Bug: Withdrawal transfers USDC from vault to itself (source = destination)

[DILOmcfly]

Bug Report

Summary

A withdrawal transaction debited my Drift user account but transferred the USDC from the Drift vault to itself (source = destination), resulting in permanent loss of funds for the user.

Transaction Evidence

• TX: 2M5SkN3niSc9aecXvEPU4izbKhg923qAQZJtM9BcNbRcZJewSaTwkxZQwohKCjRaM7dRvYcMMK8guD4NSbKfLVeT
• Date: February 5, 2026, 18:04:35 UTC
• Amount: 64.998235 USDC
• User Wallet: DoUWiEkyk9WpzZDamtvv4UbuWmEoNuVUYJN3a7xnq1wu
• User Account PDA: CzS42Ph5tK1B7r8u58Szvc52SCHcSB4gt4Fx9KFiLwCR

The Problem

The inner Token Transfer instruction in the withdrawal TX shows:

Source:      GXWqPpjQpdz7KZw9p7f5PX2eGxHAhvpNXiviFkAB8zXg (Drift USDC Spot Vault)
Destination: GXWqPpjQpdz7KZw9p7f5PX2eGxHAhvpNXiviFkAB8zXg (Drift USDC Spot Vault)
Amount:      64998235

Both source and destination are the same address — the Drift USDC Spot Market Vault (JCNCMFXo5M5qwUPg2Utu1u6YWp3MbygxqBsBeXXJfrw authority).

Impact

1. My Drift account was debited by 64.998235 USDC ✅
2. The USDC was "transferred" from vault → vault (net change: 0 in vault balance) ✅
3. USDC never arrived in my personal wallet ❌
4. Account now shows ~$0 balance

Token Balance Changes (from TX)

Owner: JCNCMFXo5M5qwUPg2Utu1u6YWp3MbygxqBsBeXXJfrw (Vault)
Change: 62,924,993.306074 → 62,924,993.306074 (+0.000000 USDC)

The vault balance didn't change at all — the USDC is still there.

Context

• Used @drift-labs/sdk to execute the withdrawal
• The withdrawal instruction was constructed with the vault's token account as both source AND destination
• This appears to be a bug in how the SDK constructs the withdrawal instruction when the user's USDC ATA doesn't exist or isn't passed correctly

Request

The USDC is still in the vault. Could you please:

1. Investigate how this happened
2. Re-credit 64.998235 USDC to my Drift account (CzS42Ph5tK1B7r8u58Szvc52SCHcSB4gt4Fx9KFiLwCR)
3. Fix the underlying bug to prevent this for other users

Environment

• SDK version: @drift-labs/sdk (latest at time of TX, Feb 2026)
• Network: Solana Mainnet
• RPC: Helius

Thank you for looking into this.