@deserialize/multi-vm-wallet 1.4.2 → 1.4.12

package/utils/savings/saving-actions.ts

@@ -0,0 +1,92 @@
+// import { EVMDeriveChildPrivateKey } from "../walletBip32";
+// import { ethers } from "ethers";
+// import { WalletClient, PublicClient, Hex, Chain } from "viem";
+// import { } from "../utils";
+// import { ChainWalletConfig, TransactionResult } from "../types";
+// import { getNativeBalance, sendERC20Token, sendNativeToken } from "../evm";
+// import { fetchPrices } from "../price";
+// import { privateKeyToAccount } from "viem/accounts";
+
+// /**
+//  * Handles multi-pocket savings accounts for an EVM wallet
+//  */
+// export class BaseSavingsManager {
+//     private mnemonic: string;
+//     private walletIndex: number;
+//     chain: ChainWalletConfig
+//     private pockets: Map<number, { privateKey: string; address: string; derivationPath: string }> = new Map();
+
+//     constructor(mnemonic: string, walletIndex: number = 0, chain: ChainWalletConfig) {
+//         this.mnemonic = mnemonic;
+//         this.chain = chain
+//         this.walletIndex = walletIndex;
+//     }
+
+
+
+//     /**
+//      * Derive a pocket (savings account) at accountIndex
+//      */
+//     derivePocket(accountIndex: number) {
+//         const derivationPath = `m/44'/60'/${accountIndex}'/0/${this.walletIndex}`;
+//         const { privateKey } = EVMDeriveChildPrivateKey(this.mnemonic, this.walletIndex, `m/44'/60'/${accountIndex}'/0/`);
+//         const wallet = new ethers.Wallet(privateKey);
+
+//         const pocket = { privateKey, address: wallet.address, derivationPath };
+//         this.pockets.set(accountIndex, pocket);
+//         return pocket;
+//     }
+
+//     getPocket(accountIndex: number) {
+//         if (!this.pockets.has(accountIndex)) {
+//             return this.derivePocket(accountIndex);
+//         }
+//         return this.pockets.get(accountIndex)!;
+//     }
+//     async transferToPocket(
+//         mainWallet: WalletClient,
+//         client: PublicClient,
+//         accountIndex: number,
+//         amount: string
+//     ): Promise<TransactionResult> {
+//         const pocket = this.getPocket(accountIndex);
+//         return await sendNativeToken(mainWallet, client, pocket.address as Hex, amount, 5);
+//     }
+
+//     async transferTokenToPocket(
+//         mainWallet: WalletClient,
+//         client: PublicClient,
+//         tokenAddress: string,
+//         accountIndex: number,
+//         amount: bigint
+//     ): Promise<TransactionResult> {
+//         const pocket = this.getPocket(accountIndex);
+//         return await sendERC20Token(mainWallet, client, tokenAddress as Hex, pocket.address as Hex, amount, 5);
+//     }
+
+//     verifyPocketAddress(accountIndex: number, storedAddress: string) {
+//         const pocket = this.getPocket(accountIndex);
+//         return pocket.address.toLowerCase() === storedAddress.toLowerCase();
+//     }
+// }
+
+// export class SavingsManager extends BaseSavingsManager {
+
+//     constructor(mnemonic: string, walletIndex: number = 0, chain: ChainWalletConfig) {
+//         super(mnemonic, walletIndex, chain)
+//     }
+//     getTotalTokenBalanceOfAllPockets(tokens: string[], pockets: number[]) {
+
+//         const balances = pockets.map((p: number) => { })
+//     }
+
+//     getPocketTokenBalance(tokens: string[], pocket: number) {
+//         const account = privateKeyToAccount(`0x${this.derivePocket(pocket).privateKey}`)
+//         const balances = tokens.map((t: string) => {
+//             const nativeBalance = getNativeBalance(account.address)
+
+
+//         })
+//     }
+
+// }

