withdraw_spl_token: add mint in params and validate in the instruction processor

[brewmaster012]

Currently, in to withdraw SPL token from the gateway program,
the user must provide correct from and to addresses otherwise the transfer will fail.

protocol-contracts-solana/programs/protocol-contracts-solana/src/lib.rs

Lines 165 to 175 in 21cfcad

	let xfer_ctx = CpiContext::new_with_signer(
	token.to_account_info(),
	anchor_spl::token::Transfer {
	from: ctx.accounts.from.to_account_info(),
	to: ctx.accounts.to.to_account_info(),
	authority: pda.to_account_info(),
	},
	signer_seeds,
	);
	transfer(xfer_ctx, amount)?;
	msg!("withdraw spl token successfully");

Correct include the following conditions:

1. the from and to are both token accounts;
2. the from and to token accounts have the same mint account (they store the same SPL token)

Unlike Ethereum ERC20, SPL token cannot be transferred to arbitrary accounts/addresses.

[lumtis]

@brewmaster012 would it be possible to provide some more details and assess if it is in scope for zeta-chain/node#2401?

[brewmaster012]

Yeah I'm going to close this one.
After evaluation this issue does not add additional check while introducing significant complexity.