@exodus/web3-ethereum 13.6.3 → 14.0.0

package/lib/provider/provider.js

@@ -18,10 +18,8 @@ export class EthereumProvider extends BaseProvider {
             throw new Error('"storageKeyPrefix" must be provided.');
         }
         this.#storage = createStorageWrapper(storage, storageKeyPrefix);
-        this.#supportedChainIds = supportedChainIds
-            .map(this.#sanitizeChainId)
-            .sort();
-        this.#getDefaultChainId = async () => getDefaultChainId().then((chainId) => chainId ? this.#sanitizeChainId(chainId) : null);
+        this.#supportedChainIds = supportedChainIds.map(this.#sanitizeChainId).sort();
+        this.#getDefaultChainId = async () => getDefaultChainId().then((chainId) => (chainId ? this.#sanitizeChainId(chainId) : null));
         // Observe account changes.
         this.on('connect', () => {
             const unobserve = accountsObservable.observe((accounts) => {
@@ -126,7 +124,9 @@ export class EthereumProvider extends BaseProvider {
         // if not supported yet, add it
         const chainId = this.#sanitizeChainId(params.chainId);
         if (!this.#supportedChainIds.includes(chainId)) {
-            await this._callRpcMethod('wallet_addEthereumChain', [params]);
+            await this._callRpcMethod('wallet_addEthereumChain', [
+                params,
+            ]);
             this.#supportedChainIds.push(chainId);
         }
         return this.#switchChain(chainId);
@@ -163,8 +163,7 @@ export class EthereumProvider extends BaseProvider {
                 data: args,
             });
         }
-        if (!Array.isArray(params) &&
-            (typeof params !== 'object' || params === null)) {
+        if (!Array.isArray(params) && (typeof params !== 'object' || params === null)) {
             throw ethErrors.rpc.invalidRequest({
                 message: "'args.params' must be an object or array if provided.",
                 data: args,
@@ -261,6 +260,7 @@ export class EthereumProvider extends BaseProvider {
             const params = paramsOrCallback;
             return new Promise((resolve, reject) => this.request({ method, params })
                 .then((result) => resolve({ id: '1', jsonrpc: '2.0', result }))
+                // eslint-disable-next-line prefer-promise-reject-errors -- JSON-RPC response format
                 .catch((err) => reject({ id: '1', jsonrpc: '2.0', error: err })));
         }
         const payload = methodOrPayload;
@@ -274,11 +274,13 @@ export class EthereumProvider extends BaseProvider {
         this.request({ method, params })
             .then((result) => {
             if (hasCallback) {
+                // eslint-disable-next-line promise/no-callback-in-promise -- legacy callback-based API
                 callback(null, { id, jsonrpc, result });
             }
         })
             .catch((err) => {
             if (hasCallback) {
+                // eslint-disable-next-line promise/no-callback-in-promise -- legacy callback-based API
                 callback(err, { id, jsonrpc, error: err });
             }
         });

package/lib/provider/storage.js

@@ -4,7 +4,7 @@ export function createStorageWrapper(storage, storageKeyPrefix) {
         try {
             return await storage.getItem(chainIdKey);
         }
-        catch (err) {
+        catch {
             return null;
         }
     }
@@ -12,7 +12,7 @@ export function createStorageWrapper(storage, storageKeyPrefix) {
         try {
             await storage.setItem(chainIdKey, chainId);
         }
-        catch (err) {
+        catch {
             // Ignore error.
         }
     }
@@ -20,7 +20,7 @@ export function createStorageWrapper(storage, storageKeyPrefix) {
         try {
             await storage.removeItem(chainIdKey);
         }
-        catch (err) {
+        catch {
             // Ignore error.
         }
     }

package/lib/provider-proxy/proxy.js

@@ -1,3 +1,4 @@
+/* eslint-disable @exodus/hydra/no-param-reassign-prop-only */
 import { createProviderProxy } from '@exodus/web3-provider/proxy';
 const ETHEREUM_INIT_METHODS_SET = new Set([
     'accountsChangedSet',
@@ -69,8 +70,7 @@ export const createEthereumProviderProxy = ({ isWalletNameFlag, impersonateOther
                 if (shouldInitProvider) {
                     await initProvider();
                 }
-                if (property === 'enable' ||
-                    args[0]?.method === 'eth_requestAccounts') {
+                if (property === 'enable' || args[0]?.method === 'eth_requestAccounts') {
                     const managementProvider = await getManagementProvider();
                     const chainId = (await getActiveChainId()) || (await getDefaultChainId());
                     await managementProvider.askUserToChooseWallet(`evm:${chainId}`);

