@continuumdao/ctm-mpc-defi 0.2.59 → 0.2.60

package/dist/agent/skills/railgun/SKILL.md

@@ -29,8 +29,8 @@ Call `ctm_railgun_ensure_wallet` first. Use the returned `railgunAddress` as the
 
 ## Shield
 
-1. Call `ctm_railgun_build_shield_multisign` without `shieldSignature`, with `railgunAddress` from `ctm_railgun_ensure_wallet`. Submit that personal_sign request.
-2. Call the same tool again with `shieldSignature` set to the completed signature. Submit the resulting approve-and-shield transaction.
+1. Call `ctm_railgun_build_shield_multisign` without `shieldSignature`, with `railgunAddress` from `ctm_railgun_ensure_wallet`. Submit that personal_sign request (`sign_request_agree`, then `trigger_sign_result`).
+2. `broadcast_sign_result` on that request returns the shield-key signature in `txHashes[0]` and does not send a transaction. Call this tool again with `shieldSignature` set to that hex. Submit the resulting approve-and-shield transaction.
 
 The first call signs Railgun's shield message. The second call builds the EVM shield. If allowance is short, the second call includes an approve, and a zero-approve reset when a non-zero allowance is still too small. Shielding spends the KeyGen threshold key, not the 0zk spending key.
 

package/dist/protocols/evm/railgun/index.cjs

@@ -662,6 +662,16 @@ async function shieldSignatureMessage() {
   const wallet = await import('@railgun-community/wallet');
   return wallet.getShieldPrivateKeySignatureMessage();
 }
+function shieldPrivateKeyFromSignature(signature) {
+  const hex = signature.startsWith("0x") ? signature : `0x${signature}`;
+  if (!/^0x[0-9a-fA-F]+$/.test(hex) || (hex.length - 2) % 2 !== 0) {
+    throw new Error("Shield-key signature must be hex.");
+  }
+  if ((hex.length - 2) / 2 !== 65) {
+    throw new Error("Shield-key signature must be the 65-byte personal_sign of RAILGUN_SHIELD.");
+  }
+  return viem.keccak256(hex);
+}
 function personalSignBody(args, message) {
   const executor = viem.getAddress(args.executorAddress);
   const digest = viem.hashMessage(message);
@@ -742,6 +752,7 @@ async function buildEvmMultisignBodyRailgunShield(args) {
   if (!signature) {
     return personalSignBody(args, await shieldSignatureMessage());
   }
+  const shieldPrivateKey = shieldPrivateKeyFromSignature(signature);
   const network = await railgunNetworkByChainId(args.chainId);
   if (!network) throw new Error("Railgun is not deployed on this chain.");
   const tokenAddress = viem.getAddress(args.tokenAddress);
@@ -793,7 +804,7 @@ async function buildEvmMultisignBodyRailgunShield(args) {
   const populated = await populate(
     sharedModels.TXIDVersion.V2_PoseidonMerkle,
     networkName,
-    signature,
+    shieldPrivateKey,
     [{ tokenAddress, amount, recipientAddress: args.railgunAddress.trim() }],
     [],
     railgunGasDetails(args.chainDetail, 1200000n)
@@ -1263,6 +1274,7 @@ exports.setRailgunPopulateShieldForTests = setRailgunPopulateShieldForTests;
 exports.setRailgunShieldLogReaderForTests = setRailgunShieldLogReaderForTests;
 exports.setRailgunWalletSession = setRailgunWalletSession;
 exports.shieldIndexEndpoint = shieldIndexEndpoint;
+exports.shieldPrivateKeyFromSignature = shieldPrivateKeyFromSignature;
 exports.unlockRailgunBrowserWallet = unlockRailgunBrowserWallet;
 exports.utxoScanTerminalStatus = utxoScanTerminalStatus;
 //# sourceMappingURL=index.cjs.map