@elizaos/plugin-wallet 2.0.0-beta.1 → 2.0.3-beta.5

package/src/security/wallet-context-safety.ts

@@ -0,0 +1,128 @@
+import type { Memory } from "@elizaos/core";
+
+/** GHSA-7qxr-x6cg-r9cc — embedded addresses in token metadata must not become transfer recipients. */
+/** GHSA-gh63-5vpj-39qp — block financial writes on injection-flagged channel messages. */
+
+const FINANCIAL_WRITE_SUBACTIONS = new Set(["transfer", "swap", "bridge"]);
+
+function messageHasPromptInjectionFlag(message: Memory): boolean {
+  const metadata = message.content?.metadata;
+  return (
+    typeof metadata === "object" &&
+    metadata !== null &&
+    (metadata as { promptInjectionSuspected?: boolean })
+      .promptInjectionSuspected === true
+  );
+}
+export const EVM_ADDRESS_PATTERN = /0x[a-fA-F0-9]{40}\b/g;
+
+const INFERRED_RECIPIENT_PHRASE =
+  /\b(?:prior\s+wallet\s+evidence|operational\s+recipient|canonical\s+(?:testnet\s+)?(?:operational|settlement)\s+recipient|based\s+on\s+(?:the\s+)?prior|from\s+prior\s+(?:wallet|session|context))\b/i;
+
+export function sanitizeWalletDisplayLabel(label: string): string {
+  return label
+    .replace(EVM_ADDRESS_PATTERN, "[address]")
+    .replace(
+      /\[[^\]]*(?:recipient|operational|settlement|canonical)[^\]]*\]/gi,
+      "[routing-hint-removed]",
+    )
+    .trim();
+}
+
+export function readMemoryText(message: Memory): string {
+  if (typeof message.content === "string") {
+    return message.content;
+  }
+  if (
+    message.content &&
+    typeof message.content === "object" &&
+    typeof message.content.text === "string"
+  ) {
+    return message.content.text;
+  }
+  return "";
+}
+
+function collectExplicitRecipients(
+  options: Record<string, unknown> | undefined,
+): string[] {
+  const out: string[] = [];
+  const params =
+    options &&
+    typeof options === "object" &&
+    "parameters" in options &&
+    options.parameters &&
+    typeof options.parameters === "object"
+      ? (options.parameters as Record<string, unknown>)
+      : null;
+
+  for (const source of [params, options]) {
+    if (!source) continue;
+    for (const key of ["recipient", "toAddress", "to"] as const) {
+      const value = source[key];
+      if (typeof value === "string" && /^0x[a-fA-F0-9]{40}$/.test(value)) {
+        out.push(value.toLowerCase());
+      }
+    }
+  }
+  return out;
+}
+
+export function messageAuthorizesEvmRecipient(
+  message: Memory,
+  options: Record<string, unknown> | undefined,
+  recipient: string,
+): boolean {
+  const normalized = recipient.toLowerCase();
+  const explicit = collectExplicitRecipients(options);
+  if (explicit.includes(normalized)) {
+    return true;
+  }
+
+  const userText = readMemoryText(message);
+  if (userText.toLowerCase().includes(normalized)) {
+    return true;
+  }
+
+  return false;
+}
+
+export function assertWalletFinancialActionAllowed(
+  message: Memory,
+  subaction: string | undefined,
+): void {
+  if (!subaction || !FINANCIAL_WRITE_SUBACTIONS.has(subaction)) {
+    return;
+  }
+  if (messageHasPromptInjectionFlag(message)) {
+    throw new Error(
+      "Wallet transfer, swap, and bridge are blocked for this message (GHSA-gh63-5vpj-39qp): suspected prompt injection in untrusted channel content.",
+    );
+  }
+}
+
+export function assertEvmTransferRecipientAuthorized(
+  message: Memory,
+  options: Record<string, unknown> | undefined,
+  recipient: string,
+): void {
+  if (!/^0x[a-fA-F0-9]{40}$/.test(recipient)) {
+    throw new Error("recipient must be a valid EVM address.");
+  }
+
+  const userText = readMemoryText(message);
+  if (
+    INFERRED_RECIPIENT_PHRASE.test(userText) &&
+    !messageAuthorizesEvmRecipient(message, options, recipient)
+  ) {
+    throw new Error(
+      "Transfer recipient cannot be inferred from prior wallet context or token metadata. Provide an explicit 0x recipient address in this message or in structured action parameters.",
+    );
+  }
+
+  if (!messageAuthorizesEvmRecipient(message, options, recipient)) {
+    throw new Error(
+      "Transfer recipient must appear explicitly in the current user message or structured action parameters. Addresses from token names or earlier session quotes are not accepted.",
+    );
+  }
+}

