@anywalletkit/protocol-swap2-core 0.8.0 → 0.9.0

package/dist/swap2/base.js

@@ -7,7 +7,7 @@ import {
   nativeUnits,
   normalizeTypedDomain,
   swap2ChainId
-} from "../chunk-CRCDWV3L.js";
+} from "../chunk-PU5NM3Y6.js";
 import "../chunk-IVR3SREQ.js";
 import "../chunk-2KC734UX.js";
 export {

package/dist/swap2/single.cjs

@@ -907,6 +907,8 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
         }
       } else if (remote && !pinnedTargets.includes(unsigned.to.toLowerCase())) {
         throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' calls ${(0, import_viem.getAddress)(unsigned.to)} on ${this.fromChain}, which the app did not pin as a call target (remoteProvider callTargets) \u2014 refused`);
+      } else if (remote && provider.verifiesQuotes !== true && provider.verifiesBuilds !== true) {
+        throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' calls ${(0, import_viem.getAddress)(unsigned.to)} with calldata the app does not check (remoteProvider verifyQuote / verifyBuild) \u2014 refused`);
       }
     }
     const needsApproval = !!unsigned.approvalAddress && !!source.contract;
@@ -1394,6 +1396,9 @@ function remotePinRefusal(provider, q, chain) {
   if (tx.data !== void 0 && tx.to && !pinned(provider.callTargets?.(chain), tx.to)) {
     return `${provider.name}: the route calls ${tx.to}, which the app did not pin as a call target on ${chain} (remoteProvider callTargets)`;
   }
+  if (tx.data !== void 0 && provider.verifiesQuotes !== true && provider.verifiesBuilds !== true) {
+    return `${provider.name}: the route's calldata is not checked by the app (remoteProvider verifyQuote / verifyBuild) \u2014 a pinned target alone does not say whom it pays`;
+  }
   return null;
 }