@hyperlane-xyz/rebalancer 27.2.13 → 27.3.0

package/src/bridges/LiFiBridge.test.ts

@@ -15,6 +15,7 @@ const testLogger = pino({ level: 'silent' });
 
 const TEST_PRIVATE_KEY =
   '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80';
+const OTHER_PRIVATE_KEY = `${TEST_PRIVATE_KEY.slice(0, -1)}1`;
 
 const BRIDGE_CONFIG: ExternalBridgeConfig = {
   integrator: 'test-rebalancer',
@@ -34,6 +35,58 @@ const SOLANA_CHAIN_METADATA_CONFIG: ExternalBridgeConfig = {
   },
 };
 
+const DUPLICATE_CHAIN_ID_CONFIG: ExternalBridgeConfig = {
+  integrator: 'test-rebalancer',
+  chainMetadata: {
+    ethereum: {
+      chainId: 1,
+      protocol: ProtocolType.Ethereum,
+      name: 'ethereum',
+      displayName: 'Ethereum',
+      domainId: 1,
+      rpcUrls: [{ http: 'https://ethereum-rpc.local' }],
+    },
+    radix: {
+      chainId: 1,
+      protocol: ProtocolType.Radix,
+      name: 'radix',
+      displayName: 'Radix',
+      domainId: 1001,
+      rpcUrls: [{ http: 'https://radix-rpc.local' }],
+    },
+    solanamainnet: {
+      chainId: 1399811149,
+      protocol: ProtocolType.Sealevel,
+      name: 'solanamainnet',
+      displayName: 'Solana',
+      domainId: 1399811149,
+      rpcUrls: [{ http: 'https://api.mainnet-beta.solana.com' }],
+    },
+  },
+};
+
+const NON_EVM_DOMAIN_COLLISION_CONFIG: ExternalBridgeConfig = {
+  integrator: 'test-rebalancer',
+  chainMetadata: {
+    ethereum: {
+      chainId: 1,
+      protocol: ProtocolType.Ethereum,
+      name: 'ethereum',
+      displayName: 'Ethereum',
+      domainId: 1,
+      rpcUrls: [{ http: 'https://ethereum-rpc.local' }],
+    },
+    cosmos: {
+      chainId: 999999999,
+      protocol: ProtocolType.Cosmos,
+      name: 'cosmos',
+      displayName: 'Cosmos',
+      domainId: 1,
+      rpcUrls: [{ http: 'https://rpc.cosmos.invalid' }],
+    },
+  },
+};
+
 // Use all-digit hex addresses to avoid EIP-55 checksum case mutations
 const TOKEN_ADDR = '0x1234567890123456789012345678901234567890';
 const SENDER_ADDR = '0x9876543210987654321098765432109876543210';
@@ -557,6 +610,49 @@ describe('LiFiBridge.quote() input validation', function () {
   });
 });
 
+describe('LiFiBridge.quote() routing policy', function () {
+  let bridge: LiFiBridge;
+
+  beforeEach(() => {
+    bridge = new LiFiBridge(BRIDGE_CONFIG, testLogger);
+  });
+
+  it('should use RECOMMENDED order for reverse toAmount quotes', async () => {
+    const originalFetch = globalThis.fetch;
+    let requestUrl = '';
+
+    globalThis.fetch = (async (input: URL | RequestInfo) => {
+      requestUrl = String(input);
+      return {
+        ok: true,
+        json: async () =>
+          createLiFiStep({
+            toChainId: 1151111081099710,
+            toAmount: '5000000000',
+          }),
+      } as Response;
+    }) as typeof fetch;
+
+    try {
+      const quote = await bridge.quote({
+        fromChain: 42161,
+        toChain: 1151111081099710,
+        fromToken: TOKEN_ADDR,
+        toToken: TOKEN_ADDR,
+        fromAddress: SENDER_ADDR,
+        toAddress: SENDER_ADDR,
+        toAmount: 5000000000n,
+      });
+      const params = new URL(requestUrl).searchParams;
+
+      expect(params.get('order')).to.equal('RECOMMENDED');
+      expect(quote.requestParams.toAmount).to.equal(5000000000n);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+});
+
 describe('LiFiBridge.getStatus()', function () {
   let bridge: LiFiBridge;
 
