mpp-rb 0.1.5 → 0.1.7

data/lib/mpp/methods/tempo/defaults.rb

@@ -10,6 +10,8 @@ module Mpp
         RPC_URL = "https://rpc.tempo.xyz"
         PATH_USD = "0x20c0000000000000000000000000000000000000"
         USDC = "0x20C000000000000000000000b9537d11c60E8b50"
+        # Same address on mainnet and Moderato.
+        OUSD = "0x20c0000000000000000000006a37DA5C996874BE"
         PATH_USD_DECIMALS = 6
 
         # Testnet (Moderato)
@@ -25,6 +27,14 @@ module Mpp
           TESTNET_CHAIN_ID => PATH_USD
         }.freeze, T::Hash[T.untyped, T.untyped])
 
+        # Chain ID -> ordered currencies a server accepts by default
+        DEFAULT_ACCEPTED_CURRENCIES = T.let({
+          CHAIN_ID => [OUSD, USDC].freeze,
+          TESTNET_CHAIN_ID => [OUSD, PATH_USD].freeze
+        }.freeze, T::Hash[Integer, T::Array[String]])
+
+        ADDRESS_PATTERN = T.let(/\A0x[0-9a-fA-F]{40}\z/, Regexp)
+
         # Chain ID -> default RPC URL mapping
         CHAIN_RPC_URLS = T.let({
           CHAIN_ID => RPC_URL,
@@ -57,6 +67,47 @@ module Mpp
           DEFAULT_CURRENCIES.fetch(chain_id, PATH_USD)
         end
 
+        # Ordered currencies a server offers when none are configured. Unknown
+        # chains keep the single default from default_currency_for_chain.
+        sig { params(chain_id: T.nilable(Integer)).returns(T::Array[String]) }
+        def default_currencies_for_chain(chain_id)
+          defaults = chain_id && DEFAULT_ACCEPTED_CURRENCIES[chain_id]
+          defaults || [default_currency_for_chain(chain_id)]
+        end
+
+        # Resolve the ordered currencies a server method accepts. An explicit
+        # currencies list replaces the chain defaults, and the legacy singular
+        # currency restricts acceptance to exactly that token.
+        sig do
+          params(
+            chain_id: T.nilable(Integer),
+            currency: T.nilable(String),
+            currencies: T.nilable(T::Array[String])
+          ).returns(T::Array[String])
+        end
+        def accepted_currencies(chain_id: nil, currency: nil, currencies: nil)
+          unless currency.nil? || currencies.nil?
+            Kernel.raise ArgumentError, "pass currency: or currencies:, not both"
+          end
+          return [currency] unless currency.nil?
+          return default_currencies_for_chain(chain_id) if currencies.nil?
+
+          Kernel.raise ArgumentError, "currencies must not be empty" if currencies.empty?
+          currencies.each do |address|
+            unless ADDRESS_PATTERN.match?(address.to_s)
+              Kernel.raise ArgumentError, "Invalid Tempo currency address: #{address.inspect}"
+            end
+          end
+          currencies.uniq(&:downcase)
+        end
+
+        # Fee tokens a local fee payer accepts by default: pathUSD, then the
+        # chain's default currency.
+        sig { params(chain_id: T.nilable(Integer)).returns(T::Array[String]) }
+        def default_fee_tokens(chain_id)
+          [PATH_USD, default_currency_for_chain(chain_id)].uniq(&:downcase)
+        end
+
         sig { params(chain_id: T.nilable(Integer), testnet: T::Boolean).returns(String) }
         def resolve_currency(chain_id: nil, testnet: false)
           id = chain_id || (testnet ? TESTNET_CHAIN_ID : CHAIN_ID)

data/lib/mpp/methods/tempo/intents.rb

@@ -22,7 +22,9 @@ module Mpp
         attr_reader :name
         attr_accessor :rpc_url
 
