@exodus/ethereum-api 10.3.0 → 10.3.1

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [10.3.1](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-api@10.3.0...@exodus/ethereum-api@10.3.1) (2026-11-03)
+
+
+### Bug Fixes
+
+* authenticate EVM replacements and remaining outgoing history ([#9094](https://github.com/ExodusMovement/assets/issues/9094)) ([3cca521](https://github.com/ExodusMovement/assets/commit/3cca521f813fdb5e03c9d0dfaa4030b5c3b17bca))
+
+
+
 ## [10.3.0](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-api@10.2.3...@exodus/ethereum-api@10.3.0) (2026-10-30)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/ethereum-api",
-  "version": "10.3.0",
+  "version": "10.3.1",
   "description": "Transaction monitors, fee monitors, RPC with the blockchain node, and other networking code for Ethereum and EVM-based blockchains",
   "type": "module",
   "main": "src/index.js",
@@ -65,5 +65,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "99c7d9d4aae75358a0269479e056e5785fbad5ed"
+  "gitHead": "cc266df454f96bb8efd03909701476c54985e3d7"
 }

package/src/hooks/monitor.js

@@ -54,7 +54,7 @@ export const createEthereumHooks = ({
   const addresses = new Map()
   const generations = new Map()
   const commits = new Map()
-  const afterTickHook = async ({ walletAccount, refresh = false }) => {
+  const afterTickHook = async ({ walletAccount, refresh = false, monitor }) => {
     // Order requests at entry, not after address discovery: discovery itself can
     // be delayed while a newer explicit refresh is already running.
     const accountKey = String(walletAccount)
@@ -126,6 +126,7 @@ export const createEthereumHooks = ({
           processTxLog({
             asset,
             assetClientInterface,
+            monitor,
             walletAccount,
             batch,
           })

package/src/transaction-authentication.js

@@ -0,0 +1,93 @@
+import { verifyTransactionSignature } from '@exodus/ethereum-lib'
+import assert from 'minimalistic-assert'
+
+export async function fetchAuthenticatedTransaction({
+  baseAsset,
+  txId,
+  address,
+  server = baseAsset.server,
+  missingTransactionMessage = 'Signed transaction is required',
+}) {
+  assert(typeof address === 'string', 'Wallet address is required for authentication')
+  const transaction = await server.getTransactionByHash(txId)
+  assert(transaction, missingTransactionMessage)
+  assert(
+    verifyTransactionSignature({
+      transaction,
+      txId,
+      address,
+      chainId: baseAsset.chainId,
+    }),
+    `Cannot authenticate transaction ${txId}`
+  )
+  return transaction
+}
+
+export function rpcInteger(value) {
+  const integer = BigInt(value)
+  const number = Number(integer)
+  assert(Number.isSafeInteger(number) && number >= 0, 'Transaction integer exceeds safe range')
+  return number
+}
+
+// A signed envelope authenticates these fields. Receipts, token events, internal
+// transfers and inclusion status are separate execution claims, not signed data.
+export async function authenticateHistoryTransactions({
+  transactions,
+  baseAsset,
+  address,
+  server = baseAsset.server,
+}) {
+  const authenticated = []
+  const cache = new Map()
+  for (const item of transactions) {
+    if (item.from?.toLowerCase() !== address.toLowerCase()) {
+      authenticated.push(item)
+      continue
+    }
+    let signed = cache.get(item.hash)
+    if (!signed) {
+      signed = await fetchAuthenticatedTransaction({ baseAsset, txId: item.hash, address, server })
+      cache.set(item.hash, signed)
+    }
+    authenticated.push({
+      ...item,
+      hash: signed.hash,
+      from: signed.from.toLowerCase(),
+      to: signed.to?.toLowerCase() ?? null,
+      value: BigInt(signed.value).toString(),
+      nonce: rpcInteger(signed.nonce),
+      gas: rpcInteger(signed.gas),
+      input: signed.input,
+    })
+  }
+  return authenticated
+}
+
+export async function authenticateReplacement({ baseAsset, tx, address }) {
+  const signed = await fetchAuthenticatedTransaction({
+    baseAsset,
+    txId: tx.txId,
+    address,
+    missingTransactionMessage: `ERR_BUMP_TX_DROPPED: transaction ${tx.txId} is no longer available`,
+  })
+  const type = rpcInteger(signed.type ?? '0x0')
+  // The current replacement serializer supports legacy and fee-market envelopes.
+  // Never silently discard access lists, blob commitments or 7702 authorizations.
+  assert([0, 2].includes(type), 'Unsupported replacement transaction envelope')
+  assert(!signed.accessList?.length, 'Cannot replace a transaction with an access list')
+  const nonce = rpcInteger(signed.nonce)
+  const gasLimit = rpcInteger(signed.gas)
+  const gasPrice = BigInt(type === 2 ? signed.maxFeePerGas : signed.gasPrice)
+  const pricingTx = tx.update({
+    feeAmount: baseAsset.currency.baseUnit(gasPrice * BigInt(gasLimit)),
+    data: {
+      ...tx.data,
+      nonce,
+      gasLimit,
+      gasPrice: gasPrice.toString(),
+      tipGasPrice: type === 2 ? BigInt(signed.maxPriorityFeePerGas).toString() : undefined,
+    },
+  })
+  return { signed, nonce, gasLimit, pricingTx }
+}