@@ -612,4 +708,178 @@ describe('LiFiBridge constructor chainMetadataByChainId', function () {
       expect(msg).to.include('does not match requested');
     }
   });
+
+  it('should prefer Ethereum metadata for LiFi chainId lookups when non-EVM chainIds collide', () => {
+    const bridge = new LiFiBridge(DUPLICATE_CHAIN_ID_CONFIG, testLogger);
+    const quote = createTestQuote(
+      { fromChainId: 1 },
+      {
+        fromChain: 1,
+        toChain: 1151111081099710,
+      },
+    );
+
+    return bridge
+      .execute(quote, {
+        [ProtocolType.Ethereum]: '0x1234',
+      })
+      .catch((error: unknown) => {
+        const msg = error instanceof Error ? error.message : String(error);
+        expect(
+          isValidationError(msg),
+          `Expected non-validation error but got: ${msg}`,
+        ).to.equal(false);
+        expect(msg).to.not.include('Missing private key');
+        expect(msg).to.not.include('protocol radix');
+        expect(msg.toLowerCase()).to.include('private key');
+      });
+  });
+
+  it('should index Tron by chainId even when domainId differs', () => {
+    const TRON_CHAIN_ID = 728126428;
+    const bridge = new LiFiBridge(
+      {
+        integrator: 'test-rebalancer',
+        chainMetadata: {
+          tron: {
+            chainId: TRON_CHAIN_ID,
+            protocol: ProtocolType.Tron,
+            name: 'tron',
+            displayName: 'Tron',
+            domainId: 999000999,
+            rpcUrls: [{ http: 'https://api.trongrid.io/jsonrpc' }],
+          },
+        },
+      },
+      testLogger,
+    );
+    const getProtocolTypeForChainId = (
+      bridge as any
+    ).getProtocolTypeForChainId.bind(bridge);
+
+    expect(getProtocolTypeForChainId(TRON_CHAIN_ID)).to.equal(
+      ProtocolType.Tron,
+    );
+    expect(getProtocolTypeForChainId(999000999)).to.equal(undefined);
+  });
+
+  it('should not let non-EVM domainIds overwrite EVM chainId lookups', () => {
+    const bridge = new LiFiBridge(NON_EVM_DOMAIN_COLLISION_CONFIG, testLogger);
+    const getProtocolTypeForChainId = (
+      bridge as any
+    ).getProtocolTypeForChainId.bind(bridge);
+
+    expect(getProtocolTypeForChainId(1)).to.equal(ProtocolType.Ethereum);
+    expect(getProtocolTypeForChainId(999999999)).to.equal(ProtocolType.Cosmos);
+  });
+});
+
+describe('LiFiBridge source protocol handling', function () {
+  it('ignores unrelated Tron keys when executing an Ethereum LiFi route', async () => {
+    const bridge = new LiFiBridge(BRIDGE_CONFIG, testLogger);
+    (bridge as any).configureLiFiProvider = (
+      protocol: ProtocolType,
+      key: string,
+      fromChain: number,
+    ) => {
+      expect(protocol).to.equal(ProtocolType.Ethereum);
+      expect(key).to.equal(TEST_PRIVATE_KEY);
+      expect(fromChain).to.equal(42161);
+      throw new Error('expected downstream error');
+    };
+
+    const quote = createTestQuote();
+
+    try {
+      await bridge.execute(quote, {
+        [ProtocolType.Ethereum]: TEST_PRIVATE_KEY,
+        [ProtocolType.Tron]: OTHER_PRIVATE_KEY,
+      });
+      expect.fail('Expected execute to throw');
+    } catch (error: unknown) {
+      const msg = (error as Error).message;
+      expect(msg).to.equal('expected downstream error');
+    }
+  });
+
+  it('addressesEqual keeps Sealevel base58 comparison case-sensitive', () => {
+    const bridge = new LiFiBridge(SOLANA_CHAIN_METADATA_CONFIG, testLogger);
+    const addressesEqualFn = (bridge as any).addressesEqual.bind(bridge);
+
+    expect(
+      addressesEqualFn(
+        'SoLANAAddReSs1234567890123456789012345678',
+        'solanaaddress1234567890123456789012345678',
+        1399811149,
+      ),
+    ).to.be.false;
+  });
+
+  it('throws when the route source protocol is Tron', async () => {
+    const TRON_CHAIN_ID = 728126428;
+    const bridge = new LiFiBridge(
+      {
+        integrator: 'test-rebalancer',
+        chainMetadata: {
+          tron: {
+            chainId: TRON_CHAIN_ID,
+            protocol: ProtocolType.Tron,
+            name: 'tron',
+            displayName: 'Tron',
+            domainId: TRON_CHAIN_ID,
+            rpcUrls: [{ http: 'https://api.trongrid.io/jsonrpc' }],
+          },
+        },
+      },
+      testLogger,
+    );
+    const quote = createTestQuote(
+      { fromChainId: TRON_CHAIN_ID },
+      { fromChain: TRON_CHAIN_ID },
+    );
+
+    try {
+      await bridge.execute(quote, {
+        [ProtocolType.Tron]: TEST_PRIVATE_KEY,
+      });
+      expect.fail('Should have thrown for unsupported source protocol Tron');
+    } catch (error: unknown) {
+      const msg = (error as Error).message;
+      expect(msg).to.include("Unsupported protocol type 'tron'");
+    }
+  });
+
+  it('throws when the route source protocol is an unsupported non-Tron chain', async () => {
+    const COSMOS_CHAIN_ID = 999999999;
+    const bridge = new LiFiBridge(
+      {
+        integrator: 'test-rebalancer',
+        chainMetadata: {
+          cosmos: {
+            chainId: COSMOS_CHAIN_ID,
+            protocol: ProtocolType.Cosmos,
+            name: 'cosmos',
+            displayName: 'Cosmos',
+            domainId: COSMOS_CHAIN_ID,
+            rpcUrls: [{ http: 'https://rpc.cosmos.invalid' }],
+          },
+        },
+      },
+      testLogger,
+    );
+    const quote = createTestQuote(
+      { fromChainId: COSMOS_CHAIN_ID },
+      { fromChain: COSMOS_CHAIN_ID },
+    );
+
+    try {
+      await bridge.execute(quote, {
+        [ProtocolType.Cosmos]: TEST_PRIVATE_KEY,
+      });
+      expect.fail('Should have thrown for unsupported source protocol Cosmos');
+    } catch (error: unknown) {
+      const msg = (error as Error).message;
+      expect(msg).to.include("Unsupported protocol type 'cosmos'");
+    }
+  });
 });

