feat: close position account on claim to return rent

programs/vitalfi-vault/src/instructions.rs

@@ -513,7 +513,8 @@ pub struct Claim<'info> {
         seeds = [b"position", vault.key().as_ref(), user.key().as_ref()],
         bump = position.bump,
         has_one = vault,
-        constraint = position.owner == user.key()
+        constraint = position.owner == user.key(),
+        close = user
     )]
     pub position: Account<'info, Position>,
 
@@ -527,23 +528,30 @@ pub struct Claim<'info> {
     #[account(mut)]
     pub user: Signer<'info>,
 
+    pub system_program: Program<'info, System>,
     pub token_program: Program<'info, Token>,
 }
 
 /// Claims refund (if Canceled) or payout (if Matured).
 ///
 /// Canceled: Returns full deposited amount.
 /// Matured: Returns floor(deposited * payout_num / payout_den).
+///
+/// Position account is closed after claim, returning rent to user.
 pub fn claim(ctx: Context<Claim>) -> Result<()> {
     let vault = &mut ctx.accounts.vault;
-    let position = &mut ctx.accounts.position;
+    let position = &ctx.accounts.position;
+
+    require!(
+        vault.status == VaultStatus::Canceled || vault.status == VaultStatus::Matured,
+        VaultError::InvalidStatus
+    );
 
-    let entitled = if vault.status == VaultStatus::Canceled {
-        // Refund full deposit
+    require!(position.deposited > 0, VaultError::NothingToClaim);
+
+    let to_pay = if vault.status == VaultStatus::Canceled {
         position.deposited
     } else {
-        // Calculate payout based on payout factor
-        // entitled = floor(deposited * payout_num / payout_den)
         require!(vault.payout_den > 0, VaultError::ZeroTotalDeposited);
 
         let payout_u128 = ((position.deposited as u128)
@@ -552,7 +560,6 @@ pub fn claim(ctx: Context<Claim>) -> Result<()> {
             .checked_div(vault.payout_den)
             .ok_or(VaultError::ArithmeticOverflow)?;
 
-        // Validate result fits in u64 to prevent silent truncation
         require!(
             payout_u128 <= u64::MAX as u128,
             VaultError::ArithmeticOverflow
@@ -561,24 +568,13 @@ pub fn claim(ctx: Context<Claim>) -> Result<()> {
         payout_u128 as u64
     };
 
-    let to_pay = entitled
-        .checked_sub(position.claimed)
-        .ok_or(VaultError::NothingToClaim)?;
-
     require!(to_pay > 0, VaultError::NothingToClaim);
 
-    // Prevents reentrancy
-    position.claimed = position
-        .claimed
-        .checked_add(to_pay)
-        .ok_or(VaultError::ArithmeticOverflow)?;
-
     vault.total_claimed = vault
         .total_claimed
         .checked_add(to_pay)
         .ok_or(VaultError::ArithmeticOverflow)?;
 
-    // Perform transfer after state update
     let vault_key = vault.key();
     let vault_id_bytes = vault.vault_id.to_le_bytes();
     let authority_key = vault.authority.key();

tests/authority.spec.ts

@@ -319,6 +319,7 @@ describe("Authority Permission Tests", () => {
           position: positionPda,
           userTokenAccount: user1TokenAccount,
           user: user1.publicKey,
+          systemProgram: SystemProgram.programId,
           tokenProgram: TOKEN_PROGRAM_ID,
         })
         .signers([user1])

tests/happy-path.spec.ts

@@ -178,6 +178,7 @@ describe("Vault Close Happy Path", () => {
         position: positionPda,
         userTokenAccount: user1TokenAccount,
         user: user1.publicKey,
+        systemProgram: SystemProgram.programId,
         tokenProgram: TOKEN_PROGRAM_ID,
       })
       .signers([user1])
@@ -301,6 +302,7 @@ describe("Vault Close Happy Path", () => {
         position: positionPda,
         userTokenAccount: user1TokenAccount,
         user: user1.publicKey,
+        systemProgram: SystemProgram.programId,
         tokenProgram: TOKEN_PROGRAM_ID,
       })
       .signers([user1])

