@payai/x402-evm 2.4.1 → 2.4.3

package/dist/cjs/exact/facilitator/index.d.ts

@@ -1,15 +1,19 @@
 import { SchemeNetworkFacilitator, PaymentPayload, PaymentRequirements, FacilitatorContext, VerifyResponse, SettleResponse, Network } from '@payai/x402/types';
-import { F as FacilitatorEvmSigner } from '../../signer-D912R4mq.js';
+import { F as FacilitatorEvmSigner } from '../../signer-tYS6Y46X.js';
 import { x402Facilitator } from '@payai/x402/facilitator';
+import 'viem';
 
 interface ExactEvmSchemeConfig {
     /**
-     * If enabled, the facilitator will deploy ERC-4337 smart wallets
-     * via EIP-6492 when encountering undeployed contract signatures.
+     * Allowlist of factory contract addresses (hex strings, case-insensitive) that the facilitator
+     * will call when deploying an undeployed smart wallet via ERC-6492.
      *
-     * @default false
+     * A non-empty list enables ERC-4337 smart wallet deployment via EIP-6492. An empty or omitted
+     * list denies all factory deployment calls (feature disabled by default).
+     *
+     * @default []
      */
-    deployERC4337WithEIP6492?: boolean;
+    eip6492AllowedFactories?: string[];
     /**
      * If enabled, run on-chain simulation during settle's re-verify.
      *
@@ -83,12 +87,15 @@ interface EvmFacilitatorConfig {
      */
     networks: Network | Network[];
     /**
-     * If enabled, the facilitator will deploy ERC-4337 smart wallets
-     * via EIP-6492 when encountering undeployed contract signatures.
+     * Allowlist of factory contract addresses (hex strings, case-insensitive) that the facilitator
+     * will call when deploying an undeployed smart wallet via ERC-6492.
      *
-     * @default false
+     * A non-empty list enables ERC-4337 smart wallet deployment via EIP-6492. An empty or omitted
+     * list denies all factory deployment calls (feature disabled by default).
+     *
+     * @default []
      */
-    deployERC4337WithEIP6492?: boolean;
+    eip6492AllowedFactories?: string[];
     /**
      * If enabled, reruns on-chain simulation during settle's re-verify.
      *

package/dist/cjs/exact/facilitator/index.js

@@ -336,6 +336,7 @@ var ErrEip2612SpenderNotPermit2 = "eip2612_spender_not_permit2";
 var ErrEip2612DeadlineExpired = "eip2612_deadline_expired";
 var ErrUnsupportedPayloadType = "unsupported_payload_type";
 var ErrInvalidTransactionState = "invalid_transaction_state";
+var ErrFactoryNotAllowed = "eip6492_factory_not_allowed";
 
