HOLD-BACK

        authority: authority.clone(),    };    let ctx = match signer {        Some(s) => CpiContext::new_with_signer(token_program.to_account_info(), accounts, s),        None => CpiContext::new(token_program.to_account_info(), accounts),    };    token_interface::transfer_checked(ctx, amount, decimals)} /// Token-2022 mints with fee, hook, delegate, pause or similar extensions can/// make the vault pay out less than it recorded or block a payout entirely./// Only plain mints (and metadata-only extensions) are accepted.fn check_mint_extensions(mint: &AccountInfo) -> Result<()> {    if *mint.owner != anchor_spl::token_2022::ID {        return Ok(());    }    let data = mint.try_borrow_data()?;    let state = StateWithExtensions::<MintState>::unpack(&data).map_err(|_| error!(HoldbackError::UnsafeMint))?;    for ext in state.get_extension_types().map_err(|_| error!(HoldbackError::UnsafeMint))? {        match ext {            ExtensionType::MetadataPointer | ExtensionType::TokenMetadata => {}            _ => return err!(HoldbackError::UnsafeMint),        }    }

1. Line 304 Some(s) => CpiContext::new_with_signer(token_program.to_account_info(), accounts, s),: Makes a CPI signed by a PDA. The signer seeds prove the program controls that address.
2. Line 305 None => CpiContext::new(token_program.to_account_info(), accounts),: Makes a cross-program invocation into another program.
3. Line 307 token_interface::transfer_checked(ctx, amount, decimals): A checked token transfer, which also verifies the mint and decimals.
4. Line 314 if *mint.owner != anchor_spl::token_2022::ID {: Targets the Token-2022 program instead of the original Token Program.
5. Line 322 _ => return err!(HoldbackError::UnsafeMint),: An explicit validation that aborts the instruction with an error.

// Browser client for the Holdback program on Solana devnet, signed with Phantom.// Bundled into site/devnet.js by `npm run build:site`. It exposes the same// api(path, body) shape as the in-page simulation, so the demo UI is shared.//// The connected Phantom wallet is the developer and pays every fee and rent.// The other roles (subcontractor, arbiter, funder, stranger) are throwaway// keypairs created in the browser: they hold no SOL and only co-sign.import { AnchorProvider, BN, Program } from "@coral-xyz/anchor";import {  Connection, Keypair, PublicKey, SystemProgram, Transaction, VersionedTransaction, LAMPORTS_PER_SOL,} from "@solana/web3.js";import {  TOKEN_2022_PROGRAM_ID, getMintLen, getAssociatedTokenAddressSync,  createInitializeMint2Instruction, createAssociatedTokenAccountIdempotentInstruction, createMintToInstruction,} from "@solana/spl-token";import idl from "../target/idl/holdback.json"; const RPC = "https://api.devnet.solana.com";const PROGRAM_ID = new PublicKey(idl.address);const TP = TOKEN_2022_PROGRAM_ID;const DEC = 100; // test USDC with 2 decimals, same as the testsconst WARRANTY_SECS = 45;const ARBITER_WINDOW_SECS = 60; // after this, an unsettled defect no longer blocks releaseconst TITLE = "Turan Residences, electrical, block B";

1. Line 13 TOKEN_2022_PROGRAM_ID, getMintLen, getAssociatedTokenAddressSync,: Targets the Token-2022 program instead of the original Token Program.
2. Line 14 createInitializeMint2Instruction, createAssociatedTokenAccountIdempotentInstruction, creat: Mints new tokens. The mint authority must sign.