package/utils/savings/savings-manager.ts

@@ -0,0 +1,271 @@
+/**
+ * Savings Manager
+ *
+ * Core logic for managing BIP-44 derived savings accounts.
+ * Provides security-first operations that always derive addresses from account indices.
+ *
+ * Security Model:
+ * - NEVER trust stored addresses without verification
+ * - ALWAYS derive addresses from accountIndex for transactions
+ * - Provide verification and audit tools for tamper detection
+ */
+
+import { Hex } from "viem";
+import { EVMVM } from "../evm/evm";
+import { SVMVM } from "../svm/svm";
+import { VM } from "../vm";
+import {
+    SavingsAccount,
+    AddressVerificationResult,
+    SavingsAuditResult,
+    TransferToSavingsOptions,
+    WithdrawFromSavingsOptions
+} from "./types";
+
+// ============================================
+// SavingsManager Class
+// ============================================
+
+/**
+ * Manages BIP-44 derived savings accounts
+ *
+ * This class provides:
+ * 1. Account derivation from BIP-44 account indices
+ * 2. Address verification to prevent database tampering
+ * 3. Transaction builders for deposits and withdrawals
+ * 4. Batch auditing of stored addresses
+ */
+export class SavingsManagerOld {
+    private vm: VM<any, any, any>;
+
+    constructor(vm: VM<any, any, any>) {
+        this.vm = vm;
+    }
+
+    /**
+     * Create a new savings account by deriving from account index
+     *
+     * @param accountIndex - BIP-44 account index (1+ for savings, 0 is main wallet)
+     * @returns SavingsAccount with derived private key and address
+     *
+     * @example
+     * const savingsAccount = manager.createSavingsAccount(1); // First savings account
+     * console.log(savingsAccount.address); // Derived address
+     * console.log(savingsAccount.derivationPath); // m/44'/60'/1'/0/0
+     */
+    createSavingsAccount(accountIndex: number): SavingsAccount {
+        if (accountIndex < 0) {
+            throw new Error("Account index must be non-negative");
+        }
+
+        const derived = this.vm.deriveSavingsAccount(accountIndex);
+
+        // For EVM, the address is a string (Hex)
+        // For SVM, the address is a PublicKey
+        let addressHex: Hex;
+        let privateKeyHex: Hex;
+
+        if (this.vm instanceof EVMVM) {
+            addressHex = derived.address as Hex;
+            privateKeyHex = (derived.privateKey as string).startsWith('0x')
+                ? derived.privateKey as Hex
+                : `0x${derived.privateKey}` as Hex;
+        } else if (this.vm instanceof SVMVM) {
+            // For SVM, convert PublicKey to base58 string
+            addressHex = derived.address.toBase58() as Hex;
+            // For SVM, convert Keypair secret key to hex
+            const keypair = derived.privateKey as any;
+            privateKeyHex = `0x${Buffer.from(keypair.secretKey).toString('hex')}` as Hex;
+        } else {
+            throw new Error("Unsupported VM type");
+        }
+
+        return {
+            accountIndex,
+            privateKey: privateKeyHex,
+            address: addressHex,
+            derivationPath: derived.derivationPath
+        };
+    }
+
+    /**
+     * Verify a stored address matches the derived address for an account index
+     *
+     * Security: This prevents database tampering attacks where an attacker
+     * modifies stored addresses to redirect funds.
+     *
+     * @param accountIndex - The account index to verify
+     * @param storedAddress - The address from storage/database
+     * @returns Verification result with validity flag and details
+     *
+     * @example
+     * const result = manager.verifySavingsAddress(1, storedAddress);
+     * if (!result.isValid) {
+     *     console.error("Address mismatch! Possible tampering:", result.error);
+     * }
+     */
+    verifySavingsAddress(accountIndex: number, storedAddress: Hex): AddressVerificationResult {
+        try {
+            const derived = this.createSavingsAccount(accountIndex);
+
+            const isValid = derived.address.toLowerCase() === storedAddress.toLowerCase();
+
+            return {
+                accountIndex,
+                storedAddress,
+                derivedAddress: derived.address,
+                isValid,
+                error: isValid ? undefined : "Address mismatch - stored address does not match derived address"
+            };
+        } catch (error: any) {
+            return {
+                accountIndex,
+                storedAddress,
+                derivedAddress: "0x0" as Hex,
+                isValid: false,
+                error: `Verification failed: ${error.message}`
+            };
+        }
+    }
+
+    /**
+     * Audit multiple savings addresses at once
+     *
+     * Useful for batch verification of all stored savings addresses.
+     *
+     * @param addresses - Map of accountIndex to stored address
+     * @returns Audit result with summary and per-address details
+     *
+     * @example
