Fix inverted contribute/refund time gates in token-fundraiser (anchor)

[boymak]

Summary

The token-fundraiser (Anchor) example gates contribute and refund on the campaign window with inverted comparisons:

• contribute only accepted contributions after the campaign window had closed (require!(duration <= elapsed_days, FundraiserEnded)).
• refund only allowed refunds while the campaign was still open (require!(duration >= elapsed_days, FundraiserNotEnded)).

So for any real (non-zero duration) fundraiser, contributions are rejected for the entire campaign and only allowed once it's over, while refunds are allowed during the campaign and blocked afterwards — the opposite of the intended behaviour.

The bug is invisible today because the test uses duration = 0, where both inverted conditions happen to evaluate correctly (0 <= 0 and 0 >= 0).

Fix

• contribute now rejects once elapsed_days >= duration (campaign ended) → contributions accepted while the campaign is open.
• refund now rejects while elapsed_days < duration (campaign still open) → refunds allowed only after it ends.

(The cast is parenthesised — (… as u16) < duration — to avoid Rust parsing as u16 < as a generic.)

Tests

The tests now create a non-zero (open) campaign so contributions are valid, and assert that a refund is rejected while the campaign is still open. A successful refund requires advancing the validator clock past duration (e.g. via bankrun's setClock).

Verification

The Anchor program compiles (cargo build-sbf). The identical semantic fix was applied to the Pinocchio port of this example in #613, where the corrected behaviour was verified end-to-end on a local solana-test-validator (contributions accepted while open, rejected after the campaign ends; refunds rejected while open).

[greptile-apps]

Greptile Summary

This PR corrects an inverted time-gate bug in the Anchor token-fundraiser example: contribute and refund had their comparison operators swapped, meaning contributions were only accepted after a campaign ended and refunds were only permitted while it was still open. The fix reverses both comparisons to their intended semantics.

• contribute.rs: Changed duration <= elapsed to elapsed < duration so contributions are accepted only while the campaign is active.
• refund.rs: Changed duration >= elapsed to elapsed >= duration so refunds are allowed only after the campaign has ended.
• bankrun.test.ts: Campaign duration changed from 0 (which masked the bug) to 5 days; a setElapsedDays clock-manipulation helper is added; tests now cover both the rejection of an early refund and the success of a post-campaign refund with balance assertions.

Confidence Score: 5/5

The fix is safe to merge — it corrects two inverted comparisons to their clearly intended semantics, and the rewritten tests now exercise both the happy and rejection paths with deterministic clock control and explicit balance assertions.

Both comparison inversions are straightforward and mutually consistent: the contribute and refund windows are now contiguous and non-overlapping (open while elapsed < duration, refund-eligible once elapsed >= duration). The boundary values and as u16 cast parenthesisation are handled correctly. Test coverage is substantially improved over the previous zero-duration degenerate case.

No files require special attention.

Important Files Changed

Filename	Overview
tokens/token-fundraiser/anchor/programs/fundraiser/src/instructions/contribute.rs	Comparison corrected from duration <= elapsed to elapsed < duration; parentheses added around the as u16 cast to avoid Rust parsing ambiguity — logic is now correct.
tokens/token-fundraiser/anchor/programs/fundraiser/src/instructions/refund.rs	Comparison corrected from duration >= elapsed to elapsed >= duration; boundary semantics are consistent (campaign end day triggers refund eligibility).
tokens/token-fundraiser/anchor/tests/bankrun.test.ts	Tests upgraded from a zero-duration degenerate campaign to a 5-day campaign with deterministic clock control; both the reject-while-open and refund-after-close paths are now exercised with balance assertions.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant C as Contributor
    participant P as Program (contribute/refund)
    participant Clock as Solana Clock
    participant V as Vault

    Note over P: Campaign open (elapsed < duration)

    C->>P: contribute(amount)
    P->>Clock: get unix_timestamp
    Clock-->>P: current_time
    P->>P: "elapsed = (current_time - time_started) / SECONDS_TO_DAYS"
    alt "elapsed < duration (campaign open)"
        P->>V: transfer tokens in
        P-->>C: OK
    else "elapsed >= duration (campaign ended)"
        P-->>C: Error: FundraiserEnded
    end

    Note over P: Campaign ended (elapsed >= duration)

    C->>P: refund()
    P->>Clock: get unix_timestamp
    Clock-->>P: current_time
    P->>P: "elapsed = (current_time - time_started) / SECONDS_TO_DAYS"
    alt "elapsed >= duration (campaign ended)"
        P->>V: transfer tokens out to contributor ATA
        P-->>C: OK
    else "elapsed < duration (campaign still open)"
        P-->>C: Error: FundraiserNotEnded
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant C as Contributor
    participant P as Program (contribute/refund)
    participant Clock as Solana Clock
    participant V as Vault

    Note over P: Campaign open (elapsed < duration)

    C->>P: contribute(amount)
    P->>Clock: get unix_timestamp
    Clock-->>P: current_time
    P->>P: "elapsed = (current_time - time_started) / SECONDS_TO_DAYS"
    alt "elapsed < duration (campaign open)"
        P->>V: transfer tokens in
        P-->>C: OK
    else "elapsed >= duration (campaign ended)"
        P-->>C: Error: FundraiserEnded
    end

    Note over P: Campaign ended (elapsed >= duration)

    C->>P: refund()
    P->>Clock: get unix_timestamp
    Clock-->>P: current_time
    P->>P: "elapsed = (current_time - time_started) / SECONDS_TO_DAYS"
    alt "elapsed >= duration (campaign ended)"
        P->>V: transfer tokens out to contributor ATA
        P-->>C: OK
    else "elapsed < duration (campaign still open)"
        P-->>C: Error: FundraiserNotEnded
    end

Loading

_{Reviews (4): Last reviewed commit: "Pin clock in the refund-rejection test t..." | Re-trigger Greptile}

[boymak]

Thanks — addressed both test-quality points in 063ec63:

1. Narrowed the refund-rejection assertion. The catch now asserts the error is FundraiserNotEnded rather than accepting any exception.

2. Added a post-campaign (positive-path) refund test. It advances the clock past the 5-day window with banksClient.getClock() + context.setClock(...), then asserts a successful refund: the contribution is returned to the contributor, the vault is emptied, and the contributor account is closed.

That covers both sides of the corrected refund gate (rejected while open, allowed after the campaign ends) plus the corrected contribute gate (accepted while open).

[dev-jodee]

@boymak looks good, but there's some ci failures

[boymak]

Thanks! Both CI failures are fixed now:

• build-and-test: the failures were a test-harness issue, not the program. bankrun doesn't advance its clock on its own, so the day-based time gates read whatever the runtime's default clock was and rejected contributions. The tests now pin the clock relative to the fundraiser's recorded start time via setClock (a small setElapsedDays helper) — one day into the campaign for the open-window cases, past duration for the successful-refund case.
• Biome: collapsed the multi-line calls it flagged.

The program logic itself I verified end-to-end on a local solana-test-validator (contributions accepted while open / rejected after the campaign ends; refunds the reverse).

Pushed to the branch — could you re-run the workflow when you get a chance? (fork PRs need approval to run.)