@liquidium/client 0.7.0 → 0.7.1

package/dist/index.d.cts

@@ -1,8 +1,18 @@
 import { Identity, HttpAgent } from '@icp-sdk/core/agent';
 import { PublicClient } from 'viem';
 
-/** Minimal viem-compatible client shape required for SDK EVM read calls. */
-type EvmReadClient = Pick<PublicClient, "readContract">;
+/**
+ * Minimal viem-compatible client shape required for SDK EVM read calls.
+ *
+ * When `getCode` is present and `chain` identifies Ethereum mainnet, the SDK
+ * uses it for a best-effort native ETH contract-destination check. Provider
+ * failures fail open and do not block the outflow.
+ */
+interface EvmReadClient {
+    readContract: PublicClient["readContract"];
+    chain?: PublicClient["chain"];
+    getCode?: PublicClient["getCode"];
+}
 /**
  * Runtime options for `new LiquidiumClient(config)`.
  *
@@ -30,11 +40,11 @@ interface LiquidiumClientConfig {
     fetch?: typeof fetch;
     /** Per-request timeout for SDK API calls in milliseconds. */
     timeoutMs?: number;
-    /** Ethereum RPC URL used for public ERC-20 reads in EVM supply flows. */
+    /** Ethereum RPC URL used for best-effort native ETH outflow checks and public ERC-20 reads. */
     evmRpcUrl?: string;
     /** Optional headers for RPC providers that authenticate via HTTP headers. */
     evmRpcHeaders?: Record<string, string>;
-    /** Existing viem public client or compatible read client for EVM reads. */
+    /** Existing viem client; mainnet `chain` and `getCode` enable native ETH outflow checks. */
     evmPublicClient?: EvmReadClient;
 }
 /** Pool canister principal text values grouped by pool asset. */
@@ -2305,6 +2315,7 @@ declare const LiquidiumErrorCode: {
     readonly WITHDRAW_TOO_LOW: "WITHDRAW_TOO_LOW";
     readonly REPAYMENT_EXCEEDS_DEBT: "REPAYMENT_EXCEEDS_DEBT";
     readonly INVALID_ADDRESS: "INVALID_ADDRESS";
+    readonly CONTRACT_DESTINATION_UNSUPPORTED: "CONTRACT_DESTINATION_UNSUPPORTED";
     readonly DEPOSIT_ADDRESS_ERROR: "DEPOSIT_ADDRESS_ERROR";
     readonly NETWORK_ERROR: "NETWORK_ERROR";
     readonly SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";

package/dist/index.d.ts

@@ -1,8 +1,18 @@
 import { Identity, HttpAgent } from '@icp-sdk/core/agent';
 import { PublicClient } from 'viem';
 
-/** Minimal viem-compatible client shape required for SDK EVM read calls. */
-type EvmReadClient = Pick<PublicClient, "readContract">;
+/**
+ * Minimal viem-compatible client shape required for SDK EVM read calls.
+ *
+ * When `getCode` is present and `chain` identifies Ethereum mainnet, the SDK
+ * uses it for a best-effort native ETH contract-destination check. Provider
+ * failures fail open and do not block the outflow.
+ */
+interface EvmReadClient {
+    readContract: PublicClient["readContract"];
+    chain?: PublicClient["chain"];
+    getCode?: PublicClient["getCode"];
+}
 /**
  * Runtime options for `new LiquidiumClient(config)`.
  *
@@ -30,11 +40,11 @@ interface LiquidiumClientConfig {
     fetch?: typeof fetch;
     /** Per-request timeout for SDK API calls in milliseconds. */
     timeoutMs?: number;
-    /** Ethereum RPC URL used for public ERC-20 reads in EVM supply flows. */
+    /** Ethereum RPC URL used for best-effort native ETH outflow checks and public ERC-20 reads. */
     evmRpcUrl?: string;
     /** Optional headers for RPC providers that authenticate via HTTP headers. */
     evmRpcHeaders?: Record<string, string>;
-    /** Existing viem public client or compatible read client for EVM reads. */
+    /** Existing viem client; mainnet `chain` and `getCode` enable native ETH outflow checks. */
     evmPublicClient?: EvmReadClient;
 }
 /** Pool canister principal text values grouped by pool asset. */
@@ -2305,6 +2315,7 @@ declare const LiquidiumErrorCode: {
     readonly WITHDRAW_TOO_LOW: "WITHDRAW_TOO_LOW";
     readonly REPAYMENT_EXCEEDS_DEBT: "REPAYMENT_EXCEEDS_DEBT";
     readonly INVALID_ADDRESS: "INVALID_ADDRESS";
+    readonly CONTRACT_DESTINATION_UNSUPPORTED: "CONTRACT_DESTINATION_UNSUPPORTED";
     readonly DEPOSIT_ADDRESS_ERROR: "DEPOSIT_ADDRESS_ERROR";
     readonly NETWORK_ERROR: "NETWORK_ERROR";
     readonly SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";