package/src/tx-create.js

@@ -1,5 +1,4 @@
 import {
-  assertValidTxValue,
   currency2buffer,
   getHighestIncentiveTxByNonce,
   isEthereumLikeToken,
@@ -7,6 +6,7 @@ import {
 import createEthereumJsTx from '@exodus/ethereum-lib/src/unsigned-tx/create-ethereumjs-tx.js'
 import assert from 'minimalistic-assert'
 
+import { authenticateReplacement } from './transaction-authentication.js'
 import { ensureSaneEip1559GasPriceForTipGasPrice } from './fee-utils.js'
 import { fetchGasLimit } from './gas-estimation.js'
 import { getAggregateTransactionPricing, getExtraFeeData } from './get-fee.js'
@@ -17,6 +17,7 @@ import {
   resolveTxAttributesByTxType,
   resolveTxFromAddress,
   resolveTxNonce,
+  TX_TYPE_CREATE_CONTRACT,
   TX_TYPE_TRANSFER,
 } from './tx-type/index.js'
 
@@ -327,86 +328,45 @@ const createBumpUnsignedTx = async ({
 
   const baseAsset = asset.baseAsset
   const replacedTx = baseAssetTxLog.get(bumpTxId)
-  const assets = await assetClientInterface.getAssetsForNetwork({ baseAssetName: baseAsset.name })
   if (!replacedTx || !replacedTx.pending) {
     throw new Error(`Cannot bump transaction ${bumpTxId}: not found or confirmed`)
   }
 
