@integraledger/lcp-binding-evm-common 0.12.2 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,85 @@
 # @integraledger/lcp-binding-evm-common
 
+## 0.13.0
+
+### Patch Changes
+
+- @integraledger/lcp-authority@0.13.0
+- @integraledger/lcp-binding-core@0.13.0
+- @integraledger/lcp-kernel@0.13.0
+
+## 0.12.3
+
+### Patch Changes
+
+- 82444ad: `verifyEip3009Signature` does the token's whole acceptance test, and says what it does not do.
+
+  ⛔⛔ **IT ANSWERED `true` FOR SIGNATURES `FiatTokenV2` REVERTS ON.** For any `(r, s, v)` the pair
+  `(r, n − s, v ^ 1)` recovers the same address, so `recoverTypedDataAddress` alone accepts both encodings —
+  **measured: the malleated form of an honest payer's own signature verified.** Circle's token routes EOA
+  signatures through `ECRecover.sol`, which reverts before recovery on a high-s value and on any `v` outside
+  `{27, 28}`. A payer could present the malleated form, be served the resource, and the transfer would revert
+  — free goods, which is the exact failure the function exists to prevent. `isCanonicalSignature` is those two
+  gates, exported so its boundary is reachable: `s === n/2` is ACCEPTED, because the token's guard is
+  `s > n/2`, and no signing run will ever produce that value.
+
+  ⛔ **The components are read out of the regex MATCH, not sliced at fixed offsets.** With `.slice(66, 130)`,
+  dropping the leading anchor shifted every offset and the malformed input failed the `v` gate by accident —
+  so the anchor's own mutant survived. The shape check and the component read are now one statement. (Fourth
+  instance of an anchor mutant surviving in one day; the other three were killed by adding a `junk0x…` case.)
+
+  ⛔⛔ **AND THE ERC-1271 CLAIM WAS FALSE.** The first version of this docblock said a contract wallet _"cannot
+  sign an EIP-3009 authorization at all — the token has no `isValidSignature` call in that path"_. That is
+  wrong for **`FiatTokenV2_2`**, the 2023 implementation deployed as USDC on Base, Arbitrum and Polygon among
+  others, which routes `transferWithAuthorization` through `SignatureChecker.isValidSignatureNow` and
+  therefore **does** dispatch to ERC-1271 for a contract account. Deciding that needs a chain read and this
+  function takes no ports, so its contract is stated narrowly instead: **a `false` means "not signed by that
+  EOA", never "the chain will reject it".** A caller that must accept smart-account payers has to make the
+  ERC-1271 call itself; one that refuses on this answer alone is choosing to accept EOA payers only, and
+  should say so at the call site.
+
+  ⚠️ **The `try` came off.** It caught every failure and answered `false`, including a `typedData` this
+  deployment could not encode — so an operator with a mis-copied `tokenName` would have been told that every
+  honest payer is a forger, which is the live mistake the docblock itself names. The two untrusted inputs
+  still answer `false`; a wiring error throws.
+
+  Mutation: `binding-evm-common` 98.56, floor 98. The two remaining `eip3009.ts` survivors are pre-existing,
+  in `eip155ChainId`.
+
+- 48d1346: `verifyEip3009Signature` — the check the token makes, available before the money moves.
+
+  `buildEip3009TypedData` has been here since the canonical EVM binding shipped, and nothing beside it could
+  answer whether a given authorization was actually signed by the account it names. So a seller surface
+  holding a payer's credential had three bad options: take the signature on trust until settlement, grow a
+  viem dependency of its own, or reimplement recovery. `seller-mpp` needs exactly this for the 2026-08-24
+  audit's C-28, and `seller-x402` already reaches here for `makeEvmAcceptanceVerifier` — the commons owns EVM
+  crypto, and this is the piece that was missing.
+
+  ⭐ **`ecrecover`, because that is what the TOKEN does.** `FiatTokenV2.transferWithAuthorization` recovers the
+  signer from the EIP-712 digest and compares it to `from`; this recovers and compares the same way.
