@pushchain/core 6.0.22 → 6.0.24

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+@pushchain/core@6.0.23 (2026-09-01)
+
+- docs: changelog entry for the EVM PC20 burn routing fix
+- fix: route EVM PC20 imports through the payload path
+
+---
+
 @pushchain/core@6.0.22 (2026-08-14)
 
 - fix: make PC20 first exports and Solana R3 E2E reliable
@@ -63,6 +70,16 @@
   metadata, and added SVM remaining-account support required by the Solana
   gateway.
 
+- Fixed EVM PC20 wrapper burns destroying the wrapper without unlocking the
+  canonical token. A payload-less burn took the funds-only path, whose empty
+  payload gains the gateway's PC20 selector and then fails the chain's inbound
+  decode at ballot finalization — no handler runs, no revert is produced, and
+  the already-burned wrapper leaves the canonical token locked in VaultPC20.
+  The always-forward mitigation was gated to Solana; PC20 imports now route
+  through the payload path on both VMs, and `executeFundsOnly` fails closed
+  with `PC20UnsafeEmptyPayloadError` if a PC20 import ever reaches it again.
+  PRC20 and native funds-only flows are unchanged.
+
 ---
 
 @pushchain/core@6.0.20 (2026-07-10)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushchain/core",
-  "version": "6.0.22",
+  "version": "6.0.24",
   "homepage": "https://push.org",
   "keywords": [
     "pushchain",

package/src/lib/orchestrator/internals/execute-funds-only.js

@@ -31,11 +31,19 @@ const response_builder_1 = require("./response-builder");
 const push_chain_tx_1 = require("./push-chain-tx");
 const svm_helpers_1 = require("./svm-helpers");
 const svm_1 = require("./pc20/svm");
+const gate_1 = require("./pc20/gate");
 const helpers_2 = require("./helpers");
 const response_builder_2 = require("./response-builder");
 const formatters_1 = require("../../formatters");
 async function executeFundsOnly(ctx, execute, eventBuffer, getResponseCallbacks) {
     const transformFn = (tx, buf = []) => (0, response_builder_2.transformToUniversalTxResponse)(ctx, tx, buf, getResponseCallbacks());
+    // Fail closed: a PC20 wrapper burn must never be broadcast from this path.
+    // It sends an empty payload, the gateway prepends the PC20 selector, and the
+    // chain's inbound decode hard-fails on the selector-only result with no
+    // revert — burning the wrapper and locking the canonical token forever.
+    // The orchestrator routes PC20 imports to the payload path; this is the
+    // backstop for any caller that reaches here anyway.
+    (0, gate_1.assertPC20ImportHasPayload)(execute, false, 'executeFundsOnly');
     const chain = ctx.universalSigner.account.chain;
     const { vm } = chain_1.CHAIN_INFO[chain];
     if (!helpers_1.SUPPORTED_GATEWAY_CHAINS.includes(chain)) {

package/src/lib/orchestrator/orchestrator.js

@@ -266,8 +266,8 @@ class Orchestrator {
                     // Single PC20 gate. Downstream builders only ever see the legacy
                     // PRC20/native shape; the PC20 branch is added here in Phase 2.
                     const legacy = await (0, gate_1.gateFunds)(this.ctx, execute);
-                    // SVM PC20 imports never take the raw funds-only path: the Solana
-                    // gateway prepends the PC20 selector to the (empty) payload and
+                    // PC20 imports never take the raw funds-only path, on EITHER VM.
+                    // The gateway prepends the PC20 selector to the (empty) payload and
                     // classifies the RESULT as FUNDS_AND_PAYLOAD, and the chain's
                     // inbound decode hard-fails on that selector-only payload with no
                     // revert — the wrapper is already burned (same "0x" vs "" guard as
@@ -275,9 +275,18 @@ class Orchestrator {
                     // payload (UEA multicall transfer to `to`), which classifies and
                     // decodes legitimately — the same always-forward mitigation R3
                     // ships on both VMs.
-                    const svmPc20Import = legacy._pc20?.direction === 'import' &&
-                        chain_1.CHAIN_INFO[this.ctx.universalSigner.account.chain].vm === enums_1.VM.SVM;
-                    return attachPerCallHookForWait(!hasData && !svmPc20Import
+                    //
+                    // This was previously gated on VM.SVM, which left EVM wrapper burns
+                    // on the unsafe path: observed on Donut as a burned wrapper whose
+                    // canonical token was never unlocked. The brick is at ballot
+                    // finalization — NormalizeForTxType (x/uexecutor/types/inbound.go)
+                    // strips the selector, gets '0x', which passes its `!= ""` empty
+                    // check, and DecodeRawPayload('0x') then fails — so no handler runs
+                    // at all: no deploy, no credit, and no INBOUND_REVERT. With a real
+                    // forward payload the decode succeeds and the funds_and_payload
+                    // handler deploys the UEA and credits normally.
+                    const pc20Import = legacy._pc20?.direction === 'import';
+                    return attachPerCallHookForWait(!hasData && !pc20Import
                         ? await (0, internals_1.executeFundsOnly)(this.ctx, legacy, eventBuffer, rcb)
                         : await (0, internals_1.executeFundsWithPayload)(this.ctx, legacy, eventBuffer, rcb));
                 }