[s2imonovic]

Create an instruction for the refund after withdrawals are disabled.

---

Note

High Risk
Authority can move arbitrary SPL amounts from custody to any recipient ATA without TSS or nonce; compromise or misuse of the PDA authority is a direct custody risk.

Overview
Adds refund_spl_token, an authority-only path to return SPL from the gateway PDA ATA to a user when normal TSS withdrawals are unavailable (e.g. withdrawals disabled).

The handler checks PDA authority, positive amount, custody balance, and PDA/recipient ATA–mint alignment; it can create the recipient ATA if missing (same pattern as SPL withdraw), then transfer_checked from custody with the PDA as signer. It does not use TSS signatures or nonce, and is not blocked by deposit pause. New errors: InsufficientBalance, InvalidAmount.

Gateway tests cover happy path, non-authority rejection, insufficient balance, ATA creation, and refunds while deposits are paused.

^{Reviewed by Cursor Bugbot for commit 26925b2. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 26925b2. Configure here.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 83 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
programs/gateway/src/instructions/refund.rs	0.00%	79 Missing ⚠️
programs/gateway/src/lib.rs	0.00%	3 Missing ⚠️
programs/gateway/src/contexts.rs	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[skosito]

Solid, mirrors the withdraw SPL flow closely and has good test coverage. A couple of design points to confirm (trust model, no rent reimbursement) plus minor nits. LGTM once the trust-model intent is confirmed.

Note: the Cursor Bugbot "ATA create invoke order wrong" comment looks like a false positive. Solana matches invoke accounts by pubkey, not slice position, the identical ordering is used in the working withdraw::handle_spl, and the new "creates recipient ATA if needed" test exercises this exact path.

[morde08]

A couple of test-coverage gaps on the new refund path — both low priority, neither blocking.