@rabby-wallet/rabby-swap 0.0.85 → 0.0.86-alpha.1

package/dist/dexs/kyberswap.js

@@ -1,6 +1,6 @@
 import { CHAINS_ENUM, CHAINS } from "@debank/common";
 import { Interface } from "@ethersproject/abi";
-import { generateGetQuote, isSameAddress } from "../utils";
+import { generateGetQuote, isSameAddress, resolveToTokenReceiver } from "../utils";
 import { KyberswapABI } from "../abi";
 import { DEX_ENUM } from "../consts";
 const NATIVE_TOKEN = "0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE";
@@ -43,10 +43,10 @@ export const decodeCalldata = (tx) => {
     const result = contractInterface.parseTransaction({ data: tx.data });
     let desc;
     if (result.name === "swapSimpleMode") {
-        const [execution] = result.args;
-        desc = execution.desc;
+        const [, swapDesc] = result.args;
+        desc = swapDesc;
     }
-    if (result.name === "swap") {
+    else if (result.name === "swap") {
         const [execution] = result.args;
         desc = execution.desc;
     }
@@ -63,6 +63,6 @@ export const decodeCalldata = (tx) => {
             ? chain.nativeTokenAddress
             : dstToken,
         minReceiveToTokenAmount: minReturnAmount.toString(),
-        toTokenReceiver: tx.from,
+        toTokenReceiver: resolveToTokenReceiver(dstReceiver, tx.from),
     };
 };

package/dist/dexs/openocean.js

@@ -1,6 +1,6 @@
 import { Interface } from "@ethersproject/abi";
 import { CHAINS_ENUM, CHAINS } from "@debank/common";
-import { generateGetQuote, isSameAddress } from "../utils";
+import { generateGetQuote, isSameAddress, resolveToTokenReceiver } from "../utils";
 import { OpenOceanABI } from "../abi";
 import { DEX_ENUM } from "../consts";
 const NATIVE_TOKENS = {
@@ -111,6 +111,6 @@ export const decodeCalldata = (tx) => {
             ? chain.nativeTokenAddress
             : dstToken,
         minReceiveToTokenAmount: minReturnAmount.toString(),
-        toTokenReceiver: tx.from,
+        toTokenReceiver: resolveToTokenReceiver(dstReceiver, tx.from),
     };
 };

package/dist/index.d.ts

@@ -3,4 +3,5 @@ import { getQuote } from "./quote";
 import { DEX_ENUM } from "./consts";
 import { UNI_NATIVE_TO_ADDRESSES } from "./dexs/uni";
 export * from "./tokenPools";
+export * from "./verify";
 export { WrapTokenAddressMap, DEX_ENUM, DEX_SUPPORT_CHAINS, getQuote, DEX_ROUTER_WHITELIST, DEX_SPENDER_WHITELIST, UNI_NATIVE_TO_ADDRESSES, };

package/dist/index.js

@@ -3,4 +3,5 @@ import { getQuote } from "./quote";
 import { DEX_ENUM } from "./consts";
 import { UNI_NATIVE_TO_ADDRESSES } from "./dexs/uni";
 export * from "./tokenPools";
+export * from "./verify";
 export { WrapTokenAddressMap, DEX_ENUM, DEX_SUPPORT_CHAINS, getQuote, DEX_ROUTER_WHITELIST, DEX_SPENDER_WHITELIST, UNI_NATIVE_TO_ADDRESSES, };

package/dist/utils.d.ts

@@ -3,6 +3,8 @@ import { CHAINS_ENUM } from "@debank/common";
 import { QuoteParams, QuoteResult } from "./quote";
 import { DEX_ENUM } from "./consts";
 export declare const isSameAddress: (addr1: string, addr2: string) => boolean;
+export declare const NULL_ADDRESS = "0x0000000000000000000000000000000000000000";
+export declare const resolveToTokenReceiver: (encodedReceiver: string, txFrom: string) => string;
 export declare const generateGetQuote: ({ SUPPORT_CHAINS, id, dex, }: {
     SUPPORT_CHAINS: CHAINS_ENUM[];
     id: "matcha" | "matcha_v2" | "openocean" | "1inch_v6" | "paraswap" | "kyberswap" | "odos" | "paraswap_v6" | "magpie" | "sushi" | "rabby" | "uni";

