@rhinestone/shared-configs 2.0.1 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +41 -0
- package/dist/configs/chains.json +452 -0
- package/dist/scripts/__tests__/validation.test.js +215 -0
- package/dist/scripts/audit-token-authorizations.d.ts +1 -0
- package/dist/scripts/audit-token-authorizations.js +541 -0
- package/dist/scripts/generate.js +3 -1
- package/dist/scripts/validation.js +97 -2
- package/dist/src/chains.d.ts +3 -1
- package/dist/src/chains.js +452 -0
- package/dist/src/generated/networks.d.ts +1105 -1105
- package/dist/src/generated/packageVersion.d.ts +1 -1
- package/dist/src/generated/packageVersion.js +1 -1
- package/dist/src/index.d.ts +2 -2
- package/dist/src/types.d.ts +47 -2
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -18,6 +18,47 @@ Source-of-truth lives in Yeet Jsonnet config:
|
|
|
18
18
|
2. Regenerate configs with `bun run generate` from this directory (requires Go)
|
|
19
19
|
3. Merge to `main` to publish `@rhinestone/shared-configs`
|
|
20
20
|
|
|
21
|
+
## Token authorizations
|
|
22
|
+
|
|
23
|
+
An EVM token with verified token-native signed authorization support carries an
|
|
24
|
+
optional `authorization` object in `chainRegistry[chainId].tokens[]`:
|
|
25
|
+
|
|
26
|
+
```ts
|
|
27
|
+
{
|
|
28
|
+
standards: ['erc3009', 'erc2612'],
|
|
29
|
+
domain: {
|
|
30
|
+
name: 'USD Coin',
|
|
31
|
+
version: '2',
|
|
32
|
+
chainId: 8453,
|
|
33
|
+
verifyingContract: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
|
|
34
|
+
},
|
|
35
|
+
domainSeparator: '0x02fa7265e7c5d81118673727957699e4d68f74cd74b7db77da710fe8a2c7834f',
|
|
36
|
+
eoaOnly: false,
|
|
37
|
+
}
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
The domain contains every EIP-712 signing field. Most deployments use the
|
|
41
|
+
canonical `chainId` layout; legacy Polygon USDT0 instead carries a bytes32
|
|
42
|
+
`salt` and omits `chainId`. `domainSeparator` pins the exact live contract
|
|
43
|
+
value. Consumers should derive the separator from `domain`, compare it with the
|
|
44
|
+
pinned value and the token's live `DOMAIN_SEPARATOR()`, and fail closed before
|
|
45
|
+
requesting a signature if either differs.
|
|
46
|
+
|
|
47
|
+
`eoaOnly: false` means the verified implementation also exposes bytes-signature
|
|
48
|
+
overloads backed by ERC-1271-aware signature checking. Consumers using only the
|
|
49
|
+
legacy `v/r/s` overloads may still impose their own EOA-only restriction.
|
|
50
|
+
|
|
51
|
+
Absence means no token-native capability has been verified. It says nothing
|
|
52
|
+
about Permit2, which is an external contract and is available only when the
|
|
53
|
+
owner has granted it sufficient token allowance.
|
|
54
|
+
|
|
55
|
+
Run `bun run audit:token-authorizations` to revalidate every direct EVM token at
|
|
56
|
+
a single recent block per chain. The audit resolves EIP-1967, legacy Zeppelin,
|
|
57
|
+
and facet-routed implementations; checks exact selectors, state readers, EIP
|
|
58
|
+
type hashes, signature overloads, and the live domain separator; and fails when
|
|
59
|
+
the result differs from the registry. Use `TOKEN_AUTH_AUDIT_RPC_<chainId>` to
|
|
60
|
+
override a rate-limited public RPC.
|
|
61
|
+
|
|
21
62
|
## Vendor drift
|
|
22
63
|
|
|
23
64
|
`bun run check:vendor-drift` diffs the RHINO, NEAR and CCTP claims in
|