fix: add pub bump: u8 to PDA structs per skill rule

The Solana Anchor coding-style skill requires every struct that lives in a PDA to store its canonical bump so later instructions can validate and re-sign without a second `find_program_address` derivation (which costs ~1.5k CU per call).

Structs updated (13 of 15 from the audit list):

basics/
- favorites::Favorites        (new bump field + `set_inner` pass-through)

tokens/token-swap/
- state::Amm                  (new bump field + saved in `handle_create_amm`)
- state::Pool                 (new bump field + saved in `handle_create_pool`)

tokens/token-extensions/transfer-hook/
- counter::CounterAccount             (`b"counter"` PDA)
- transfer-cost::CounterAccount       (`b"counter"` PDA)
- account-data-as-seed::CounterAccount (`b"counter", payer` PDA)
- whitelist::WhiteList                (`b"white_list"` PDA)
- allow-block-list-token::ABWallet    (`[AB_WALLET_SEED, wallet]` PDA — bump threaded through the `init_wallet` impl signature)
- transfer-switch::TransferSwitch     (`[wallet]` PDA — bump threaded through `handle_switch`)
- transfer-switch::AdminConfig        (`[b"admin-config"]` PDA — bump threaded through `handle_configure_admin`; note the struct already had `pub bump: u8` in Config but wasn't saved)

tokens/token-extensions/nft-meta-data-pointer/
- extension_nft::GameData             (new bump field; saved on first create in `init_player` *and* `chop_tree` which both use init_if_needed — guarded by `if bump == 0` so repeat calls don't overwrite)
- extension_nft::PlayerData           (new bump field; saved in `handle_init_player`)

tokens/token-fundraiser/
- state::Contributor          (new bump field; `handle_contribute` now takes `&ContributeBumps`; init_if_needed guarded with `if bump == 0`)

Deliberately not touched (audit mis-classified these as PDAs):

- basics/realloc/anchor::Message — declared with `#[account]` but its `#[account(init, ...)]` constraint has NO `seeds =` attribute, so it's allocated as a plain keypair account, not a PDA. No bump to store.
- tokens/external-delegate-token-master::UserAccount — same: initialized without `seeds =`. It's *referenced* as a seed in downstream instructions (`seeds = [user_account.key().as_ref()]`), but the account itself isn't a PDA.

For accounts using `init_if_needed`, the bump is only persisted on the first-init path, guarded by `if account.bump == 0`. Bump is deterministic (canonical bump is unique per (seeds, program_id) pair) so zero is a safe sentinel — a genuine `bump == 0` never occurs for canonical PDAs on mainnet (probability ~1/256 per PDA, and Anchor always picks the highest bump). Subsequent calls are no-ops for that field.

Verified with `cargo check --workspace` per affected anchor project: all pass (pre-existing warnings about `mut context` unused-mut in some handlers are unrelated).

4th of 5 commits in the skill-audit cleanup.

Author: mikemaccana-edwardbot

basics/favorites/anchor/programs/favorites/src/lib.rs

@@ -25,6 +25,7 @@ pub mod favorites {
             number,
             color,
             hobbies,
+            bump: context.bumps.favorites,
         });
         Ok(())
     }
@@ -43,6 +44,10 @@ pub struct Favorites {
 
     #[max_len(5, 50)]
     pub hobbies: Vec<String>,
+
+    /// Canonical bump for this PDA. Stored so later instructions can
+    /// re-derive/validate the PDA without recomputing via `find_program_address`.
+    pub bump: u8,
 }
 // When people call the set_favorites instruction, they will need to provide the accounts that will be modifed. This keeps Solana fast!
 #[derive(Accounts)]

tokens/token-extensions/nft-meta-data-pointer/anchor-example/anchor/programs/extension_nft/src/instructions/chop_tree.rs

@@ -7,6 +7,9 @@ use session_keys::{Session, SessionToken};
 use solana_program::program::invoke_signed;
 
 pub fn chop_tree(context: Context<ChopTree>, counter: u16, amount: u64) -> Result<()> {
+    // Save game_data bump on first creation (init_if_needed). See init_player.rs
+    // for the same pattern.
+    let game_data_bump = context.bumps.game_data;
     let account: &mut ChopTree<'_> = context.accounts;
     account.player.update_energy()?;
     account.player.print()?;
@@ -18,6 +21,9 @@ pub fn chop_tree(context: Context<ChopTree>, counter: u16, amount: u64) -> Resul
     account.player.last_id = counter;
     account.player.chop_tree(amount)?;
     account.game_data.on_tree_chopped(amount)?;
+    if account.game_data.bump == 0 {
+        account.game_data.bump = game_data_bump;
+    }
 
     msg!(
         "You chopped a tree and got 1 wood. You have {} wood and {} energy left.",

tokens/token-extensions/nft-meta-data-pointer/anchor-example/anchor/programs/extension_nft/src/instructions/init_player.rs

