@qrlwallet/connect 5.0.0 → 5.0.1

package/dist/index.js

@@ -3645,7 +3645,7 @@ function requestedSwitchChainId(params) {
   }
   return canonicalChainId2(request.chainId);
 }
-var TRANSACTION_FIELDS = /* @__PURE__ */ new Set(["from", "to", "value", "gas", "data"]);
+var TRANSACTION_FIELDS = /* @__PURE__ */ new Set(["from", "to", "value", "gas", "data", "chainId"]);
 var QRL_TRANSACTION_MAX_DATA_BYTES = 128 * 1024;
 var QRL_TRANSACTION_MAX_QUANTITY_HEX_DIGITS = 64;
 var RPC_QUANTITY_RE = /^0x(?:0|[1-9a-fA-F][0-9a-fA-F]*)$/;
@@ -3660,8 +3660,11 @@ function validateRpcQuantity(value, field) {
   if (field === "gas" && BigInt(value) > BigInt(Number.MAX_SAFE_INTEGER)) {
     throw new Error("transaction gas exceeds the wallet safe-integer limit");
   }
+  if (field === "chainId" && BigInt(value) === 0n) {
+    throw new Error("transaction chainId must be positive");
+  }
 }
-function validateTransactionRequest(method, params, authorizedAccount) {
+function validateTransactionRequest(method, params, authorizedAccount, currentChainId) {
   if (params?.length !== 1 || !isRecordObj(params[0])) {
     throw new Error(`${method} requires exactly one transaction object`);
   }
@@ -3679,6 +3682,12 @@ function validateTransactionRequest(method, params, authorizedAccount) {
   }
   if ("value" in tx) validateRpcQuantity(tx.value, "value");
   if ("gas" in tx) validateRpcQuantity(tx.gas, "gas");
+  if ("chainId" in tx) {
+    validateRpcQuantity(tx.chainId, "chainId");
+    if (canonicalChainId2(tx.chainId) !== canonicalChainId2(currentChainId)) {
+      throw new Error("transaction chainId does not match the connected wallet");
+    }
+  }
   if ("data" in tx && (typeof tx.data !== "string" || tx.data.length > QRL_TRANSACTION_MAX_DATA_BYTES * 2 + 2 || !/^0x(?:[0-9a-fA-F]{2})*$/.test(tx.data))) {
     throw new Error("transaction data must be bounded 0x-prefixed bytes");
   }
@@ -3696,7 +3705,7 @@ function snapshotRequestParams(params) {
     throw new Error(`Request params must be JSON-serializable: ${detail}`);
   }
 }
-function validateRestrictedRequest(method, params, authorizedAccounts) {
+function validateRestrictedRequest(method, params, authorizedAccounts, currentChainId) {
   if (method === "qrl_requestAccounts") {
     if (params !== void 0 && params.length !== 0) {
       throw new Error("qrl_requestAccounts does not accept parameters");
@@ -3711,7 +3720,7 @@ function validateRestrictedRequest(method, params, authorizedAccounts) {
     throw new Error("No authorized account: call qrl_requestAccounts first");
   }
   if (method === "qrl_sendTransaction" || method === "qrl_signTransaction") {
-    validateTransactionRequest(method, params, authorizedAccount);
+    validateTransactionRequest(method, params, authorizedAccount, currentChainId);
     return void 0;
   }
   if (method === "qrl_signMessage") {
@@ -4059,7 +4068,8 @@ var QRLConnectProvider = class extends import_eventemitter34.default {
       const expectedChainId = validateRestrictedRequest(
         method,
         stableParams,
-        this.connectionManager.getAccounts()
+        this.connectionManager.getAccounts(),
+        this.connectionManager.getChainId()
       );
       return this.enqueueRestrictedRequest(method, stableParams, expectedChainId, generation);
     }
@@ -4124,6 +4134,14 @@ var QRLConnectProvider = class extends import_eventemitter34.default {
         throw new Error("Not connected to QRL Wallet");
       }
     }
+    if (restricted) {
+      validateRestrictedRequest(
+        method,
+        params,
+        this.connectionManager.getAccounts(),
+        this.connectionManager.getChainId()
+      );
+    }
     if (this.requestCounter >= Number.MAX_SAFE_INTEGER) {
       throw new Error("JSON-RPC request id counter exhausted");
     }