package/dist/index.js

@@ -45,6 +45,7 @@ var LiquidiumErrorCode = {
   WITHDRAW_TOO_LOW: "WITHDRAW_TOO_LOW",
   REPAYMENT_EXCEEDS_DEBT: "REPAYMENT_EXCEEDS_DEBT",
   INVALID_ADDRESS: "INVALID_ADDRESS",
+  CONTRACT_DESTINATION_UNSUPPORTED: "CONTRACT_DESTINATION_UNSUPPORTED",
   DEPOSIT_ADDRESS_ERROR: "DEPOSIT_ADDRESS_ERROR",
   // Transport
   NETWORK_ERROR: "NETWORK_ERROR",
@@ -1785,6 +1786,11 @@ var HISTORY_ACTIVITIES = `${SDK_API_V2_PATH}/history/activities`;
 var HISTORY_USERS = `${SDK_API_V2_PATH}/history/users`;
 var INFLOW = `${SDK_API_V2_PATH}/inflow`;
 var SIMPLE_LOANS = `${SDK_API_V1_PATH}/instant-loans`;
+function buildEthereumAddressBytecodePath(request) {
+  return `${SDK_API_V2_PATH}/ethereum/addresses/${encodeURIComponent(
+    request.address
+  )}/bytecode`;
+}
 function buildHistoryUserTransactionsPath(profileId, query) {
   const base = `${HISTORY_USERS}/${encodeURIComponent(profileId)}/transactions`;
   const qs = query.toString();
@@ -3341,6 +3347,71 @@ function accountTypeToString(accountType) {
       return `Principal:${accountType.data}`;
   }
 }
+var EMPTY_EVM_BYTECODE = "0x";
+var LAST_ETHEREUM_MAINNET_PRECOMPILE_ADDRESS = 0x11n;
+var CONTRACT_DESTINATION_UNSUPPORTED_MESSAGE = "Contract addresses are not supported for native ETH withdrawals or borrowing";
+var RESERVED_DESTINATION_MESSAGE = "Ethereum outflow destination must not be the zero address or a precompile";
+async function guardEthereumOutflowDestination({
+  address,
+  apiClient,
+  asset,
+  chain,
+  evmReadClient
+}) {
+  if (chain !== Chain.ETH) {
+    return;
+  }
+  const normalizedAddress = getAddress(address);
+  if (BigInt(normalizedAddress) <= LAST_ETHEREUM_MAINNET_PRECOMPILE_ADDRESS) {
+    throw new LiquidiumError(
+      LiquidiumErrorCode.INVALID_ADDRESS,
+      RESERVED_DESTINATION_MESSAGE
+    );
+  }
+  if (asset !== Asset.ETH) {
+    return;
+  }
+  if (evmReadClient?.chain?.id === mainnet.id && evmReadClient.getCode) {
+    let bytecode;
+    try {
+      bytecode = await evmReadClient.getCode({
+        address: normalizedAddress
+      });
+    } catch {
+      return;
+    }
+    if (bytecode === void 0 || bytecode === EMPTY_EVM_BYTECODE) {
+      return;
+    }
+    if (typeof bytecode !== "string" || !/^0x(?:[0-9a-fA-F]{2})*$/.test(bytecode)) {
+      return;
+    }
+    throw new LiquidiumError(
+      LiquidiumErrorCode.CONTRACT_DESTINATION_UNSUPPORTED,
+      CONTRACT_DESTINATION_UNSUPPORTED_MESSAGE
+    );
+  }
+  if (!apiClient) {
+    return;
+  }
+  let response;
+  try {
+    response = await apiClient.get(
+      buildEthereumAddressBytecodePath({ address: normalizedAddress })
+    );
+  } catch {
+    return;
+  }
+  if (!response || typeof response !== "object" || !("hasDeployedBytecode" in response) || typeof response.hasDeployedBytecode !== "boolean") {
+    return;
+  }
+  if (response.hasDeployedBytecode) {
+    throw new LiquidiumError(
+      LiquidiumErrorCode.CONTRACT_DESTINATION_UNSUPPORTED,
+      CONTRACT_DESTINATION_UNSUPPORTED_MESSAGE
+    );
+  }
+}
 
