Fix CPI token program spoofing in Create (validate SPL Token program id)

[Herrsosa]

PR Title

Fix CPI token program spoofing in Create (validate SPL Token program id)

Summary

This PR fixes a CPI program-id substitution vulnerability in the Create instruction by validating that the provided token program account is the official SPL Token program (spl_token::id()).

Root cause (what was wrong)

process_create accepted a caller-supplied “token program” account and used it as the program_id for the token transfer instruction, then CPI-invoked it, without verifying it was actually SPL Token.

process_unlock already validated the token program id, but process_create did not.

Impact (why it matters)

A malicious caller could provide an arbitrary executable program ID in place of SPL Token and cause the vesting program to invoke that program during Create. This breaks the invariant “Create always transfers via SPL Token” and is a known Solana CPI security footgun, especially in composable contexts.

Fix

• Reject Create if spl_token_account.key != spl_token::id().

Tests

• Adds test_create_rejects_invalid_token_program (solana-program-test) that registers a fake program and asserts:
  • the transaction fails with InvalidArgument
  • the fake program is not invoked

Run locally:

cd program
cargo test --features test-bpf