+
+  ⛔ **It deliberately does NOT fall back to ERC-1271.** A contract wallet cannot sign an EIP-3009
+  authorization at all — the token has no `isValidSignature` call on that path — so accepting one here would
+  accept a payment the chain rejects, which is the failure this check exists to prevent rather than to cause.
+
+  ⛔ **Answers `false` rather than throwing,** for the reason `atrHashEquals` states about itself: a predicate
+  that throws is a worse contract than one that answers. A malformed signature, a signature of the wrong
+  length and an `expectedSigner` that is not an address are all _"no, this is not signed by them"_ — and the
+  caller is holding an untrusted credential and needs a value it can put on the wire. Addresses compare as
+  decoded 20-byte values, so a payer's own lowercase spelling is the same payer.
+
+  ⚠️ The domain stays the caller's to get right, and it is where this goes wrong in practice: `tokenName` and
+  `tokenVersion` are the token's own EIP-712 domain and differ between USDC deployments, so a signature
+  verified against a domain copied from another chain fails here exactly as it would on-chain.
+
+  Mutation: `binding-evm-common` 98.40, floor 98 holds. ⛔ Both regex anchors needed their own case —
+  `junk0x…` and `0x…ff` — because every other malformed input was refused by both mutants and the anchors
+  could otherwise be deleted with the suite green.
+
+  - @integraledger/lcp-authority@0.12.3
+  - @integraledger/lcp-binding-core@0.12.3
+  - @integraledger/lcp-kernel@0.12.3
+
 ## 0.12.2
 
 ### Patch Changes

package/dist/eip3009.d.ts

@@ -101,4 +101,41 @@ export interface LcpEvmSigner {
         message: Record<string, unknown>;
     }): Promise<Hex>;
 }
+/**
+ * Whether the 65-byte signature is one `FiatTokenV2` will accept at all, before asking who signed it.
+ *
+ * Not a style check. Both rules come straight out of the token's `ECRecover.sol`, and skipping either one
+ * turns {@link verifyEip3009Signature} from *"the chain will accept this"* into *"some chain might"*.
+ *
+ * ⭐ Exported so the boundary is reachable by a test. `s === n/2` is ACCEPTED (the token's guard is
+ * `s > n/2`), and no signing run will ever produce that value — so an off-by-one there is invisible from
+ * the public predicate, where such a signature simply fails to recover and answers `false` either way.
+ */
+export declare function isCanonicalSignature(signature: string): boolean;
+/**
+ * Whether an EIP-3009 authorization was signed, canonically, by the account it says it is from.
+ *
+ * ⭐ **The token's OWN acceptance test, not merely `ecrecover`.** `FiatTokenV2.transferWithAuthorization`
+ * routes an EOA signature through `ECRecover.sol`, which refuses a high-s signature and any `v` outside
+ * `{27, 28}` before recovering. A check that only recovered would answer `true` to the malleated form of an
+ * honest payer's own signature — measured — and the seller would serve the resource against a transfer that
+ * reverts. {@link isCanonicalSignature} is those two gates.
+ *
+ * ⛔⛔ **EOA ONLY, AND ON `FiatTokenV2_2` THAT IS NARROWER THAN THE TOKEN.** An earlier draft of this
+ * docblock said a contract wallet *"cannot sign an EIP-3009 authorization at all"*. That is false for
+ * `FiatTokenV2_2` — the 2023 implementation deployed as USDC on Base, Arbitrum and Polygon among others —
+ * which routes `transferWithAuthorization` through `SignatureChecker.isValidSignatureNow` and therefore
+ * DOES dispatch to ERC-1271 for a contract account. Deciding that needs a chain read, and this function
+ * takes no ports: **a `false` here means "not signed by that EOA", never "the chain will reject it"**. A
+ * caller that must accept smart-account payers has to make the ERC-1271 call itself, and one that refuses
+ * on this answer alone is choosing to accept EOA payers only. Say which, at the call site.
