@elizaos/plugin-wallet 2.0.0-beta.1 → 2.0.3-beta.6

package/src/chains/evm/actions/helpers.ts

@@ -29,8 +29,12 @@ export function hasEvmPrivateKey(runtime: IAgentRuntime): boolean {
   return typeof privateKey === "string" && privateKey.startsWith("0x");
 }
 
-export function isConfirmed(options?: Record<string, unknown>): boolean {
-  return options?.confirmed === true;
+/**
+ * LLM-supplied `confirmed` / TOON flags are never trusted (GHSA-rqm7-f4jc-84x3).
+ * Use {@link gateWalletFinancialExecution} from `security/wallet-financial-confirmation.ts`.
+ */
+export function isConfirmed(_options?: Record<string, unknown>): boolean {
+  return false;
 }
 
 function toConfirmationValue(value: unknown): ConfirmationValue {
@@ -71,11 +75,9 @@ export async function confirmationRequired(params: {
 }): Promise<ActionResult> {
   const confirmation = {
     actionName: params.actionName,
-    confirmed: false,
-    parameters: {
-      ...toConfirmationRecord(params.parameters),
-      confirmed: true,
-    },
+    parameters: toConfirmationRecord(params.parameters),
+    instructions:
+      "Reply yes to confirm or no to cancel. Do not set confirmed:true in action parameters.",
   };
 
   const content = {

package/src/chains/evm/actions/swap.ts

@@ -1,11 +1,10 @@
 import type { ActionResult, HandlerCallback, IAgentRuntime, Memory, State } from "@elizaos/core";
-import { requireActionSpec } from "../generated/specs/spec-helpers";
 import {
-  buildSendTxParams,
-  confirmationRequired,
-  createEvmActionValidator,
-  isConfirmed,
-} from "./helpers";
+  gateWalletFinancialExecution,
+  walletFinancialGateActionResult,
+} from "../../../security/wallet-financial-confirmation.js";
+import { requireActionSpec } from "../generated/specs/spec-helpers";
+import { buildSendTxParams, createEvmActionValidator } from "./helpers";
 
 const legacySpec = requireActionSpec("EVM_SWAP");
 const spec = { ...legacySpec, name: "WALLET" };
@@ -27,6 +26,8 @@ import {
   DEFAULT_SLIPPAGE_PERCENT,
   GAS_BUFFER_MULTIPLIER,
   GAS_PRICE_MULTIPLIER,
+  KYBERSWAP_CHAIN_MAP,
+  KYBERSWAP_NATIVE_SENTINEL,
   NATIVE_TOKEN_ADDRESS,
   TX_CONFIRMATION_TIMEOUT_MS,
 } from "../constants";
@@ -37,6 +38,8 @@ import {
   BebopRouteSchema,
   EVMError,
   EVMErrorCode,
+  type KyberSwapRouteData,
+  type KyberSwapRouteSummary,
   parseSwapParams,
   type SupportedChain,
   type SwapParams,
@@ -173,6 +176,9 @@ export class SwapAction {
             case "bebop":
               result = await this.executeBebopQuote(quote, resolvedParams);
               break;
+            case "kyberswap":
+              result = await this.executeKyberSwapQuote(quote, resolvedParams);
+              break;
           }
 
           if (result) {
@@ -242,6 +248,7 @@ export class SwapAction {
     const quotesPromises: Promise<SwapQuote | undefined>[] = [
       this.getLifiQuote(fromAddress, params, fromTokenDecimals, slippage),
       this.getBebopQuote(fromAddress, params, fromTokenDecimals),
+      this.getKyberSwapQuote(fromAddress, params, fromTokenDecimals, slippage),
     ];
 
     const quotesResults = await Promise.all(quotesPromises);
@@ -384,6 +391,68 @@ export class SwapAction {
     }
   }
 