+     * const addresses = new Map([
+     *     [1, "0xabc..."],
+     *     [2, "0xdef..."]
+     * ]);
+     * const audit = manager.auditSavingsAddresses(addresses);
+     * console.log(`Valid: ${audit.valid}/${audit.total}`);
+     */
+    auditSavingsAddresses(addresses: Map<number, Hex>): SavingsAuditResult {
+        const results: AddressVerificationResult[] = [];
+
+        for (const [accountIndex, storedAddress] of addresses.entries()) {
+            const result = this.verifySavingsAddress(accountIndex, storedAddress);
+            results.push(result);
+        }
+
+        const valid = results.filter(r => r.isValid).length;
+        const invalid = results.filter(r => !r.isValid).length;
+
+        return {
+            total: results.length,
+            valid,
+            invalid,
+            allValid: invalid === 0,
+            results,
+            timestamp: new Date()
+        };
+    }
+
+    /**
+     * Build transaction parameters for depositing to savings
+     *
+     * Security: Always derives the destination address from accountIndex.
+     * Optional expectedAddress parameter allows tamper detection.
+     *
+     * @param accountIndex - Savings account to deposit to
+     * @param amount - Amount to transfer (in base units)
+     * @param options - Optional security and priority settings
+     * @returns Transaction parameters (to, value, data)
+     *
+     * @example
+     * const txParams = manager.buildDepositTransaction(1, parseEther("1.0"), {
+     *     expectedAddress: storedAddress // Verify it matches derived
+     * });
+     */
+    buildDepositTransaction(
+        accountIndex: number,
+        amount: bigint,
+        options?: TransferToSavingsOptions
+    ): { to: Hex; value: bigint; data?: Hex } {
+        const savingsAccount = this.createSavingsAccount(accountIndex);
+
+        // Security check: if expectedAddress provided, verify it matches
+        if (options?.expectedAddress) {
+            const verification = this.verifySavingsAddress(accountIndex, options.expectedAddress);
+            if (!verification.isValid) {
+                throw new Error(
+                    `Security check failed: Expected address ${options.expectedAddress} ` +
+                    `does not match derived address ${savingsAccount.address}. ` +
+                    `Possible database tampering detected.`
+                );
+            }
+        }
+
+        return {
+            to: savingsAccount.address,
+            value: amount,
+            data: undefined // Simple native transfer
+        };
+    }
+
+    /**
+     * Build transaction parameters for withdrawing from savings
+     *
+     * Security: Uses the derived private key for signing.
+     * Optional expectedAddress parameter verifies the source address.
+     *
+     * @param accountIndex - Savings account to withdraw from
+     * @param to - Destination address
+     * @param amount - Amount to transfer (in base units)
+     * @param options - Optional security and priority settings
+     * @returns Transaction parameters and private key for signing
+     *
+     * @example
+     * const { privateKey, tx } = manager.buildWithdrawalTransaction(
+     *     1, destinationAddress, parseEther("0.5")
+     * );
+     * // Use privateKey to sign the transaction
+     */
+    buildWithdrawalTransaction(
+        accountIndex: number,
+        to: Hex,
+        amount: bigint,
+        options?: WithdrawFromSavingsOptions
+    ): { privateKey: Hex; from: Hex; to: Hex; value: bigint; data?: Hex } {
+        const savingsAccount = this.createSavingsAccount(accountIndex);
+
+        // Security check: if expectedAddress provided, verify it matches
+        if (options?.expectedAddress) {
+            const verification = this.verifySavingsAddress(accountIndex, options.expectedAddress);
+            if (!verification.isValid) {
+                throw new Error(
+                    `Security check failed: Expected address ${options.expectedAddress} ` +
+                    `does not match derived address ${savingsAccount.address}. ` +
+                    `Possible database tampering detected.`
+                );
+            }
+        }
+
+        return {
+            privateKey: savingsAccount.privateKey,
+            from: savingsAccount.address,
+            to,
+            value: amount,
+            data: undefined // Simple native transfer
+        };
+    }
+
+    /**
+     * Get savings account details without exposing private key
+     *
+     * @param accountIndex - The account index
+     * @returns Public account information (address and derivation path only)
+     */
+    getSavingsAccountInfo(accountIndex: number): Omit<SavingsAccount, 'privateKey'> {
+        const account = this.createSavingsAccount(accountIndex);
+        return {
+            accountIndex: account.accountIndex,
+            address: account.address,
+            derivationPath: account.derivationPath
+        };
+    }
+}