package/src/bridges/LiFiBridge.ts

@@ -14,7 +14,12 @@ import {
 } from '@lifi/sdk';
 import bs58 from 'bs58';
 import type { ChainMetadata } from '@hyperlane-xyz/sdk';
-import { ProtocolType, assert, ensure0x } from '@hyperlane-xyz/utils';
+import {
+  ProtocolType,
+  assert,
+  ensure0x,
+  isEVMLike,
+} from '@hyperlane-xyz/utils';
 import type { Logger } from 'pino';
 import { type Chain, createWalletClient, http } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
@@ -133,21 +138,25 @@ export class LiFiBridge implements IExternalBridge {
   constructor(config: ExternalBridgeConfig, logger: Logger) {
     this.config = config;
     this.logger = logger;
-    // Build chainId -> metadata map for O(1) lookups
+    // Build LiFi chainId -> metadata map for O(1) lookups.
+    // Numeric chainIds are only unique for EVM chains; non-EVM chains can
+    // legitimately collide (e.g. radix and ethereum both use 1), so index
+    // non-EVM chains only through explicit Hyperlane-domain -> LiFi mappings.
     this.chainMetadataByChainId = new Map();
     if (config.chainMetadata) {
+      const metadataByDomainId = new Map<number, ChainMetadata>();
       for (const metadata of Object.values(config.chainMetadata)) {
-        if (metadata.chainId !== undefined) {
+        metadataByDomainId.set(metadata.domainId, metadata);
+        if (metadata.chainId !== undefined && isEVMLike(metadata.protocol)) {
           this.chainMetadataByChainId.set(Number(metadata.chainId), metadata);
         }
       }
-      // Also key by LiFi chain IDs so both Hyperlane domains and LiFi IDs resolve to the same metadata.
+      // Also key by LiFi chain IDs so both Hyperlane domains and LiFi IDs
+      // resolve to the same metadata for non-EVM chains like Solana.
       for (const [hyperlaneDomainId, lifiChainId] of Object.entries(
         HYPERLANE_TO_LIFI_CHAIN_IDS,
       )) {
-        const metadata = this.chainMetadataByChainId.get(
-          Number(hyperlaneDomainId),
-        );
+        const metadata = metadataByDomainId.get(Number(hyperlaneDomainId));
         if (metadata !== undefined) {
           this.chainMetadataByChainId.set(Number(lifiChainId), metadata);
         }
@@ -179,11 +188,24 @@ export class LiFiBridge implements IExternalBridge {
    * Iterates metadata to find matching chainId and returns first HTTP RPC URL.
    */
   private getRpcUrlForChainId(chainId: number): string | undefined {
-    return this.chainMetadataByChainId.get(chainId)?.rpcUrls?.[0]?.http;
+    return this.getMetadataForChainId(chainId)?.rpcUrls?.[0]?.http;
   }
 
