[ara-stock]

What

litesvm_token::get_spl_account slices the account data with data[..T::LEN] before unpacking it, so it panics whenever the account exists but its data is shorter than T::LEN. For example:

• get_spl_account::<Account> on a mint (82 bytes < 165) panics with range end index 165 out of range for slice of length 82;
• get_spl_account::<Mint> on a wallet (0 bytes) panics the same way.

Because TransferChecked, MintToChecked, BurnChecked and ApproveChecked read the mint through get_spl_account, passing a wrong address as the mint makes send() panic instead of returning Err, even though the function already returns Result and a missing account is reported as AccountNotFound.

Fix

Take data.get(..T::LEN) and fall back to the whole (shorter) data, so Pack::unpack sees a slice of the wrong length and returns InvalidAccountData, which is converted to FailedTransactionMetadata like the other unpack errors. Accounts that are at least T::LEN long (including Token-2022 accounts with extensions) are handled as before.

Tests

Added test_get_spl_account_with_short_data to crates/token/tests/one_owner.rs: it checks that get_spl_account::<Account> on a mint and get_spl_account::<Mint> on a wallet return Err, and that TransferChecked::send() with a wallet as the mint returns Err. The test panics on master and passes with the fix; cargo test -p litesvm-token --test one_owner passes.

This change was prepared with AI assistance (Claude) and reviewed before submission.

🤖 Generated with Claude Code