-        def initialize(chain_id: nil, rpc_url: nil, timeout: 30, store: nil, validate_sender: nil)
+        def initialize(chain_id: nil, rpc_url: nil, timeout: 30, store: Mpp::MemoryStore.new, validate_sender: nil)
+          raise ArgumentError, "store is required" if store.nil?
+
           @name = "charge"
           @rpc_url = rpc_url || (chain_id ? Defaults.rpc_url_for_chain(chain_id) : nil)
           @_method = nil
@@ -39,11 +41,75 @@ module Mpp
           @_method&.fee_payer_allowed_fee_tokens
         end
 
+        def configured_fee_token
+          @_method&.fee_token
+        end
+
         def relay
           @_method&.relay
         end
 
+        # @deprecated Use #validate followed by #broadcast.
         def verify(credential, request)
+          validate(credential, request)
+          broadcast(credential, request)
+        end
+
+        def validate(credential, request)
+          req = resolve_request(credential, request)
+          if relay
+            relay.validate(Relay.to_relay_input(credential))
+          else
+            validate_credential(credential, req)
+          end
+
+          Mpp::Validation.new(
+            challenge: credential.challenge,
+            credential: credential,
+            details: {mode: validation_mode(credential)},
+            intent: name,
+            method: "tempo",
+            request: request,
+            source: credential.source
+          )
+        end
+
+        def broadcast(credential, request)
+          req = resolve_request(credential, request)
+          return relay.broadcast(Relay.to_relay_input(credential)) if relay
+
+          # mppx revalidates Tempo credentials before claiming replay state or
+          # submitting a transaction. No per-credential state lives on the intent.
+          validated = validate_credential(credential, req)
+          case credential.payload["type"]
+          when "hash"
+            hash = credential.payload.fetch("hash")
+            unless @store.put_if_absent("mpp:charge:#{hash.downcase}", hash)
+              raise Mpp::VerificationError, "Transaction hash already used"
+            end
+            validated
+          when "proof"
+            unless @store.put_if_absent("mpp:proof:#{credential.challenge.id}", true)
+              raise Mpp::VerificationError, "Proof credential has already been used"
+            end
+            validated
+          when "transaction"
+            payload = Schemas::TransactionCredentialPayload.new(type: "transaction", signature: credential.payload["signature"])
+            broadcast_transaction(payload, req, credential: credential)
+          end
+        end
+
+        private
+
+        def validation_mode(credential)
+          case credential.payload["type"]
+          when "hash" then "push"
+          when "proof" then "proof"
+          when "transaction" then "pull"
+          end
+        end
+
+        def resolve_request(credential, request)
           req = Schemas::ChargeRequest.from_hash(request)
 
           # Check challenge expiry
@@ -53,69 +119,61 @@ module Mpp
             raise Mpp::VerificationError, "Request has expired" if expires < Time.now.utc
           end
 
-          return relay.verify(credential, request) if relay
+          req
+        end
 
+        def validate_credential(credential, req)
           payload_data = credential.payload
           unless payload_data.is_a?(Hash) && payload_data.key?("type")
-            raise Mpp::VerificationError,
-              "Invalid credential payload"
+            raise Mpp::VerificationError, "Invalid credential payload"
           end
 
           case payload_data["type"]
           when "hash"
             payload = Schemas::HashCredentialPayload.new(type: "hash", hash: payload_data["hash"])
-            verify_hash(payload, req, credential: credential)
+            validate_hash(payload, req, credential: credential)
           when "transaction"
             payload = Schemas::TransactionCredentialPayload.new(
               type: "transaction", signature: payload_data["signature"]
             )
-            verify_transaction(payload, req, credential: credential)
+            validate_transaction(payload, req, credential: credential)
           when "proof"
             payload = Schemas::ProofCredentialPayload.new(
               type: "proof", signature: payload_data["signature"]
             )
-            verify_proof(payload, req, credential: credential)
+            validate_proof(payload, req, credential: credential)
           else
             raise Mpp::VerificationError, "Invalid credential type: #{payload_data["type"]}"
           end
         end
 
