fix(security): validation skips discriminator check (Issue #7)

- validate wallet discriminator (must be 1) in create_session.rs
- validate wallet discriminator in manage_authority.rs (add/remove)
- validate wallet discriminator in execute.rs
- validate wallet discriminator in transfer_ownership.rs

Author: onspeedhp

program/src/processor/create_session.rs

@@ -110,6 +110,12 @@ pub fn process(
         return Err(ProgramError::IllegalOwner);
     }
 
+    // Validate Wallet Discriminator (Issue #7)
+    let wallet_data = unsafe { wallet_pda.borrow_data_unchecked() };
+    if wallet_data.is_empty() || wallet_data[0] != AccountDiscriminator::Wallet as u8 {
+        return Err(ProgramError::InvalidAccountData);
+    }
+
     // Verify Authorizer
     // Check removed: conditional writable check inside match
 

program/src/processor/execute.rs

@@ -4,7 +4,7 @@ use crate::{
     },
     compact::parse_compact_instructions,
     error::AuthError,
-    state::authority::AuthorityAccountHeader,
+    state::{authority::AuthorityAccountHeader, AccountDiscriminator},
 };
 use pinocchio::{
     account_info::AccountInfo,
@@ -61,6 +61,11 @@ pub fn process(
     if wallet_pda.owner() != program_id || authority_pda.owner() != program_id {
         return Err(ProgramError::IllegalOwner);
     }
+    // Validate Wallet Discriminator (Issue #7)
+    let wallet_data = unsafe { wallet_pda.borrow_data_unchecked() };
+    if wallet_data.is_empty() || wallet_data[0] != AccountDiscriminator::Wallet as u8 {
+        return Err(ProgramError::InvalidAccountData);
+    }
 
     if !authority_pda.is_writable() {
         return Err(ProgramError::InvalidAccountData);

program/src/processor/manage_authority.rs

@@ -133,6 +133,17 @@ pub fn process_add_authority(
     if admin_auth_pda.owner() != program_id {
         return Err(ProgramError::IllegalOwner);
     }
+    // Validate Wallet Discriminator (Issue #7)
+    let wallet_data = unsafe { wallet_pda.borrow_data_unchecked() };
+    if wallet_data.is_empty() || wallet_data[0] != AccountDiscriminator::Wallet as u8 {
+        return Err(ProgramError::InvalidAccountData);
+    }
+
+    // Validate Wallet Discriminator (Issue #7)
+    let wallet_data = unsafe { wallet_pda.borrow_data_unchecked() };
+    if wallet_data.is_empty() || wallet_data[0] != AccountDiscriminator::Wallet as u8 {
+        return Err(ProgramError::InvalidAccountData);
+    }
 
     // Validate system_program is the correct System Program (audit N2)
     if !sol_assert_bytes_eq(

program/src/processor/transfer_ownership.rs

@@ -111,6 +111,11 @@ pub fn process(
     if wallet_pda.owner() != program_id || current_owner.owner() != program_id {
         return Err(ProgramError::IllegalOwner);
     }
+    // Validate Wallet Discriminator (Issue #7)
+    let wallet_data = unsafe { wallet_pda.borrow_data_unchecked() };
+    if wallet_data.is_empty() || wallet_data[0] != AccountDiscriminator::Wallet as u8 {
+        return Err(ProgramError::InvalidAccountData);
+    }
 
     // Validate system_program is the correct System Program (audit N2)
     if !sol_assert_bytes_eq(

tests-e2e/TEST_ISSUES.md

@@ -30,6 +30,10 @@
 **Status**: ✅ Fixed
 **Fix**: Replaced hardcoded rent calculations with `Rent::minimum_balance(space)` in `create_wallet.rs` and `manage_authority.rs`. Verified by tests.
 
+### Issue #8 (Validation): Wallet Discriminator Check
+**Status**: ✅ Fixed
+**Fix**: Added `wallet_data[0] == AccountDiscriminator::Wallet` check in `create_session.rs`, `manage_authority.rs`, `execute.rs`, and `transfer_ownership.rs`.
+
 ## Current Status
 All E2E scenarios are PASSING.
 - Happy Path