@0xsequence/provider 1.1.0 → 1.1.1

package/dist/0xsequence-provider.cjs.dev.js

@@ -2107,6 +2107,25 @@ function fromExtended(transaction) {
   return [transaction, ...(transaction.auxiliary || [])];
 }
 
+function validateTransactionRequest(wallet, transaction) {
+  const transactions = core.commons.transaction.fromTransactionish(wallet, transaction);
+  const unwound = core.commons.transaction.unwind(wallet, transactions);
+  unwound.forEach(transaction => validateTransaction(wallet, transaction));
+}
+function validateTransaction(wallet, transaction) {
+  if (transaction.to.toLowerCase() === wallet.toLowerCase()) {
+    if (transaction.data) {
+      const data = ethers.ethers.utils.arrayify(transaction.data);
+      if (data.length >= 4) {
+        throw new Error('self calls are forbidden');
+      }
+    }
+  }
+  if (transaction.delegateCall) {
+    throw new Error('delegate calls are forbidden');
+  }
+}
+
 const SIGNER_READY_TIMEOUT = 10000;
 class WalletRequestHandler {
   constructor(_account, prompter, networks) {
@@ -2297,6 +2316,7 @@ class WalletRequestHandler {
                 }
                 return tx;
               });
+              validateTransactionRequest(account.address, transactionParams);
               let txnHash = '';
               if (_this.prompter === null) {
                 // prompter is null, so we'll send from here
@@ -2322,6 +2342,7 @@ class WalletRequestHandler {
               if (sender !== account.address) {
                 throw new Error('sender address does not match wallet');
               }
+              validateTransactionRequest(account.address, transaction);
               if (_this.prompter === null) {
                 // The eth_signTransaction method expects a `string` return value we instead return a `SignedTransactions` object,
                 // this can only be broadcasted using an RPC provider with support for signed Sequence transactions, like this one.

package/dist/0xsequence-provider.cjs.prod.js

@@ -2107,6 +2107,25 @@ function fromExtended(transaction) {
   return [transaction, ...(transaction.auxiliary || [])];
 }
 
+function validateTransactionRequest(wallet, transaction) {
+  const transactions = core.commons.transaction.fromTransactionish(wallet, transaction);
+  const unwound = core.commons.transaction.unwind(wallet, transactions);
+  unwound.forEach(transaction => validateTransaction(wallet, transaction));
+}
+function validateTransaction(wallet, transaction) {
+  if (transaction.to.toLowerCase() === wallet.toLowerCase()) {
+    if (transaction.data) {
+      const data = ethers.ethers.utils.arrayify(transaction.data);
+      if (data.length >= 4) {
+        throw new Error('self calls are forbidden');
+      }
+    }
+  }
+  if (transaction.delegateCall) {
+    throw new Error('delegate calls are forbidden');
+  }
+}
+
 const SIGNER_READY_TIMEOUT = 10000;
 class WalletRequestHandler {
   constructor(_account, prompter, networks) {
@@ -2297,6 +2316,7 @@ class WalletRequestHandler {
                 }
                 return tx;
               });
+              validateTransactionRequest(account.address, transactionParams);
               let txnHash = '';
               if (_this.prompter === null) {
                 // prompter is null, so we'll send from here
@@ -2322,6 +2342,7 @@ class WalletRequestHandler {
               if (sender !== account.address) {
                 throw new Error('sender address does not match wallet');
               }
+              validateTransactionRequest(account.address, transaction);
               if (_this.prompter === null) {
                 // The eth_signTransaction method expects a `string` return value we instead return a `SignedTransactions` object,
                 // this can only be broadcasted using an RPC provider with support for signed Sequence transactions, like this one.

package/dist/0xsequence-provider.esm.js

@@ -2103,6 +2103,25 @@ function fromExtended(transaction) {
   return [transaction, ...(transaction.auxiliary || [])];
 }
 