-        private
-
         def get_rpc_url
           raise Mpp::VerificationError, "No rpc_url configured on ChargeIntent" unless @rpc_url
 
           @rpc_url
         end
 
-        # Parse a hash credential source: nil if absent, the address for a
+        # Parse a credential source: nil if absent, the address for a
         # did:pkh:eip155 DID matching expected_chain_id, else raises.
-        def parse_hash_credential_source(source, expected_chain_id)
+        def parse_credential_source(source, expected_chain_id)
           return nil unless source
 
           expected_chain_id = begin
             Integer(expected_chain_id)
           rescue ArgumentError, TypeError
-            raise Mpp::VerificationError, "Hash credential source is invalid"
+            raise Mpp::VerificationError, "Credential source is invalid"
           end
 
           parsed = Proof.parse_source(source)
           unless parsed && parsed[:chain_id] == expected_chain_id
-            raise Mpp::VerificationError, "Hash credential source is invalid"
+            raise Mpp::VerificationError, "Credential source is invalid"
           end
 
           parsed[:address]
         end
 
-        def verify_hash(payload, request, credential:)
-          # Validate the source before reserving the hash.
-          source_address = parse_hash_credential_source(credential.source, request.method_details.chain_id)
-
-          if @store
-            store_key = "mpp:charge:#{payload.hash.downcase}"
-            raise Mpp::VerificationError, "Transaction hash already used" unless @store.put_if_absent(store_key,
-              payload.hash)
-          end
+        def validate_hash(payload, request, credential:)
+          source_address = parse_credential_source(credential.source, request.method_details.chain_id)
 
           rpc_url = get_rpc_url
           result = Rpc.call(rpc_url, "eth_getTransactionReceipt", [payload.hash])
@@ -133,14 +191,12 @@ module Mpp
             raise Mpp::VerificationError,
               "Transaction must contain a Transfer log matching request parameters"
           end
-          assert_challenge_bound_memo(matched_logs, credential.challenge) unless request.method_details.memo
+          assert_challenge_bound_memo(matched_logs, credential.challenge)
 
           Mpp::Receipt.success(payload.hash)
         end
 
-        def verify_transaction(payload, request, credential:)
-          validate_transaction_payload(payload.signature, request, challenge: credential.challenge)
-
+        def broadcast_transaction(payload, request, credential:)
           raw_tx = payload.signature
 
           # Simulation payload for the locally co-signed tx, if we sponsor it.
@@ -151,26 +207,22 @@ module Mpp
             raise Mpp::VerificationError, "No fee payer configured" unless payer
 
             if local_fee_payer?(payer)
-              raw_tx, simulate_payload = cosign_as_fee_payer(raw_tx, request.currency, request: request, challenge: credential.challenge)
+              raw_tx, simulate_payload = cosign_as_fee_payer(raw_tx, nil, request: request, challenge: credential.challenge)
             else
               raw_tx = payer.cosign(raw_tx)
             end
           end
 
           rpc_url = get_rpc_url
-          reserved_tx_hash = T.let(nil, T.nilable(String))
-          store_key = T.let(nil, T.nilable(String))
-          if @store
-            reserved_tx_hash = raw_transaction_hash(raw_tx)
-            store_key = "mpp:charge:#{reserved_tx_hash.downcase}"
-            unless @store.put_if_absent(store_key, TRANSACTION_PENDING)
-              raise Mpp::VerificationError, "Transaction hash already used" unless @store.get(store_key) == TRANSACTION_PENDING
+          reserved_tx_hash = raw_transaction_hash(raw_tx)
+          store_key = "mpp:charge:#{reserved_tx_hash.downcase}"
+          unless @store.put_if_absent(store_key, TRANSACTION_PENDING)
+            raise Mpp::VerificationError, "Transaction hash already used" unless @store.get(store_key) == TRANSACTION_PENDING
 