package/utils/svm/svm.ts

@@ -83,7 +83,31 @@ export class SVMVM extends VM<PublicKey, Keypair, Connection> {
         return { privateKey, index };
     }
 
-
+    /**
+     * Derive a savings account using BIP-44 account index
+     *
+     * Uses the pattern: m/44'/501'/accountIndex'/0/0
+     * - Main wallet: m/44'/501'/0'/0/0 (account index 0)
+     * - Savings 1: m/44'/501'/1'/0/0 (account index 1)
+     * - Savings 2: m/44'/501'/2'/0/0 (account index 2)
+     *
+     * @param accountIndex - The BIP-44 account index (0 for main, 1+ for savings)
+     * @returns Object containing privateKey (Keypair), address (PublicKey), and derivation path
+     */
+    deriveSavingsAccount(accountIndex: number): { privateKey: Keypair; address: PublicKey; derivationPath: string } {
+        // Use fixed address index 0 for savings accounts
+        // Vary only the account index (3rd position in BIP-44)
+        const derivationPath = `m/44'/501'/${accountIndex}'/0/0`;
+
+        // Derive the keypair using the account index in the path
+        const keypair = SVMDeriveChildPrivateKey(this.seed, 0, `m/44'/501'/${accountIndex}'/0/`);
+
+        return {
+            privateKey: keypair,
+            address: keypair.publicKey,
+            derivationPath
+        };
+    }
 
     static fromMnemonic(mnemonic: string): VM<PublicKey, Keypair, Connection> {
         const seed = VM.mnemonicToSeed(mnemonic)

package/utils/test.ts

@@ -8,7 +8,7 @@ import { Connection, PublicKey, Keypair } from "@solana/web3.js";
 import { SVMChainWallet, SVMVM, } from "./svm";
 import { VM } from "./vm";
 import { ChainWalletConfig } from "./types";
-import { discoverNFTs, EVMChainWallet, EVMVM } from "./evm";
+import { discoverNFTs, EVMChainWallet } from "./evm";
 import { } from "./svm/transactionParsing";
 import { getEVMTransactionHistory } from "./evm/transactionParsing";
 import { createPublicClient, encodeFunctionData, Hex, http, parseAbi, parseUnits, PublicClient, zeroAddress } from "viem";
@@ -22,7 +22,6 @@ import { entryPoint07Address } from "viem/account-abstraction";
 import { KERNEL_V3_3, KernelVersionToAddressesMap } from '@zerodev/sdk/constants';
 import { deserializeSessionKey } from "./evm/aa-service";
 import { toSpendingLimitHook } from "@zerodev/hooks"
-import { SavingsManager } from "./savings";
 // const mnemonic = GenerateNewMnemonic()
 