   private getProtocolTypeForChainId(chainId: number): ProtocolType | undefined {
-    return this.chainMetadataByChainId.get(chainId)?.protocol;
+    return this.getMetadataForChainId(chainId)?.protocol;
+  }
+
+  private getMetadataForChainId(chainId: number): ChainMetadata | undefined {
+    const directMetadata = this.chainMetadataByChainId.get(chainId);
+    if (directMetadata) {
+      return directMetadata;
+    }
+
+    const matches = Object.values(this.config.chainMetadata ?? {}).filter(
+      (metadata) =>
+        metadata.chainId !== undefined && Number(metadata.chainId) === chainId,
+    );
+    return matches.length === 1 ? matches[0] : undefined;
   }
 
   private addressesEqual(a: string, b: string, chainId: number): boolean {
@@ -196,58 +218,53 @@ export class LiFiBridge implements IExternalBridge {
   }
 
   /**
-   * Configure LiFi SDK providers from the given private keys.
-   * Sets up wallet/signer for each protocol type present in the keys map.
+   * Configure the LiFi SDK provider for the route source protocol.
    */
-  private configureLiFiProviders(
-    privateKeys: Partial<Record<ProtocolType, string>>,
+  private configureLiFiProvider(
+    protocol: ProtocolType,
+    key: string,
     fromChain: number,
     fromRpcUrl: string | undefined,
   ): void {
     const providers: Parameters<typeof lifiConfig.setProviders>[0] = [];
-    for (const [protocol, key] of Object.entries(privateKeys)) {
-      switch (protocol) {
-        case ProtocolType.Ethereum: {
-          const account = privateKeyToAccount(ensure0x(key) as `0x${string}`);
-          const chain = getViemChain(fromChain, fromRpcUrl);
-          const walletClient = createWalletClient({
-            account,
-            chain,
-            transport: http(fromRpcUrl),
-          });
-          providers.push(
-            EVM({
-              getWalletClient: async () => walletClient,
-              switchChain: async (requiredChainId: number) => {
-                const switchRpcUrl = this.getRpcUrlForChainId(requiredChainId);
-                const requiredChain = getViemChain(
-                  requiredChainId,
-                  switchRpcUrl,
-                );
-                return createWalletClient({
-                  account,
-                  chain: requiredChain,
-                  transport: http(switchRpcUrl),
-                });
-              },
-            }),
-          );
-          break;
-        }
-        case ProtocolType.Sealevel: {
-          const base58Key = toBase58SolanaKey(key);
-          providers.push(
-            Solana({
-              getWalletAdapter: async () => new KeypairWalletAdapter(base58Key),
-            }),
-          );
-          break;
-        }
-        default:
-          throw new Error(
-            `Unsupported protocol type '${protocol}' for LiFi provider`,
-          );
+    switch (protocol) {
+      case ProtocolType.Ethereum: {
+        const account = privateKeyToAccount(ensure0x(key) as `0x${string}`);
+        const chain = getViemChain(fromChain, fromRpcUrl);
+        const walletClient = createWalletClient({
+          account,
+          chain,
+          transport: http(fromRpcUrl),
+        });
+        providers.push(
+          EVM({
+            getWalletClient: async () => walletClient,
+            switchChain: async (requiredChainId: number) => {
+              const switchRpcUrl = this.getRpcUrlForChainId(requiredChainId);
+              const requiredChain = getViemChain(requiredChainId, switchRpcUrl);
+              return createWalletClient({
+                account,
+                chain: requiredChain,
+                transport: http(switchRpcUrl),
+              });
+            },
+          }),
+        );
+        break;
+      }
+      case ProtocolType.Sealevel: {
+        const base58Key = toBase58SolanaKey(key);
+        providers.push(
+          Solana({
+            getWalletAdapter: async () => new KeypairWalletAdapter(base58Key),
+          }),
+        );
+        break;
       }
+      default:
+        throw new Error(
+          `Unsupported protocol type '${protocol}' for LiFi provider`,
+        );
     }
 