-  let replacedTokenTx
-  if (replacedTx.tokens.length > 0) {
-    const [tokenAssetName] = replacedTx.tokens
-    const tokenTxSet = await assetClientInterface.getTxLog({
-      assetName: tokenAssetName,
-      walletAccount,
-    })
-    replacedTokenTx = tokenTxSet.get(bumpTxId)
-
-    if (replacedTokenTx) {
-      // Attempt to overwrite the asset to reflect the fact that
-      // we're performing a token transaction.
-      asset = assets[tokenAssetName]
-      if (!asset) {
-        throw new Error(
-          `unable to find ${tokenAssetName} during token bump transaction: asset was not available in assetsForNetwork`
-        )
-      }
-    }
-  }
-
-  const sourceTx = replacedTokenTx || replacedTx
-  const toAddress = sourceTx.to
-
-  // For self-sends `coinAmount` is `0` (correct for balance accounting, the
-  // wallet's net delta really is zero), so we can't reconstruct the on-chain
-  // value from it. Recover from `data.rawCoinAmount`, which the tx-log
-  // writers persist alongside `coinAmount` for exactly this purpose.
-  if (sourceTx.selfSend && !sourceTx.data?.rawCoinAmount) {
-    throw new Error(
-      `Cannot bump self-send transaction ${bumpTxId}: original transfer amount is unrecoverable from the tx log (data.rawCoinAmount missing). Re-broadcast the send with a higher fee instead.`
-    )
-  }
-
-  const amount = sourceTx.data?.rawCoinAmount
-    ? asset.currency.baseUnit(sourceTx.data.rawCoinAmount)
-    : sourceTx.coinAmount.negate()
-
-  const txValue = assertValidTxValue({
-    asset,
-    amount,
-    txValue: replacedTx.data?.rawCoinAmount
-      ? baseAsset.currency.baseUnit(replacedTx.data.rawCoinAmount)
-      : replacedTx.coinAmount.negate(),
+  const walletAddress = await assetClientInterface.getReceiveAddress({
+    assetName: baseAsset.name,
+    walletAccount,
   })
-
-  const isDuplex = Boolean(replacedTokenTx && txValue.gt(baseAsset.currency.ZERO))
-
-  const txInput = replacedTx.data.data || '0x'
-
-  const isTokenTx =
-    !isDuplex /* nonpayable */ &&
-    replacedTokenTx &&
-    Object.keys(asset.contract.methodIds).includes(txInput.slice(0, 10))
-
-  const txToAddress = isTokenTx ? asset.contract.address : undefined
-
-  const replacedTxNonce = replacedTx.data.nonce
-
   assert(
-    Number.isInteger(replacedTxNonce),
-    `Cannot bump transaction ${bumpTxId}: data object seems to be corrupted`
+    fromAddress.toLowerCase() === walletAddress.toLowerCase(),
+    'Replacement sender must be the wallet address'
   )
-
-  // If we have evaluated a bump transaction and the `providedNonce` differs
-  // from the `bumpNonce`, we've encountered a conflict and cannot respect
-  // the caller's request.
-  if (maybeProvidedNonce && maybeProvidedNonce !== replacedTxNonce) {
+  const { signed, nonce, gasLimit, pricingTx } = await authenticateReplacement({
+    baseAsset,
+    tx: replacedTx,
+    address: fromAddress,
+  })
+  if (maybeProvidedNonce !== undefined && maybeProvidedNonce !== nonce) {
     throw new Error('incorrect nonce for replacement transaction')
   }
-
-  const nonce = maybeProvidedNonce ?? replacedTxNonce
-
+  // Reuse the exact signed call. In particular, never reconstruct token calldata
+  // from indexer effects or use a tx-log recipient as the outer destination.
+  const txInput = signed.input
+  const txToAddress = signed.to ?? null
+  const txValue = baseAsset.currency.baseUnit(BigInt(signed.value))
+  let toAddress = txToAddress
+  let amount = asset === baseAsset ? txValue : asset.currency.ZERO
+  if (
+    asset !== baseAsset &&
+    asset.contract?.address.toLowerCase() === txToAddress?.toLowerCase() &&
+    Object.hasOwn(asset.contract.methodIds, txInput.slice(0, 10))
+  ) {
+    const { method, values } = asset.contract.decodeInput(Buffer.from(txInput.slice(2), 'hex'))
+    if (method === 'transfer' || method === 'approve') {
+      toAddress = values[0]
+      amount = asset.currency.baseUnit(values[1])
+    }
+  }
   await verifyBumpTxCanReplace({ baseAsset, bumpTxId, fromAddress, nonce })
-
   const resolvedTxAttributes = await resolveTxAttributesByTxType({
     asset,
     assetClientInterface,
@@ -416,36 +376,46 @@ const createBumpUnsignedTx = async ({
     txInput,
     toAddress,
     txToAddress,
-    txType,
+    txType: txToAddress === null ? TX_TYPE_CREATE_CONTRACT : TX_TYPE_TRANSFER,
     txValue,
     walletAccount,
   })
 