-              receipt_data = fetch_transaction_receipt(rpc_url, reserved_tx_hash)
-              verify_transaction_receipt!(receipt_data, request, credential: credential)
-              @store.put(store_key, TRANSACTION_VERIFIED)
-              return Mpp::Receipt.success(reserved_tx_hash)
-            end
+            receipt_data = fetch_transaction_receipt(rpc_url, reserved_tx_hash)
+            verify_transaction_receipt!(receipt_data, request, credential: credential)
+            @store.put(store_key, TRANSACTION_VERIFIED)
+            return Mpp::Receipt.success(reserved_tx_hash)
           end
 
           # We pay the gas, so simulate the co-signed tx first and bail if it
@@ -178,7 +230,7 @@ module Mpp
           begin
             simulate_before_broadcast(simulate_payload, rpc_url) if simulate_payload
           rescue
-            @store.delete(store_key) if @store && store_key
+            @store.delete(store_key)
             raise
           end
 
@@ -186,33 +238,36 @@ module Mpp
           begin
             tx_hash = Rpc.call(rpc_url, "eth_sendRawTransaction", [raw_tx])
           rescue => e
-            if reserved_tx_hash && store_key && transaction_submission_may_have_succeeded?(e)
+            if transaction_submission_may_have_succeeded?(e)
               receipt_data = fetch_transaction_receipt(rpc_url, reserved_tx_hash)
               verify_transaction_receipt!(receipt_data, request, credential: credential)
-              @store&.put(store_key, TRANSACTION_VERIFIED)
+              @store.put(store_key, TRANSACTION_VERIFIED)
               return Mpp::Receipt.success(reserved_tx_hash)
             end
 
-            @store.delete(store_key) if @store && store_key
+            @store.delete(store_key)
             raise Mpp::VerificationError, "Transaction submission failed: #{e.message}"
           end
 
           unless tx_hash
-            @store.delete(store_key) if @store && store_key
+            @store.delete(store_key)
             raise Mpp::VerificationError, "No transaction hash returned"
           end
 
-          if reserved_tx_hash && tx_hash.downcase != reserved_tx_hash.downcase
-            @store.delete(store_key) if @store && store_key
-            raise Mpp::VerificationError, "Returned transaction hash does not match submitted transaction"
-          end
+          # Tempo nodes hash canonical RLP, which can differ from keccak(raw
+          # bytes). Replay keys must follow the chain hash so a later hash
+          # credential for the same payment is rejected. Keep the raw-hash
+          # claim until verification finishes so a concurrent retry cannot
+          # rebroadcast the same payload.
+          raw_store_key = store_key
+          store_key, reserved_tx_hash = rebase_reservation_to_chain_hash(store_key, reserved_tx_hash, tx_hash)
 
-          tx_hash = reserved_tx_hash || tx_hash
-          receipt_data = fetch_transaction_receipt(rpc_url, tx_hash)
+          receipt_data = fetch_transaction_receipt(rpc_url, reserved_tx_hash)
           verify_transaction_receipt!(receipt_data, request, credential: credential)
-          @store.put(store_key, TRANSACTION_VERIFIED) if @store && store_key
+          @store.put(store_key, TRANSACTION_VERIFIED)
+          @store.put(raw_store_key, TRANSACTION_VERIFIED) if raw_store_key != store_key
 
