@rabby-wallet/rabby-bridge 0.0.13 → 0.0.14-alpha.0

package/dist/quote.js

@@ -1,14 +1,22 @@
+import { BRIDGE_ERRORS, BridgeError, asBridgeError, reportBridgeError } from './errors/index.js';
+import { InvalidBridgeCalldataError, validateBridgeCalldata, } from './calldata/index.js';
+import { finishCheck, knownCompare } from './calldata/expect.js';
+import { calldataDiagnostics } from './calldata/diagnostics.js';
+import { sanitizeBridgeError } from './errors/sanitize.js';
 import { BRIDGE_ENUM } from './consts.js';
 import { getBridgeAltContracts, getBridgeRouter, getBridgeSpender, isSupportedBridgeAggregator, isSupportedBridgeChain, } from './list.js';
-export class InvalidBridgeContractError extends Error {
+import { verifyRelayOrder } from './providers/relay.js';
+export class InvalidBridgeContractError extends BridgeError {
     constructor(kind, aggregatorId, chainId, expected, received, bridgeId) {
-        super(`Invalid bridge ${kind} for ${aggregatorId} on ${chainId}: expected ${expected}, got ${received}`);
+        super(kind === 'router' ? BRIDGE_ERRORS.ROUTER_NOT_ALLOWED : BRIDGE_ERRORS.SPENDER_NOT_ALLOWED, { aggregatorId, chainId, bridgeId });
         this.kind = kind;
         this.aggregatorId = aggregatorId;
         this.chainId = chainId;
         this.expected = expected;
         this.received = received;
         this.bridgeId = bridgeId;
+        this.message =
+            `Invalid bridge ${kind} for ${aggregatorId} on ${chainId}: expected ${expected}, got ${received}`;
         this.name = 'InvalidBridgeContractError';
     }
 }
@@ -20,18 +28,32 @@ const isSameAddress = (left, right) => {
 };
 function assertSupported(aggregatorId, fromChainId) {
     if (!isSupportedBridgeAggregator(aggregatorId)) {
-        throw new Error(`${aggregatorId} is not supported`);
+        const error = new BridgeError(BRIDGE_ERRORS.UNSUPPORTED_BRIDGE_AGGREGATOR, { aggregatorId, chainId: fromChainId });
+        error.message = `${aggregatorId} is not supported`;
+        throw error;
     }
     if (!isSupportedBridgeChain(aggregatorId, fromChainId)) {
-        throw new Error(`${aggregatorId} does not support ${fromChainId}`);
+        const error = new BridgeError(BRIDGE_ERRORS.UNSUPPORTED_SOURCE_CHAIN, { aggregatorId, chainId: fromChainId });
+        error.message = `${aggregatorId} does not support ${fromChainId}`;
+        throw error;
     }
 }
 const requireSlippage = (slippage) => {
     if (!slippage) {
-        throw new Error('slippage is required for this API call');
+        throw new BridgeError(BRIDGE_ERRORS.SLIPPAGE_IS_REQUIRED_FOR_THIS_API_CALL);
     }
     return slippage;
 };
+const readBuildAttachment = (value) => {
+    if (!value || typeof value !== 'object')
+        return {};
+    const record = value;
+    const wrapped = Boolean(record.tx && !record.to && !record.data);
+    return {
+        tx: wrapped ? record.tx : record,
+        orderData: record.order_data,
+    };
+};
 const stringifyQuoteKey = (quoteKey) => {
     if (typeof quoteKey === 'string') {
         return quoteKey;
@@ -45,9 +67,12 @@ export const validateBridgeQuote = (aggregatorId, fromChainId, quote) => {
     }
     const expectedSpender = getBridgeSpender(aggregatorId, fromChainId);
     const receivedSpender = quote.approve_contract_id;
-    if (!expectedSpender || !receivedSpender) {
+    if (!receivedSpender) {
         return true;
     }
