@kaspacom/kcc20-tx-builder 0.8.0-fee.3 → 0.8.0-fee.4

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.8.0-fee.4
+
+- Require the fee-account owner key to match the connected Schnorr funding wallet for creation and binding.
+- Exclude the account source outpoint from binding funding and reject duplicate inputs.
+
 ## 0.8.0-fee.3
 
 - Build wallet-signable fee-account genesis and one-time market binding PSKTs from the pinned escrow artifact.

package/RELEASING.md

@@ -95,9 +95,10 @@ consumer deployment. Record any unverified operation families explicitly.
 
 ## Fee integration prerelease
 
-Version `0.8.0-fee.3` adds fee-account creation and binding PSKTs for DEV
+Version `0.8.0-fee.4` adds fee-account creation and binding PSKTs for DEV
 integration. Run the existing snapshot and example tests against the pinned
-WASM before publishing it under `next`. This prerelease does not build
+WASM before publishing it under `next`. This version fixes fee.3's owner and
+funding-source checks. This prerelease does not build
 fee-market trades, claims or authority rotation. Funded fee-market journeys and
 signed settlement construction remain required before enabling markets or
 promoting a stable fee release.

package/dist/cjs/engine.js

@@ -383,6 +383,7 @@ function createKcc20PsktBuilderEngine(options) {
         const principalSompi = parseU64(params.principalSompi, "fee account principal");
         const network = request.network || env.KASPA_NETWORK || "testnet-10";
         const walletAddress = requireKaspaAddress(request.owner?.walletAddress);
+        assertFeeAccountSchnorrWalletOwner(walletAddress, owner);
         const priorityFee = parseU64(env.KCC20_FEE_ACCOUNT_PRIORITY_FEE_SOMPI || DEFAULT_PRIORITY_FEE.toString(), "priorityFee");
         const artifactKey = "KCC20FeeEscrowV1.placeholder.json";
         const supplied = options.artifacts?.[artifactKey] ?? await options.artifactProvider?.(artifactKey);
@@ -500,6 +501,7 @@ function createKcc20PsktBuilderEngine(options) {
         }
         const network = request.network || env.KASPA_NETWORK || "testnet-10";
         const walletAddress = requireKaspaAddress(request.owner?.walletAddress);
+        assertFeeAccountSchnorrWalletOwner(walletAddress, owner);
         const accountAddress = requireKaspaAddress(indexed.address);
         const priorityFee = parseU64(env.KCC20_FEE_ACCOUNT_PRIORITY_FEE_SOMPI || DEFAULT_PRIORITY_FEE.toString(), "priorityFee");
         const computeBudget = parsePositiveNumber(env.KCC20_FEE_ACCOUNT_COMPUTE_BUDGET || 500, "computeBudget");
@@ -545,7 +547,7 @@ function createKcc20PsktBuilderEngine(options) {
                 tokenId, accountId, marketId, policyId,
             });
             assertScriptAddress(kw, plan.currentRedeemScript, accountAddress, network, "unbound fee account address");
-            const fundingEntry = (0, sale_common_js_1.selectFundingEntry)(walletUtxos.entries, priorityFee + 10000n, [], params.fundingOutpoint);
+            const fundingEntry = (0, sale_common_js_1.selectFundingEntry)(walletUtxos.entries, priorityFee + 10000n, [accountEntry.outpoint], params.fundingOutpoint);
             const fundingAmount = (0, sale_common_js_1.utxoAmountSompi)(fundingEntry);
             if (fundingAmount <= priorityFee + 10000n)
                 throw new Error("fee account binding funding change is too small");
@@ -568,6 +570,7 @@ function createKcc20PsktBuilderEngine(options) {
             });
             (0, sale_common_js_1.setVersionOneInputMassFields)(unsignedTx, computeBudget);
             unsignedTx.inputs[1].computeBudget = 30;
+            assertUniqueTransactionInputOutpoints(unsignedTx, "fee account binding");
             const scripts = [{
                     inputIndex: 0,
                     scriptHex: (0, sale_common_js_1.bytesToHex)(plan.currentRedeemScript),
@@ -9341,6 +9344,14 @@ function createKcc20PsktBuilderEngine(options) {
             throw new Error("owner.walletAddress must be a Kaspa address");
         return address;
     }
+    function assertFeeAccountSchnorrWalletOwner(walletAddress, owner) {
+        const script = String(kaspaWasm.payToAddressScript(walletAddress).script)
+            .toLowerCase();
+        const publicKey = /^20([0-9a-f]{64})ac$/.exec(script)?.[1];
+        if (!publicKey || publicKey !== owner) {
+            throw new Error("fee account owner must match the connected Schnorr wallet address");
+        }
+    }
     return {
         build: buildInProcessPskt,
         buildInProcessPskt,