-          Mpp::Receipt.success(tx_hash)
+          Mpp::Receipt.success(reserved_tx_hash)
         end
 
         def transaction_submission_may_have_succeeded?(error)
@@ -245,12 +300,13 @@ module Mpp
 
         def verify_transaction_receipt!(receipt_data, request, credential:)
           raise Mpp::VerificationError, "Transaction reverted" unless receipt_data["status"] == "0x1"
-          matched_logs = match_transfer_logs(receipt_data, request, expected_sender: receipt_data["from"])
+          source_address = parse_credential_source(credential.source, request.method_details.chain_id)
+          matched_logs = match_transfer_logs(receipt_data, request, expected_sender: source_address || receipt_data["from"])
           unless matched_logs.any?
             raise Mpp::VerificationError,
               "Transaction must contain a Transfer log matching request parameters"
           end
-          assert_challenge_bound_memo(matched_logs, credential.challenge) unless request.method_details.memo
+          assert_challenge_bound_memo(matched_logs, credential.challenge)
         end
 
         def verify_transfer_logs(receipt, request, expected_sender: nil)
@@ -258,7 +314,6 @@ module Mpp
         end
 
         def match_transfer_logs(receipt, request, expected_sender: nil, source: nil, validate_sender: nil)
-          expected_memo = request.method_details.memo
           matched_logs = []
 
           (receipt["logs"] || []).each do |log|
@@ -273,41 +328,25 @@ module Mpp
             next unless to_address.downcase == request.recipient.downcase
 
             matched =
-              if expected_memo
-                next unless topics[0] == TRANSFER_WITH_MEMO_TOPIC
+              case topics[0]
+              when TRANSFER_WITH_MEMO_TOPIC
                 next if topics.length < 4
 
                 data = log.fetch("data", "0x")
                 next if data.length < 66
 
                 amount = data[2, 64].to_i(16)
-                memo = topics[3]
-                memo_clean = expected_memo.downcase
-                memo_clean = "0x#{memo_clean}" unless memo_clean.start_with?("0x")
-                next unless amount == Integer(request.amount) && memo.downcase == memo_clean
-
-                {kind: :memo, memo: memo}
-              else
-                case topics[0]
-                when TRANSFER_WITH_MEMO_TOPIC
-                  next if topics.length < 4
-
-                  data = log.fetch("data", "0x")
-                  next if data.length < 66
+                next unless amount == Integer(request.amount)
 
-                  amount = data[2, 64].to_i(16)
-                  next unless amount == Integer(request.amount)
-
-                  {kind: :memo, memo: topics[3]}
-                when TRANSFER_TOPIC
-                  data = log.fetch("data", "0x")
-                  next if data.length < 66
+                {kind: :memo, memo: topics[3]}
+              when TRANSFER_TOPIC
+                data = log.fetch("data", "0x")
+                next if data.length < 66
 
-                  amount = data.delete_prefix("0x").to_i(16)
-                  next unless amount == Integer(request.amount)
+                amount = data.delete_prefix("0x").to_i(16)
+                next unless amount == Integer(request.amount)
 
-                  {kind: :transfer}
-                end
+                {kind: :transfer}
               end
 
             next unless matched
@@ -339,6 +378,22 @@ module Mpp
           raise Mpp::VerificationError, "Payment verification failed: memo is not bound to this challenge"
         end
 
+        def validate_transaction(payload, request, credential:)
+          parse_credential_source(credential.source, request.method_details.chain_id)
+          validate_transaction_payload(payload.signature, request, challenge: credential.challenge)
+          if request.method_details.fee_payer
+            payer = fee_payer
+            raise Mpp::VerificationError, "No fee payer configured" unless payer
+
+            # Move existing local sponsorship checks before signing. Hosted
+            # payers retain their own policy and terminal credential validation.
+            if local_fee_payer?(payer)
+              prepare_fee_payer_transaction(payload.signature, nil, request: request, challenge: credential.challenge)
+            end
+          end
+          true
+        end
+
         def validate_transaction_payload(signature, request, challenge: nil)
           # Best-effort pre-broadcast check
           begin
@@ -389,30 +444,40 @@ module Mpp
         end
 
         def raw_transaction_hash(raw_tx)
-          Kernel.require "eth"
-
           hex = raw_tx.delete_prefix("0x")
           unless hex.match?(/\A[0-9a-fA-F]+\z/) && hex.length.even?
             raise Mpp::VerificationError, "Invalid transaction signature"
           end
 