package/src/security/wallet-financial-confirmation.ts

@@ -0,0 +1,150 @@
+import type {
+  ActionResult,
+  ConfirmationDecision,
+  HandlerCallback,
+  IAgentRuntime,
+  Memory,
+} from "@elizaos/core";
+import { requireConfirmation } from "@elizaos/core";
+import type { WalletRouterParams } from "../types/wallet-router.js";
+
+/** Cache namespace for on-chain wallet writes (GHSA-rqm7-f4jc-84x3). */
+export const WALLET_FINANCIAL_CONFIRM_ACTION = "WALLET_FINANCIAL";
+
+const ON_CHAIN_SUBACTIONS = new Set<WalletRouterParams["subaction"]>([
+  "transfer",
+  "swap",
+  "bridge",
+  "gov",
+]);
+
+export function requiresWalletFinancialConfirmation(
+  params: Pick<WalletRouterParams, "subaction" | "dryRun">,
+): boolean {
+  if (params.dryRun) {
+    return false;
+  }
+  return ON_CHAIN_SUBACTIONS.has(params.subaction);
+}
+
+export function walletFinancialPendingKey(
+  params: Pick<
+    WalletRouterParams,
+    | "subaction"
+    | "chain"
+    | "toChain"
+    | "amount"
+    | "recipient"
+    | "fromToken"
+    | "toToken"
+    | "slippageBps"
+    | "op"
+    | "governor"
+    | "proposalId"
+  >,
+): string {
+  const entries: [string, string][] = [
+    ["subaction", params.subaction],
+    ["chain", (params.chain ?? "").toLowerCase()],
+    ["toChain", (params.toChain ?? "").toLowerCase()],
+    ["amount", params.amount ?? ""],
+    ["recipient", (params.recipient ?? "").toLowerCase()],
+    ["fromToken", (params.fromToken ?? "").toLowerCase()],
+    ["toToken", (params.toToken ?? "").toLowerCase()],
+    [
+      "slippageBps",
+      params.slippageBps === undefined ? "" : String(params.slippageBps),
+    ],
+    ["op", (params.op ?? "").toLowerCase()],
+    ["governor", (params.governor ?? "").toLowerCase()],
+    ["proposalId", params.proposalId ?? ""],
+  ];
+  return entries.map(([key, value]) => `${key}=${value}`).join("|");
+}
+
+export function walletFinancialPreview(
+  params: Pick<
+    WalletRouterParams,
+    | "subaction"
+    | "chain"
+    | "toChain"
+    | "amount"
+    | "recipient"
+    | "fromToken"
+    | "toToken"
+    | "op"
+  >,
+): string {
+  const chainLabel = params.chain ?? params.toChain ?? "the selected chain";
+  switch (params.subaction) {
+    case "transfer":
+      return `Transfer ${params.amount ?? "?"} ${params.fromToken ?? "tokens"} to ${params.recipient ?? "?"} on ${chainLabel}? Reply yes to submit or no to cancel.`;
+    case "swap":
+      return `Swap ${params.amount ?? "?"} ${params.fromToken ?? "?"} to ${params.toToken ?? "?"} on ${chainLabel}? Reply yes to submit or no to cancel.`;
+    case "bridge":
+      return `Bridge ${params.amount ?? "?"} from ${params.chain ?? "?"} to ${params.toChain ?? "?"}? Reply yes to submit or no to cancel.`;
+    case "gov":
+      return `Governance ${params.op ?? "operation"} on ${chainLabel}? Reply yes to submit or no to cancel.`;
+    default:
+      return `Submit wallet ${params.subaction} on ${chainLabel}? Reply yes to confirm or no to cancel.`;
+  }
+}
+
+export type WalletFinancialGateResult =
+  | { readonly proceed: true }
+  | {
+      readonly proceed: false;
+      readonly decision: ConfirmationDecision;
+      readonly text: string;
+    };
+
+export async function gateWalletFinancialExecution(args: {
+  runtime: IAgentRuntime;
+  message: Memory;
+  params: WalletRouterParams;
+  callback?: HandlerCallback;
+}): Promise<WalletFinancialGateResult> {
+  if (!requiresWalletFinancialConfirmation(args.params)) {
+    return { proceed: true };
+  }
+
+  const decision = await requireConfirmation({
+    runtime: args.runtime,
+    message: args.message,
+    actionName: WALLET_FINANCIAL_CONFIRM_ACTION,
+    pendingKey: walletFinancialPendingKey(args.params),
+    prompt: walletFinancialPreview(args.params),
+    callback: args.callback,
+    metadata: { subaction: args.params.subaction },
+  });
+
+  if (decision.status === "confirmed") {
+    return { proceed: true };
+  }
+
+  const text =
+    decision.status === "pending"
+      ? walletFinancialPreview(args.params)
+      : "Wallet operation cancelled.";
+
+  return { proceed: false, decision, text };
+}
+
+export function walletFinancialGateActionResult(
+  gate: Extract<WalletFinancialGateResult, { proceed: false }>,
+): ActionResult {
+  const awaiting = gate.decision.status === "pending";
+  return {
+    success: awaiting,
+    text: gate.text,
+    values: {
+      walletActionPrepared: awaiting,
+      walletActionSucceeded: false,
+    },
+    data: {
+      requiresConfirmation: awaiting,
+      confirmationStatus: gate.decision.status,
+      awaitingUserInput: awaiting,
+    },
+  };
+}