package/dist/index.mjs

@@ -3540,7 +3540,7 @@ function requestedSwitchChainId(params) {
   }
   return canonicalChainId2(request.chainId);
 }
-var TRANSACTION_FIELDS = /* @__PURE__ */ new Set(["from", "to", "value", "gas", "data"]);
+var TRANSACTION_FIELDS = /* @__PURE__ */ new Set(["from", "to", "value", "gas", "data", "chainId"]);
 var QRL_TRANSACTION_MAX_DATA_BYTES = 128 * 1024;
 var QRL_TRANSACTION_MAX_QUANTITY_HEX_DIGITS = 64;
 var RPC_QUANTITY_RE = /^0x(?:0|[1-9a-fA-F][0-9a-fA-F]*)$/;
@@ -3555,8 +3555,11 @@ function validateRpcQuantity(value, field) {
   if (field === "gas" && BigInt(value) > BigInt(Number.MAX_SAFE_INTEGER)) {
     throw new Error("transaction gas exceeds the wallet safe-integer limit");
   }
+  if (field === "chainId" && BigInt(value) === 0n) {
+    throw new Error("transaction chainId must be positive");
+  }
 }
-function validateTransactionRequest(method, params, authorizedAccount) {
+function validateTransactionRequest(method, params, authorizedAccount, currentChainId) {
   if (params?.length !== 1 || !isRecordObj(params[0])) {
     throw new Error(`${method} requires exactly one transaction object`);
   }
@@ -3574,6 +3577,12 @@ function validateTransactionRequest(method, params, authorizedAccount) {
   }
   if ("value" in tx) validateRpcQuantity(tx.value, "value");
   if ("gas" in tx) validateRpcQuantity(tx.gas, "gas");
+  if ("chainId" in tx) {
+    validateRpcQuantity(tx.chainId, "chainId");
+    if (canonicalChainId2(tx.chainId) !== canonicalChainId2(currentChainId)) {
+      throw new Error("transaction chainId does not match the connected wallet");
+    }
+  }
   if ("data" in tx && (typeof tx.data !== "string" || tx.data.length > QRL_TRANSACTION_MAX_DATA_BYTES * 2 + 2 || !/^0x(?:[0-9a-fA-F]{2})*$/.test(tx.data))) {
     throw new Error("transaction data must be bounded 0x-prefixed bytes");
   }
@@ -3591,7 +3600,7 @@ function snapshotRequestParams(params) {
     throw new Error(`Request params must be JSON-serializable: ${detail}`);
   }
 }
-function validateRestrictedRequest(method, params, authorizedAccounts) {
+function validateRestrictedRequest(method, params, authorizedAccounts, currentChainId) {
   if (method === "qrl_requestAccounts") {
     if (params !== void 0 && params.length !== 0) {
       throw new Error("qrl_requestAccounts does not accept parameters");
@@ -3606,7 +3615,7 @@ function validateRestrictedRequest(method, params, authorizedAccounts) {
     throw new Error("No authorized account: call qrl_requestAccounts first");
   }
   if (method === "qrl_sendTransaction" || method === "qrl_signTransaction") {
-    validateTransactionRequest(method, params, authorizedAccount);
+    validateTransactionRequest(method, params, authorizedAccount, currentChainId);
     return void 0;
   }
   if (method === "qrl_signMessage") {
@@ -3954,7 +3963,8 @@ var QRLConnectProvider = class extends EventEmitter4 {
       const expectedChainId = validateRestrictedRequest(
         method,
         stableParams,
-        this.connectionManager.getAccounts()
+        this.connectionManager.getAccounts(),
+        this.connectionManager.getChainId()
       );
       return this.enqueueRestrictedRequest(method, stableParams, expectedChainId, generation);
     }
@@ -4019,6 +4029,14 @@ var QRLConnectProvider = class extends EventEmitter4 {
         throw new Error("Not connected to QRL Wallet");
       }
     }
+    if (restricted) {
+      validateRestrictedRequest(
+        method,
+        params,
+        this.connectionManager.getAccounts(),
+        this.connectionManager.getChainId()
+      );
+    }
     if (this.requestCounter >= Number.MAX_SAFE_INTEGER) {
       throw new Error("JSON-RPC request id counter exhausted");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qrlwallet/connect",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "packageManager": "npm@10.9.8",
   "description": "Connect your dApp to QRL Wallet via QR code or deep link",
   "main": "dist/index.js",