-  const gasLimit = replacedTx.data.gasLimit
-
-  const maybeTxToReplace = await getHighestIncentiveTxByNonce({
+  const prices = await resolveTxFactoryGasPrices({
     assetClientInterface,
-    asset,
-    nonce: resolvedTxAttributes.nonce,
-    walletAccount,
+    baseAsset,
+    feeData,
+    nonce,
+    txToReplace: pricingTx,
   })
+  const { eip1559Enabled } = prices
+  let { resolvedGasPrice: gasPrice, resolvedTipGasPrice: tipGasPrice } = prices
 
-  assert(
-    maybeTxToReplace,
-    `unable to resolve pending transaction for nonce ${resolvedTxAttributes.nonce}`
-  )
-
-  const {
-    eip1559Enabled,
-    resolvedGasPrice: gasPrice,
-    resolvedTipGasPrice: tipGasPrice,
-  } = await resolveTxFactoryGasPrices({
+  const competingTx = await getHighestIncentiveTxByNonce({
     assetClientInterface,
-    baseAsset,
-    feeData,
+    asset: baseAsset,
     nonce,
-    txToReplace: maybeTxToReplace,
+    walletAccount,
   })
+  if (competingTx && competingTx.txId !== bumpTxId) {
+    const competing = await authenticateReplacement({
+      baseAsset,
+      tx: competingTx,
+      address: fromAddress,
+    })
+    assert(competing.nonce === nonce, 'Replacement nonce does not match signed transaction')
+    const competingPrices = await resolveTxFactoryGasPrices({
+      assetClientInterface,
+      baseAsset,
+      feeData,
+      nonce,
+      txToReplace: competing.pricingTx,
+    })
+    if (competingPrices.resolvedGasPrice.gt(gasPrice)) gasPrice = competingPrices.resolvedGasPrice
+    if (eip1559Enabled && competingPrices.resolvedTipGasPrice.gt(tipGasPrice)) {
+      tipGasPrice = competingPrices.resolvedTipGasPrice
+    }
+  }
 
   return createUnsignedTxWithFees({
     ...resolvedTxAttributes,
@@ -540,6 +510,24 @@ export const createTxFactory = ({ chainId, assetClientInterface, useAbsoluteNonc
       walletAccount,
     })
 
+    if (maybeTxToReplace) {
+      const walletAddress = await assetClientInterface.getReceiveAddress({
+        assetName: baseAsset.name,
+        walletAccount,
+      })
+      assert(
+        fromAddress.toLowerCase() === walletAddress.toLowerCase(),
+        'Replacement sender must be the wallet address'
+      )
+    }
+    const pricingTxToReplace = maybeTxToReplace
+      ? await authenticateReplacement({ baseAsset, tx: maybeTxToReplace, address: fromAddress })
+      : undefined
+    assert(
+      !pricingTxToReplace || pricingTxToReplace.nonce === nonce,
+      'Replacement nonce does not match signed transaction'
+    )
+
     const {
       eip1559Enabled,
       resolvedGasPrice: gasPrice,
@@ -552,7 +540,7 @@ export const createTxFactory = ({ chainId, assetClientInterface, useAbsoluteNonc
       gasPrice: providedGasPrice,
       nonce,
       tipGasPrice: providedTipGasPrice,
-      txToReplace: maybeTxToReplace,
+      txToReplace: pricingTxToReplace?.pricingTx,
     })
 