 
@@ -34,8 +33,8 @@ const pKey = ""
 // const testUserKeyPair = Keypair.fromSecretKey(base58.decode(pKey));
 // const x = testUserKeyPair instanceof Keypair;
 
-const evmPrivKey = ""
-const evmPrivateKeyExposed = ""
+const evmPrivKey = "0xc9ca95aa5f40bae8b0f741ec89acc07b837590b2f9f818d3439df98c6e4f8dbe"
+const evmPrivateKeyExposed = "0x92cccc7792024dcac5992e5d2986dade41770acfd3dab0fe98ee953ed1bf0c3a"
 // const vm = new SVMVM(seed)
 
 
@@ -212,28 +211,6 @@ const testPrice = async () => {
     walletA.getPrices(['0x98d0baa52b2D063E780DE12F615f963Fe8537553']).then(console.log)
 }
 
-const testSavingsPocket = async () => {
-
-
-    const mnemonic = EVMVM.generateMnemonicFromPrivateKey(evmPrivateKeyExposed)
-    console.log('mnemonic: ', mnemonic);
-
-    const savingsManager = new SavingsManager(mnemonic, evmChainConfig, wallet.index)
-
-    const pocket0 = savingsManager.getPocket(0)
-
-    // const deposited = await savingsManager.transferToPocket(walletA.wallet, pocket0.index, "0.00001")
-
-    const balance = await savingsManager.getPocketTokenBalance([], 0)
-    console.log('balance: ', balance);
-
-    // console.log('deposited: ', deposited);
-
-
-}
-
-// testSavingsPocket()
-
 // testPrice()
 
 

package/utils/vm.ts

@@ -2,7 +2,6 @@ import { Balance, ChainWalletConfig, TokenInfo, vmTypes } from "./types";
 import * as bip39 from "@scure/bip39";
 import CryptoJS from "crypto-js";
 import { PriceResponse } from "./price.types";
-import { EntropyToMnemonic, mnemonicToSeed } from "./walletBip32";
 
 // Abstract Base Classes
 export abstract class VM<AddressType, PrivateKeyType, ConnectionType> {
@@ -13,13 +12,13 @@ export abstract class VM<AddressType, PrivateKeyType, ConnectionType> {
         this.type = vm;
         this.seed = seed
     }
-    static mnemonicToSeed = mnemonicToSeed
+    static mnemonicToSeed = (mnemonic: string) => {
+        return Buffer.from(bip39.mnemonicToSeedSync(mnemonic)).toString("hex");
+    }
 
     static generateSalt(): string {
         return CryptoJS.lib.WordArray.random(16).toString(); // 128-bit salt
     }
-
-    static getMnemonicFromEntropy = EntropyToMnemonic
     static deriveKey(
         password: string,
         salt: string,
@@ -66,8 +65,6 @@ export abstract class VM<AddressType, PrivateKeyType, ConnectionType> {
     decryptSeedPhrase = VM.decryptSeedPhrase
 
 
-
-
     abstract derivationPath: string
 
 
@@ -75,5 +72,17 @@ export abstract class VM<AddressType, PrivateKeyType, ConnectionType> {
     abstract generatePrivateKey(index: number, mnemonic?: string, derivationPath?: string): { privateKey: PrivateKeyType, index: number };
     abstract getTokenInfo(tokenAddress: AddressType, connection: ConnectionType): Promise<TokenInfo>
 
