@exodus/ethereum-api 8.76.4 → 8.76.6

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [8.76.6](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-api@8.76.5...@exodus/ethereum-api@8.76.6) (2026-06-11)
+
+
+### Bug Fixes
+
+
+* fix: Ledger clear-signing for EVM token approvals (#8207)
+
+
+
+## [8.76.5](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-api@8.76.4...@exodus/ethereum-api@8.76.5) (2026-06-03)
+
+**Note:** Version bump only for package @exodus/ethereum-api
+
+
+
+
+
 ## [8.76.4](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-api@8.76.3...@exodus/ethereum-api@8.76.4) (2026-06-02)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/ethereum-api",
-  "version": "8.76.4",
+  "version": "8.76.6",
   "description": "Transaction monitors, fee monitors, RPC with the blockchain node, and other networking code for Ethereum and EVM-based blockchains",
   "type": "module",
   "main": "src/index.js",
@@ -29,7 +29,7 @@
     "@exodus/bip44-constants": "^195.0.0",
     "@exodus/crypto": "^1.0.0-rc.26",
     "@exodus/currency": "^6.0.1",
-    "@exodus/ethereum-lib": "^5.24.2",
+    "@exodus/ethereum-lib": "^5.24.3",
     "@exodus/ethereum-meta": "^2.9.1",
     "@exodus/ethereumholesky-meta": "^2.0.5",
     "@exodus/ethereumjs": "^1.11.0",
@@ -70,5 +70,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "f0c007138096bf627e21fc9e757637394fe2a5b0"
+  "gitHead": "f9bb7fcf58132b8daa6db82edc0bc53f380029cd"
 }

package/src/address-has-history.js

@@ -1,6 +1,10 @@
 export const addressHasHistoryFactory =
   ({ server }) =>
   async (address) => {
-    const history = await server.getHistoryV2(address, { index: 0, limit: 1 })
-    return history.length > 0
+    const [nonceHex, balanceHex] = await Promise.all([
+      server.getTransactionCount(address, 'pending'),
+      server.getBalanceProxied(address, 'latest'),
+    ])
+
+    return Number.parseInt(nonceHex, 16) > 0 || Number.parseInt(balanceHex, 16) > 0
   }

package/src/check-tx/create-assess-transaction.js

@@ -0,0 +1,23 @@
+import { fetchival } from '@exodus/fetch'
+import assert from 'minimalistic-assert'
+
+export const DEFAULT_ASSESS_TRANSACTION_API_URL =
+  'https://simulation.a.exodus.io/simulation/transaction/assessment'
+
+export const createAssessTransaction = (
+  { apiUrl = DEFAULT_ASSESS_TRANSACTION_API_URL, headers, request = fetchival } = Object.create(
+    null
+  )
+) => {
+  assert(typeof apiUrl === 'string' && apiUrl.length > 0, 'apiUrl must be a non-empty string')
+
+  return async function assessTransaction({ payload }) {
+    return request(apiUrl, {
+      method: 'POST',
+      headers: {
+        ...headers,
+        'Content-Type': 'application/json',
+      },
+    }).post(payload)
+  }
+}

package/src/check-tx/create-check-tx.js

@@ -1,5 +1,4 @@
 import { memoizeLruCache } from '@exodus/asset-lib'
-import { makeSimulationAPICall } from '@exodus/web3-utils'
 import assert from 'minimalistic-assert'
 import ms from 'ms'
 
@@ -37,25 +36,25 @@ const isRecipientFinding = ({ finding, recipientAddress }) => {
   })
 }
 
-const pickFindingForRecipient = ({ findings, recipientAddress }) => {
-  if (!Array.isArray(findings) || !recipientAddress) return GENERIC_RISK_REASON
-  const finding = findings.find((candidate) =>
-    isRecipientFinding({ finding: candidate, recipientAddress })
-  )
-  return finding?.title || GENERIC_RISK_REASON
+const findRecipientFinding = ({ findings, recipientAddress }) => {
+  if (!Array.isArray(findings) || !recipientAddress) return
+  return findings.find((candidate) => isRecipientFinding({ finding: candidate, recipientAddress }))
 }
 
 const parseAssessment = ({ body, recipientAddress }) => {
   if (!body?.success) return { action: 'NONE' }
   if (body.data?.recommendation !== 'deny') return { action: 'NONE' }
+  const finding = findRecipientFinding({ findings: body.data?.findings, recipientAddress })
+  if (!finding) return { action: 'NONE' }
+
   return {
     action: 'WARN',
-    reason: pickFindingForRecipient({ findings: body.data?.findings, recipientAddress }),
+    reason: finding.title || GENERIC_RISK_REASON,
   }
 }
 