+    if (!expectedSpender) {
+        throw new InvalidBridgeContractError('spender', aggregatorId, fromChainId, 'configured spender', receivedSpender, quote.bridge_id);
+    }
     const allowedSpenders = [
         expectedSpender,
         ...getBridgeAltContracts(aggregatorId),
@@ -57,81 +82,219 @@ export const validateBridgeQuote = (aggregatorId, fromChainId, quote) => {
     }
     return true;
 };
-export const validateBridgeTx = (aggregatorId, fromChainId, bridgeId, tx) => {
+const quotedToAmount = (quoteKey) => {
+    let key = quoteKey;
+    if (typeof key === 'string') {
+        try {
+            key = JSON.parse(key);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (!key || typeof key !== 'object' || Array.isArray(key))
+        return undefined;
+    const amount = key.to_token_raw_amount;
+    if (typeof amount === 'string' || (typeof amount === 'number' && Number.isSafeInteger(amount))) {
+        return String(amount);
+    }
+    return undefined;
+};
+const validateBridgeRouter = (aggregatorId, fromChainId, bridgeId, tx) => {
     if (!shouldValidateBridgeContracts(aggregatorId)) {
         return true;
     }
     const expectedRouter = getBridgeRouter(aggregatorId, fromChainId);
-    if (!expectedRouter) {
-        return true;
-    }
     const allowedRouters = [
-        expectedRouter,
+        ...(expectedRouter ? [expectedRouter] : []),
         ...getBridgeAltContracts(aggregatorId),
     ];
     if (!allowedRouters.some((addr) => isSameAddress(addr, tx.to))) {
-        throw new InvalidBridgeContractError('router', aggregatorId, fromChainId, expectedRouter, tx.to, bridgeId);
+        throw asBridgeError(new InvalidBridgeContractError('router', aggregatorId, fromChainId, expectedRouter || allowedRouters.join(',') || 'configured router', tx.to, bridgeId), BRIDGE_ERRORS.ROUTER_NOT_ALLOWED, { ...calldataDiagnostics(tx.data),
+            pass: false, routerPass: false, fromPass: false, toPass: false, receiverPass: false, blocking: true });
     }
     return true;
 };
-export const getQuote = async (aggregatorId, params, api) => {
-    assertSupported(aggregatorId, params.fromChainId);
-    const baseParams = {
-        aggregator_id: aggregatorId,
-        user_addr: params.userAddress,
-        from_chain_id: params.fromChainId,
-        from_token_id: params.fromTokenId,
-        from_token_raw_amount: params.fromTokenRawAmount,
-        to_chain_id: params.toChainId,
-        to_token_id: params.toTokenId,
-        fee_rate: params.feeRate,
-        slippage: requireSlippage(params.slippage),
-    };
-    const quotes = api.getBridgeQuoteListV2
-        ? await api.getBridgeQuoteListV2(baseParams)
-        : await api.getBridgeQuoteV2?.(baseParams);
-    if (!quotes) {
-        throw new Error('Bridge API does not provide a quote list method');
+const fieldErrors = {
+    fromPass: [BRIDGE_ERRORS.FROM_ADDRESS_MISMATCH, BRIDGE_ERRORS.FROM_CHAIN_MISMATCH,
+        BRIDGE_ERRORS.FROM_TOKEN_MISMATCH, BRIDGE_ERRORS.FROM_AMOUNT_MISMATCH,
+        BRIDGE_ERRORS.DEPOSITOR_MISMATCH, BRIDGE_ERRORS.MISSING_SOURCE_TOKEN, BRIDGE_ERRORS.MISSING_SOURCE_AMOUNT],
+    toPass: [BRIDGE_ERRORS.TO_CHAIN_MISMATCH, BRIDGE_ERRORS.TO_TOKEN_MISMATCH,
+        BRIDGE_ERRORS.MIN_RECEIVE_MISMATCH, BRIDGE_ERRORS.MISSING_DESTINATION,
+        BRIDGE_ERRORS.MISSING_DESTINATION_CHAIN, BRIDGE_ERRORS.MISSING_OUTPUT_TOKEN,