package/dist/utils.js

@@ -15,6 +15,8 @@ export const isSameAddress = (addr1, addr2) => {
         return false;
     return addr1.toLowerCase() === addr2.toLowerCase();
 };
+export const NULL_ADDRESS = "0x0000000000000000000000000000000000000000";
+export const resolveToTokenReceiver = (encodedReceiver, txFrom) => (isSameAddress(encodedReceiver, NULL_ADDRESS) ? txFrom : encodedReceiver);
 export const generateGetQuote = ({ SUPPORT_CHAINS, id, dex, }) => (options, api) => __awaiter(void 0, void 0, void 0, function* () {
     if (!options.chainServerId || !options.nativeTokenAddress) {
         throw new Error(`lack chainServerId or nativeTokenAddress is not support}`);

package/dist/verify/calldata.d.ts

@@ -0,0 +1,25 @@
+import { DEX_ENUM } from "../consts";
+import { DecodeCalldataResult, QuoteResult, TxWithChainId } from "../quote";
+/** 解码出的 minReceive 相对「报价 × (1-滑点)」允许的相对偏差。两端现网均为 5%。 */
+export declare const CALLDATA_MIN_RECEIVE_TOLERANCE = 0.05;
+/**
+ * 尝试解码。wrap、无 dex、无 tx、解码抛错或解不出时返回 null。
+ */
+export declare const decodeSwapCalldata: (dexId: DEX_ENUM | null, tx?: TxWithChainId) => DecodeCalldataResult | null;
+/** 纯比对：token、支付数量、最低到手（相对滑点带）。 */
+export declare const matchDecodedCalldata: (decoded: DecodeCalldataResult, quote: QuoteResult, slippageRatio: string | number) => boolean;
+export type VerifyCalldataParams = {
+    data: QuoteResult | null;
+    dexId: DEX_ENUM | null;
+    /** 已换算成小数的滑点，如 1% → 0.01。 */
+    slippage: string | number;
+    tx?: TxWithChainId;
+    /** 传入则不再解码。 */
+    decoded?: DecodeCalldataResult | null;
+};
+/** 解不出、无滑点或无报价时跳过比对（现网视为通过）。 */
+export declare const shouldSkipCalldataMatch: (slippage: string | number, decoded: DecodeCalldataResult | null, data: QuoteResult | null, tx?: TxWithChainId) => boolean;
+/**
+ * 解码并与报价比对。解码成功后不再依赖应用链目录。
+ */
+export declare const verifyCalldata: (p: VerifyCalldataParams) => boolean;

package/dist/verify/calldata.js

@@ -0,0 +1,44 @@
+import BigNumber from "bignumber.js";
+import { DEX_ENUM } from "../consts";
+import { decodeCalldata, } from "../quote";
+import { isSameAddress } from "../utils";
+/** 解码出的 minReceive 相对「报价 × (1-滑点)」允许的相对偏差。两端现网均为 5%。 */
+export const CALLDATA_MIN_RECEIVE_TOLERANCE = 0.05;
+/**
+ * 尝试解码。wrap、无 dex、无 tx、解码抛错或解不出时返回 null。
+ */
+export const decodeSwapCalldata = (dexId, tx) => {
+    if (!dexId || dexId === DEX_ENUM.WRAPTOKEN || !tx) {
+        return null;
+    }
+    try {
+        return decodeCalldata(dexId, tx);
+    }
+    catch (_a) {
+        return null;
+    }
+};
+/** 纯比对：token、支付数量、最低到手（相对滑点带）。 */
+export const matchDecodedCalldata = (decoded, quote, slippageRatio) => {
+    const estimateMinReceive = new BigNumber(quote.toTokenAmount).times(new BigNumber(1).minus(slippageRatio));
+    return (isSameAddress(decoded.fromToken, quote.fromToken) &&
+        decoded.fromTokenAmount === quote.fromTokenAmount &&
+        isSameAddress(decoded.toToken, quote.toToken) &&
+        new BigNumber(decoded.minReceiveToTokenAmount)
+            .minus(estimateMinReceive)
+            .div(estimateMinReceive)
+            .abs()
+            .lte(CALLDATA_MIN_RECEIVE_TOLERANCE));
+};
+/** 解不出、无滑点或无报价时跳过比对（现网视为通过）。 */
+export const shouldSkipCalldataMatch = (slippage, decoded, data, tx) => !slippage || !decoded || !data || !tx;
+/**
+ * 解码并与报价比对。解码成功后不再依赖应用链目录。
+ */
+export const verifyCalldata = (p) => {
+    const decoded = p.decoded !== undefined ? p.decoded : decodeSwapCalldata(p.dexId, p.tx);
+    if (shouldSkipCalldataMatch(p.slippage, decoded, p.data, p.tx)) {
+        return true;
+    }
+    return matchDecodedCalldata(decoded, p.data, p.slippage);
+};

