@defisaver/positions-sdk 2.1.137-audit-dev → 2.1.138

package/esm/types/aaveV4.d.ts

@@ -44,6 +44,11 @@ export interface AaveV4SpokeInfo {
     value: AaveV4SpokesType;
     url: string;
     address: EthAddress;
+    /**
+     * Known hub addresses, used only to prefetch hub data in parallel with the spoke data.
+     * The on-chain reserves are the source of truth — hubs found there but missing here are
+     * fetched dynamically, so this list going stale can't break spoke loading.
+     */
     hubs: EthAddress[];
 }
 export interface AaveV4SpokeData {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defisaver/positions-sdk",
-  "version": "2.1.137-audit-dev",
+  "version": "2.1.138",
   "description": "",
   "main": "./cjs/index.js",
   "module": "./esm/index.js",
@@ -25,17 +25,11 @@
     "@types/lodash": "^4.17.15",
     "@types/memoizee": "^0.4.12",
     "decimal.js": "^10.6.0",
+    "graphql-request": "^1.8.2",
     "lodash": "^4.17.21",
     "memoizee": "^0.4.17",
     "viem": "^2.37.9"
   },
-  "overrides": {
-    "serialize-javascript": "^7.1.0",
-    "uuid": "^11.1.1",
-    "@typescript-eslint/typescript-estree": {
-      "minimatch": "^9.0.9"
-    }
-  },
   "devDependencies": {
     "@defisaver/eslint-config": "^1.0.1",
     "@metamask/eth-json-rpc-middleware": "^15.0.1",
@@ -46,7 +40,6 @@
     "dotenv": "^16.3.1",
     "eslint": "^8.49.0",
     "eslint-plugin-import": "^2.31.0",
-    "eslint-webpack-plugin": "^4.0.1",
     "mocha": "^10.2.0",
     "nock": "^14.0.0",
     "ts-node": "^10.9.2",

package/src/aaveV4/index.ts

@@ -21,7 +21,9 @@ import {
 } from '../types';
 import { AaveV4ViewContractViem } from '../contracts';
 import { getStakingApy, STAKING_ASSETS } from '../staking';
-import { isMaxUint, wethToEth, wethToEthByAddress } from '../services/utils';
+import {
+  isMaxUint, shortenAddress, wethToEth, wethToEthByAddress,
+} from '../services/utils';
 import { aaveV4GetAggregatedPositionData, calcUserRiskPremiumBps } from '../helpers/aaveV4Helpers';
 import { findAaveV4SpokeByAddress, getAaveV4HubByAddress } from '../markets/aaveV4';
 import { aprToApy } from '../moneymarket';
@@ -56,10 +58,10 @@ const formatReserveAsset = async (reserveAsset: AaveV4ReserveAssetOnChain, hubAs
   // tokens package. Flag it so consumers can render it read-only instead of feeding NaN into amounts.
   const isUnsupported = assetInfo.symbol === '?';
   const symbol = wethToEth(assetInfo.symbol);
+  // The hub registry only provides display metadata — a hub missing from it (newly deployed by
+  // Aave, SDK not yet updated) must not prevent the reserve from loading, so fall back to a
+  // generated label instead of failing.
   const hubInfo = getAaveV4HubByAddress(network, reserveAsset.hub);
-  if (!hubInfo) {
-    throw new Error(`Hub not found with address: ${reserveAsset.hub}`);
-  }
 