+        BRIDGE_ERRORS.MISSING_MIN_OUTPUT, BRIDGE_ERRORS.UNSUPPORTED_DESTINATION_CALL,
+        BRIDGE_ERRORS.UNSUPPORTED_RELAY_ORDER_SHAPE],
+    receiverPass: [BRIDGE_ERRORS.RECEIVER_MISMATCH, BRIDGE_ERRORS.MISSING_RECEIVER,
+        BRIDGE_ERRORS.REFUND_RECIPIENT_MISMATCH,
+        BRIDGE_ERRORS.UNSUPPORTED_DESTINATION_CALL,
+        BRIDGE_ERRORS.RELAY_REFUND_RECIPIENT_MISMATCH, BRIDGE_ERRORS.RELAY_ORDER_HASH_MISMATCH,
+        BRIDGE_ERRORS.MISSING_RELAY_ORDER_DATA,
+        BRIDGE_ERRORS.UNVERIFIED_RELAY_FUNDING, BRIDGE_ERRORS.RELAY_SOURCE_PAYMENT_MISMATCH],
+};
+const bindingErrors = [
+    BRIDGE_ERRORS.QUOTE_ID_MISMATCH, BRIDGE_ERRORS.REQUEST_ID_MISMATCH, BRIDGE_ERRORS.SOCKET_RFQ_QUOTE_ID_MISMATCH,
+];
+const checkBridgeTx = (aggregatorId, fromChainId, bridgeId, tx, expectation, options = {}, operation = 'verifyTx') => {
+    const routerPass = validateBridgeRouter(aggregatorId, fromChainId, bridgeId, tx);
+    let check;
+    try {
+        check = validateBridgeCalldata(aggregatorId, fromChainId, tx, expectation);
     }
-    return quotes.filter((quote) => {
-        try {
-            validateBridgeQuote(aggregatorId, params.fromChainId, quote);
-            return true;
-        }
-        catch (error) {
-            if (error instanceof InvalidBridgeContractError) {
-                return false;
-            }
-            throw error;
+    catch (error) {
+        check = { ok: false, aggregatorId, errors: asBridgeError(error, BRIDGE_ERRORS.INVALID_CALLDATA).errors };
+    }
+    const enforceRelayOrder = aggregatorId === BRIDGE_ENUM.RELAY &&
+        (options.allowMissingRelayOrder !== true || expectation?.orderData !== undefined);
+    if (enforceRelayOrder) {
+        const orderErrors = expectation?.orderData === undefined
+            ? [BRIDGE_ERRORS.MISSING_RELAY_ORDER_DATA]
+            : check.parsed?.orderId
+                ? verifyRelayOrder(expectation.orderData, check.parsed, fromChainId, expectation.userAddress, tx.to)
+                : [BRIDGE_ERRORS.MISSING_RELAY_ORDER_ID];
+        if (orderErrors.length === 0 && check.parsed) {
+            const verified = finishCheck('relay', check.parsed, expectation?.toChainId ? undefined : BRIDGE_ERRORS.MISSING_DESTINATION_CHAIN, expectation, fromChainId, knownCompare(check.parsed));
+            check = { ...check, ok: check.ok && verified.ok, unverifiedFields: verified.unverifiedFields,
+                errors: [...check.errors, ...verified.errors.filter((error) => !check.errors.some((existing) => existing.error_code === error.error_code))] };
         }
+        check = { ...check, ok: check.ok && orderErrors.length === 0,
+            errors: [...check.errors,
+                ...orderErrors.filter((error) => !check.errors.some((existing) => existing.error_code === error.error_code))] };
+    }
+    const unverifiedFields = check.unverifiedFields ?? [
+        'sourceToken', 'sourceAmount', 'outputToken', 'minOutputAmount', 'receiver',
+        ...(expectation?.toChainId ? ['destinationChainId'] : []),
+    ];
+    const externalDestination = check.parsed && ((aggregatorId === BRIDGE_ENUM.RELAY && check.parsed.destinationChainId === undefined) ||
+        (aggregatorId === BRIDGE_ENUM.SOCKET &&
+            ['receiveERC20', 'receiveNative', 'depositForBurn'].includes(check.parsed.protocolMethod ?? '')));
+    // Known local limits remain unverified, without repeating an expected gap as an error.
