Merge pull request from GHSA-f5qf-2wp5-vjgr

* Adding Noah's patch to fix.

* Last patch.

hydra/program/src/processors/add_member/nft.rs

@@ -47,5 +47,7 @@ pub fn add_member_nft(ctx: Context<AddMemberWithNFT>, args: AddMemberArgs) -> Re
     membership_account.shares = args.shares;
     membership_account.bump_seed = *ctx.bumps.get("membership_account").unwrap();
     membership_account.fanout = fanout.key();
+    membership_account.stake_time = Clock::get()?.unix_timestamp;
+
     Ok(())
 }

hydra/program/src/processors/add_member/wallet.rs

@@ -45,5 +45,7 @@ pub fn add_member_wallet(ctx: Context<AddMemberWallet>, args: AddMemberArgs) ->
     membership_account.shares = args.shares;
     membership_account.bump_seed = *ctx.bumps.get("membership_account").unwrap();
     membership_account.fanout = fanout.key();
+    membership_account.stake_time = Clock::get()?.unix_timestamp;
+
     Ok(())
 }

hydra/program/src/processors/stake/set.rs

@@ -62,6 +62,7 @@ pub fn set_token_member_stake(ctx: Context<SetTokenMemberStake>, shares: u64) ->
         &membership_mint.key(),
         Some(HydraError::InvalidStakeAta.into()),
     )?;
+    membership_voucher.stake_time = Clock::get()?.unix_timestamp;
     membership_voucher.fanout = fanout.key();
     membership_voucher.membership_key = member.key();
     fanout.total_staked_shares = fanout

hydra/program/src/processors/stake/set_for.rs

@@ -64,6 +64,7 @@ pub fn set_for_token_member_stake(ctx: Context<SetForTokenMemberStake>, shares:
         &membership_mint.key(),
         Some(HydraError::InvalidStakeAta.into()),
     )?;
+    membership_voucher.stake_time = Clock::get()?.unix_timestamp;
     membership_voucher.fanout = fanout.key();
     membership_voucher.membership_key = member.key();
     fanout.total_staked_shares = fanout

hydra/program/src/state.rs

@@ -47,7 +47,7 @@ pub struct FanoutMint {
                                    // +50 padding
 }
 
-pub const FANOUT_MEMBERSHIP_VOUCHER_SIZE: usize = 32 + 8 + 8 + 1 + 32 + 8 + 64;
+pub const FANOUT_MEMBERSHIP_VOUCHER_SIZE: usize = 32 + 8 + 8 + 1 + 32 + 8 + 8 + 56;
 #[account]
 #[derive(Default, Debug)]
 pub struct FanoutMembershipVoucher {
@@ -57,14 +57,16 @@ pub struct FanoutMembershipVoucher {
     pub bump_seed: u8,
     pub membership_key: Pubkey,
     pub shares: u64,
+    pub stake_time: i64,
 }
 
-pub const FANOUT_MINT_MEMBERSHIP_VOUCHER_SIZE: usize = 32 + 32 + 8 + 1 + 32;
+pub const FANOUT_MINT_MEMBERSHIP_VOUCHER_SIZE: usize = 32 + 32 + 8 + 1 + 8 + 24;
 #[account]
 #[derive(Default)]
 pub struct FanoutMembershipMintVoucher {
     pub fanout: Pubkey,
     pub fanout_mint: Pubkey,
     pub last_inflow: u64,
     pub bump_seed: u8,
+    pub stake_time: i64,
 }

hydra/program/src/utils/logic/distribution.rs

@@ -67,6 +67,10 @@ pub fn distribute_mint<'info>(
     membership_key: &Pubkey,
 ) -> Result<()> {
     msg!("Distribute For Mint");
+    if membership_voucher.stake_time == 0 {
+        membership_voucher.stake_time = Clock::get()?.unix_timestamp;
+    }
+
     let mint = &fanout_mint;
     let fanout_for_mint_membership_voucher_unchecked = fanout_for_mint_membership_voucher;
     let fanout_mint_member_token_account_info = fanout_mint_member_token_account.to_account_info();
@@ -98,6 +102,8 @@ pub fn distribute_mint<'info>(
         &fanout_for_mint.key(),
         &mint.key(),
         &fanout.key(),
+        membership_voucher.stake_time,
+        fanout_for_mint_object.total_inflow,
     )?;
     let holding_account_ata = parse_token_account(holding_account, &fanout.key())?;
     parse_token_account(&fanout_mint_member_token_account_info, &member.key())?;

hydra/program/src/utils/mod.rs

@@ -99,6 +99,8 @@ pub fn parse_mint_membership_voucher<'info>(
     fanout_for_mint: &Pubkey,
     fanout_mint: &Pubkey,
     fanout: &Pubkey,
+    stake_time: i64,
+    total_inflow: u64,
 ) -> Result<FanoutMembershipMintVoucher> {
     let account_info = fanout_for_mint_membership_voucher.to_account_info();
     let mint_membership_voucher_bump = assert_derivation(
@@ -134,18 +136,25 @@ pub fn parse_mint_membership_voucher<'info>(
         FanoutMembershipMintVoucher {
             fanout: *fanout,
             fanout_mint: *fanout_mint,
-            last_inflow: 0,
+            last_inflow: total_inflow,
             bump_seed: mint_membership_voucher_bump,
+            stake_time: stake_time
         }
     } else {
         let mut membership_data: &[u8] =
             &fanout_for_mint_membership_voucher.try_borrow_mut_data()?;
         assert_owned_by(fanout_for_mint_membership_voucher, &crate::ID)?;
-        let membership = FanoutMembershipMintVoucher::try_deserialize(&mut membership_data)?;
+        let mut membership = FanoutMembershipMintVoucher::try_deserialize(&mut membership_data)?;
         if membership.bump_seed != mint_membership_voucher_bump {
             msg!("Mint Membership Bump Doesnt match");
             return Err(HydraError::InvalidMembershipVoucher.into());
         }
+        // If this account was staked before at a different time, clear it out.
+        if stake_time != membership.stake_time {
+          membership.last_inflow = total_inflow;
+          membership.stake_time = stake_time;
+        } 
+
         membership
     })
 }