+function validateTransactionRequest(wallet, transaction) {
+  const transactions = commons.transaction.fromTransactionish(wallet, transaction);
+  const unwound = commons.transaction.unwind(wallet, transactions);
+  unwound.forEach(transaction => validateTransaction(wallet, transaction));
+}
+function validateTransaction(wallet, transaction) {
+  if (transaction.to.toLowerCase() === wallet.toLowerCase()) {
+    if (transaction.data) {
+      const data = ethers.utils.arrayify(transaction.data);
+      if (data.length >= 4) {
+        throw new Error('self calls are forbidden');
+      }
+    }
+  }
+  if (transaction.delegateCall) {
+    throw new Error('delegate calls are forbidden');
+  }
+}
+
 const SIGNER_READY_TIMEOUT = 10000;
 class WalletRequestHandler {
   constructor(_account, prompter, networks) {
@@ -2293,6 +2312,7 @@ class WalletRequestHandler {
                 }
                 return tx;
               });
+              validateTransactionRequest(account.address, transactionParams);
               let txnHash = '';
               if (_this.prompter === null) {
                 // prompter is null, so we'll send from here
@@ -2318,6 +2338,7 @@ class WalletRequestHandler {
               if (sender !== account.address) {
                 throw new Error('sender address does not match wallet');
               }
+              validateTransactionRequest(account.address, transaction);
               if (_this.prompter === null) {
                 // The eth_signTransaction method expects a `string` return value we instead return a `SignedTransactions` object,
                 // this can only be broadcasted using an RPC provider with support for signed Sequence transactions, like this one.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xsequence/provider",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "provider sub-package for Sequence",
   "repository": "https://github.com/0xsequence/sequence.js/tree/master/packages/provider",
   "source": "src/index.ts",
@@ -11,15 +11,15 @@
   "dependencies": {
     "eventemitter2": "^6.4.5",
     "webextension-polyfill": "^0.10.0",
-    "@0xsequence/abi": "1.1.0",
-    "@0xsequence/account": "1.1.0",
-    "@0xsequence/auth": "1.1.0",
-    "@0xsequence/relayer": "1.1.0",
-    "@0xsequence/migration": "1.1.0",
-    "@0xsequence/core": "1.1.0",
-    "@0xsequence/network": "1.1.0",
-    "@0xsequence/wallet": "1.1.0",
-    "@0xsequence/utils": "1.1.0"
+    "@0xsequence/account": "1.1.1",
+    "@0xsequence/abi": "1.1.1",
+    "@0xsequence/auth": "1.1.1",
+    "@0xsequence/core": "1.1.1",
+    "@0xsequence/migration": "1.1.1",
+    "@0xsequence/network": "1.1.1",
+    "@0xsequence/relayer": "1.1.1",
+    "@0xsequence/utils": "1.1.1",
+    "@0xsequence/wallet": "1.1.1"
   },
   "peerDependencies": {
     "ethers": ">=5.5 < 6"

package/src/transactions.ts

@@ -0,0 +1,23 @@
+import { commons } from '@0xsequence/core'
+import { ethers } from 'ethers'
+
+export function validateTransactionRequest(wallet: string, transaction: commons.transaction.Transactionish) {
+  const transactions = commons.transaction.fromTransactionish(wallet, transaction)
+  const unwound = commons.transaction.unwind(wallet, transactions)
+  unwound.forEach(transaction => validateTransaction(wallet, transaction))
+}
+
+function validateTransaction(wallet: string, transaction: commons.transaction.Transaction) {
+  if (transaction.to.toLowerCase() === wallet.toLowerCase()) {
+    if (transaction.data) {
+      const data = ethers.utils.arrayify(transaction.data)
+      if (data.length >= 4) {
+        throw new Error('self calls are forbidden')
+      }
+    }
+  }
+
+  if (transaction.delegateCall) {
+    throw new Error('delegate calls are forbidden')
+  }
+}

package/src/transports/wallet-request-handler.ts

@@ -7,6 +7,7 @@ import { BigNumber, ethers, providers } from 'ethers'
 import { EventEmitter2 as EventEmitter } from 'eventemitter2'
 
 import { fromExtended } from '../extended'
+import { validateTransactionRequest } from '../transactions'
 import {
   ProviderMessageRequest,
   ProviderMessageResponse,
@@ -393,6 +394,8 @@ export class WalletRequestHandler implements ExternalProvider, JsonRpcHandler, P
               return tx
             })
 
+          validateTransactionRequest(account.address, transactionParams)
+
           let txnHash = ''
           if (this.prompter === null) {
             // prompter is null, so we'll send from here
@@ -421,6 +424,8 @@ export class WalletRequestHandler implements ExternalProvider, JsonRpcHandler, P
             throw new Error('sender address does not match wallet')
           }
 
+          validateTransactionRequest(account.address, transaction)
+
           if (this.prompter === null) {
             // The eth_signTransaction method expects a `string` return value we instead return a `SignedTransactions` object,
             // this can only be broadcasted using an RPC provider with support for signed Sequence transactions, like this one.