Anchor: How to validate Token Program in Account structs?

Question

In my account struct:

#[derive(Accounts)]
pub struct WithdrawToken<'info> {
  #[account(mut, token::mint = mint, token::authority = signer, 
     token::token_program = token_program)]
  pub to_ata: InterfaceAccount<'info, TokenAccount>,
  pub signer: Signer<'info>,
  pub token_program: Interface<'info, TokenInterface>,
}

How can I validate the token_program via #[account(constraint = settings.token_program == token_program)]?

Do I need to validate token_program against attacks?

From Anchor library, token_program can be either TOKEN_PROGRAM_ID, or TOKEN_2022_PROGRAM_ID public key. but attackers may try to use a fake token_program...

How can I save token_program into my Settings account?

#[account]
#[derive(InitSpace)]
pub struct Settings {
  pub token_program: Interface<'_, TokenInterface>,
}

the above gives me error: the trait bound anchor_lang::prelude::Interface<'_, TokenInterface>: anchor_lang::Space is not satisfied

Answer 1

if your token_program can be 2 different programs, i'mnot sure you can check it with constaints. But you can check it the function :

if ctx.accounts.token_program.to_account_info().key().to_string() != "Token..." && ctx.accounts.token_program.to_account_info().key().to_string() != "..." {
    return err!(ErrorCode::PublicKeyMismatch);
}