package/dist/verify/contracts.d.ts

@@ -0,0 +1,20 @@
+import { CHAINS_ENUM } from "@debank/common";
+import { DEX_ENUM } from "../consts";
+/** 取该 DEX 在此链上的 router。Uni 用 native 支付时走独立入口地址。 */
+export declare const getRouter: (dexId: DEX_ENUM, chain: CHAINS_ENUM, payTokenId: string, nativeTokenAddress: string) => string | undefined;
+/** wrap 无 spender；其余读白名单。 */
+export declare const getSpender: (dexId: DEX_ENUM, chain: CHAINS_ENUM) => string | undefined;
+export type VerifyRouterAndSpenderParams = {
+    chain: CHAINS_ENUM;
+    dexId: DEX_ENUM;
+    router?: string;
+    spender?: string;
+    payTokenId?: string;
+    receiveTokenId?: string;
+    nativeTokenAddress: string;
+};
+/**
+ * 校验 tx.to / approve spender 是否在白名单。
+ * wrap、native 支付或缺少 spender 时跳过 spender 校验。
+ */
+export declare const verifyRouterAndSpender: (p: VerifyRouterAndSpenderParams) => [boolean, boolean];

package/dist/verify/contracts.js

@@ -0,0 +1,48 @@
+import { DEX_ENUM } from "../consts";
+import { UNI_NATIVE_TO_ADDRESSES } from "../dexs/uni";
+import { DEX_ROUTER_WHITELIST, DEX_SPENDER_WHITELIST } from "../list";
+import { isSameAddress } from "../utils";
+import { isSwapWrapToken } from "./wrap";
+const isNativeToken = (tokenId, nativeTokenAddress) => isSameAddress(tokenId, nativeTokenAddress);
+/** 取该 DEX 在此链上的 router。Uni 用 native 支付时走独立入口地址。 */
+export const getRouter = (dexId, chain, payTokenId, nativeTokenAddress) => {
+    if (dexId === DEX_ENUM.UNI && isNativeToken(payTokenId, nativeTokenAddress)) {
+        return UNI_NATIVE_TO_ADDRESSES[chain];
+    }
+    const list = DEX_ROUTER_WHITELIST[dexId];
+    if (!list)
+        return undefined;
+    return list[chain];
+};
+/** wrap 无 spender；其余读白名单。 */
+export const getSpender = (dexId, chain) => {
+    if (dexId === DEX_ENUM.WRAPTOKEN) {
+        return "";
+    }
+    const list = DEX_SPENDER_WHITELIST[dexId];
+    if (!list)
+        return undefined;
+    return list[chain];
+};
+/**
+ * 校验 tx.to / approve spender 是否在白名单。
+ * wrap、native 支付或缺少 spender 时跳过 spender 校验。
+ */
+export const verifyRouterAndSpender = (p) => {
+    const { chain, dexId, router, spender, payTokenId, receiveTokenId, nativeTokenAddress, } = p;
+    if (dexId === DEX_ENUM.WRAPTOKEN) {
+        return [true, true];
+    }
+    if (!dexId || !router || !payTokenId || !receiveTokenId) {
+        return [true, true];
+    }
+    const routerWhitelist = getRouter(dexId, chain, payTokenId, nativeTokenAddress);
+    const spenderWhitelist = getSpender(dexId, chain);
+    const skipSpender = !spender ||
+        isNativeToken(payTokenId, nativeTokenAddress) ||
+        isSwapWrapToken(payTokenId, receiveTokenId, chain, nativeTokenAddress);
+    return [
+        isSameAddress(routerWhitelist || "", router),
+        skipSpender ? true : isSameAddress(spenderWhitelist || "", spender),
+    ];
+};