+    const reportableFields = unverifiedFields.filter((field) => {
+        if (!check.parsed)
+            return true;
+        if (field === 'outputToken')
+            return false;
+        if (field === 'minOutputAmount')
+            return check.parsed.minOutputAmount !== undefined;
+        return !(externalDestination && ['receiver', 'destinationChainId'].includes(field));
     });
+    // Unclassified structure failures invalidate every field; known field failures stay separate.
+    const comparable = Boolean(expectation && check.parsed) && check.errors.every((error) => bindingErrors.some((item) => item.error_code === error.error_code) ||
+        Object.values(fieldErrors).some((group) => group.some((item) => item.error_code === error.error_code)));
+    const fieldPass = (field, required) => comparable &&
+        required.every((item) => !unverifiedFields.includes(item)) &&
+        !check.errors.some((error) => fieldErrors[field].some((item) => item.error_code === error.error_code));
+    const flags = {
+        pass: routerPass && !check.errors.length && !reportableFields.length, routerPass,
+        fromPass: fieldPass('fromPass', ['sourceToken', 'sourceAmount']),
+        toPass: fieldPass('toPass', ['outputToken', 'minOutputAmount', ...(expectation?.toChainId ? ['destinationChainId'] : [])]),
+        receiverPass: fieldPass('receiverPass', ['receiver']),
+    };
+    const context = {
+        ...check.parsed?.diagnostics, ...calldataDiagnostics(tx.data), aggregatorId,
+        chainId: fromChainId, toChainId: expectation?.toChainId, bridgeId, operation, method: check.method,
+        ...(check.parsed ? { hasDestinationCall: Boolean(check.parsed.hasDestinationCall || check.parsed.destinationCallData !== undefined) } : {}),
+        ...flags, blocking: true,
+    };
+    const errors = [
+        ...check.errors,
+        ...(reportableFields.length ? [{ ...BRIDGE_ERRORS.UNVERIFIED_BRIDGE_FIELDS, unverifiedFields: reportableFields }] : []),
+    ].map((error) => sanitizeBridgeError({ ...error, ...context }));
+    if (errors.length) {
+        const error = new InvalidBridgeCalldataError(aggregatorId, fromChainId, check.method, check.reason || errors[0].message, errors);
+        reportBridgeError(options.onError, error, context);
+        throw error;
+    }
+    return { ...flags, unverifiedFields, errors };
+};
+export const validateBridgeTx = (aggregatorId, fromChainId, bridgeId, tx, expectation, options = {}) => checkBridgeTx(aggregatorId, fromChainId, bridgeId, tx, expectation, options);
+export const getQuote = async (aggregatorId, params, api) => {
+    try {
+        params = { ...params };
+        assertSupported(aggregatorId, params.fromChainId);
+        const baseParams = {
+            aggregator_id: aggregatorId,
+            user_addr: params.userAddress,
+            from_chain_id: params.fromChainId,
+            from_token_id: params.fromTokenId,
+            from_token_raw_amount: params.fromTokenRawAmount,
+            to_chain_id: params.toChainId,
+            to_token_id: params.toTokenId,