     if (nft) {

package/src/tx-log/authenticated-monitor.js

@@ -0,0 +1,85 @@
+import { BaseMonitor } from '@exodus/asset-lib'
+import { Tx } from '@exodus/models'
+import assert from 'minimalistic-assert'
+
+import { fetchAuthenticatedTransaction, rpcInteger } from '../transaction-authentication.js'
+
+export class AuthenticatedEthereumMonitor extends BaseMonitor {
+  async verifyNewSentTransactions({ assetName = this.asset.name, logItems, walletAccount }) {
+    if (logItems.length === 0) return
+    let address
+    let txLog
+    for (const item of logItems) {
+      const tx = Tx.fromJSON(item)
+      if (tx.dropped) {
+        txLog ??= await this.aci.getTxLog({ assetName, walletAccount })
+        const existing = txLog.get(tx.txId)
+        // A disappeared envelope must not prevent marking the stored transaction
+        // dropped. Only its status may change without reauthentication.
+        if (existing && tx.equals(existing.update({ dropped: true, error: tx.error }))) continue
+      }
+      if (!tx.sent) {
+        if (!tx.from?.length) continue
+        address ??= await this.aci.getReceiveAddress({
+          assetName: this.asset.name,
+          walletAccount,
+          useCache: true,
+        })
+        if (!tx.from.some((from) => from.toLowerCase() === address.toLowerCase())) continue
+      }
+      assert(
+        (await this.verifyTransactionAuthentication({ tx, assetName, walletAccount })) === true,
+        `Cannot authenticate outgoing transaction ${tx.txId}`
+      )
+    }
+  }
+
+  async verifyTransactionAuthentication(params) {
+    if (typeof this.asset.verifyTransactionAuthentication === 'function') {
+      return super.verifyTransactionAuthentication(params)
+    }
+    const address = await this.aci.getReceiveAddress({
+      assetName: this.asset.name,
+      walletAccount: params.walletAccount,
+      useCache: true,
+    })
+    const transaction = await fetchAuthenticatedTransaction({
+      baseAsset: this.asset,
+      txId: params.tx.txId,
+      address,
+      server: this.server,
+    })
+    const tx = params.tx
+    // Bind the fields used by acceleration even for entries already in the log.
+    // Token destinations/amounts describe effects rather than the outer envelope;
+    // replacement creation always uses the verified envelope itself.
+    if (tx.data.nonce !== undefined && tx.data.nonce !== rpcInteger(transaction.nonce)) return false
+    if (tx.data.gasLimit !== undefined && tx.data.gasLimit !== rpcInteger(transaction.gas)) {
+      return false
+    }
+    if (
+      tx.data.data !== undefined &&
+      tx.data.data.toLowerCase() !== transaction.input.toLowerCase()
+    ) {
+      return false
+    }
+    if (params.assetName === this.asset.name) {
+      // Base-asset fee entries for token operations can display the token
+      // recipient. That execution effect is not the envelope's destination.
+      if (
+        tx.tokens.length === 0 &&
+        tx.to &&
+        tx.to.toLowerCase() !== (transaction.to ?? address).toLowerCase()
+      ) {
+        return false
+      }
+      if (
+        tx.data.rawCoinAmount !== undefined &&
+        BigInt(tx.data.rawCoinAmount) !== BigInt(transaction.value)
+      ) {
+        return false
+      }
+    }
+    return true
+  }
+}

package/src/tx-log/clarity-monitor.js

@@ -1,9 +1,10 @@
-import { BaseMonitor } from '@exodus/asset-lib'
 import { getAssetAddresses } from '@exodus/ethereum-lib'
 import lodash from 'lodash'
 import assert from 'minimalistic-assert'
 
+import { AuthenticatedEthereumMonitor } from './authenticated-monitor.js'
 import { applyRemoteConfigEip7702Whitelist, createEip7702Whitelist } from '../eip7702-whitelist.js'
+import { authenticateHistoryTransactions } from '../transaction-authentication.js'
 import { executeEthLikeFeeMonitorUpdate } from '../fee-utils.js'
 import {
   filterEffects,
@@ -25,7 +26,7 @@ import {
 
 const { isEmpty } = lodash
 
-export class ClarityMonitor extends BaseMonitor {
+export class ClarityMonitor extends AuthenticatedEthereumMonitor {
   constructor({
     server,
     config,
@@ -255,6 +256,13 @@ export class ClarityMonitor extends BaseMonitor {
         walletAccount,
       }))
 