package/dist/verify/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Swap 两端共用的报价校验。
+ * wrap / 合约白名单 / calldata 分文件；链目录、预执行留在应用。
+ */
+export { isSwapWrapToken } from "./wrap";
+export { getRouter, getSpender, verifyRouterAndSpender } from "./contracts";
+export type { VerifyRouterAndSpenderParams } from "./contracts";
+export { CALLDATA_MIN_RECEIVE_TOLERANCE, decodeSwapCalldata, matchDecodedCalldata, shouldSkipCalldataMatch, verifyCalldata, } from "./calldata";
+export type { VerifyCalldataParams } from "./calldata";
+export { isSwapCalldataReceiverAllowed } from "./receiver";
+export { verifySdk } from "./sdk";
+export type { VerifySdkParams, VerifySdkResult } from "./sdk";

package/dist/verify/index.js

@@ -0,0 +1,9 @@
+/**
+ * Swap 两端共用的报价校验。
+ * wrap / 合约白名单 / calldata 分文件；链目录、预执行留在应用。
+ */
+export { isSwapWrapToken } from "./wrap";
+export { getRouter, getSpender, verifyRouterAndSpender } from "./contracts";
+export { CALLDATA_MIN_RECEIVE_TOLERANCE, decodeSwapCalldata, matchDecodedCalldata, shouldSkipCalldataMatch, verifyCalldata, } from "./calldata";
+export { isSwapCalldataReceiverAllowed } from "./receiver";
+export { verifySdk } from "./sdk";

package/dist/verify/receiver.d.ts

@@ -0,0 +1 @@
+export declare const isSwapCalldataReceiverAllowed: (toTokenReceiver?: string | null, userAddress?: string | null) => boolean;

package/dist/verify/receiver.js

@@ -0,0 +1,15 @@
+import { NULL_ADDRESS, isSameAddress } from "../utils";
+export const isSwapCalldataReceiverAllowed = (toTokenReceiver, userAddress) => {
+    var _a;
+    const receiver = ((_a = toTokenReceiver === null || toTokenReceiver === void 0 ? void 0 : toTokenReceiver.toString) === null || _a === void 0 ? void 0 : _a.call(toTokenReceiver)) || "";
+    if (!receiver) {
+        return true;
+    }
+    if (isSameAddress(receiver, NULL_ADDRESS)) {
+        return true;
+    }
+    if (!userAddress) {
+        return false;
+    }
+    return isSameAddress(receiver, userAddress);
+};

package/dist/verify/sdk.d.ts

@@ -0,0 +1,31 @@
+import { CHAINS_ENUM } from "@debank/common";
+import { DEX_ENUM } from "../consts";
+import { DecodeCalldataResult, QuoteResult } from "../quote";
+export type VerifySdkParams = {
+    chain: CHAINS_ENUM;
+    dexId: DEX_ENUM;
+    /** UI 滑点，单位百分数，如 1 表示 1%。 */
+    slippage: string | number;
+    data: QuoteResult | null;
+    payTokenId: string;
+    receiveTokenId: string;
+    /** 由应用传入，对应其链目录中的 native 地址。 */
+    nativeTokenAddress: string;
+    /** 解码 calldata 用；应用侧用自己的链目录解析。 */
+    chainId: number;
+    userAddress: string;
+};
+export type VerifySdkResult = {
+    routerPass: boolean;
+    spenderPass: boolean;
+    callDataPass: boolean;
+    receiverPass: boolean;
+    isSdkDataPass: boolean;
+    decoded: DecodeCalldataResult | null;
+};
+/**
+ * 组合 router / spender / calldata。
+ * native↔WETH 视为 wrap，走 WRAPTOKEN（不解码、不查 DEX 白名单）。
+ * 预执行、gas 不在此处理。
+ */
+export declare const verifySdk: (p: VerifySdkParams) => VerifySdkResult;

