@0xio/sdk 2.6.0 → 2.7.0

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 All notable changes to the 0xio Wallet SDK will be documented in this file.
 
+## [2.7.0] - 2026-05-16
+
+### Security (post-audit remediation)
+
+**Transport hardening:**
+- Session nonce validation on all bridge responses — blocks same-origin impersonation
+- Removed wildcard `'*'` postMessage fallback — parent only addressed once origin established
+- Removed `Math.random()` fallback for request IDs — throws if `crypto` unavailable
+- `requestTimestamps` capped to prevent unbounded growth in idle tabs
+- Removed legacy `octraWalletReady` listeners and `createOctraWallet` alias
+
+### Added
+
+- **Pluggable wallet adapter system** (`src/adapter.ts`, `src/supports/`):
+  - `WalletTransportAdapter` interface — add support for any wallet without touching core SDK
+  - `src/supports/0xio.ts` — built-in adapter with session nonce + iframe bridge support
+  - `src/supports/template.ts` — starter template for new adapters
+  - `detectWalletAdapter()` auto-detect helper
+  - Exported: `WalletTransportAdapter`, `AdapterRequest`, `AdapterIncomingMessage`, `ZeroXIOAdapter`, `createZeroXIOAdapter`, `detectWalletAdapter`, `getAllAdapters`
+
+### Changed
+
+- `ExtensionCommunicator` delegates to adapter for detect, postMessage, listen, and ready events
+- Session nonce handling moved from communicator to adapter
+- Requires Chrome 111+ when using the 0xio browser extension
+- No breaking changes to `ZeroXIOWallet` public API
+
+**SDK fixes:**
+- Session versioning — `_sessionVersion` counter prevents stale writes from in-flight requests after disconnect/account switch
+- Debug log scrubbing — only non-sensitive fields logged (`{ to }`, `{ contract, method }`, `{ public }`)
+- Removed `retry()` and `withTimeout()` from public API export
+- Per-method payload size limits — method names ≤ 200 chars, params ≤ 64 KB, memos ≤ 1,000 chars
+- Input validation at all mutating method entry points (`isValidAddress()`, `isValidAmount()`)
+- Added `signAuthMessage(service, nonce)` — domain-separated auth signing with origin binding
+- Amount types accept `string | number` — eliminates JS precision loss for large values
+- Added `deriveOctraAddress(publicKeyBase64)` — `connect()` and `getConnectionStatus()` verify pubkey→addr binding
+- `encrypt/decryptBalance()` return full `TransactionResult` (was boolean)
+- `contractCallView` no longer leaks connected address as default caller
+- `balanceChanged` emits on public/private split change (not just total)
+- `once()` removes listener before invoke — throwing listeners no longer re-fire
+- `extensionLocked`/`extensionUnlocked` events emitted (were suppressed)
+- Permissions stored in `ConnectionInfo` and survive session restore
+- `connectedAt` preserved across `getConnectionStatus()` polls
+- `connect` event only emits on disconnected→connected transition
+- `NETWORKS` frozen + `getNetworkConfig()` returns frozen copies
+- `validateBalance()` uses `Number()` not `parseFloat()` — rejects partial numerics
+- `validateNetworkInfo()` rejects empty rpcUrl (except custom network)
+- `switchNetwork()` requires active connection
+- `checkSDKCompatibility()` no longer falsely flags non-Chrome transports
+
 ## [2.6.0] - 2026-05-13
 
 ### Added

package/README.md

@@ -1,9 +1,21 @@
 # 0xio Wallet SDK
 
-**Version:** 2.6.0
+**Version:** 2.7.0
 
 Official TypeScript SDK for integrating DApps with 0xio Wallet on Octra Network.
 
+## What's New in v2.7.0
+
+Security hardening release (post-audit remediation):
+- **MessageChannel transport** (H-2 fix): Extension now uses a private `MessageChannel` port instead of `window.postMessage`, preventing page scripts from intercepting or injecting wallet messages. SDK validates a per-session nonce on every response.
+- **Pluggable wallet adapters**: New `src/supports/` system — implement `WalletTransportAdapter` and drop a file in `supports/` to add any wallet without touching core SDK code. See `src/supports/template.ts` for the starting point.
+- Fixed wildcard postMessage target leaking request payloads to any origin (HIGH)
+- Removed `Math.random()` fallback for request IDs — throws if `crypto` unavailable (MEDIUM)
+- Fixed `requestTimestamps` unbounded memory growth in idle tabs (LOW)
+- Removed all `octraWalletReady` legacy event listeners and `createOctraWallet` alias (LOW)
+- Extension fixes: balance/network events now delivered end-to-end; `accountChanged` on wallet switch; exact hostname tab matching; approval listener spoofing from content scripts blocked
+- All 17 post-audit findings resolved. See `AUDIT_REMEDIATION.md` for full details.
+
 ## What's New in v2.6.0
 
 - **`sendPrivateTransfer(to, amount)`**: Send encrypted (stealth) transfers — amount is hidden from everyone except sender and recipient. Uses PVAC-HFHE for ciphertext subtraction + zero-knowledge proofs. The node re-encrypts under the recipient's key.
@@ -295,6 +307,38 @@ The SDK automatically detects when your DApp is running inside:
 
 No code changes are needed for DApp developers. Just use the SDK as normal and it will auto-detect the environment and choose the correct transport.
 
+## Wallet Adapters
+
+The SDK ships with a pluggable adapter system so multiple wallets can be supported without changing core code.
+
+### Auto-detect
+
+```typescript
+import { detectWalletAdapter, ZeroXIOWallet } from '@0xio/sdk';
+
+const adapter = detectWalletAdapter();
+if (!adapter) throw new Error('No supported wallet found');
+
+const wallet = new ZeroXIOWallet({ appName: 'My DApp', adapter });
+```
+
+### Pass an adapter explicitly
+
+```typescript
+import { ZeroXIOWallet, ZeroXIOAdapter } from '@0xio/sdk';
+
+const wallet = new ZeroXIOWallet({ appName: 'My DApp', adapter: ZeroXIOAdapter });
+```
+
+### Add support for another wallet
+
+1. Copy `src/supports/template.ts` → `src/supports/my-wallet.ts`
+2. Fill in the four constants (`REQUEST_SOURCE`, `RESPONSE_SOURCE`, `WINDOW_KEY`, `READY_EVENT`) and the message-shape mapping
+3. Register it in `src/supports/index.ts` `REGISTERED_ADAPTERS`
+4. Export it from `src/index.ts` if you want it in the public API
+
+See `DOCUMENTATION.md → Wallet Adapter System` for the full interface spec.
+
 ## Requirements
 
 - 0xio Wallet Extension v2.0.1 or higher (Mainnet Alpha)