-
+    /**
+     * Derive a savings account using BIP-44 account index
+     *
+     * Main wallet uses: m/44'/60'/0'/0/0 (account index 0)
+     * Savings accounts use: m/44'/60'/N'/0/0 (account index N)
+     *
+     * @param accountIndex - The BIP-44 account index (1 for first savings, 2 for second, etc.)
+     * @returns Object containing privateKey, address, and derivation path
+     */
+    abstract deriveSavingsAccount(accountIndex: number): { privateKey: PrivateKeyType; address: AddressType; derivationPath: string };
+
+    // abstract validateAddress(address: AddressType): boolean;
+    // abstract getNativeBalance(address: AddressType, connection: ConnectionType): Promise<Balance>;
 }

package/utils/walletBip32.ts

@@ -84,30 +84,6 @@ export function GenerateNewMnemonic() {
     const mnemonic = bip39.generateMnemonic(wordlist);
     return mnemonic;
 }
-
-export const mnemonicToSeed = (mnemonic: string) => {
-    return Buffer.from(bip39.mnemonicToSeedSync(mnemonic)).toString("hex");
-}
-
-export function EntropyToMnemonic(entropy: string) {
-    const entropyBytes = Buffer.from(entropy);
-
-    // Truncate to valid BIP39 entropy length (16, 20, 24, 28, or 32 bytes)
-    // Default to 16 bytes (12 words) for shortest valid mnemonic
-    const validLength = 16;
-    const truncatedBytes = entropyBytes.length >= validLength
-        ? entropyBytes.slice(0, validLength)
-        : entropyBytes; // If shorter, pad with zeros
-
-    // Pad if necessary
-    if (truncatedBytes.length < validLength) {
-        const padded = Buffer.alloc(validLength, 0);
-        truncatedBytes.copy(padded);
-        return bip39.entropyToMnemonic(padded, wordlist);
-    }
-
-    return bip39.entropyToMnemonic(truncatedBytes, wordlist);
-}
 export function ValidateMnemonic(mnemonic: string) {
     const isValid = bip39.validateMnemonic(mnemonic, wordlist);
     if (!isValid) {

package/dist/savings/saving-manager.d.ts

@@ -1,47 +0,0 @@
-import { WalletClient, PublicClient, Hex } from "viem";
-import { Balance, ChainWalletConfig, TransactionResult } from "../types";
-import { Account } from "viem/accounts";
-/**
- * Handles multi-pocket savings accounts for an EVM wallet
- * @param masterAddress is the address of the wallet that owns this pocket
- * this is for when the mnemonic of this saving manager is created deterministically from the private key
- *
- */
-export declare class BaseSavingsManager {
-    private mnemonic;
-    private walletIndex;
-    chain: ChainWalletConfig;
-    client: PublicClient;
-    private pockets;
-    masterAddress: Hex | undefined;
-    constructor(mnemonic: string, walletIndex: number | undefined, chain: ChainWalletConfig, masterAddress?: Hex);
-    /**
-     * Derive a pocket (savings account) at accountIndex
-     */
-    private derivePocket;
-    getMainWallet(): {
-        privateKey: string;
-        address: string;
-        derivationPath: string;
-    };
-    getMainWalletAddress(): Hex;
-    getPocket(accountIndex: number): {
-        privateKey: string;
-        address: string;
-        derivationPath: string;
-        index: number;
-    };
-    transferToPocket(mainWallet: WalletClient, pocketIndex: number, amount: string): Promise<TransactionResult>;
-    transferTokenToPocket(mainWallet: WalletClient, tokenAddress: string, pocketIndex: number, amount: bigint): Promise<TransactionResult>;
-    verifyPocketAddress(accountIndex: number, storedAddress: string): boolean;
-    accountFromPocketId(p: number): Account;
-}
-export declare class SavingsManager extends BaseSavingsManager {
-    constructor(mnemonic: string, chain: ChainWalletConfig, walletIndex?: number);
-    getTotalTokenBalanceOfAllPockets(tokens: string[], pockets: number[]): void;
-    getPocketTokenBalance(tokens: string[], pocket: number): Promise<{
-        address: Hex | 'native';
-        balance: Balance;
-    }[]>;
-    sendToMainWallet(pocketIndex: number, amountInEther: number, token: Hex | "native"): Promise<TransactionResult>;
-}