-          "0x#{Eth::Util.keccak256([hex].pack("H*")).unpack1("H*")}"
-        rescue LoadError
-          raise Mpp::VerificationError,
-            "eth gem is required to compute transaction hash for transaction replay protection"
+          "0x#{Attribution.keccak256([hex].pack("H*")).unpack1("H*")}"
+        end
+
+        def normalize_tx_hash(tx_hash)
+          hex = tx_hash.to_s.downcase
+          hex.start_with?("0x") ? hex : "0x#{hex}"
+        end
+
+        def rebase_reservation_to_chain_hash(store_key, reserved_tx_hash, returned_tx_hash)
+          canonical = normalize_tx_hash(returned_tx_hash)
+          return [store_key, reserved_tx_hash] if canonical == reserved_tx_hash.downcase
+
+          canonical_key = "mpp:charge:#{canonical}"
+          unless @store.put_if_absent(canonical_key, TRANSACTION_PENDING)
+            unless @store.get(canonical_key) == TRANSACTION_PENDING
+              @store.put(store_key, TRANSACTION_VERIFIED)
+              raise Mpp::VerificationError, "Transaction hash already used"
+            end
+          end
+
+          [canonical_key, canonical]
         end
 
         def match_transfer_calldata(call_data_hex, request, challenge: nil)
           return false if call_data_hex.length < 136
 
           selector = call_data_hex[0, 8].downcase
-          expected_memo = request.method_details.memo
 
-          if expected_memo
-            return false unless selector == TRANSFER_WITH_MEMO_SELECTOR
-          elsif selector != TRANSFER_WITH_MEMO_SELECTOR
-            return false
-          end
+          return false unless selector == TRANSFER_WITH_MEMO_SELECTOR
 
           decoded_to = "0x#{call_data_hex[32, 40]}"
           decoded_amount = call_data_hex[72, 64].to_i(16)
@@ -421,23 +486,16 @@ module Mpp
           return false unless decoded_amount == Integer(request.amount)
           return false if call_data_hex.length < 200
 
-          if expected_memo
-            decoded_memo = "0x#{call_data_hex[136, 64]}"
-            memo_clean = expected_memo.downcase
-            memo_clean = "0x#{memo_clean}" unless memo_clean.start_with?("0x")
-            return false unless decoded_memo.downcase == memo_clean
-          else
-            return false unless challenge
+          return false unless challenge
 
-            decoded_memo = "0x#{call_data_hex[136, 64]}"
-            return false unless Attribution.verify_server(decoded_memo, challenge.realm)
-            return false unless Attribution.verify_challenge_binding(decoded_memo, challenge.id)
-          end
+          decoded_memo = "0x#{call_data_hex[136, 64]}"
+          return false unless Attribution.verify_server(decoded_memo, challenge.realm)
+          return false unless Attribution.verify_challenge_binding(decoded_memo, challenge.id)
 
           true
         end
 
-        def verify_proof(payload, request, credential:)
+        def validate_proof(payload, request, credential:)
           raise Mpp::VerificationError, "Proof credentials are only valid for zero-amount challenges" unless Integer(request.amount).zero?
           raise Mpp::VerificationError, "Proof credential must include a source" unless credential.source
 
@@ -455,11 +513,6 @@ module Mpp
           )
           raise Mpp::VerificationError, "Proof signature does not match source" unless valid
 
-          if @store
-            store_key = "mpp:proof:#{credential.challenge.id}"
-            raise Mpp::VerificationError, "Proof credential has already been used" unless @store.put_if_absent(store_key, true)
-          end
-
           Mpp::Receipt.success(credential.challenge.id)
         end
 
@@ -467,12 +520,27 @@ module Mpp
           !FeePayerClient.hosted_config?(payer)
         end
 