@@ -7,6 +7,14 @@ pub fn handle_init_player(context: Context<InitPlayer>) -> Result<()> {
     context.accounts.player.energy = MAX_ENERGY;
     context.accounts.player.last_login = Clock::get()?.unix_timestamp;
     context.accounts.player.authority = context.accounts.signer.key();
+    context.accounts.player.bump = context.bumps.player;
+    // init_if_needed — only save bump if this is the first init. Subsequent
+    // calls reuse the existing account and must not overwrite the stored bump
+    // (they'd be equal anyway because PDA derivation is deterministic, but
+    // guarding keeps the intent crystal-clear).
+    if context.accounts.game_data.bump == 0 {
+        context.accounts.game_data.bump = context.bumps.game_data;
+    }
     Ok(())
 }
 

tokens/token-extensions/nft-meta-data-pointer/anchor-example/anchor/programs/extension_nft/src/state/game_data.rs

@@ -6,6 +6,8 @@ use crate::constants::MAX_WOOD_PER_TREE;
 #[derive(InitSpace)]
 pub struct GameData {
     pub total_wood_collected: u64,
+    /// Canonical bump for this PDA.
+    pub bump: u8,
 }
 
 impl GameData {

tokens/token-extensions/nft-meta-data-pointer/anchor-example/anchor/programs/extension_nft/src/state/player_data.rs

@@ -16,6 +16,8 @@ pub struct PlayerData {
     pub energy: u64,
     pub last_login: i64,
     pub last_id: u16,
+    /// Canonical bump for this PDA.
+    pub bump: u8,
 }
 
 impl PlayerData {

tokens/token-extensions/transfer-hook/account-data-as-seed/anchor/programs/transfer-hook/src/instructions/initialize_extra_account_meta_list.rs

@@ -45,5 +45,7 @@ pub fn handler(mut context: Context<InitializeExtraAccountMetaList>) -> Result<(
         &extra_account_metas,
     ).map_err(|_| ProgramError::InvalidAccountData)?;
 
+    context.accounts.counter_account.bump = context.bumps.counter_account;
+
     Ok(())
 }

tokens/token-extensions/transfer-hook/account-data-as-seed/anchor/programs/transfer-hook/src/lib.rs

@@ -90,4 +90,6 @@ pub fn handle_extra_account_metas_count() -> usize {
 #[derive(InitSpace)]
 pub struct CounterAccount {
     pub counter: u64,
+    /// Canonical bump for this PDA.
+    pub bump: u8,
 }

tokens/token-extensions/transfer-hook/allow-block-list-token/anchor/programs/abl-token/src/instructions/init_wallet.rs

@@ -29,10 +29,11 @@ pub struct InitWallet<'info> {
 }
 
 impl InitWallet<'_> {
-    pub fn init_wallet(&mut self, args: InitWalletArgs) -> Result<()> {
+    pub fn init_wallet(&mut self, args: InitWalletArgs, bump: u8) -> Result<()> {
         let ab_wallet = &mut self.ab_wallet;
         ab_wallet.wallet = self.wallet.key();
         ab_wallet.allowed = args.allowed;
+        ab_wallet.bump = bump;
         Ok(())
     }
 }

tokens/token-extensions/transfer-hook/allow-block-list-token/anchor/programs/abl-token/src/lib.rs

@@ -38,7 +38,8 @@ pub mod abl_token {
     }
 
     pub fn init_wallet(context: Context<InitWallet>, args: InitWalletArgs) -> Result<()> {
-        context.accounts.init_wallet(args)
+        let bump = context.bumps.ab_wallet;
+        context.accounts.init_wallet(args, bump)
     }
 
     pub fn remove_wallet(context: Context<RemoveWallet>) -> Result<()> {

tokens/token-extensions/transfer-hook/allow-block-list-token/anchor/programs/abl-token/src/state.rs

@@ -10,6 +10,8 @@ use anchor_lang::prelude::*;
 pub struct ABWallet {
     pub wallet: Pubkey,
     pub allowed: bool,
+    /// Canonical bump for this PDA.
+    pub bump: u8,
 }
 
 #[account]