+  private async getKyberSwapQuote(
+    fromAddress: Address,
+    params: SwapParams,
+    fromTokenDecimals: number,
+    slippage: number
+  ): Promise<SwapQuote | undefined> {
+    try {
+      const chainSlug = KYBERSWAP_CHAIN_MAP[params.chain];
+      if (!chainSlug) return undefined;
+
+      const fromToken =
+        params.fromToken === NATIVE_TOKEN_ADDRESS ? KYBERSWAP_NATIVE_SENTINEL : params.fromToken;
+      const toToken =
+        params.toToken === NATIVE_TOKEN_ADDRESS ? KYBERSWAP_NATIVE_SENTINEL : params.toToken;
+      const amountIn = parseUnits(params.amount, fromTokenDecimals).toString();
+
+      const url = new URL(`https://aggregator-api.kyberswap.com/${chainSlug}/api/v1/routes`);
+      url.searchParams.set("tokenIn", fromToken);
+      url.searchParams.set("tokenOut", toToken);
+      url.searchParams.set("amountIn", amountIn);
+      url.searchParams.set("gasInclude", "true");
+      url.searchParams.set("source", "elizaos");
+
+      const res = await fetch(url.toString(), {
+        headers: { "X-Client-Id": "elizaos", Accept: "application/json" },
+      });
+
+      if (!res.ok) throw new Error(`KyberSwap API error: ${res.status}`);
+
+      const data = await res.json();
+      const routeSummary = data?.data?.routeSummary as KyberSwapRouteSummary | undefined;
+      if (!routeSummary?.amountOut) throw new Error("No route found from KyberSwap");
+
+      const slippageBps = Math.round(slippage * 10000);
+      // KyberSwap's quote endpoint returns the expected gross output; the
+      // guaranteed minimum is computed client-side by applying the slippage
+      // tolerance (same math the build endpoint uses internally).
+      const minOut = (BigInt(routeSummary.amountOut) * BigInt(10000 - slippageBps)) / 10000n;
+
+      return {
+        aggregator: "kyberswap",
+        minOutputAmount: minOut.toString(),
+        swapData: {
+          routeSummary,
+          routerAddress: data.data.routerAddress,
+          chainSlug,
+          fromToken,
+          toToken,
+          amountIn,
+          slippageBps,
+          fromAddress,
+        } satisfies KyberSwapRouteData,
+      };
+    } catch (error) {
+      logger.error(
+        "Error in getKyberSwapQuote:",
+        error instanceof Error ? error.message : String(error)
+      );
+      return undefined;
+    }
+  }
+
   private async executeLifiQuote(quote: SwapQuote): Promise<Transaction | undefined> {
     const route = quote.swapData as Route;
     const step = route.steps[0];
@@ -522,6 +591,89 @@ export class SwapAction {
     };
   }
 
+  private async executeKyberSwapQuote(
+    quote: SwapQuote,
+    params: SwapParams
+  ): Promise<Transaction | undefined> {
+    const ks = quote.swapData as KyberSwapRouteData;
+    const walletClient = this.walletProvider.getWalletClient(params.chain);
+    const publicClient = this.walletProvider.getPublicClient(params.chain);
+
+    const account = walletClient.account;
+    if (!account) {
+      throw new EVMError(EVMErrorCode.WALLET_NOT_INITIALIZED, "Wallet account is not available");
+    }
+
+    const buildRes = await fetch(
+      `https://aggregator-api.kyberswap.com/${ks.chainSlug}/api/v1/route/build`,
+      {
+        method: "POST",
+        headers: {
+          "X-Client-Id": "elizaos",
+          "Content-Type": "application/json",
+          Accept: "application/json",
+        },
+        body: JSON.stringify({
+          routeSummary: ks.routeSummary,
+          sender: account.address,
+          recipient: account.address,
+          slippageTolerance: ks.slippageBps,
+          deadline: Math.floor(Date.now() / 1000) + 1200,
+          enableGasEstimation: true,
+          source: "elizaos",
+        }),
+      }
+    );
+
+    if (!buildRes.ok) {
+      throw new Error(`KyberSwap build failed: ${buildRes.status} ${buildRes.statusText}`);
+    }
+
+    const buildData = await buildRes.json();
+    const tx = buildData?.data;
+    if (!tx?.routerAddress || !tx?.data) {
+      throw new Error("Invalid transaction data from KyberSwap build");
+    }
+
+    if (ks.fromToken.toLowerCase() !== KYBERSWAP_NATIVE_SENTINEL.toLowerCase()) {
+      await this.handleTokenApproval(
+        publicClient,
+        walletClient,
+        ks.fromToken as Address,
+        tx.routerAddress as Address,
+        BigInt(ks.amountIn)
+      );
+    }
+
+    const hash = await walletClient.sendTransaction(
+      buildSendTxParams({
+        account,
+        to: tx.routerAddress as Address,
+        value: BigInt(tx.transactionValue ?? "0"),
+        data: tx.data as Hex,
+        chain: walletClient.chain,
+      })
+    );
+
+    const receipt = await publicClient.waitForTransactionReceipt({
+      hash,
+      timeout: TX_CONFIRMATION_TIMEOUT_MS,
+    });
+
+    if (receipt.status === "reverted") {
+      throw new EVMError(EVMErrorCode.CONTRACT_REVERT, `KyberSwap swap reverted. Hash: ${hash}`);
+    }
+
+    return {
+      hash,
+      from: account.address,
+      to: tx.routerAddress as Address,
+      value: BigInt(tx.transactionValue ?? "0"),
+      data: tx.data as Hex,
+      chainId: this.walletProvider.getChainConfigs(params.chain).id,
+    };
+  }
+
   private async handleTokenApproval(
     publicClient: ReturnType<WalletProvider["getPublicClient"]>,
     walletClient: ReturnType<WalletProvider["getWalletClient"]>,
@@ -678,7 +830,7 @@ export const swapAction = {
   descriptionCompressed: spec.descriptionCompressed,
   contexts: ["finance", "crypto", "wallet"],
   contextGate: { anyOf: ["finance", "crypto", "wallet"] },
-  roleGate: { minRole: "USER" },
+  roleGate: { minRole: "ADMIN" },
   parameters: [
     {
       name: "fromToken",
@@ -704,19 +856,13 @@ export const swapAction = {
       required: false,
       schema: { type: "string" },
     },
-    {
-      name: "confirmed",
-      description: "Set true after preview confirmation to submit.",
-      required: false,
-      schema: { type: "boolean", default: false },
-    },
   ],
 
