Fix: Fee recipient validation, rotation bypass, PostOnly cross-check mutation, free funds accounting, fee cap

[yossweh]

Summary

Fixes 1 HIGH and 3 MEDIUM severity vulnerabilities found during security audit of Phoenix V1 on-chain order book.

Vulnerabilities Fixed

HIGH-01: Fee Recipient Rotation Bypass (fees.rs)

Impact: Authority could change fee recipient without previous recipient signing if fees already collected, enabling fee diversion.
Fix: Force collect uncollected fees atomically before changing recipient.

MEDIUM-01: PostOnly Cross-Check Mutates State (fifo.rs)

Impact: check_for_cross() auto-cancelled expired orders on opposite book during cross-check, emitting events and modifying state during read-only validation.
Fix: Split into read-only check_for_cross() + explicit cleanup_expired_orders() instruction.

MEDIUM-02: Free Funds Mode - Unlock Without Withdrawal (reduce_order.rs, fifo.rs)

Impact: withdraw_funds=false unlocked trader funds to "free" balance but didn't withdraw, leaving funds stuck in market vault.
Fix: Ensure claim_funds=true whenever locked funds are unlocked.

MEDIUM-03: 100% Taker Fee Allowed (initialize.rs)

Impact: Market creator could set taker_fee_bps=10000 (100%), draining all trade value to fees.
Fix: Add reasonable cap at 1000 bps (10%) with governance override path.

Files Changed

• program/processor/fees.rs - Force collect fees before recipient change
• state/markets/fifo.rs - Read-only cross-check + explicit expired cleanup
• program/processor/reduce_order.rs - Require claim_funds when unlocking
• program/processor/initialize.rs - Cap taker fee at 1000 bps

Testing

• All existing tests pass
• Code compiles with Rust 1.80+

Bug Bounty

Submitted per Phoenix Legacy Bug Bounty Program (up to $200K Critical / $25K High / $10K Medium / $5K Low).