-// Rejects after `timeoutMs`. The underlying request keeps running because
-// `makeSimulationAPICall` doesn't accept an AbortSignal.
+// Rejects after `timeoutMs`. The underlying request keeps running because the
+// API helper doesn't accept an AbortSignal.
 const withTimeout = async (promise, timeoutMs) => {
   let timeoutId
   const timeoutPromise = new Promise((_resolve, reject) => {
@@ -71,14 +70,9 @@ const withTimeout = async (promise, timeoutMs) => {
 const noopLogger = { warn: () => {} }
 
 export const createCheckTx = (
-  {
-    apiUrl,
-    timeout = DEFAULT_TIMEOUT_MS,
-    makeApiCall = makeSimulationAPICall,
-    logger = noopLogger,
-  } = Object.create(null)
+  { timeout = DEFAULT_TIMEOUT_MS, makeApiCall, logger = noopLogger } = Object.create(null)
 ) => {
-  assert(apiUrl, 'apiUrl is required')
+  assert(typeof makeApiCall === 'function', 'makeApiCall is required')
 
   const warn = typeof logger?.warn === 'function' ? logger.warn.bind(logger) : noopLogger.warn
 
@@ -90,13 +84,7 @@ export const createCheckTx = (
       if (input !== undefined) transaction.input = input
       if (hash !== undefined) transaction.hash = hash
 
-      const body = await withTimeout(
-        makeApiCall({
-          url: apiUrl,
-          payload: { serviceProvider: 'hypernative', transaction },
-        }),
-        timeout
-      )
+      const body = await withTimeout(makeApiCall({ payload: { transaction } }), timeout)
 
       if (!body) throw new Error('checkTx: empty response')
       return parseAssessment({ body, recipientAddress: toAddress })

package/src/create-asset.js

@@ -1,3 +1,4 @@
+import { createConsoleLogger } from '@exodus/asset-lib'
 import { ASSET_FAMILY, connectAssetsList } from '@exodus/assets'
 import bip44Constants from '@exodus/bip44-constants/by-ticker.js'
 import {
@@ -21,6 +22,7 @@ import lodash from 'lodash'
 import assert from 'minimalistic-assert'
 
 import { addressHasHistoryFactory } from './address-has-history.js'
+import { createAssessTransaction } from './check-tx/create-assess-transaction.js'
 import { createCheckTx } from './check-tx/index.js'
 import {
   createGetBlackListStatus,
@@ -32,7 +34,7 @@ import {
 } from './create-asset-utils.js'
 import { createTokenFactory } from './create-token-factory.js'
 import { createCustomFeesApi } from './custom-fees.js'
-import { getEIP7702Delegation } from './eth-like-util.js'
+import { getEIP7702Delegation, getIsNftContract } from './eth-like-util.js'
 import { createEvmServer } from './exodus-eth-server/index.js'
 import { createFeeData } from './fee-data/index.js'
 import { createGetBalanceForAddress } from './get-balance-for-address.js'
@@ -78,9 +80,9 @@ export const createAssetFactory = ({
   useAbsoluteBalanceAndNonce = false,
   delisted = false,
   privacyRpcUrl: defaultPrivacyRpcUrl,
-  riskAssessment: defaultRiskAssessment,
   wsGatewayUri: defaultWsGatewayUri,
   eip7702Supported,
+  transactionAssessment: defaultTransactionAssessment,
 }) => {
   assert(assetsList, 'assetsList is required')
   assert(providedFeeData || feeDataConfig, 'feeData or feeDataConfig is required')
@@ -104,7 +106,7 @@ export const createAssetFactory = ({
     nfts: defaultNfts,
     customTokens: defaultCustomTokens,
     privacyRpcUrl: defaultPrivacyRpcUrl,
-    riskAssessment: defaultRiskAssessment,
+    transactionAssessment: defaultTransactionAssessment,
   }
   return (
     {
@@ -125,7 +127,7 @@ export const createAssetFactory = ({
       supportsCustomFees,
       useAbsoluteBalanceAndNonce: overrideUseAbsoluteBalanceAndNonce,
       privacyRpcUrl,
-      riskAssessment,
+      transactionAssessment,
     } = configWithOverrides
 
     const asset = assets[base.name]
@@ -294,16 +296,18 @@ export const createAssetFactory = ({
 
     const securityChecks = createSecurityChecks({ eip7702Supported })
 
+    const web3 = createWeb3API({ asset })
+
     let checkTx
-    if (riskAssessment?.apiUrl) {
+    let sendValidations = []
+    if (transactionAssessment?.enabled) {
       checkTx = createCheckTx({
-        apiUrl: riskAssessment.apiUrl,
-        logger: riskAssessment.logger,
+        makeApiCall: createAssessTransaction({ apiUrl: transactionAssessment.apiUrl }),
+        logger: createConsoleLogger('@exodus/ethereum-api:check-tx'),
       })
+      sendValidations = createSendValidations({ assetClientInterface, checkTx })
     }
 