     lifiConfig.setProviders(providers);
@@ -255,9 +272,9 @@ export class LiFiBridge implements IExternalBridge {
     this.logger.debug(
       {
         fromChain,
-        protocols: Object.keys(privateKeys),
+        protocol,
       },
-      'Configured LiFi providers for route execution',
+      'Configured LiFi provider for route execution',
     );
   }
 
@@ -381,7 +398,7 @@ export class LiFiBridge implements IExternalBridge {
       slippage: (params.slippage ?? this.config.defaultSlippage ?? 0.005)
         .toFixed(4)
         .replace(/\.?0+$/, ''),
-      order: 'CHEAPEST',
+      order: 'RECOMMENDED',
       integrator: this.config.integrator,
     });
 
@@ -491,9 +508,10 @@ export class LiFiBridge implements IExternalBridge {
     const fromChain = route.fromChainId;
     const toChain = route.toChainId;
     const fromProtocol = this.getProtocolTypeForChainId(fromChain);
+    const sourceProtocol = fromProtocol ?? ProtocolType.Ethereum;
     assert(
-      privateKeys[fromProtocol ?? ProtocolType.Ethereum],
-      `Missing private key for source chain protocol ${fromProtocol ?? ProtocolType.Ethereum}`,
+      privateKeys[sourceProtocol],
+      `Missing private key for source chain protocol ${sourceProtocol}`,
     );
 
     this.logger.info(
@@ -521,14 +539,11 @@ export class LiFiBridge implements IExternalBridge {
     let executedRoute!: RouteExtended;
 
     try {
-      this.configureLiFiProviders(privateKeys, fromChain, fromRpcUrl);
-
-      this.logger.debug(
-        {
-          fromChain,
-          protocols: Object.keys(privateKeys),
-        },
-        'Configured LiFi providers for route execution',
+      this.configureLiFiProvider(
+        sourceProtocol,
+        privateKeys[sourceProtocol]!,
+        fromChain,
+        fromRpcUrl,
       );
 
       // Execute route with update callbacks

package/src/config/RebalancerConfig.test.ts

@@ -572,6 +572,141 @@ describe('RebalancerConfig', () => {
   });
 });
 