   handler: async (
     runtime: IAgentRuntime,
     message: Memory,
     state?: State,
-    options?: Record<string, unknown>,
+    _options?: Record<string, unknown>,
     callback?: HandlerCallback
   ): Promise<ActionResult> => {
     const walletProvider = await initWalletProvider(runtime);
@@ -727,14 +873,22 @@ export const swapAction = {
 
     const swapOptions = await buildSwapDetails(state, message, runtime, walletProvider);
 
-    if (!isConfirmed(options)) {
-      const preview = `Review EVM swap before submitting: ${swapOptions.amount} ${swapOptions.fromToken} to ${swapOptions.toToken} on ${swapOptions.chain}. Re-invoke ${spec.name} with confirmed: true to submit.`;
-      return confirmationRequired({
-        actionName: spec.name,
-        preview,
-        parameters: swapOptions,
-        callback,
-      });
+    const gate = await gateWalletFinancialExecution({
+      runtime,
+      message,
+      params: {
+        subaction: "swap",
+        chain: swapOptions.chain,
+        amount: swapOptions.amount,
+        fromToken: swapOptions.fromToken,
+        toToken: swapOptions.toToken,
+        mode: "execute",
+        dryRun: false,
+      },
+      callback,
+    });
+    if (!gate.proceed) {
+      return walletFinancialGateActionResult(gate);
     }
 
     const action = new SwapAction(walletProvider);

package/src/chains/evm/actions/transfer.ts

@@ -10,6 +10,14 @@ import {
   type State,
 } from "@elizaos/core";
 import { formatEther, type Hex, parseEther } from "viem";
+import {
+  assertEvmTransferRecipientAuthorized,
+  assertWalletFinancialActionAllowed,
+} from "../../../security/wallet-context-safety.js";
+import {
+  gateWalletFinancialExecution,
+  walletFinancialGateActionResult,
+} from "../../../security/wallet-financial-confirmation.js";
 import { runIntentModel } from "../../../utils/intent-trajectory";
 import { requireActionSpec } from "../generated/specs/spec-helpers";
 import { initWalletProvider, type WalletProvider } from "../providers/wallet";
@@ -22,12 +30,7 @@ import {
   type Transaction,
   type TransferParams,
 } from "../types";
-import {
-  buildSendTxParams,
-  confirmationRequired,
-  createEvmActionValidator,
-  isConfirmed,
-} from "./helpers";
+import { buildSendTxParams, createEvmActionValidator } from "./helpers";
 
 export class TransferAction {
   constructor(private readonly walletProvider: WalletProvider) {}
@@ -134,7 +137,7 @@ export const transferAction: Action = {
   descriptionCompressed: spec.descriptionCompressed,
   contexts: ["finance", "crypto", "wallet", "payments"],
   contextGate: { anyOf: ["finance", "crypto", "wallet", "payments"] },
-  roleGate: { minRole: "USER" },
+  roleGate: { minRole: "ADMIN" },
   parameters: [
     {
       name: "amount",
@@ -160,12 +163,6 @@ export const transferAction: Action = {
       required: false,
       schema: { type: "string" },
     },
-    {
-      name: "confirmed",
-      description: "Set true after preview confirmation to submit.",
-      required: false,
-      schema: { type: "boolean", default: false },
-    },
   ],
 
   handler: async (
@@ -179,18 +176,28 @@ export const transferAction: Action = {
       state = (await runtime.composeState(message)) as State;
     }
 