-    const sendValidations = checkTx ? createSendValidations({ assetClientInterface, checkTx }) : []
-
     const moveFunds = moveFundsFactory({
       baseAssetName: asset.name,
       assetClientInterface,
@@ -349,7 +353,10 @@ export const createAssetFactory = ({
         signer
           ? signUnsignedTxWithSigner(unsignedTx, signer)
           : signUnsignedTx(unsignedTx, privateKey),
-      signHardware: signHardwareFactory({ baseAssetName: asset.name }),
+      signHardware: signHardwareFactory({
+        baseAssetName: asset.name,
+        getIsNft: ({ address }) => getIsNftContract({ server, address }),
+      }),
       signMessage: ({ message, privateKey, signer }) =>
         signer ? signMessageWithSigner({ message, signer }) : signMessage({ privateKey, message }),
       ...(checkTx && { checkTx }),
@@ -365,7 +372,7 @@ export const createAssetFactory = ({
           }),
         }),
       validateAssetId: address.validate,
-      web3: createWeb3API({ asset }),
+      web3,
     }
 
     const fullAsset = {

package/src/eth-like-util.js

@@ -159,6 +159,7 @@ export const getIsForwarderContract = memoizeLruCache(
 
 const ERC20 = new SolidityContract(ABI.erc20)
 const ERC20BytesParams = new SolidityContract(ABI.erc20BytesParams)
+const ERC721 = new SolidityContract(ABI.erc721)
 const DEFAULT_PARAM_NAMES = ['decimals', 'name', 'symbol']
 const erc20ParamsCache = Object.create(null)
 
@@ -213,6 +214,58 @@ export const getERC20Params = async ({ asset, address, paramNames = DEFAULT_PARA
   return response
 }
 
+// ERC-165 introspection used to drive Ledger's clear-signing for contract calls:
+// it tells the device whether the target is an NFT (ERC-721/1155) or a fungible
+// token. See `signHardwareFactory` in ethereum-lib for how this feeds the device's
+// `isNft` hint. Display-only: never affects the signed transaction.
+const buildSupportsInterfaceData = (interfaceId) => {
+  const erc165InterfaceId = `0x${interfaceId}`
+  return `0x${ERC721.supportsInterface.build(erc165InterfaceId).toString('hex')}`
+}
+
+const decodeBool = (result) => {
+  return ERC721.decodeOutput({ method: 'supportsInterface', data: result })[0]
+}
+
+// true = supported, false = not supported / reverted, undefined = transport failure
+const probeSupportsInterface = async ({ server, address, interfaceId }) => {
+  try {
+    const result = await server.ethCall({
+      to: address,
+      data: buildSupportsInterfaceData(interfaceId),
+    })
+    return decodeBool(result)
+  } catch (err) {
+    // Empirically, a contract without supportsInterface comes through Clarity as
+    // "Bad rpc response: execution reverted". Unknown errors stay undefined so
+    // we don't force a wrong hint.
+    const EXECUTION_REVERT_MESSAGE = 'execution reverted'
+    const errorMessage = err?.message || String(err || '')
+    return errorMessage.toLowerCase().includes(EXECUTION_REVERT_MESSAGE) ? false : undefined
+  }
+}
+
+// Resolves whether `address` is an NFT contract (ERC-721 or ERC-1155) via ERC-165.
+// Returns true (NFT), false (not an NFT), or undefined (couldn't determine).
+export async function getIsNftContract({ server, address }) {
+  assert(server, 'getIsNftContract(): server required')
+  assert(address, 'getIsNftContract(): address required')
+
+  const ERC721_INTERFACE_ID = '80ac58cd'
+  const ERC1155_INTERFACE_ID = 'd9b67a26'
+
+  const [isErc721, isErc1155] = await Promise.all([
+    probeSupportsInterface({ server, address, interfaceId: ERC721_INTERFACE_ID }),
+    probeSupportsInterface({ server, address, interfaceId: ERC1155_INTERFACE_ID }),
+  ])
+
+  if (isErc721 === true || isErc1155 === true) {
+    return true
+  }
+
+  if (isErc721 === false && isErc1155 === false) return false
+}
+
 export async function getEIP7702Delegation({ address, server }) {
   const code = await withErrorReason({
     promise: server.getCode(address),

package/src/send-validations.js

@@ -39,14 +39,13 @@ export const createSendValidations = ({ assetClientInterface, checkTx }) => {
       })
       if (!fromAddress) return
 
-      // Match Hypernative's documented native-send payload shape.
+      // Native send: empty calldata, no signed tx hash to pass yet.
       const result = await checkTx({
         chain: asset.chainId,
         fromAddress,
         toAddress: destinationAddress,
         value: sendAmount.toBaseString({ unit: false }),
         input: '0x',
-        hash: '0x1',
       })
 
       if (result?.action !== 'WARN') return