+ *
+ * ⛔ **Answers `false` rather than throwing for the two UNTRUSTED inputs,** for the reason `atrHashEquals`
+ * states about itself: a predicate that throws is a worse contract than one that answers. A malformed
+ * `signature` and an `expectedSigner` that is not an address are facts about the credential in hand.
+ * ⚠️ A `typedData` that cannot be encoded is NOT — that is this deployment's own domain being wrong, and
+ * returning `false` for it would tell an operator with a mis-copied `tokenName` that every honest payer is
+ * a forger. It throws.
+ */
+export declare function verifyEip3009Signature(typedData: Eip3009TypedData, signature: string, expectedSigner: string): Promise<boolean>;
 //# sourceMappingURL=eip3009.d.ts.map

package/dist/eip3009.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eip3009.d.ts","sourceRoot":"","sources":["../src/eip3009.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,OAAO,EAAc,KAAK,GAAG,EAAE,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAEhF,qFAAqF;AACrF,eAAO,MAAM,gCAAgC;aAC3C,yBAAyB;iBACrB,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,SAAS;;iBAC7B,IAAI,EAAE,IAAI;iBAAE,IAAI,EAAE,SAAS;;iBAC3B,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;;iBAC9B,IAAI,EAAE,YAAY;iBAAE,IAAI,EAAE,SAAS;;iBACnC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,SAAS;;iBACpC,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;;CAE1B,CAAC;AAEX;kFACkF;AAClF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED;sGACsG;AACtG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAMhD;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,GAAG,CAAC;CACZ;AAED;;;mGAGmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,OAAO,gCAAgC,CAAC;IAC/C,WAAW,EAAE,2BAA2B,CAAC;IACzC,OAAO,EAAE;QACP,IAAI,EAAE,OAAO,CAAC;QACd,EAAE,EAAE,OAAO,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,GAAG,CAAC;KACZ,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,iBAAiB,GAAG;IAC3D,aAAa,EAAE,oBAAoB,CAAC;IACpC,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CA+BA;AAED,qHAAqH;AACrH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,OAAO,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB"}
+{"version":3,"file":"eip3009.d.ts","sourceRoot":"","sources":["../src/eip3009.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,GAAG,EAER,KAAK,eAAe,EACrB,MAAM,MAAM,CAAC;AAEd,qFAAqF;AACrF,eAAO,MAAM,gCAAgC;aAC3C,yBAAyB;iBACrB,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,SAAS;;iBAC7B,IAAI,EAAE,IAAI;iBAAE,IAAI,EAAE,SAAS;;iBAC3B,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;;iBAC9B,IAAI,EAAE,YAAY;iBAAE,IAAI,EAAE,SAAS;;iBACnC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,SAAS;;iBACpC,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;;CAE1B,CAAC;AAEX;kFACkF;AAClF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED;sGACsG;AACtG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAMhD;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,GAAG,CAAC;CACZ;AAED;;;mGAGmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,OAAO,gCAAgC,CAAC;IAC/C,WAAW,EAAE,2BAA2B,CAAC;IACzC,OAAO,EAAE;QACP,IAAI,EAAE,OAAO,CAAC;QACd,EAAE,EAAE,OAAO,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,GAAG,CAAC;KACZ,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,iBAAiB,GAAG;IAC3D,aAAa,EAAE,oBAAoB,CAAC;IACpC,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CA+BA;AAED,qHAAqH;AACrH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,OAAO,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB;AAcD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAY/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/eip3009.js

@@ -7,7 +7,7 @@
  * The x402-client scheme class is deliberately NOT here; it lives in binding-evm-x402. This module is
  * protocol-agnostic typed-data construction, viem-only.