package/lib/rpc-handlers/createEVMDeps.js

@@ -50,9 +50,7 @@ const createEVMDepsFactory = ({ analytics, blockchainMetadata, }) => {
                 gasPrice,
             };
             if (eip1559Enabled) {
-                feeData.maxPriorityFeePerGas = `0x${tipGasPrice
-                    .toBaseNumber()
-                    .toString(16)}`;
+                feeData.maxPriorityFeePerGas = `0x${tipGasPrice.toBaseNumber().toString(16)}`;
                 feeData.maxFeePerGas = gasPrice;
             }
             return feeData;
@@ -79,16 +77,13 @@ const createEVMDepsFactory = ({ analytics, blockchainMetadata, }) => {
                 // then compute the priority / tip fee.
                 if (baseFeePerGas && _maxFeePerGas.gt(baseFeePerGas)) {
                     const maxPriorityFeePerGas = _maxFeePerGas.sub(baseFeePerGas);
-                    feeData.maxPriorityFeePerGas = `0x${maxPriorityFeePerGas
-                        .toBaseNumber()
-                        .toString(16)}`;
+                    feeData.maxPriorityFeePerGas = `0x${maxPriorityFeePerGas.toBaseNumber().toString(16)}`;
                 }
             }
             return feeData;
         };
-        const trackWalletWatchAssetUse = _onEthWalletWatchAssetRequest
-            ? _onEthWalletWatchAssetRequest
-            : async (assetDetails) => {
+        const trackWalletWatchAssetUse = _onEthWalletWatchAssetRequest ??
+            (async (assetDetails) => {
                 // TODO: do we still need this? If yes, this ...assetDetails expansion is no bueno
                 // why is this not always returning true in browser?
                 analytics.track({
@@ -99,7 +94,7 @@ const createEVMDepsFactory = ({ analytics, blockchainMetadata, }) => {
                     },
                 });
                 return true;
-            };
+            });
         return {
             addEthereumChain,
             chainId: _chainId || 'undefined',