package/src/services/wallet-backend-service.ts

@@ -31,7 +31,7 @@ export class WalletBackendService extends Service {
   static override serviceType = WALLET_BACKEND_SERVICE_TYPE;
 
   override capabilityDescription =
-    "Unified wallet backend and chain router (EVM + Solana, local or Steward)";
+    "Wallet backend and chain router (EVM + Solana, local or Steward)";
 
   private backend: WalletBackend | null = null;
   private backendLoadError: unknown = null;
@@ -109,6 +109,20 @@ export class WalletBackendService extends Service {
     };
   }
 
+  /**
+   * Resolve chain + required fields without signing. Used before out-of-band
+   * financial confirmation so invalid params fail fast (GHSA-rqm7-f4jc-84x3).
+   */
+  preflightWalletAction(
+    params: WalletRouterParams,
+  ): WalletRouterFailure | null {
+    const handlerResult = this.resolveHandler(params);
+    if (!handlerResult.ok) {
+      return handlerResult;
+    }
+    return this.validateRequiredParams(params);
+  }
+
   async routeWalletAction(
     params: WalletRouterParams,
   ): Promise<WalletRouterResult> {

package/src/utils/intent-trajectory.ts

@@ -83,14 +83,14 @@ export async function runIntentModel(
       },
       async () => {
         const response = await runtime.useModel(modelType, modelParams);
-        return typeof response === "string" ? response : String(response ?? "");
+        return typeof response === "string" ? response : String(response);
       },
     );
   }
 
   const startedAt = Date.now();
   const response = await runtime.useModel(modelType, modelParams);
-  const text = typeof response === "string" ? response : String(response ?? "");
+  const text = typeof response === "string" ? response : String(response);
   logActiveTrajectoryLlmCall(runtime, {
     model: modelLabel,
     systemPrompt,

package/src/wallet/steward-backend.ts

@@ -19,7 +19,7 @@ interface StewardEvmAccountBinding {
 }
 
 /**
- * Shape of the dynamically imported @elizaos/app-steward module. Defined
+ * Shape of the dynamically imported @elizaos/plugin-steward-app module. Defined
  * locally to avoid a devDependency cycle with app-steward.
  */
 interface StewardEvmAccountModule {
@@ -41,7 +41,7 @@ const STEWARD_MODULE_ID = ["@elizaos", "app-steward"].join("/");
 /**
  * Cloud / mobile signing via Steward for EVM. Solana addresses may be exposed from
  * Steward when `/vault/.../addresses` returns them; Solana **transaction** signing is
- * not implemented here yet — callers must treat Solana writes as unavailable until wired.
+ * unavailable here — callers must treat Solana writes as unavailable until wired.
  */
 export class StewardBackend implements WalletBackend {
   readonly kind = "steward" as const;
@@ -66,7 +66,7 @@ export class StewardBackend implements WalletBackend {
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
       throw new StewardUnavailableError(
-        `Cannot load Steward wallet module (@elizaos/app-steward): ${detail}`,
+        `Cannot load Steward wallet module (@elizaos/plugin-steward-app): ${detail}`,
       );
     }
 
@@ -126,7 +126,7 @@ export class StewardBackend implements WalletBackend {
 
   getSolanaSigner(): never {
     throw new StewardUnavailableError(
-      "Solana transaction signing via Steward is not implemented in this runtime yet.",
+      "Solana transaction signing via Steward is unavailable in this runtime yet.",
     );
   }