test: assert the mint rejection with rejectedWith, not a bare try/catch

Per review: a try/catch that flags any error is too vague. Follow the
token-2022/transfer-hook pattern — assert the call rejects with the
specific AnchorError (ConstraintHasOne) via chai-as-promised.

Author: moviendome

tokens/token-fundraiser/anchor/package.json

@@ -12,10 +12,12 @@
   "devDependencies": {
     "@types/bn.js": "^5.1.0",
     "@types/chai": "^5.2.3",
+    "@types/chai-as-promised": "^8.0.2",
     "@types/mocha": "^10.0.10",
     "@types/node": "^26.1.0",
     "anchor-litesvm": "^0.2.1",
     "chai": "^6.2.2",
+    "chai-as-promised": "^8.0.2",
     "litesvm": "^0.8.0",
     "mocha": "^11.7.5",
     "prettier": "^2.6.2",

tokens/token-fundraiser/anchor/pnpm-lock.yaml

@@ -10,25 +10,16 @@ import {
 } from '@solana/spl-token';
 import { PublicKey } from '@solana/web3.js';
 import { LiteSVMProvider } from 'anchor-litesvm';
-import { assert } from 'chai';
+import { assert, expect, use } from 'chai';
+import chaiAsPromised from 'chai-as-promised';
 import { LiteSVM } from 'litesvm';
 import IDL from '../target/idl/fundraiser.json';
 import type { Fundraiser } from '../target/types/fundraiser';
 
+use(chaiAsPromised);
+
 const PROGRAM_ID = new PublicKey(IDL.address);
 
-// Regression test for the missing mint binding on `checker.rs`.
-//
-// `contribute` and `refund` both carry `has_one = mint_to_raise` on the
-// `fundraiser` account, so the mint supplied in the transaction must equal the
-// one recorded at `initialize`. `check_contributions` omits that constraint, so
-// its `mint_to_raise` (and the vault derived from it) is whatever the caller
-// passes. A maker can therefore satisfy the goal check against a throwaway mint
-// they control and trigger `close = maker`, destroying the real campaign that
-// every contributor's refund depends on.
-//
-// With the constraint present, Anchor rejects the wrong mint before the handler
-// runs and the campaign account survives.
 describe('fundraiser checker mint binding', () => {
     const client = new LiteSVM();
     client.addProgramFromFile(PROGRAM_ID, 'target/deploy/fundraiser.so');
@@ -49,13 +40,11 @@ describe('fundraiser checker mint binding', () => {
     let realMint: PublicKey;
     let fakeMint: PublicKey;
 
-    it('sets up a real campaign and a maker-controlled fake mint', async () => {
+    it('sets up a real campaign mint and a maker-controlled fake mint', async () => {
         client.airdrop(maker.publicKey, BigInt(anchor.web3.LAMPORTS_PER_SOL));
 
-        // The real campaign mint, authority held by the provider wallet.
         const realMintKp = anchor.web3.Keypair.generate();
         realMint = realMintKp.publicKey;
-        // The fake mint, authority held by the maker — the whole point of the attack.
         const fakeMintKp = anchor.web3.Keypair.generate();
         fakeMint = fakeMintKp.publicKey;
 
@@ -98,14 +87,11 @@ describe('fundraiser checker mint binding', () => {
             .signers([maker])
             .rpc();
 
-        // The campaign state exists and remembers the real mint.
         const state = await program.account.fundraiser.fetch(fundraiser);
         assert.strictEqual(state.mintToRaise.toBase58(), realMint.toBase58());
     });
 
     it('rejects check_contributions against a mint other than the one recorded', async () => {
-        // The maker funds the fundraiser's ATA *for the fake mint* to the goal.
-        // Anyone may create an ATA on the PDA's behalf.
         const fakeVault = getAssociatedTokenAddressSync(fakeMint, fundraiser, true);
         const makerFakeAta = getAssociatedTokenAddressSync(fakeMint, maker.publicKey);
 
@@ -116,29 +102,21 @@ describe('fundraiser checker mint binding', () => {
         );
         await provider.sendAndConfirm(fundTx, [maker]);
 
-        // Call the payout instruction with the fake mint and its funded vault.
-        let rejected = false;
-        try {
-            await program.methods
-                .checkContributions()
-                .accountsPartial({
-                    maker: maker.publicKey,
-                    mintToRaise: fakeMint,
-                    fundraiser,
-                    makerAta: makerFakeAta,
-                    vault: fakeVault,
-                    tokenProgram: TOKEN_PROGRAM_ID,
-                })
-                .signers([maker])
-                .rpc();
-        } catch (_err) {
-            rejected = true;
-        }
-
-        assert.isTrue(rejected, 'check_contributions accepted a mint other than the one recorded at initialize');
-
-        // The real campaign must still be alive — a wrong-mint call must not
-        // reach `close = maker`.
+        const checkPromise = program.methods
+            .checkContributions()
+            .accountsPartial({
+                maker: maker.publicKey,
+                mintToRaise: fakeMint,
+                fundraiser,
+                makerAta: makerFakeAta,
+                vault: fakeVault,
+                tokenProgram: TOKEN_PROGRAM_ID,
+            })
+            .signers([maker])
+            .rpc();
+
+        await expect(checkPromise).to.eventually.be.rejectedWith(anchor.AnchorError, 'ConstraintHasOne');
+
         const state = await program.account.fundraiser.fetch(fundraiser);
         assert.strictEqual(state.mintToRaise.toBase58(), realMint.toBase58());
     });