+describe('Tron inventorySigners validation', () => {
+  const TEST_CONFIG_PATH_TRON = join(tmpdir(), 'rebalancer-tron-test.yaml');
+
+  afterEach(() => {
+    rmSync(TEST_CONFIG_PATH_TRON, { force: true });
+  });
+
+  it('should reject Tron T-prefix base58 address in inventorySigners', () => {
+    const data: RebalancerConfigFileInput = {
+      warpRouteId: 'test-tron-route',
+      strategy: [
+        {
+          rebalanceStrategy: RebalancerStrategyOptions.Weighted,
+          chains: {
+            tron: {
+              weighted: { weight: 50, tolerance: 5 },
+              executionType: ExecutionType.Inventory,
+              externalBridge: ExternalBridgeType.LiFi,
+            },
+            ethereum: {
+              weighted: { weight: 50, tolerance: 5 },
+              executionType: ExecutionType.Inventory,
+              externalBridge: ExternalBridgeType.LiFi,
+            },
+          },
+        },
+      ],
+      inventorySigners: {
+        tron: {
+          address: 'TJRabPrwbZy45sbavfcjinPJC18kjpRTv8',
+          key: '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
+        },
+        ethereum: {
+          address: '0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266',
+          key: '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
+        },
+      },
+      externalBridges: {
+        lifi: {
+          integrator: 'test-app',
+        },
+      },
+    };
+
+    writeYamlOrJson(TEST_CONFIG_PATH_TRON, data);
+    expect(() => RebalancerConfig.load(TEST_CONFIG_PATH_TRON)).to.throw(
+      /must be a valid 0x hex address/,
+    );
+  });
+
+  it('should accept valid 0x hex address for Tron inventorySigners', () => {
+    const data: RebalancerConfigFileInput = {
+      warpRouteId: 'test-tron-route',
+      strategy: [
+        {
+          rebalanceStrategy: RebalancerStrategyOptions.Weighted,
+          chains: {
+            tron: {
+              weighted: { weight: 50, tolerance: 5 },
+              executionType: ExecutionType.Inventory,
+              externalBridge: ExternalBridgeType.LiFi,
+            },
+            ethereum: {
+              weighted: { weight: 50, tolerance: 5 },
+              executionType: ExecutionType.Inventory,
+              externalBridge: ExternalBridgeType.LiFi,
+            },
+          },
+        },
+      ],
+      inventorySigners: {
+        tron: {
+          address: '0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266',
+          key: '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
+        },
+        ethereum: {
+          address: '0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266',
+          key: '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
+        },
+      },
+      externalBridges: {
+        lifi: {
+          integrator: 'test-app',
+        },
+      },
+    };
+
+    writeYamlOrJson(TEST_CONFIG_PATH_TRON, data);
+    expect(() => RebalancerConfig.load(TEST_CONFIG_PATH_TRON)).to.not.throw();
+  });
+
+  it('should reject invalid Tron address in inventorySigners', () => {
+    const data: RebalancerConfigFileInput = {
+      warpRouteId: 'test-tron-route',
+      strategy: [
+        {
+          rebalanceStrategy: RebalancerStrategyOptions.Weighted,
+          chains: {
+            tron: {
+              weighted: { weight: 50, tolerance: 5 },
+              executionType: ExecutionType.Inventory,
+              externalBridge: ExternalBridgeType.LiFi,
+            },
+            ethereum: {
+              weighted: { weight: 50, tolerance: 5 },
+              executionType: ExecutionType.Inventory,
+              externalBridge: ExternalBridgeType.LiFi,
+            },
+          },
+        },
+      ],
+      inventorySigners: {
+        tron: {
+          address: 'INVALID_TRON_ADDRESS',
+          key: '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
+        },
+        ethereum: {
+          address: '0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266',
+          key: '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
+        },
+      },
+      externalBridges: {
+        lifi: {
+          integrator: 'test-app',
+        },
+      },
+    };
+
+    writeYamlOrJson(TEST_CONFIG_PATH_TRON, data);
+    expect(() => RebalancerConfig.load(TEST_CONFIG_PATH_TRON)).to.throw(
+      /must be a valid 0x hex address/,
+    );
+  });
+});
+
 describe('per-chain bridge configuration', () => {
   const TEST_CONFIG_PATH_BRIDGE = join(tmpdir(), 'rebalancer-bridge-test.yaml');
 

package/src/config/types.ts

@@ -361,6 +361,14 @@ export const RebalancerConfigSchema = z
                 path: ['inventorySigners', protocol],
               });
             }
+          } else if (protocol === ProtocolType.Tron) {
+            if (!isAddressEvm(signerConfig.address)) {
+              ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `inventorySigners.${protocol} must be a valid 0x hex address, got: ${signerConfig.address}`,
+                path: ['inventorySigners', protocol],
+              });
+            }
           }
           // Other protocols: accept any non-empty string (future-proof)
         }