  */
-import { getAddress } from "viem";
+import { getAddress, recoverTypedDataAddress, } from "viem";
 /** EIP-3009 TransferWithAuthorization typed-data field layout (USDC FiatTokenV2). */
 export const TRANSFER_WITH_AUTHORIZATION_TYPE = {
     TransferWithAuthorization: [
@@ -70,4 +70,81 @@ export function buildEip3009TypedData(i) {
     };
     return { authorization, typedData };
 }
+/**
+ * secp256k1's order halved — the low-s boundary `FiatTokenV2`'s own `ECRecover.sol` enforces.
+ *
+ * ⛔⛔ **A SIGNATURE HAS TWO VALID ENCODINGS AND THE TOKEN ACCEPTS ONE.** For any `(r, s, v)` the pair
+ * `(r, n − s, v ^ 1)` recovers the same address, so `ecrecover` alone says `true` to both. Circle's token
+ * reverts on the high-s form before `ecrecover` is reached — *"ECRecover: invalid signature 's' value"* —
+ * and on any `v` outside `{27, 28}`. A pre-flight check without these gates answers `true` for a
+ * credential the chain refuses, and the seller has already served the resource by then.
+ */
+const SECP256K1_HALF_N = 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0n;
+/**
+ * Whether the 65-byte signature is one `FiatTokenV2` will accept at all, before asking who signed it.
+ *
+ * Not a style check. Both rules come straight out of the token's `ECRecover.sol`, and skipping either one
+ * turns {@link verifyEip3009Signature} from *"the chain will accept this"* into *"some chain might"*.
+ *
+ * ⭐ Exported so the boundary is reachable by a test. `s === n/2` is ACCEPTED (the token's guard is
+ * `s > n/2`), and no signing run will ever produce that value — so an off-by-one there is invisible from
+ * the public predicate, where such a signature simply fails to recover and answers `false` either way.
+ */
+export function isCanonicalSignature(signature) {
+    // ⛔ Captured, not sliced at fixed offsets. With `.slice(66, 130)` the components were read from
+    // positions that only line up when the anchors hold — so dropping `^` shifted every offset and the
+    // malformed input failed the `v` gate by accident, which left the anchor's mutant alive. Reading r/s/v
+    // out of the match makes the shape check and the component read the same statement.
+    const parts = /^0x([0-9a-fA-F]{64})([0-9a-fA-F]{64})([0-9a-fA-F]{2})$/.exec(signature);
+    if (parts === null)
+        return false;
+    if (BigInt(`0x${parts[2]}`) > SECP256K1_HALF_N)
+        return false;
+    const v = Number.parseInt(parts[3], 16);
+    return v === 27 || v === 28;
+}
+/**
+ * Whether an EIP-3009 authorization was signed, canonically, by the account it says it is from.
+ *
+ * ⭐ **The token's OWN acceptance test, not merely `ecrecover`.** `FiatTokenV2.transferWithAuthorization`
+ * routes an EOA signature through `ECRecover.sol`, which refuses a high-s signature and any `v` outside
+ * `{27, 28}` before recovering. A check that only recovered would answer `true` to the malleated form of an
+ * honest payer's own signature — measured — and the seller would serve the resource against a transfer that
+ * reverts. {@link isCanonicalSignature} is those two gates.
+ *
+ * ⛔⛔ **EOA ONLY, AND ON `FiatTokenV2_2` THAT IS NARROWER THAN THE TOKEN.** An earlier draft of this
+ * docblock said a contract wallet *"cannot sign an EIP-3009 authorization at all"*. That is false for
+ * `FiatTokenV2_2` — the 2023 implementation deployed as USDC on Base, Arbitrum and Polygon among others —
+ * which routes `transferWithAuthorization` through `SignatureChecker.isValidSignatureNow` and therefore
+ * DOES dispatch to ERC-1271 for a contract account. Deciding that needs a chain read, and this function
+ * takes no ports: **a `false` here means "not signed by that EOA", never "the chain will reject it"**. A
+ * caller that must accept smart-account payers has to make the ERC-1271 call itself, and one that refuses
+ * on this answer alone is choosing to accept EOA payers only. Say which, at the call site.
