OKX Marketplace of Solana

The `make_order` instruction allows the maker to create an order in base to the **mint** of an expected NFT. However, the mint is missing validation to verify that it is the type of NFT that the program should accept. This is inconsistent with the validation made during the `take_order` instruction where the Metadata has some validations. This could lead to Orders that are impossible to take because during the `make_order` instruction they don't throw and error but during the `take_order` they do. Makers would not be informed about these problems in live time so they will not realize that their orders have problems.

The account `protocol_fee_recipient` has a rent-exempt validation when the protocol configuration is set up using the instruction `init_protocol_config`. However, the instruction `update_protocol_fee_recipient` that allows to update this account doesn't have the same validation, if a no rent-exempt account is passed it will not throw any error.

The `metadata_account` is a PDA storing the metadata of an NFT. It is only used during the `take_order` instruction to get the `seller_fee_basis_points` (total royalty fee) and the `creators` (creators' address and share in percentage of the total royalty fee). This account is a PDA obtained using the `mpl_metadata_program` (Metaplex's metadata program) and the NFT's mint (`spl_token` mint). However, this account could be missing some validations, for example: - The address of the official `mpl_metadata_program` is used to generate the PDA's address and to validate it with the passed address. However, the PDA could be owned by an unknown program replicating the `mpl_metadata_program` program. - [The `key` field](https://docs.rs/mpl-token-metadata/1.2.5/mpl_token_metadata/state/enum.Key.html) could be unexpected between the following options: - Uninitialized, - EditionV1, - MasterEditionV1, - ReservationListV1, - MetadataV1, - ReservationListV2, - MasterEditionV2, - EditionMarker, - UseAuthorityRecord, - CollectionAuthorityRecord - [The `token_standard` field](https://docs.rs/mpl-token-metadata/1.2.5/mpl_token_metadata/state/enum.TokenStandard.html) could be unexpected between the following options: - NonFungible - FungibleAsset - Fungible - NonFungibleEdition

The order account uses the field `token_program` to store the official token program account's address. This operation is made on the instruction `make_order` where the address is compared to the official address given by the library `spl_token`. However, this field is never used by this instruction or other instruction. This means that the order account is storing `32` unused bytes that could be removed to reduce the rent costs. This can be translated to an extra of 0.0011136 SOL by order or 1 SOL every 898 orders.