+            fee_rate: params.feeRate,
+            slippage: requireSlippage(params.slippage),
+        };
+        const quotes = api.getBridgeQuoteListV2
+            ? await api.getBridgeQuoteListV2(baseParams).catch((error) => { throw asBridgeError(error, BRIDGE_ERRORS.BACKEND_QUOTE_REQUEST_FAILED, { requestKind: 'backend_quote' }); })
+            : await api.getBridgeQuoteV2?.(baseParams).catch((error) => { throw asBridgeError(error, BRIDGE_ERRORS.BACKEND_QUOTE_REQUEST_FAILED, { requestKind: 'backend_quote' }); });
+        if (!quotes)
+            throw new BridgeError(BRIDGE_ERRORS.MISSING_QUOTE_API);
+        return quotes.filter((quote) => {
+            try {
+                validateBridgeQuote(aggregatorId, params.fromChainId, quote);
+                return true;
+            }
+            catch (error) {
+                if (error instanceof InvalidBridgeContractError) {
+                    reportBridgeError(params.onError, error, { aggregatorId, chainId: params.fromChainId, toChainId: params.toChainId, bridgeId: quote.bridge_id, operation: 'getQuote' });
+                    return false;
+                }
+                throw error;
+            }
+        });
+    }
+    catch (error) {
+        throw asBridgeError(error, BRIDGE_ERRORS.UNKNOWN, { aggregatorId, chainId: params.fromChainId, toChainId: params.toChainId, operation: 'getQuote' });
+    }
 };
 export const buildTx = async (aggregatorId, params, api) => {
-    assertSupported(aggregatorId, params.fromChainId);
-    const buildParams = {
-        aggregator_id: aggregatorId,
-        bridge_id: params.bridgeId,
-        user_addr: params.userAddress,
-        from_chain_id: params.fromChainId,
-        from_token_id: params.fromTokenId,
-        from_token_raw_amount: params.fromTokenRawAmount,
-        to_chain_id: params.toChainId,
-        to_token_id: params.toTokenId,
-        slippage: requireSlippage(params.slippage),
-    };
-    const tx = api.buildBridgeTx
-        ? await api.buildBridgeTx({
-            ...buildParams,
-            quote_key: stringifyQuoteKey(params.quoteKey),
-        })
-        : (await api.getBridgeQuoteTxV2?.({
-            ...buildParams,
-        }))?.tx;
-    if (!tx) {
-        throw new Error('Bridge API does not provide a build tx method');
-    }
-    validateBridgeTx(aggregatorId, params.fromChainId, params.bridgeId, tx);
-    return tx;
+    try {
+        // Freeze signing intent before awaiting a backend response.
+        params = { ...params };
+        assertSupported(aggregatorId, params.fromChainId);
+        const quoteKey = stringifyQuoteKey(params.quoteKey);
+        const expectation = {
+            userAddress: params.userAddress,
+            fromTokenId: params.fromTokenId,
+            fromTokenRawAmount: params.fromTokenRawAmount,
+            toChainId: params.toChainId,
+            toTokenId: params.toTokenId,
+            toTokenRawAmount: params.toTokenRawAmount ?? quotedToAmount(quoteKey),
+            // The legacy quote+tx API requotes instead of reusing this selection.