+ *
+ * ⛔ **Answers `false` rather than throwing for the two UNTRUSTED inputs,** for the reason `atrHashEquals`
+ * states about itself: a predicate that throws is a worse contract than one that answers. A malformed
+ * `signature` and an `expectedSigner` that is not an address are facts about the credential in hand.
+ * ⚠️ A `typedData` that cannot be encoded is NOT — that is this deployment's own domain being wrong, and
+ * returning `false` for it would tell an operator with a mis-copied `tokenName` that every honest payer is
+ * a forger. It throws.
+ */
+export async function verifyEip3009Signature(typedData, signature, expectedSigner) {
+    if (!/^0x[0-9a-fA-F]{40}$/.test(expectedSigner))
+        return false;
+    if (!isCanonicalSignature(signature))
+        return false;
+    // ⛔ NOT wrapped in a try. `isCanonicalSignature` has already established that the signature parses, so
+    // the only way this throws now is an unencodable `typedData` — a wiring error, and one a `false` would
+    // report as the counterparty's fault. See the head note.
+    const recovered = await recoverTypedDataAddress({
+        domain: typedData.domain,
+        types: typedData.types,
+        primaryType: typedData.primaryType,
+        message: typedData.message,
+        signature: signature,
+    });
+    // Compared as decoded 20-byte values, not as strings: `getAddress` checksums both sides, so a payer
+    // spelling their own address in lowercase is the same payer.
+    return getAddress(recovered) === getAddress(expectedSigner);
+}
 //# sourceMappingURL=eip3009.js.map

package/dist/eip3009.js.map

@@ -1 +1 @@
-{"version":3,"file":"eip3009.js","sourceRoot":"","sources":["../src/eip3009.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAgB,UAAU,EAAkC,MAAM,MAAM,CAAC;AAEhF,qFAAqF;AACrF,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,yBAAyB,EAAE;QACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;KACnC;CACO,CAAC;AAEX;kFACkF;AAClF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,GAAG,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED;sGACsG;AACtG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,4FAA4F,KAAK,GAAG,CACrG,CAAC;IACJ,OAAO,KAAK,CAAC,WAAW,EAAS,CAAC;AACpC,CAAC;AAoDD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAoB;IAIxD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,aAAa,GAAyB;QAC1C,IAAI;QACJ,EAAE;QACF,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK;KACN,CAAC;IACF,MAAM,SAAS,GAAqB;QAClC,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,OAAO,EAAE,CAAC,CAAC,YAAY;YACvB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;SACnD;QACD,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE;YACP,IAAI;YACJ,EAAE;YACF,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;YAChC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;YAClC,KAAK;SACN;KACF,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"eip3009.js","sourceRoot":"","sources":["../src/eip3009.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAEL,UAAU,EAEV,uBAAuB,GAExB,MAAM,MAAM,CAAC;AAEd,qFAAqF;AACrF,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,yBAAyB,EAAE;QACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;KACnC;CACO,CAAC;AAEX;kFACkF;AAClF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,GAAG,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED;sGACsG;AACtG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,4FAA4F,KAAK,GAAG,CACrG,CAAC;IACJ,OAAO,KAAK,CAAC,WAAW,EAAS,CAAC;AACpC,CAAC;AAoDD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAoB;IAIxD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,aAAa,GAAyB;QAC1C,IAAI;QACJ,EAAE;QACF,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK;KACN,CAAC;IACF,MAAM,SAAS,GAAqB;QAClC,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,OAAO,EAAE,CAAC,CAAC,YAAY;YACvB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;SACnD;QACD,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE;YACP,IAAI;YACJ,EAAE;YACF,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;YAChC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;YAClC,KAAK;SACN;KACF,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GACpB,mEAAmE,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,gGAAgG;IAChG,mGAAmG;IACnG,uGAAuG;IACvG,oFAAoF;IACpF,MAAM,KAAK,GAAG,wDAAwD,CAAC,IAAI,CACzE,SAAS,CACV,CAAC;IACF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC,GAAG,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,SAAiB,EACjB,cAAsB;IAEtB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,uGAAuG;IACvG,uGAAuG;IACvG,yDAAyD;IACzD,MAAM,SAAS,GAAY,MAAM,uBAAuB,CAAC;QACvD,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,SAAS,EAAE,SAAgB;KAC5B,CAAC,CAAC;IACH,oGAAoG;IACpG,6DAA6D;IAC7D,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC;AAC9D,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { makeChainReader } from "./client.js";
 export { decodeEasAttestation, EAS_GET_ATTESTATION_ABI, type EasAttestation, isEasValidAsOf, type RawEasAttestation, readEasAttestation, } from "./eas.js";
 export { hashEip712 } from "./eip712.js";
-export { assertBytes32, type BuildEip3009Input, buildEip3009TypedData, type Eip3009Authorization, type Eip3009TypedData, eip155ChainId, type LcpEvmSigner, TRANSFER_WITH_AUTHORIZATION_TYPE, } from "./eip3009.js";
+export { assertBytes32, type BuildEip3009Input, buildEip3009TypedData, type Eip3009Authorization, type Eip3009TypedData, eip155ChainId, isCanonicalSignature, type LcpEvmSigner, TRANSFER_WITH_AUTHORIZATION_TYPE, verifyEip3009Signature, } from "./eip3009.js";
 export { assetWasTransferred, ERC20_TRANSFER_TOPIC0 } from "./erc20.js";
 export { ACCEPTANCE_DOMAIN_NAME, ACCEPTANCE_DOMAIN_VERSION, ACCEPTANCE_ENVELOPE_TYPE, type AcceptanceSignatureInput, type AcceptanceTypedData, type AcceptanceVerifyOpts, buildAcceptanceTypedData, EVM_ACCEPTANCE_SCHEMES, EVM_PAYLOAD_TYPES, type EvmAcceptanceScheme, type EvmPayloadType, isEvmAcceptanceScheme, isEvmPayloadType, makeEvmAcceptanceVerifier, makeLocalEvmSigner, rfc3339ToUnixSeconds, verifyAcceptanceSignature, } from "./erc1271.js";
 export { AUTHORIZATION_USED_ABI, type AuthorizationUsedEvent, type OnChainAtrHashProof, readAuthorizationUsed, refOf, verifyAtrHashOnChain, } from "./events.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,iBAAiB,EACtB,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,aAAa,EACb,KAAK,YAAY,EACjB,gCAAgC,GACjC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,GACrB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,iBAAiB,EACtB,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,aAAa,EACb,oBAAoB,EACpB,KAAK,YAAY,EACjB,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,GACrB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 export { makeChainReader } from "./client.js";
 export { decodeEasAttestation, EAS_GET_ATTESTATION_ABI, isEasValidAsOf, readEasAttestation, } from "./eas.js";
 export { hashEip712 } from "./eip712.js";
-export { assertBytes32, buildEip3009TypedData, eip155ChainId, TRANSFER_WITH_AUTHORIZATION_TYPE, } from "./eip3009.js";
+export { assertBytes32, buildEip3009TypedData, eip155ChainId, isCanonicalSignature, TRANSFER_WITH_AUTHORIZATION_TYPE, verifyEip3009Signature, } from "./eip3009.js";
 export { assetWasTransferred, ERC20_TRANSFER_TOPIC0 } from "./erc20.js";
 export { ACCEPTANCE_DOMAIN_NAME, ACCEPTANCE_DOMAIN_VERSION, ACCEPTANCE_ENVELOPE_TYPE, buildAcceptanceTypedData, EVM_ACCEPTANCE_SCHEMES, EVM_PAYLOAD_TYPES, isEvmAcceptanceScheme, isEvmPayloadType, makeEvmAcceptanceVerifier, makeLocalEvmSigner, rfc3339ToUnixSeconds, verifyAcceptanceSignature, } from "./erc1271.js";