package/lib/rpc-handlers/exposeHandlers.js

@@ -1,6 +1,6 @@
 import { SignTypedDataVersion } from '@exodus/ethereumjs/eth-sig-util';
 import { AssetNotSupportedError, InvalidInputError, UnauthorizedError, UnsupportedMethodError, UserRejectedRequestError, } from '@exodus/web3-errors';
-import { bufferToHex0xString, hex0xStringToBuffer, } from '@exodus/web3-ethereum-utils';
+import { bufferToHex0xString, hex0xStringToBuffer } from '@exodus/web3-ethereum-utils';
 import { connect } from '@exodus/web3-rpc-handlers';
 import { hexToBN } from '@exodus/web3-utils';
 import { parseAndValidateTypedData } from './parseAndValidateTypedData.js';
@@ -63,6 +63,23 @@ const isValidGasLimitValue = (value) => {
     const proposedGasLimit = hexToBN(value);
     return proposedGasLimit.lte(maximumBlockGasLimit);
 };
+/*
+ A `personal_sign` message, as the bytes that will actually be signed.
+
+ Only a 0x-prefixed, even-length, fully hex string counts as hex. Every other shape is
+ rejected rather than reinterpreted, because the approval screen is shown the raw request
+ string: if the signer applies a decoding rule the screen does not, the user reads one
+ message and authenticates another. Bare hex is refused for exactly that reason -- the
+ screen has no 0x to strip, so it renders the digits literally while the old signer decoded
+ them.
+ */
+const PERSONAL_SIGN_MESSAGE = /^0x([0-9a-fA-F]{2})*$/;
+const decodePersonalSignMessage = (message) => {
+    if (typeof message !== 'string' || !PERSONAL_SIGN_MESSAGE.test(message)) {
+        throw new InvalidInputError();
+    }
+    return hex0xStringToBuffer(message);
+};
 export function exposeHandlers(rpc, deps) {
     const { chainId, isTrusted, isAutoApproved, ensureTrusted, ensureUntrusted, approveConnection, approveMessage, approveTransactions, forwardRequest, getSupportedChainIds = async () => [], getAddress, getEstimatedGas, getCustomFeeData, getFeeData, getNonce, sendRawTransaction, simulateEthereumTransactions, scanDomains, onTransactionsSigned = () => { }, onEthWalletWatchAssetRequest = () => { }, isUnlocked = () => true, ensureUnlocked = async () => true, getIsConnected, getAsset, addEthereumChain, getOrigin, getPathname, getActiveWalletAccountData, transactionSigner, messageSigner, } = deps;
     const network = `evm:${chainId}`;
@@ -86,7 +103,7 @@ export function exposeHandlers(rpc, deps) {
             gasPrice,
         };
     }
-    async function prepareTransaction(transaction) {
+    async function prepareTransaction(transaction, from) {
         const transactionNeedsGasPrice = !transaction.gasPrice || !transaction.maxFeePerGas;
         const preparedTransaction = { ...transaction };
         preparedTransaction.nonce = await getNonce();
@@ -109,10 +126,14 @@ export function exposeHandlers(rpc, deps) {
         if (!transaction.data) {
             preparedTransaction.data = '0x';
         }
-        // NOTE: Keep this at the end as other parameters can affect gas estimation.
+        if (transaction.from?.toLowerCase() !== from.toLowerCase()) {
+            preparedTransaction.from = from;
+        }
         if (!transaction.gas || !isValidGasLimitValue(transaction.gas)) {
             preparedTransaction.gas = await getEstimatedGas(preparedTransaction);
         }
+        // NOTE: DO NOT introduce any parameter changes after gas
+        //       estimation!
         return preparedTransaction;
     }
     async function applyCustomFeeRate(transaction) {
@@ -121,9 +142,7 @@ export function exposeHandlers(rpc, deps) {
             const { gasPrice, maxFeePerGas, maxPriorityFeePerGas } = feeData;
             return { ...transaction, gasPrice, maxFeePerGas, maxPriorityFeePerGas };
         }
-        else {
-            return transaction;
-        }
+        return transaction;
     }
     function validateTransaction(transaction) {
         const gasKeys = [
@@ -152,7 +171,8 @@ export function exposeHandlers(rpc, deps) {
         await assertTrusted();
         await ensureUnlocked();
         const asset = await getAsset(network);
-        const preparedTransaction = await prepareTransaction(transaction);
+        const address = await getAddress();
+        const preparedTransaction = await prepareTransaction(transaction, address);
         validateTransaction(preparedTransaction);
         const origin = getOrigin();
         const pathname = getPathname ? getPathname() : '';
@@ -183,6 +203,20 @@ export function exposeHandlers(rpc, deps) {
     async function approveAndSignMessage(message) {
         await assertTrusted();
         await ensureUnlocked();
+        // The approval screen is handed this exact string, so the bytes we sign have to be
+        // derivable from it under ONE rule that the screen shares. `personal_sign` takes a
+        // 0x-prefixed hex string; the signer used to hex-decode whatever it was given, which
+        // disagreed with the screen for any message that was not 0x-prefixed hex:
+        //
+        //   `<hex of a SIWE login>`                  screen showed raw hex, we signed the login
+        //   `<hex of a SIWE login> Login only.`      screen showed the suffix, we dropped it
+        //   `Sign in to example.com`                 screen showed the text, we signed nothing
+        //
+        // Each one let a dapp put readable text in front of the user and take a signature over
+        // something else. Requiring the prefix means a string the screen renders as text can
+        // never be reinterpreted as bytes, and decoding BEFORE approval means a message we
+        // would refuse is never approved in the first place.
+        const rawMessage = decodePersonalSignMessage(message);
         await approve(approveMessage, network, message);
         const walletAccount = await getActiveWalletAccountData();
         const asset = await getAsset(network);
@@ -190,7 +224,7 @@ export function exposeHandlers(rpc, deps) {
             walletAccount,
             baseAssetName: asset.baseAssetName,
             message: {
-                rawMessage: hex0xStringToBuffer(message),
+                rawMessage,
             },
         });
         return bufferToHex0xString(signedMessageBuffer);
@@ -283,7 +317,10 @@ export function exposeHandlers(rpc, deps) {
         }
         return permissions;
     });
-    exposeEvmFunction('wallet_requestPermissions', async (requestedPermissions = { [ETH_ACCOUNTS_PERMISSION]: {} }) => {
+    const defaultRequestedPermissions = {
+        [ETH_ACCOUNTS_PERMISSION]: {},
+    };
+    exposeEvmFunction('wallet_requestPermissions', async (requestedPermissions = defaultRequestedPermissions) => {
         const parentCapability = Object.keys(requestedPermissions)[0];
         if (parentCapability !== ETH_ACCOUNTS_PERMISSION) {
             // `eth_accounts` is currently the only permission.