+            quoteKey: typeof api.buildBridgeTx === 'function' ? quoteKey : undefined,
+            slippage: params.slippage,
+        };
+        const buildParams = {
+            aggregator_id: aggregatorId,
+            bridge_id: params.bridgeId,
+            user_addr: params.userAddress,
+            from_chain_id: params.fromChainId,
+            from_token_id: params.fromTokenId,
+            from_token_raw_amount: params.fromTokenRawAmount,
+            to_chain_id: params.toChainId,
+            to_token_id: params.toTokenId,
+            slippage: requireSlippage(params.slippage),
+        };
+        const built = api.buildBridgeTx
+            ? await api.buildBridgeTx({
+                ...buildParams,
+                quote_key: quoteKey,
+            }).catch((error) => { throw asBridgeError(error, BRIDGE_ERRORS.BACKEND_BUILD_REQUEST_FAILED, { requestKind: 'backend_build' }); })
+            : await api.getBridgeQuoteTxV2?.({
+                ...buildParams,
+            }).catch((error) => { throw asBridgeError(error, BRIDGE_ERRORS.BACKEND_BUILD_REQUEST_FAILED, { requestKind: 'backend_build' }); });
+        const attached = readBuildAttachment(built);
+        const tx = attached.tx;
+        if (!tx) {
+            throw new BridgeError(BRIDGE_ERRORS.MISSING_BUILD_API);
+        }
+        checkBridgeTx(aggregatorId, params.fromChainId, params.bridgeId, tx, {
+            ...expectation,
+            orderData: attached.orderData ?? params.orderData,
+        }, params, 'buildTx');
+        return tx;
+    }
+    catch (error) {
+        throw asBridgeError(error, BRIDGE_ERRORS.UNKNOWN, { aggregatorId, chainId: params.fromChainId, toChainId: params.toChainId, operation: 'buildTx', bridgeId: params.bridgeId });
+    }
 };
 export const getQuoteListWithTx = async (aggregatorId, params, api) => {
     const quotes = await getQuote(aggregatorId, params, api);
@@ -141,6 +304,8 @@ export const getQuoteListWithTx = async (aggregatorId, params, api) => {
                 ...params,
                 bridgeId: quote.bridge_id,
                 quoteKey: quote.quote_key,
+                toTokenRawAmount: quote.to_token_raw_amount_hex_str ??
+                    (Number.isSafeInteger(quote.to_token_raw_amount) ? String(quote.to_token_raw_amount) : undefined),
             }, api);
             return {
                 ...quote,
@@ -148,7 +313,12 @@ export const getQuoteListWithTx = async (aggregatorId, params, api) => {
             };
         }
         catch (error) {
-            if (error instanceof InvalidBridgeContractError) {
+            if (error instanceof InvalidBridgeContractError ||
+                error instanceof InvalidBridgeCalldataError) {
+                // Calldata failures were already reported by checkBridgeTx.
+                if (error instanceof InvalidBridgeContractError) {
+                    reportBridgeError(params.onError, error, { aggregatorId, chainId: params.fromChainId, toChainId: params.toChainId, bridgeId: quote.bridge_id, operation: 'buildTx' });
+                }
                 return null;
             }
             throw error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rabby-wallet/rabby-bridge",
-  "version": "0.0.13",
+  "version": "0.0.14-alpha.0",
   "description": "Bridge quote helpers and contract allowlists for Rabby",
   "type": "module",
   "main": "./dist/index.js",
@@ -22,7 +22,13 @@
   "scripts": {
     "prepublishOnly": "yarn build",
     "build": "rimraf dist && tsc",
-    "test": "yarn build && NODE_OPTIONS=--experimental-vm-modules jest --runInBand --watchman=false"
+    "test": "yarn build && NODE_OPTIONS=--experimental-vm-modules jest --runInBand --watchman=false",
+    "test:bridge-calldata": "yarn build && NODE_OPTIONS=--experimental-vm-modules jest --runInBand --watchman=false tests/calldata",
+    "test:bridge-calldata:lifi": "yarn test:bridge-calldata --testNamePattern='\\[LiFi\\]'",
+    "test:bridge-calldata:socket": "yarn test:bridge-calldata --testNamePattern='\\[Socket\\]'",
+    "test:bridge-calldata:relay": "yarn test:bridge-calldata --testNamePattern='\\[Relay\\]'",
+    "test:bridge-calldata:across": "yarn test:bridge-calldata --testNamePattern='\\[Across\\]'",
+    "test:bridge-calldata:mayan": "yarn test:bridge-calldata --testNamePattern='\\[Mayan\\]'"
   },
   "devDependencies": {
     "@debank/common": "^0.3.60",
@@ -32,5 +38,9 @@
     "rimraf": "^3.0.2",
     "typescript": "^5.8.3"
   },
-  "packageManager": "yarn@4.12.0"
+  "packageManager": "yarn@4.12.0",
+  "dependencies": {
+    "@ethersproject/hash": "5.8.0",
+    "@ethersproject/strings": "5.8.0"
+  }
 }