 // src/core/pool-ledger-assets.ts
 function getPoolLedgerAssetRoute(params) {
@@ -4723,6 +4794,13 @@ var LendingModule = class {
       poolChain: selectedPool.chain,
       destinationChain: request.chain
     });
+    await guardEthereumOutflowDestination({
+      address: receiver.address,
+      apiClient: this.apiClient,
+      asset: selectedAsset,
+      chain: request.chain,
+      evmReadClient: this.evmReadClient
+    });
     const lendingActor = createLendingActor(this.canisterContext);
     try {
       const expiryTimestamp = computeExpiryTimestampFromNow();
@@ -4741,7 +4819,9 @@ var LendingModule = class {
       };
       const withdrawSubmissionData = {
         ...withdrawActionData,
-        receiverAccount: receiver.canisterAccount
+        asset: selectedAsset,
+        receiverAccount: receiver.canisterAccount,
+        receiverAddress: receiver.address
       };
       return {
         kind: WalletActionKind.createWithdraw,
@@ -4773,6 +4853,13 @@ var LendingModule = class {
     }
   }
   async submitWithdraw(request, signatureInfo) {
+    await guardEthereumOutflowDestination({
+      address: request.receiverAddress,
+      apiClient: this.apiClient,
+      asset: request.asset,
+      chain: request.chain,
+      evmReadClient: this.evmReadClient
+    });
     try {
       const result = await createLendingActor(this.canisterContext).withdraw(
         Principal.fromText(request.profileId),
@@ -4877,6 +4964,13 @@ var LendingModule = class {
       poolChain: selectedPool.chain,
       destinationChain: request.chain
     });
+    await guardEthereumOutflowDestination({
+      address: receiver.address,
+      apiClient: this.apiClient,
+      asset: selectedAsset,
+      chain: request.chain,
+      evmReadClient: this.evmReadClient
+    });
     await this.guardBorrowSameAssetPolicy({
       profileId: request.profileId,
       pool: selectedPool
@@ -4899,7 +4993,9 @@ var LendingModule = class {
       };
       const borrowSubmissionData = {
         ...borrowActionData,
-        receiverAccount: receiver.canisterAccount
+        asset: selectedAsset,
+        receiverAccount: receiver.canisterAccount,
+        receiverAddress: receiver.address
       };
       return {
         kind: WalletActionKind.createBorrow,
@@ -4928,6 +5024,13 @@ var LendingModule = class {
     }
   }
   async submitBorrow(request, signatureInfo) {
+    await guardEthereumOutflowDestination({
+      address: request.receiverAddress,
+      apiClient: this.apiClient,
+      asset: request.asset,
+      chain: request.chain,
+      evmReadClient: this.evmReadClient
+    });
     try {
       const result = await createLendingActor(
         this.canisterContext