tests/lifecycle.spec.ts

@@ -296,6 +296,7 @@ describe("Vault Lifecycle", () => {
           position: user1PositionPda,
           userTokenAccount: user1TokenAccount,
           user: user1.publicKey,
+          systemProgram: SystemProgram.programId,
           tokenProgram: TOKEN_PROGRAM_ID,
         })
         .signers([user1])
@@ -321,6 +322,7 @@ describe("Vault Lifecycle", () => {
           position: user2PositionPda,
           userTokenAccount: user2TokenAccount,
           user: user2.publicKey,
+          systemProgram: SystemProgram.programId,
           tokenProgram: TOKEN_PROGRAM_ID,
         })
         .signers([user2])
@@ -424,6 +426,7 @@ describe("Vault Lifecycle", () => {
           position: user1PositionPda,
           userTokenAccount: user1TokenAccount,
           user: user1.publicKey,
+          systemProgram: SystemProgram.programId,
           tokenProgram: TOKEN_PROGRAM_ID,
         })
         .signers([user1])

tests/security.spec.ts

@@ -288,6 +288,7 @@ describe("Security Tests", () => {
           position: testPosition,
           userTokenAccount: user1TokenAccount,
           user: user1.publicKey,
+          systemProgram: SystemProgram.programId,
           tokenProgram: TOKEN_PROGRAM_ID,
         })
         .signers([user1])
@@ -336,8 +337,8 @@ describe("Security Tests", () => {
     });
   });
 
-  describe("Partial Claim Security", () => {
-    it("Prevents double claiming through state checks", async () => {
+  describe("Position Closure Security", () => {
+    it("Prevents double claiming by closing position account", async () => {
       const testVaultId = new BN(403);
       const testVaultPda = pda.vault(authority.publicKey, testVaultId);
       const testVaultToken = pda.vaultToken(testVaultPda);
@@ -416,6 +417,7 @@ describe("Security Tests", () => {
           position: testPosition,
           userTokenAccount: user1TokenAccount,
           user: user1.publicKey,
+          systemProgram: SystemProgram.programId,
           tokenProgram: TOKEN_PROGRAM_ID,
         })
         .signers([user1])
@@ -429,7 +431,15 @@ describe("Security Tests", () => {
       // User deposited 700, gets 770
       assert.strictEqual(received.toString(), toU(770).toString());
 
-      // Try to claim again (should fail)
+      // Verify position account is closed
+      try {
+        await program.account.position.fetch(testPosition);
+        assert.fail("Position should be closed after claim");
+      } catch (err: any) {
+        expectErrorContains(err, "Account does not exist");
+      }
+
+      // Try to claim again (should fail because position doesn't exist)
       try {
         await program.methods
           .claim()
@@ -439,13 +449,19 @@ describe("Security Tests", () => {
             position: testPosition,
             userTokenAccount: user1TokenAccount,
             user: user1.publicKey,
+            systemProgram: SystemProgram.programId,
             tokenProgram: TOKEN_PROGRAM_ID,
           })
           .signers([user1])
           .rpc();
-        assert.fail("Should have failed - nothing more to claim");
+        assert.fail("Should have failed - position account closed");
       } catch (err: any) {
-        expectErrorContains(err, "NothingToClaim");
+        const errorStr = err.message || err.toString();
+        assert.isTrue(
+          errorStr.includes("Account does not exist") ||
+            errorStr.includes("AccountNotInitialized"),
+          `Expected account not found error, got: ${errorStr}`
+        );
       }
     });
   });

tests/validation.spec.ts

@@ -801,6 +801,7 @@ describe("Validation & Error Coverage", () => {
             position: position2,
             userTokenAccount: user2TokenAccount,
             user: user2.publicKey,
+            systemProgram: SystemProgram.programId,
             tokenProgram: TOKEN_PROGRAM_ID,
           })
           .signers([user2])