package/lib/rpc-handlers/index.d.ts

@@ -1,6 +1,6 @@
-export { default as createEVMDepsFactory } from './createEVMDeps.js';
 import type { Dependencies } from '../types.js';
 import type { RPC, Transport } from '@exodus/web3-types';
+export { default as createEVMDepsFactory } from './createEVMDeps.js';
 export declare const registerRPCHandlers: ({ deps, RPC, transport, }: {
     deps: Dependencies;
     RPC: RPC;

package/lib/rpc-handlers/index.js

@@ -1,5 +1,5 @@
 import { RPC_REQUEST_TIMEOUT } from '@exodus/web3-constants';
-import { validate as validateDeps, validateCommonDeps, } from '@exodus/web3-rpc-handlers';
+import { validate as validateDeps, validateCommonDeps } from '@exodus/web3-rpc-handlers';
 import { exposeHandlers } from './exposeHandlers.js';
 import { validateRequestWithEVMPrefix } from './validateRequestWithEVMPrefix.js';
 export { default as createEVMDepsFactory } from './createEVMDeps.js';
@@ -18,11 +18,7 @@ const validateEVMDeps = (evm) => {
         'transactionSigner',
         'messageSigner',
     ];
-    const optionalKeys = [
-        'getSupportedChainIds',
-        'onEthWalletWatchAssetRequest',
-        'addEthereumChain',
-    ];
+    const optionalKeys = ['getSupportedChainIds', 'onEthWalletWatchAssetRequest', 'addEthereumChain'];
     validateDeps(evm, requiredKeys, optionalKeys);
 };
 function validateEVMsDeps(evms) {

package/lib/rpc-handlers/parseAndValidateTypedData.js

@@ -2,7 +2,7 @@ import { InvalidInputError } from '@exodus/web3-errors';
 import { parseAndValidateTypedData as _parseAndValidateTypedData } from './validator.js';
 export function convertChainIdToHex(chainId) {
     if (typeof chainId !== 'string') {
-        throw new Error(`'chainId' should be a string, got: ${typeof chainId}`);
+        throw new TypeError(`'chainId' should be a string, got: ${typeof chainId}`);
     }
     // `chainId` can be a stringified decimal
     if (!chainId.startsWith('0x')) {
@@ -17,7 +17,7 @@ export function parseAndValidateTypedData(typedData, { chainId: activeChainId })
     try {
         parsedTypedData = _parseAndValidateTypedData(typedData);
     }
-    catch (e) {
+    catch {
         throw new InvalidInputError();
     }
     // Security: checking if the 'message' property includes fields that don't belong to the primary type.
@@ -26,23 +26,20 @@ export function parseAndValidateTypedData(typedData, { chainId: activeChainId })
     }
     const allowedFieldsSet = new Set(parsedTypedData.types[parsedTypedData.primaryType].map(({ name }) => name));
     // Handle cases where the message includes fields that doesn't belong to the primary type.
-    const isFieldExempted = (field) => {
-        // Handle OpenSea case. See: https://github.com/status-im/status-mobile/issues/13769
-        if (field === 'totalOriginalConsiderationItems' &&
-            parsedTypedData.primaryType === 'OrderComponents' &&
-            parsedTypedData.message['consideration']) {
-            return true;
-        }
-        return false;
-    };
+    const isFieldExempted = (field) => field === 'totalOriginalConsiderationItems' &&
+        parsedTypedData.primaryType === 'OrderComponents' &&
+        Boolean(parsedTypedData.message['consideration']);
     for (const field in parsedTypedData.message) {
         if (!allowedFieldsSet.has(field) && !isFieldExempted(field)) {
             throw new InvalidInputError(`field '${field}' is not defined in the primary type definition`);
         }
     }
     // Security: checking if the requested chain matches the active chain ID.
-    if (parsedTypedData?.domain?.chainId) {
+    if (parsedTypedData?.domain?.chainId != null) {
         const suppliedChainIdHex = convertChainIdToHex(`${parsedTypedData.domain.chainId}`);
+        if (parseInt(suppliedChainIdHex, 16) === 0) {
+            throw new InvalidInputError(`eip-155 replay protection required`);
+        }
         if (activeChainId.toLowerCase() !== suppliedChainIdHex) {
             throw new InvalidInputError(`chainId supplied in typed data does not match active chainId`);
         }