+        # A nil fee_token selects the configured fee token, else the first
+        # allowed fee token the fee payer holds, else the first allowed.
         def cosign_as_fee_payer(raw_tx, fee_token, request: nil, challenge: nil)
+          raise Mpp::VerificationError, "No fee payer account configured" unless fee_payer
+
+          tx_to_sign, recovered_addr = prepare_fee_payer_transaction(
+            raw_tx, fee_token, request: request, challenge: challenge, select_funded: true
+          )
+          fee_payer_sig = fee_payer.sign_hash(tx_to_sign.fee_payer_signature_hash)
+          signed = tx_to_sign.with(fee_payer_signature: fee_payer_sig)
+          raw_tx = "0x#{signed.encoded_2718.unpack1("H*")}"
+
+          [raw_tx, build_simulate_payload(tx_to_sign, recovered_addr, fee_payer_sig)]
+        end
+
+        # Sponsorship checks, shared by validation and terminal signing. Only
+        # select_funded (terminal signing) reads fee payer balances over RPC.
+        def prepare_fee_payer_transaction(raw_tx, fee_token, request: nil, challenge: nil, select_funded: false)
           require "eth"
           require "rlp"
 
-          raise Mpp::VerificationError, "No fee payer account configured" unless fee_payer
-
           # Decode the 0x78 fee payer envelope
           begin
             all_bytes = [raw_tx.delete_prefix("0x")].pack("H*")
@@ -591,26 +659,17 @@ module Mpp
           end
 
           # Build the final transaction with fee_token set
-          resolved_fee_token = fee_token || request&.currency
+          allowed_fee_tokens = fee_payer_allowed_fee_tokens || Defaults.default_fee_tokens(chain_id)
+          resolved_fee_token = fee_token || configured_fee_token ||
+            (select_funded && funded_fee_token(allowed_fee_tokens)) || allowed_fee_tokens.first
           raise Mpp::VerificationError, "No fee token available" unless resolved_fee_token
 
-          allowed_fee_tokens = fee_payer_allowed_fee_tokens ||
-            [Defaults.default_currency_for_chain(chain_id).downcase]
           unless allowed_fee_tokens.map(&:downcase).include?(resolved_fee_token.downcase)
             raise Mpp::VerificationError,
               "Fee token #{resolved_fee_token} is not allowed by fee payer policy"
           end
 
-          tx_to_sign = tx_for_recovery.with(fee_token: resolved_fee_token)
-
-          # Fee payer signs the 0x78 payload, which identifies the recovered sender.
-          fee_payer_hash = tx_to_sign.fee_payer_signature_hash
-          fee_payer_sig = fee_payer.sign_hash(fee_payer_hash)
-
-          signed = tx_to_sign.with(fee_payer_signature: fee_payer_sig)
-          raw_tx = "0x#{signed.encoded_2718.unpack1("H*")}"
-
-          [raw_tx, build_simulate_payload(tx_to_sign, recovered_addr, fee_payer_sig)]
+          [tx_for_recovery.with(fee_token: resolved_fee_token), recovered_addr]
         end
 
         # Build a `tempo_simulateV1` payload for the co-signed `0x76` tx.
@@ -661,6 +720,17 @@ module Mpp
           }
         end
 
+        # First allowed fee token with a nonzero fee payer balance.
+        def funded_fee_token(tokens)
+          owner = fee_payer.address.delete_prefix("0x").downcase.rjust(64, "0")
+          tokens.find do |token|
+            balance = Rpc.call(get_rpc_url, "eth_call", [{"to" => token, "data" => "0x70a08231#{owner}"}, "latest"])
+            balance.is_a?(String) && balance.delete_prefix("0x").to_i(16) > 0
+          rescue
+            false
+          end
+        end
+
         # Simulate the co-signed tx and raise if it would revert. Fails closed:
         # an RPC error is treated as a failed check, not a pass.
         def simulate_before_broadcast(simulate_payload, rpc_url)