package/dist/verify/sdk.js

@@ -0,0 +1,46 @@
+import BigNumber from "bignumber.js";
+import { DEX_ENUM } from "../consts";
+import { decodeSwapCalldata, verifyCalldata } from "./calldata";
+import { verifyRouterAndSpender } from "./contracts";
+import { isSwapCalldataReceiverAllowed } from "./receiver";
+import { isSwapWrapToken } from "./wrap";
+const toTxWithChainId = (data, chainId) => (data === null || data === void 0 ? void 0 : data.tx) ? Object.assign(Object.assign({}, data.tx), { chainId }) : undefined;
+/**
+ * 组合 router / spender / calldata。
+ * native↔WETH 视为 wrap，走 WRAPTOKEN（不解码、不查 DEX 白名单）。
+ * 预执行、gas 不在此处理。
+ */
+export const verifySdk = (p) => {
+    var _a, _b, _c;
+    const actualDexId = isSwapWrapToken(p.payTokenId, p.receiveTokenId, p.chain, p.nativeTokenAddress)
+        ? DEX_ENUM.WRAPTOKEN
+        : p.dexId;
+    const [routerPass, spenderPass] = verifyRouterAndSpender({
+        chain: p.chain,
+        dexId: actualDexId,
+        router: (_b = (_a = p.data) === null || _a === void 0 ? void 0 : _a.tx) === null || _b === void 0 ? void 0 : _b.to,
+        spender: (_c = p.data) === null || _c === void 0 ? void 0 : _c.spender,
+        payTokenId: p.payTokenId,
+        receiveTokenId: p.receiveTokenId,
+        nativeTokenAddress: p.nativeTokenAddress,
+    });
+    const tx = toTxWithChainId(p.data, p.chainId);
+    const slippageRatio = new BigNumber(p.slippage).div(100).toFixed();
+    const decoded = decodeSwapCalldata(actualDexId, tx);
+    const callDataPass = verifyCalldata({
+        data: p.data,
+        dexId: actualDexId,
+        slippage: slippageRatio,
+        tx,
+        decoded,
+    });
+    const receiverPass = isSwapCalldataReceiverAllowed(decoded === null || decoded === void 0 ? void 0 : decoded.toTokenReceiver, p.userAddress);
+    return {
+        routerPass,
+        spenderPass,
+        callDataPass,
+        receiverPass,
+        isSdkDataPass: routerPass && spenderPass && callDataPass && receiverPass,
+        decoded,
+    };
+};

package/dist/verify/wrap.d.ts

@@ -0,0 +1,6 @@
+import { CHAINS_ENUM } from "@debank/common";
+/**
+ * 是否为「链上 native ↔ 包装代币」互换。
+ * native 地址由调用方传入，不在库内查链目录（自定义链只存在于应用侧）。
+ */
+export declare const isSwapWrapToken: (payTokenId: string, receiveTokenId: string, chain: CHAINS_ENUM, nativeTokenAddress: string) => boolean;

package/dist/verify/wrap.js

@@ -0,0 +1,17 @@
+import { WrapTokenAddressMap } from "../list";
+import { isSameAddress } from "../utils";
+/**
+ * 是否为「链上 native ↔ 包装代币」互换。
+ * native 地址由调用方传入，不在库内查链目录（自定义链只存在于应用侧）。
+ */
+export const isSwapWrapToken = (payTokenId, receiveTokenId, chain, nativeTokenAddress) => {
+    const wrapTokens = [
+        WrapTokenAddressMap[chain],
+        nativeTokenAddress,
+    ];
+    return (!!payTokenId &&
+        !!receiveTokenId &&
+        payTokenId !== receiveTokenId &&
+        !!wrapTokens.find((token) => isSameAddress(payTokenId, token)) &&
+        !!wrapTokens.find((token) => isSameAddress(receiveTokenId, token)));
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rabby-wallet/rabby-swap",
-  "version": "0.0.85",
+  "version": "0.0.86-alpha.1",
   "description": "",
   "main": "dist/index.js",
   "scripts": {