Many serious Solana bugs are not math bugs. They are authorization bugs.
Implement is_authority.
Return true only when the provided authority matches exactly.
A CPMM usually has privileged actions like:
Those should never run for the wrong signer.