# Incompatible token-account unpacking and strict size checks break SPL-Token-2022 balance queries

Solaxy RPC used legacy spl_token unpacker on SPL-Token-2022 accounts with extensions, breaking balance queries and ATA discovery for extended accounts.

- Payout: Contest reward
- Severity: high
- Program: Solaxy
- Credited: Rhaydden
- Disclosed: 2025-09-01
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_solaxy.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Asolaxy%3A3.1.2
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:high tech:solana technique:incomplete-fix technique:source-review vuln:dos vuln:misconfiguration

**Target:** SVM rollup RPC get_token_account_balance and is_mint_account
**Root cause:** TokenAccount::unpack from legacy spl_token assumes fixed 165-byte layout and errors on Token-2022 accounts with TLV extensions; is_mint_account requires exact Mint::LEN equality, rejecting extended mints.
**Steps:**
1. Create a Token-2022 mint with ExtensionType::TransferFeeConfig via try_calculate_account_len::<Mint>(&extensions).
2. Create an ATA for that mint with spl_token_2022::id(); account size becomes 165 + X bytes.
3. Call get_token_account_balance on the extended token account; RPC calls TokenAccount::unpack(data) directly.
4. Observe InvalidAccountData / 'could not decode account data' error.
5. Call is_mint_account on the extended mint; data.len() == Mint::LEN fails, causing false negatives in get_ata_for_single_mint and get_atas_for_spl_program.
**How found:** Noticed test harness trims data to TokenAccount::LEN before unpack, masking the length mismatch, while production RPC path unpacks full data; traced to spl_token vs spl_token_2022 layout difference.
**Insight:** When a test harness slices/trims input before parsing, compare against the production path — the trim often hides a real length/layout mismatch that surfaces only with extension-bearing accounts.