing + new test_unknown_instruction_fails).
• compression/cnft-burn, compression/cnft-vault - cargo check (no Rust test suite in repo).
• tokens/escrow/anchor - cargo test: 4 passed (test_make_offer, test_take_offer, new test_cancel_offer, new test_cancel_offer_rejects_non_maker).
• tokens/token-extensions/default-account-state/native - pnpm build-and-test: 1 passed (existing TS suite still green).
• basics/repository-layout/anchor - cargo test: 8 passed (success + rejection cases per instruction).
• tokens/token-extensions/nft-meta-data-pointer/anchor-example - comment-only; pre-existing build failure of the session-keys crate is unchanged (not introduced by this PR).

---

Note

Medium Risk
Medium risk: changes touch on-chain token/CPI flows (escrow, token-swap, cNFT CPI) and alter failure semantics, which can impact client expectations and fund movement if mis-specified.

Overview
Improves correctness and safety of several Solana program examples by turning previously silent/ambiguous behaviors into explicit failures and tightening CPI/account validation.

In basics/counter (native + pinocchio), empty/unknown instruction data now returns InvalidInstructionData, native increment additionally enforces counter_account.owner == program_id, and tests now assert success/failure cases (including unknown discriminants and wrong-owner accounts).

In the Anchor carnival example, introduces CarnivalError and changes ride/game/food “refusal” branches to return real errors instead of Ok(()), with tests split to explicitly expect either success or rejection.

Hardens compressed NFT CPI examples by constraining bubblegum_program to MPL_BUBBLEGUM_ID in cnft-burn and cnft-vault withdraw instructions.

Extends the Anchor escrow example with a maker-signed cancel_offer that returns vault funds and closes vault/offer, and shifts initialization of the maker’s token-B ATA to make_offer (so the maker—not the taker—pays rent); tests updated accordingly.

In token examples, fixes default-account-state to sign update_default_account_state with mint_authority, adds a warning comment about unaudited session-keys usage, and updates token-swap to remove dead InvalidMint, fail fast with InsufficientBalance (no balance clamping), and use transfer_checked for mint/decimal validation in deposit/swap/withdraw.

^{Reviewed by Cursor Bugbot for commit 26e37b0. Bugbot is set up for automated code reviews on this repo. Configure here.}