+    assertWalletFinancialActionAllowed(message, "transfer");
+
     const walletProvider = await initWalletProvider(runtime);
     const paramOptions = await buildTransferDetails(state, message, runtime, walletProvider);
+    assertEvmTransferRecipientAuthorized(message, options, paramOptions.toAddress);
 
-    if (!isConfirmed(options)) {
-      const tokenLabel = paramOptions.token?.trim() || "native token";
-      const preview = `Review EVM transfer before submitting: ${paramOptions.amount} ${tokenLabel} on ${paramOptions.fromChain} to ${paramOptions.toAddress}. Re-invoke ${spec.name} with confirmed: true to submit.`;
-      return confirmationRequired({
-        actionName: spec.name,
-        preview,
-        parameters: paramOptions,
-        callback,
-      });
+    const gate = await gateWalletFinancialExecution({
+      runtime,
+      message,
+      params: {
+        subaction: "transfer",
+        chain: paramOptions.fromChain,
+        amount: paramOptions.amount,
+        recipient: paramOptions.toAddress,
+        fromToken: paramOptions.token,
+        mode: "execute",
+        dryRun: false,
+      },
+      callback,
+    });
+    if (!gate.proceed) {
+      return walletFinancialGateActionResult(gate);
     }
 
     const action = new TransferAction(walletProvider);

package/src/chains/evm/biome.json

@@ -1,6 +1,6 @@
 {
 	"root": false,
-	"$schema": "https://biomejs.dev/schemas/2.4.14/schema.json",
+	"$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
 	"files": {
 		"includes": [
 			"__tests__/**",

package/src/chains/evm/build.ts

@@ -3,6 +3,11 @@
 import { existsSync } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const rmPathRecursive = fileURLToPath(
+  new URL("../../../../../packages/scripts/rm-path-recursive.mjs", import.meta.url)
+);
 
 async function runBuild(): Promise<boolean> {
   console.log("Building @elizaos/plugin-wallet evm chain...");
@@ -10,7 +15,7 @@ async function runBuild(): Promise<boolean> {
   const distDir = join(process.cwd(), "dist");
 
   if (existsSync(distDir)) {
-    await Bun.$`rm -rf ${distDir}`;
+    await Bun.$`node ${rmPathRecursive} ${distDir}`;
   }
 
   await mkdir(distDir, { recursive: true });

package/src/chains/evm/constants.ts

@@ -10,6 +10,7 @@ export const TX_CONFIRMATION_TIMEOUT_MS = 60000;
 export const BRIDGE_POLL_INTERVAL_MS = 5000;
 export const MAX_BRIDGE_POLL_ATTEMPTS = 60 as const;
 export const NATIVE_TOKEN_ADDRESS = "0x0000000000000000000000000000000000000000" as const;
+export const KYBERSWAP_NATIVE_SENTINEL = "0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE" as const;
 
 export const BEBOP_CHAIN_MAP: Readonly<Record<string, string>> = {
   mainnet: "ethereum",
@@ -20,4 +21,22 @@ export const BEBOP_CHAIN_MAP: Readonly<Record<string, string>> = {
   linea: "linea",
 } as const;
 
+export const KYBERSWAP_CHAIN_MAP: Readonly<Record<string, string>> = {
+  mainnet: "ethereum",
+  arbitrum: "arbitrum",
+  base: "base",
+  polygon: "polygon",
+  optimism: "optimism",
+  bsc: "bsc",
+  linea: "linea",
+  avalanche: "avalanche",
+  mantle: "mantle",
+  zksync: "zksync",
+  scroll: "scroll",
+  blast: "blast",
+  mode: "mode",
+  sonic: "sonic",
+  berachain: "berachain",
+} as const;
+
 export const DEFAULT_CHAINS = ["mainnet", "base", "bsc"] as const;