 export { AUTHORIZATION_USED_ABI, readAuthorizationUsed, refOf, verifyAtrHashOnChain, } from "./events.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EAEvB,cAAc,EAEd,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EAEb,qBAAqB,EAGrB,aAAa,EAEb,gCAAgC,GACjC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EAIxB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EAGjB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EAGtB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,GACrB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EAEvB,cAAc,EAEd,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EAEb,qBAAqB,EAGrB,aAAa,EACb,oBAAoB,EAEpB,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EAIxB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EAGjB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EAGtB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,GACrB,MAAM,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-binding-evm-common",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "Shared EVM machinery for LCP rail bindings: typed-data construction and signature verification.",
   "keywords": [
     "lcp",
@@ -44,9 +44,9 @@
   "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/binding-evm-common#readme",
   "dependencies": {
     "viem": "2.55.11",
-    "@integraledger/lcp-binding-core": "0.12.2",
-    "@integraledger/lcp-authority": "0.12.2",
-    "@integraledger/lcp-kernel": "0.12.2"
+    "@integraledger/lcp-authority": "0.13.0",
+    "@integraledger/lcp-binding-core": "0.13.0",
+    "@integraledger/lcp-kernel": "0.13.0"
   },
   "devDependencies": {
     "@types/node": "24.13.3",

package/src/eip3009.ts

@@ -7,7 +7,13 @@
  * The x402-client scheme class is deliberately NOT here; it lives in binding-evm-x402. This module is
  * protocol-agnostic typed-data construction, viem-only.
  */
-import { type Address, getAddress, type Hex, type TypedDataDomain } from "viem";
+import {
+  type Address,
+  getAddress,
+  type Hex,
+  recoverTypedDataAddress,
+  type TypedDataDomain,
+} from "viem";
 
 /** EIP-3009 TransferWithAuthorization typed-data field layout (USDC FiatTokenV2). */
 export const TRANSFER_WITH_AUTHORIZATION_TYPE = {
@@ -140,3 +146,86 @@ export interface LcpEvmSigner {
     message: Record<string, unknown>;
   }): Promise<Hex>;
 }
+
+/**
+ * secp256k1's order halved — the low-s boundary `FiatTokenV2`'s own `ECRecover.sol` enforces.
+ *
+ * ⛔⛔ **A SIGNATURE HAS TWO VALID ENCODINGS AND THE TOKEN ACCEPTS ONE.** For any `(r, s, v)` the pair
+ * `(r, n − s, v ^ 1)` recovers the same address, so `ecrecover` alone says `true` to both. Circle's token
+ * reverts on the high-s form before `ecrecover` is reached — *"ECRecover: invalid signature 's' value"* —
+ * and on any `v` outside `{27, 28}`. A pre-flight check without these gates answers `true` for a
+ * credential the chain refuses, and the seller has already served the resource by then.
+ */
+const SECP256K1_HALF_N =
+  0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0n;
+
+/**
+ * Whether the 65-byte signature is one `FiatTokenV2` will accept at all, before asking who signed it.
+ *
+ * Not a style check. Both rules come straight out of the token's `ECRecover.sol`, and skipping either one
+ * turns {@link verifyEip3009Signature} from *"the chain will accept this"* into *"some chain might"*.
+ *
+ * ⭐ Exported so the boundary is reachable by a test. `s === n/2` is ACCEPTED (the token's guard is
+ * `s > n/2`), and no signing run will ever produce that value — so an off-by-one there is invisible from
+ * the public predicate, where such a signature simply fails to recover and answers `false` either way.
+ */
+export function isCanonicalSignature(signature: string): boolean {
+  // ⛔ Captured, not sliced at fixed offsets. With `.slice(66, 130)` the components were read from
+  // positions that only line up when the anchors hold — so dropping `^` shifted every offset and the
+  // malformed input failed the `v` gate by accident, which left the anchor's mutant alive. Reading r/s/v
+  // out of the match makes the shape check and the component read the same statement.
