Account expansion: Transfer more lamports only if needed (#694)

Result of audit feedback

(cherry picked from commit 020a978270)

CHANGELOG.md

@@ -49,6 +49,7 @@ Update this for each program release and mainnet deployment.
 - Stop loss: Avoid expensive health cache for expired orders (#682)
 - Account creation: Add account_create_v2 instruction (#680, #685)
 - Account resizing: Lower maximums due to tx account limit (#686, #688, #689)
+- Account resizing: Fix denial of service if account has too many lamports (#694)
 - Token register: Revamp API for simpler use from governance (#665)
 - Token register untrusted: Adjust default oracle staleness (#678)
 - Fix typo in name of admin_token_withdraw_fees instruction (#655)

programs/mango-v4/src/instructions/account_expand.rs

@@ -26,17 +26,19 @@ pub fn account_expand(
 
     require_gt!(new_space, old_space);
 
-    // transfer required additional rent
-    anchor_lang::system_program::transfer(
-        anchor_lang::context::CpiContext::new(
-            ctx.accounts.system_program.to_account_info(),
-            anchor_lang::system_program::Transfer {
-                from: ctx.accounts.payer.to_account_info(),
-                to: realloc_account.clone(),
-            },
-        ),
-        new_rent_minimum - old_lamports,
-    )?;
+    if old_lamports < new_rent_minimum {
+        // transfer required additional rent
+        anchor_lang::system_program::transfer(
+            anchor_lang::context::CpiContext::new(
+                ctx.accounts.system_program.to_account_info(),
+                anchor_lang::system_program::Transfer {
+                    from: ctx.accounts.payer.to_account_info(),
+                    to: realloc_account.clone(),
+                },
+            ),
+            new_rent_minimum - old_lamports,
+        )?;
+    }
 
     // realloc: it's safe to not re-zero-init since we never shrink accounts
     realloc_account.realloc(new_space, false)?;