   const isStakingAsset = STAKING_ASSETS.includes(symbol);
   const supplyIncentives: IncentiveData[] = [];
@@ -124,8 +126,8 @@ const formatReserveAsset = async (reserveAsset: AaveV4ReserveAssetOnChain, hubAs
     decimals: reserveAsset.decimals,
     isUnsupported,
     underlying: reserveAsset.underlying,
-    hub: hubInfo.address,
-    hubName: hubInfo?.label,
+    hub: hubInfo?.address ?? reserveAsset.hub,
+    hubName: hubInfo?.label ?? `Hub ${shortenAddress(reserveAsset.hub)}`,
     assetId: reserveAsset.assetId,
     reserveId,
     paused: reserveAsset.paused,
@@ -163,16 +165,32 @@ const formatReserveAsset = async (reserveAsset: AaveV4ReserveAssetOnChain, hubAs
 export async function _getAaveV4SpokeData(provider: Client, network: NetworkNumber, market: AaveV4SpokeInfo, blockNumber: 'latest' | number = 'latest'): Promise<AaveV4SpokeData> {
   const viewContract = AaveV4ViewContractViem(provider, network, blockNumber);
 
-  const hubsData: Record<EthAddress, AaveV4HubOnChainData> = {};
+  const hubsData: Record<string, AaveV4HubOnChainData> = {};
+  const loadHubData = async (hubAddress: EthAddress) => {
+    hubsData[hubAddress.toLowerCase()] = await fetchHubData(viewContract, hubAddress);
+  };
+
+  // market.hubs is only a prefetch hint (lets known hubs load in parallel with the spoke data), so
+  // failures are tolerated here — any hub the reserves actually reference is (re)fetched below.
   const [spokeData, merklCampaigns] = await Promise.all([
     viewContract.read.getSpokeDataFull([market.address]),
     getAaveV4MerkleCampaigns(network),
-    ...market.hubs.map(async (hubAddress) => {
-      hubsData[hubAddress] = await fetchHubData(viewContract, hubAddress);
-    }),
+    ...market.hubs.map((hubAddress) => loadHubData(hubAddress).catch(() => {})),
   ]);
 
-  const reserveAssetsArray = await Promise.all(spokeData[1].map(async (reserveAssetOnChain: AaveV4ReserveAssetOnChain, index: number) => formatReserveAsset(reserveAssetOnChain, hubsData[reserveAssetOnChain.hub].assets[reserveAssetOnChain.assetId], index, +spokeData[0].oracleDecimals.toString(), network)));
+  // The on-chain reserves are the source of truth for which hubs the spoke uses — fetch any hub
+  // the prefetch didn't cover, so an asset listed from a hub unknown to the SDK can't break the spoke.
+  const missingHubs = [...new Set(spokeData[1].map((reserveAsset: AaveV4ReserveAssetOnChain) => reserveAsset.hub.toLowerCase() as EthAddress))]
+    .filter((hubAddress) => !hubsData[hubAddress]);
+  await Promise.all(missingHubs.map(loadHubData));
+
+  const reserveAssetsArray = (await Promise.all(spokeData[1].map(async (reserveAssetOnChain: AaveV4ReserveAssetOnChain, index: number) => {
+    const hubAsset = hubsData[reserveAssetOnChain.hub.toLowerCase()]?.assets[reserveAssetOnChain.assetId];
+    // A reserve whose hub-side asset data can't be resolved is skipped instead of failing the
+    // whole spoke (position math degrades for that one asset only).
+    if (!hubAsset) return null;
+    return formatReserveAsset(reserveAssetOnChain, hubAsset, index, +spokeData[0].oracleDecimals.toString(), network);
+  }))).filter((asset): asset is AaveV4ReserveAssetData => asset !== null);
 
   const enrichedAssets = reserveAssetsArray.map((asset) => attachAaveV4MerklIncentives(asset, market.address, merklCampaigns));
 

package/src/contracts.ts

@@ -1,4 +1,4 @@
-import { getContract, Client, GetContractReturnType } from 'viem';
+import { getContract, Client } from 'viem';
 import * as configRaw from './config/contracts';
 import {
   Blockish, EthAddress, HexString, NetworkNumber,
@@ -57,7 +57,7 @@ export const getConfigContractAbi = <TKey extends ConfigKey>(name: TKey, network
   return latestAbi as unknown as typeof configRaw[TKey]['abi'];
 };
 
