Description

It was found that PDA accounts in both vault and swap-endpoint programs do not use constant prefixes with pubkeys to derive the PDA addresses.

#[account(
    init_if_needed,
    seeds = [deposit_channel_associated_token_account.key().as_ref()],
    bump,
    payer = agg_key,
    space = size_of::<DepositChannelHistoricalFetch>() + DISCRIMINATOR_SIZE,
)]

Impact

This might result in seed collisions in case of any future updates to the code.

Recommendations

It is recommended to use constant prefixes with pubkeys to derive the PDA addresses.

Remediation

This issue has been acknowledged by Chainflip, and a fix was implemented in commit 5c784600↗.