+  const parts = /^0x([0-9a-fA-F]{64})([0-9a-fA-F]{64})([0-9a-fA-F]{2})$/.exec(
+    signature,
+  );
+  if (parts === null) return false;
+  if (BigInt(`0x${parts[2] as string}`) > SECP256K1_HALF_N) return false;
+  const v = Number.parseInt(parts[3] as string, 16);
+  return v === 27 || v === 28;
+}
+
+/**
+ * Whether an EIP-3009 authorization was signed, canonically, by the account it says it is from.
+ *
+ * ⭐ **The token's OWN acceptance test, not merely `ecrecover`.** `FiatTokenV2.transferWithAuthorization`
+ * routes an EOA signature through `ECRecover.sol`, which refuses a high-s signature and any `v` outside
+ * `{27, 28}` before recovering. A check that only recovered would answer `true` to the malleated form of an
+ * honest payer's own signature — measured — and the seller would serve the resource against a transfer that
+ * reverts. {@link isCanonicalSignature} is those two gates.
+ *
+ * ⛔⛔ **EOA ONLY, AND ON `FiatTokenV2_2` THAT IS NARROWER THAN THE TOKEN.** An earlier draft of this
+ * docblock said a contract wallet *"cannot sign an EIP-3009 authorization at all"*. That is false for
+ * `FiatTokenV2_2` — the 2023 implementation deployed as USDC on Base, Arbitrum and Polygon among others —
+ * which routes `transferWithAuthorization` through `SignatureChecker.isValidSignatureNow` and therefore
+ * DOES dispatch to ERC-1271 for a contract account. Deciding that needs a chain read, and this function
+ * takes no ports: **a `false` here means "not signed by that EOA", never "the chain will reject it"**. A
+ * caller that must accept smart-account payers has to make the ERC-1271 call itself, and one that refuses
+ * on this answer alone is choosing to accept EOA payers only. Say which, at the call site.
+ *
+ * ⛔ **Answers `false` rather than throwing for the two UNTRUSTED inputs,** for the reason `atrHashEquals`
+ * states about itself: a predicate that throws is a worse contract than one that answers. A malformed
+ * `signature` and an `expectedSigner` that is not an address are facts about the credential in hand.
+ * ⚠️ A `typedData` that cannot be encoded is NOT — that is this deployment's own domain being wrong, and
+ * returning `false` for it would tell an operator with a mis-copied `tokenName` that every honest payer is
+ * a forger. It throws.
+ */
+export async function verifyEip3009Signature(
+  typedData: Eip3009TypedData,
+  signature: string,
+  expectedSigner: string,
+): Promise<boolean> {
+  if (!/^0x[0-9a-fA-F]{40}$/.test(expectedSigner)) return false;
+  if (!isCanonicalSignature(signature)) return false;
+  // ⛔ NOT wrapped in a try. `isCanonicalSignature` has already established that the signature parses, so
+  // the only way this throws now is an unencodable `typedData` — a wiring error, and one a `false` would
+  // report as the counterparty's fault. See the head note.
+  const recovered: Address = await recoverTypedDataAddress({
+    domain: typedData.domain,
+    types: typedData.types,
+    primaryType: typedData.primaryType,
+    message: typedData.message,
+    signature: signature as Hex,
+  });
+  // Compared as decoded 20-byte values, not as strings: `getAddress` checksums both sides, so a payer
+  // spelling their own address in lowercase is the same payer.
+  return getAddress(recovered) === getAddress(expectedSigner);
+}

package/src/index.ts

@@ -15,8 +15,10 @@ export {
   type Eip3009Authorization,
   type Eip3009TypedData,
   eip155ChainId,
+  isCanonicalSignature,
   type LcpEvmSigner,
   TRANSFER_WITH_AUTHORIZATION_TYPE,
+  verifyEip3009Signature,
 } from "./eip3009.js";
 export { assetWasTransferred, ERC20_TRANSFER_TOPIC0 } from "./erc20.js";
 export {