Etherings-public

        key(&data, 49..81)? != *destination.key {        return Err(ProgramError::InvalidAccountData);    }    let recipient = key(&data, 17..49)?;    drop(data);    let source_state = token(reserve)?;    let destination_state = token(destination)?;    let (expected_delegate, bump) = Pubkey::find_program_address(&[DELEGATE_SEED], program_id);    if delegate.key != &expected_delegate || source_state.owner !=        key(&config.try_borrow_data()?, 1..33)? ||        source_state.mint != *mint.key || source_state.delegate != COption::Some(*delegate.key) ||        source_state.delegated_amount < amount || destination_state.owner != recipient ||        destination_state.mint != *mint.key {        return Err(ProgramError::InvalidAccountData);    }    payout.try_borrow_mut_data()?[105] = 1;    let mut ix = spl_token_2022::instruction::transfer_checked(        token_program.key, reserve.key, mint.key, destination.key, delegate.key, &[], amount, 9)?;    ix.accounts.push(AccountMeta::new_readonly(*meta_list.key, false));    ix.accounts.push(AccountMeta::new_readonly(*sysvar.key, false));    ix.accounts.push(AccountMeta::new_readonly(*gateway_config.key, false));    ix.accounts.push(AccountMeta::new_readonly(*hook.key, false));    invoke_signed(&ix, &[reserve.clone(), mint.clone(), destination.clone(), delegate.clone(),        meta_list.clone(), sysvar.clone(), gateway_config.clone(), hook.clone(), token_program.clone()],

1. Line 380 let (expected_delegate, bump) = Pubkey::find_program_address(&[DELEGATE_SEED], program_id): Derives a PDA from seeds and the program ID and returns the address with its canonical bump.
2. Line 380 let (expected_delegate, bump) = Pubkey::find_program_address(&[DELEGATE_SEED], program_id): Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
3. Line 389 let mut ix = spl_token_2022::instruction::transfer_checked(: A checked token transfer, which also verifies the mint and decimals.
4. Line 389 let mut ix = spl_token_2022::instruction::transfer_checked(: Targets the Token-2022 program instead of the original Token Program.
5. Line 395 invoke_signed(&ix, &[reserve.clone(), mint.clone(), destination.clone(), delegate.clone(),: Makes a CPI signed by a PDA. The signer seeds prove the program controls that address.

        let bump = Pubkey::find_program_address(&[CONFIG_SEED_MARKET], program_id).1;        create_pda(config, vault, system, program_id, CONFIG_LEN,            &[CONFIG_SEED_MARKET, &[bump]])?;    } else {        check_config(program_id, config)?;        if read_u64(&config.try_borrow_data()?, 33)?.checked_add(1) != Some(version)        { return Err(ProgramError::InvalidInstructionData); }    }    let mut bytes = config.try_borrow_mut_data()?;    bytes[0] = 1;    bytes[1..33].copy_from_slice(vault.key.as_ref());    bytes[33..41].copy_from_slice(&version.to_le_bytes());    bytes[41..73].copy_from_slice(royalty.as_ref());    bytes[73..105].copy_from_slice(platform.as_ref());    bytes[105..137].copy_from_slice(silver.as_ref());    Ok(())} fn check_asset(program_id: &Pubkey, silver: &Pubkey, mint: &AccountInfo, state: &AccountInfo,    lifecycle: &AccountInfo, extra: &AccountInfo) -> Result<bool, ProgramError>{    if mint.owner != &spl_token_2022::id() || state.owner != silver        || extra.owner != silver        || *extra.key != get_extra_account_metas_address_and_bump_seed(mint.key, silver).0

1. Line 85 let bump = Pubkey::find_program_address(&[CONFIG_SEED_MARKET], program_id).1;: Derives a PDA from seeds and the program ID and returns the address with its canonical bump.
2. Line 85 let bump = Pubkey::find_program_address(&[CONFIG_SEED_MARKET], program_id).1;: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
3. Line 90 if read_u64(&config.try_borrow_data()?, 33)?.checked_add(1) != Some(version): Uses checked arithmetic so overflow fails instead of wrapping.
4. Line 106 if mint.owner != &spl_token_2022::id() || state.owner != silver: Targets the Token-2022 program instead of the original Token Program.

            Pubkey::find_program_address(&[b"silver-state", mint.as_ref()], &SILVER_PROGRAM).0                == ctx.accounts.box_state.key(),            ProofError::WrongBox        );        require!(            Pubkey::find_program_address(&[b"silver-collection"], &SILVER_PROGRAM)                .0                .to_bytes()                == state[68..100],            ProofError::WrongBox        );        let cooldown_until = i64::from_le_bytes(state[196..204].try_into().unwrap());        require!(            Clock::get()?.unix_timestamp >= cooldown_until,            ProofError::Cooldown        );        drop(state);        require!(            ctx.accounts.box_mint.supply == 1 && ctx.accounts.box_mint.decimals == 0,            ProofError::WrongBox        );        require!(            ctx.accounts.box_mint.to_account_info().owner == &spl_token_2022::id(),            ProofError::WrongBox

1. Line 49 Pubkey::find_program_address(&[b"silver-state", mint.as_ref()], &SILVER_PROGRAM).0: Derives a PDA from seeds and the program ID and returns the address with its canonical bump.
2. Line 53 require!(: An explicit validation that aborts the instruction with an error.
3. Line 62 Clock::get()?.unix_timestamp >= cooldown_until,: Reads on-chain time from the Clock sysvar.
4. Line 71 ctx.accounts.box_mint.to_account_info().owner == &spl_token_2022::id(),: Targets the Token-2022 program instead of the original Token Program.

    let (collection, _) = Pubkey::find_program_address(&[COLLECTION_SEED], program_id);    let mint_space = ExtensionType::try_calculate_account_len::<Mint>(&[        ExtensionType::MetadataPointer,        ExtensionType::TransferHook,    ])?;    let mint_bump_seed = [mint_bump];    let mint_seeds: &[&[u8]] = &[MINT_SEED, issuance_id, &mint_bump_seed];    let authority_bump_seed = [authority_bump];    let authority_seeds: &[&[u8]] = &[AUTHORITY_SEED, &authority_bump_seed];    create_pda(mint, admin, system, token_program.key, mint_space, mint_seeds)?;    let funded_size = mint_space        .checked_add(768)        .ok_or(ProgramError::InvalidAccountData)?;    let final_rent = Rent::get()?.minimum_balance(funded_size);    if mint.lamports() < final_rent {        invoke(            &system_instruction::transfer(admin.key, mint.key, final_rent - mint.lamports()),            &[admin.clone(), mint.clone(), system.clone()],        )?;    }    invoke(        &spl_token_2022::extension::metadata_pointer::instruction::initialize(            token_program.key,            mint.key,

1. Line 181 let (collection, _) = Pubkey::find_program_address(&[COLLECTION_SEED], program_id);: Derives a PDA from seeds and the program ID and returns the address with its canonical bump.
2. Line 192 .checked_add(768): Uses checked arithmetic so overflow fails instead of wrapping.
3. Line 196 invoke(: Makes a cross-program invocation into another program.
4. Line 202 &spl_token_2022::extension::metadata_pointer::instruction::initialize(: Targets the Token-2022 program instead of the original Token Program.