lang: forbid pubkey mint on token init (#1804)

lang/syn/src/parser/accounts/mod.rs

@@ -120,6 +120,24 @@ fn constraints_cross_checks(fields: &[AccountField]) -> ParseResult<()> {
                     ));
                 }
             }
+            match kind {
+                // This doesn't catch cases like account.key() or account.key.
+                // My guess is that doesn't happen often and we can revisit
+                // this if I'm wrong.
+                InitKind::Token { mint, .. } | InitKind::AssociatedToken { mint, .. } => {
+                    if !fields.iter().any(|f| {
+                        f.ident()
+                            .to_string()
+                            .starts_with(&mint.to_token_stream().to_string())
+                    }) {
+                        return Err(ParseError::new(
+                            field.ident.span(),
+                            "the mint constraint has to be an account field for token initializations (not a public key)",
+                        ));
+                    }
+                }
+                _ => (),
+            }
         }
     }
     Ok(())