-export const createViemContractFromConfigFunc = <TKey extends ConfigKey>(name: TKey, _address?: HexString) => (client: Client, network: NetworkNumber, block?: Blockish): GetContractReturnType<typeof configRaw[TKey]['abi'], Client, HexString> => {
+export const createViemContractFromConfigFunc = <TKey extends ConfigKey>(name: TKey, _address?: HexString) => (client: Client, network: NetworkNumber, block?: Blockish) => {
   const address = (_address || getConfigContractAddress(name, network, block));
   const abi = getConfigContractAbi(name, network, block) as typeof configRaw[TKey]['abi'];
   return getContract({

package/src/savings/morphoVaults/index.ts

@@ -1,9 +1,9 @@
 import { Client } from 'viem';
 import Dec from 'decimal.js';
+import { request as graphqlRequest } from 'graphql-request';
 import { assetAmountInEth } from '@defisaver/tokens';
 import * as morphoVaultsOptions from './options';
 import { EthAddress, EthereumProvider, NetworkNumber } from '../../types/common';
-import { LONGER_TIMEOUT } from '../../services/utils';
 import { getViemProvider } from '../../services/viem';
 import { getMorphoVaultContractViem } from '../../contracts';
 import { MorphoVault, SavingsVaultData } from '../../types';
@@ -30,22 +30,6 @@ const vaultDataQuery = `
 
 const MORPHO_BLUE_API = 'https://api.morpho.org/graphql';
 
-const fetchVaultData = async (address: EthAddress, chainId: NetworkNumber) => {
-  const res = await fetch(MORPHO_BLUE_API, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      query: vaultDataQuery,
-      variables: { address, chainId },
-    }),
-    signal: AbortSignal.timeout(LONGER_TIMEOUT),
-  });
-  if (!res.ok) throw new Error(`Morpho vault request failed: ${res.status}`);
-  const body = await res.json();
-  if (!body?.data) throw new Error('Morpho vault response missing data');
-  return body.data;
-};
-
 export const _getMorphoVaultData = async (provider: Client, network: NetworkNumber, morphoVault: MorphoVault, accounts: EthAddress[]): Promise<SavingsVaultData> => {
   const morphoVaultContract = getMorphoVaultContractViem(provider, morphoVault.address);
 
@@ -56,7 +40,7 @@ export const _getMorphoVaultData = async (provider: Client, network: NetworkNumb
     morphoVaultContract.read.totalSupply(),
     morphoVaultContract.read.decimals(),
     morphoVaultContract.read.DECIMALS_OFFSET(),
-    fetchVaultData(morphoVault.address, network),
+    graphqlRequest(MORPHO_BLUE_API, vaultDataQuery, { address: morphoVault.address, chainId: network }),
     ...accounts.map(async (account) => {
       const share = await morphoVaultContract.read.balanceOf([account]);
       shares[account] = share;

package/src/services/utils.ts

@@ -20,6 +20,8 @@ export const isAddress = (address: string) => typeof address === 'string' && (ne
 
 export const compareAddresses = (addr1 = '', addr2 = '') => addr1.toLowerCase() === addr2.toLowerCase();
 
+export const shortenAddress = (address = '', start = 8, end = 4) => `${address.substring(0, start)}...${address.slice(-end)}`;
+
 export const getWeiAmountForDecimals = (amount: string | number, decimals: number) => new Dec(amount).mul(10 ** decimals).floor().toString();
 
 export const getEthAmountForDecimals = (amount: string | number, decimals: string | number) => new Dec(amount).div(10 ** +decimals).toString();

package/src/types/aaveV4.ts

@@ -52,6 +52,11 @@ export interface AaveV4SpokeInfo {
   value: AaveV4SpokesType,
   url: string,
   address: EthAddress,
+  /**
+   * Known hub addresses, used only to prefetch hub data in parallel with the spoke data.
+   * The on-chain reserves are the source of truth — hubs found there but missing here are
+   * fetched dynamically, so this list going stale can't break spoke loading.
+   */
   hubs: EthAddress[],
 }