+      allTxs = await authenticateHistoryTransactions({
+        transactions: allTxs,
+        baseAsset: this.asset,
+        server: this.server,
+        address: derivedData.ourWalletAddress,
+      })
+
       const logItemsByAsset = this.getAllLogItemsByAsset({
         getLogItemsFromServerTx,
         ourWalletAddress: derivedData.ourWalletAddress,
@@ -277,6 +285,12 @@ export class ClarityMonitor extends BaseMonitor {
         ...derivedData,
       })
 
+      await this.updateTxLogByAssetBatch({
+        logItemsByAsset,
+        walletAccount,
+        refresh,
+        batch,
+      })
       this.aci.removeTxLogBatch({
         assetName,
         walletAccount,
@@ -284,16 +298,6 @@ export class ClarityMonitor extends BaseMonitor {
         batch,
       })
 
-      for (const [assetName, txs] of Object.entries(logItemsByAsset)) {
-        this.aci.updateTxLogAndNotifyBatch({
-          assetName,
-          walletAccount,
-          txs,
-          refresh,
-          batch,
-        })
-      }
-
       historyResponse = response
       processedLogItemsByAsset = logItemsByAsset
     } catch (error) {

package/src/tx-log/ethereum-no-history-monitor.js

@@ -1,8 +1,8 @@
-import { BaseMonitor } from '@exodus/asset-lib'
 import { SynchronizedTime } from '@exodus/basic-utils'
 import { Tx } from '@exodus/models'
 import lodash from 'lodash'
 
+import { AuthenticatedEthereumMonitor } from './authenticated-monitor.js'
 import { applyRemoteConfigEip7702Whitelist, createEip7702Whitelist } from '../eip7702-whitelist.js'
 import { getBatchedRpcBalances } from './monitor-utils/get-batched-rpc-balances.js'
 import { UNCONFIRMED_TX_LIMIT } from './monitor-utils/get-derive-transactions-to-check.js'
@@ -25,7 +25,7 @@ const getMissingNonce = (tx, txFromNode) => {
 
 // The base ethereum monitor no history class handles listening for assets with no history
 
-export class EthereumNoHistoryMonitor extends BaseMonitor {
+export class EthereumNoHistoryMonitor extends AuthenticatedEthereumMonitor {
   constructor({ server, config, eip7702Supported, eip7702Whitelist, getBlackListStatus, ...args }) {
     super(args)
     this.server = server

package/src/tx-log-staking-processor/index.js

@@ -1,3 +1,5 @@
+import assert from 'minimalistic-assert'
+
 import { getPolygonUndelegateTxInEthereumTxLog } from '../staking/matic/matic-staking-utils.js'
 import { assetStakingTxProps } from './asset-staking-tx-data.js'
 
@@ -17,7 +19,13 @@ const getAssetExpandedTxLog = async ({ assetName, aci, txs, walletAccount }) =>
   return additionalTxs
 }
 
-const processTxLog = async ({ asset, assetClientInterface: aci, walletAccount, batch }) => {
+const processTxLog = async ({
+  asset,
+  assetClientInterface: aci,
+  walletAccount,
+  batch,
+  monitor,
+}) => {
   const { name: assetName, currency } = asset
   const txs = await aci.getTxLog({ assetName, walletAccount })
 
@@ -36,6 +44,11 @@ const processTxLog = async ({ asset, assetClientInterface: aci, walletAccount, b
   const expandedTxs = await getAssetExpandedTxLog({ assetName, aci, txs, walletAccount })
   newTxs.push(...expandedTxs)
 
+  if (expandedTxs.length > 0) {
+    assert(monitor, 'History monitor is required to authenticate new staking transactions')
+    await monitor.verifyNewSentTransactions({ assetName, logItems: expandedTxs, walletAccount })
+  }
+
   if (newTxs.length > 0) {
     aci.updateTxLogAndNotifyBatch({ assetName, walletAccount, txs: newTxs, batch })
   }