Fix AccountData docs and add SPL token program validation

- Fix account-comparison/CLAUDE.md: Replace incorrect fixed byte offsets
  with Size column since String is variable-length in Borsh serialization
- Add SPL Token program ID validation in compressed-claim processor
  before CPI to prevent invalid program substitution

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: tilo-14

account-comparison/CLAUDE.md

@@ -23,16 +23,16 @@ programs/account-comparison/tests/
 
 ### AccountData (Solana PDA)
 
-| Field | Type | Offset |
-|-------|------|--------|
-| discriminator | `[u8; 8]` | 0..8 |
-| user | `Pubkey` | 8..40 |
-| name | `String` | 40..168 |
-| data | `[u8; 128]` | 168..232 |
+| Field | Type | Size |
+|-------|------|------|
+| discriminator | `[u8; 8]` | 8 bytes |
+| user | `Pubkey` | 32 bytes |
+| name | `String` | 4 + name_len (max 60 chars) |
+| data | `[u8; 128]` | 128 bytes |
 
 - **Seeds**: `["account", user.key()]`
 - **Discriminator**: 8 bytes, SHA256("account:AccountData")[0..8]
-- **Space**: 232 bytes
+- **Space**: 232 bytes. String uses Borsh serialization (4-byte length prefix + variable content).
 
 ### CompressedAccountData (LightAccount)
 

airdrop-implementations/compressed-claim/program/Cargo.toml

@@ -21,13 +21,13 @@ light-ctoken-sdk = { version = "0.2", features = ["v1"] }
 thiserror = "2.0.11"
 borsh = "0.10.0"
 light-sdk = { version = "0.17" }
+spl-token = { version = "5.0.0", features = ["no-entrypoint"] }
 
 [dev-dependencies]
 solana-sdk = "2.3"
 light-program-test = { version = "0.17", features = ["v2"] }
 light-client = { version = "0.17", features = ["v2"] }
 tokio = "1.4"
-spl-token = { version = "5.0.0", features = ["no-entrypoint"] }
 
 [lib]
 crate-type = ["cdylib", "lib"]

airdrop-implementations/compressed-claim/program/src/processor.rs

@@ -71,6 +71,12 @@ fn process_claim(accounts: &[AccountInfo], ix_data: ClaimIxData) -> ProgramResul
         ctoken_program_info.key.log();
         return Err(ProgramError::InvalidArgument);
     }
+    // CHECK:
+    if token_program_info.key != &spl_token::ID {
+        msg!("Invalid SPL token program.");
+        token_program_info.key.log();
+        return Err(ProgramError::InvalidArgument);
+    }
     let compressed_token_account = CTokenAccount::new(
         mint,
         associated_airdrop_pda_info.key.clone(),