 // src/exact/facilitator/eip3009-utils.ts
 var import_viem3 = require("viem");
@@ -743,9 +744,22 @@ async function settleEIP3009(signer, payload, requirements, eip3009Payload, conf
     const { address: factoryAddress, data: factoryCalldata } = (0, import_viem4.parseErc6492Signature)(
       eip3009Payload.signature
     );
-    if (config.deployERC4337WithEIP6492 && factoryAddress && factoryCalldata && !(0, import_viem4.isAddressEqual)(factoryAddress, "0x0000000000000000000000000000000000000000")) {
+    if (factoryAddress && factoryCalldata && !(0, import_viem4.isAddressEqual)(factoryAddress, "0x0000000000000000000000000000000000000000")) {
       const bytecode = await signer.getCode({ address: payer });
       if (!bytecode || bytecode === "0x") {
+        const normalizedFactory = factoryAddress.toLowerCase();
+        const isAllowed = (config.eip6492AllowedFactories ?? []).some(
+          (allowed) => allowed.toLowerCase() === normalizedFactory
+        );
+        if (!isAllowed) {
+          return {
+            success: false,
+            errorReason: ErrFactoryNotAllowed,
+            transaction: "",
+            network: payload.accepted.network,
+            payer
+          };
+        }
         const deployTx = await signer.sendTransaction({
           to: factoryAddress,
           data: factoryCalldata
@@ -1140,6 +1154,7 @@ async function checkPermit2Prerequisites(config, signer, tokenAddress, payer, am
   return { isValid: true, invalidReason: void 0, payer };
 }
 function buildExactPermit2SettleArgs(permit2Payload) {
+  const { signature } = (0, import_viem6.parseErc6492Signature)(permit2Payload.signature);
   return [
     {
       permitted: {
@@ -1154,7 +1169,7 @@ function buildExactPermit2SettleArgs(permit2Payload) {
       to: (0, import_viem6.getAddress)(permit2Payload.permit2Authorization.witness.to),
       validAfter: BigInt(permit2Payload.permit2Authorization.witness.validAfter)
     },
-    permit2Payload.signature
+    signature
   ];
 }
 function splitEip2612Signature(signature) {
@@ -1472,7 +1487,7 @@ var ExactEvmScheme = class {
     this.scheme = "exact";
     this.caipFamily = "eip155:*";
     this.config = {
-      deployERC4337WithEIP6492: config?.deployERC4337WithEIP6492 ?? false,
+      eip6492AllowedFactories: config?.eip6492AllowedFactories ?? [],
       simulateInSettle: config?.simulateInSettle ?? false
     };
   }
@@ -1586,7 +1601,7 @@ var ExactEvmSchemeV12 = class {
     this.scheme = "exact";
     this.caipFamily = "eip155:*";
     this.config = {
-      deployERC4337WithEIP6492: config?.deployERC4337WithEIP6492 ?? false,
+      eip6492AllowedFactories: config?.eip6492AllowedFactories ?? [],
       simulateInSettle: config?.simulateInSettle ?? false
     };
   }
@@ -1646,10 +1661,23 @@ var ExactEvmSchemeV12 = class {
       const { address: factoryAddress, data: factoryCalldata } = (0, import_viem9.parseErc6492Signature)(
         exactEvmPayload.signature
       );
-      if (this.config.deployERC4337WithEIP6492 && factoryAddress && factoryCalldata && !(0, import_viem9.isAddressEqual)(factoryAddress, "0x0000000000000000000000000000000000000000")) {
+      if (factoryAddress && factoryCalldata && !(0, import_viem9.isAddressEqual)(factoryAddress, "0x0000000000000000000000000000000000000000")) {
         const payerAddress = exactEvmPayload.authorization.from;
         const bytecode = await this.signer.getCode({ address: payerAddress });
         if (!bytecode || bytecode === "0x") {
+          const normalizedFactory = factoryAddress.toLowerCase();
+          const isAllowed = (this.config.eip6492AllowedFactories ?? []).some(
+            (allowed) => allowed.toLowerCase() === normalizedFactory
+          );
+          if (!isAllowed) {
+            return {
+              success: false,
+              errorReason: ErrFactoryNotAllowed,
+              transaction: "",
+              network: payloadV1.network,
+              payer: exactEvmPayload.authorization.from
+            };
+          }
           const deployTx = await this.signer.sendTransaction({
             to: factoryAddress,
             data: factoryCalldata
@@ -1851,14 +1879,14 @@ function registerExactEvmScheme(facilitator, config) {
   facilitator.register(
     config.networks,
     new ExactEvmScheme(config.signer, {
-      deployERC4337WithEIP6492: config.deployERC4337WithEIP6492,
+      eip6492AllowedFactories: config.eip6492AllowedFactories,
       simulateInSettle: config.simulateInSettle
     })
   );
   facilitator.registerV1(
     NETWORKS,
     new ExactEvmSchemeV12(config.signer, {
-      deployERC4337WithEIP6492: config.deployERC4337WithEIP6492,
+      eip6492AllowedFactories: config.eip6492AllowedFactories,
       simulateInSettle: config.simulateInSettle
     })
   );