@sidhujag/sysweb3-keyring 2.1.7 → 2.1.8

package/esm/transactions/ethereum.js

@@ -1,6 +1,7 @@
 import { decrypt, signTypedData as signTypedDataUtil, getEncryptionPublicKey, recoverPersonalSignature, recoverTypedSignature, } from '@metamask/eth-sig-util';
 import { INetworkType } from '@sidhujag/sysweb3-network';
 import { createContractUsingAbi, getErc20Abi, getErc21Abi, getErc55Abi, } from '@sidhujag/sysweb3-utils';
+import { getAddress } from 'ethers/address';
 import { accessListify, Transaction } from 'ethers/transaction';
 import { hexlify } from 'ethers/utils';
 import omit from 'lodash/omit';
@@ -9,9 +10,11 @@ import { assertEvmGasLimit, bufferedEvmGasLimit, EvmGasLimitError, getEvmFeeData
 import { CustomJsonRpcProvider, wrapTransactionResponse } from '../providers';
 import { KeyringAccountType, } from '../types';
 import { assertEvmCancellationEnvelope, authenticateRetainedCancellation, } from './evm-cancellation';
+import { readEvmOwnData, serializePreparedEvmTransaction, snapshotPreparedEvmTransaction, } from './evm-envelope';
 import { deriveEvmAccountFromMnemonic, parsePersonalMessage as parseLocalPersonalMessage, privateKeyToAccount, normalizeGasLimitedTransaction, sendLocalEvmTransaction, signDigestHex, signPersonalMessage as signLocalPersonalMessage, } from './evm-local-signer';
 import { captureEvmSubmission, submitSignedEvmTransaction, submitSignedHardwareEvmTransaction, evmSubmissionFailure, copyEvmSubmissionFailure, } from './evm-submission';
-import { signPreparedEvmEnvelope, snapshotPreparedEvmRequest, } from './prepared-evm';
+import { signLedgerEvmTransaction } from './ledger-signing';
+import { signPreparedEvmEnvelope, snapshotPreparedEvmRequest, snapshotEvmSigningIdentity, preparedEvmGuard, } from './prepared-evm';
 import { getAddressDerivationPath } from '../utils/derivation-paths';
 const hardwareSignerUnavailable = (hardware) => Object.assign(new Error(`${hardware} signer is unavailable in this host`), {
     code: 'HARDWARE_SIGNER_UNAVAILABLE',
@@ -154,7 +157,7 @@ export class EthereumTransactions {
             }
             return () => assertSynchronousOriginalValidation(guard(), 'Signing context guard must be synchronous');
         };
-        this.captureEvmSigningContext = (target) => {
+        this.captureEvmAccountContext = (target) => {
             this.assertHardwareSignerAvailable(target);
             const state = this.getState();
             const selectedType = state.activeAccountType;
@@ -168,7 +171,6 @@ export class EthereumTransactions {
             const account = { address: selectedAccount.address };
             const network = { ...state.activeNetwork };
             const assertSession = this.captureSessionGuard();
-            const provider = this.web3Provider;
             const assertCurrent = () => {
                 assertSession();
                 const current = this.getState();
@@ -182,8 +184,7 @@ export class EthereumTransactions {
                     [current.activeNetwork, this.getNetwork()].some((selected) => selected.kind !== network.kind ||
                         selected.chainId !== network.chainId ||
                         selected.slip44 !== network.slip44 ||
-                        selected.url !== network.url) ||
-                    this.web3Provider !== provider)
+                        selected.url !== network.url))
                     throw new Error('Wallet signing context changed');
             };
             assertCurrent();
@@ -192,10 +193,20 @@ export class EthereumTransactions {
                 activeAccountType,
                 activeAccountId,
                 activeNetwork: network,
-                provider,
                 assertCurrent,
             };
         };
+        this.captureEvmSigningContext = (target) => {
+            const context = this.captureEvmAccountContext(target);
+            const provider = this.web3Provider;
+            const assertCurrent = () => {
+                context.assertCurrent();
+                if (this.web3Provider !== provider)
+                    throw new Error('Wallet signing context changed');
+            };
+            assertCurrent();
+            return { ...context, provider, assertCurrent };
+        };
         this.captureSubmission = (operation, account, type, id, network, assertCurrent, details = {}) => {
             if (!this.captureSubmissionLifecycle)
                 throw new TypeError('A durable EVM submission lifecycle is required');
@@ -296,10 +307,51 @@ export class EthereumTransactions {
                 throw error;
             }
         };
-        this.ethSign = async (params) => {
-            const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey();
-            const { accounts, activeAccountId, activeAccountType, activeNetwork } = this.getState();
-            const activeAccount = accounts[activeAccountType][activeAccountId];
+        this.ethSign = async (params, input) => {
+            const selected = this.captureEvmAccountContext();
+            if (!Array.isArray(params) || params.length !== 2)
+                throw new Error('Invalid digest request');
+            const first = Object.getOwnPropertyDescriptor(params, '0');
+            const second = Object.getOwnPropertyDescriptor(params, '1');
+            if (!first ||
+                !second ||
+                !('value' in first) ||
+                !('value' in second) ||
+                typeof first.value !== 'string' ||
+                typeof second.value !== 'string')
+                throw new Error('Invalid digest request');
+            params = [first.value, second.value];
+            const options = readEvmOwnData(input, [
+                'selectedAccount',
+                'targetAccount',
+                'assertCurrent',
+            ]);
+            const selectedAccount = snapshotEvmSigningIdentity(options.selectedAccount);
+            const targetAccount = snapshotEvmSigningIdentity(options.targetAccount);
+            const hostGuard = preparedEvmGuard({
+                assertCurrent: options.assertCurrent,
+            });
+            const target = {
+                id: targetAccount.id,
+                type: targetAccount.type,
+            };
+            const context = this.captureEvmAccountContext(target);
+            const assertCurrent = () => {
+                hostGuard();
+                selected.assertCurrent();
+                context.assertCurrent();
+                if (selected.activeAccountId !== selectedAccount.id ||
+                    selected.activeAccountType !== selectedAccount.type ||
+                    getAddress(selected.activeAccount.address) !==
+                        selectedAccount.expectedAddress ||
+                    getAddress(context.activeAccount.address) !==
+                        targetAccount.expectedAddress ||
+                    targetAccount.type === 'SmartAccount')
+                    throw new Error('EVM digest signing context changed');
+            };
+            assertCurrent();
+            const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey(target);
+            const { activeAccountId, activeAccountType, activeNetwork, activeAccount } = context;
             // Validate that the derived address matches the active account to prevent race conditions
             if (address.toLowerCase() !== activeAccount.address.toLowerCase()) {
                 throw {
@@ -368,14 +420,19 @@ export class EthereumTransactions {
                     throw error;
                 }
             };
+            let signature;
             switch (activeAccountType) {
                 case KeyringAccountType.Trezor:
-                    return await signWithTrezor();
+                    signature = await signWithTrezor();
+                    break;
                 case KeyringAccountType.Ledger:
-                    return await signWithLedger();
+                    signature = await signWithLedger();
+                    break;
                 default:
-                    return sign();
+                    signature = sign();
             }
+            assertCurrent();
+            return signature;
         };
         this.signPersonalMessage = async (params) => {
             const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey();
@@ -945,33 +1002,18 @@ export class EthereumTransactions {
                     const rawTx = serializeTransaction(txFormattedForEthers);
                     if (retained)
                         assertCancellationEnvelope(rawTx);
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
+                    const { rawTransaction: signedTx } = await signLedgerEvmTransaction(this.requireLedgerSigner(), {
+                        unsignedTransaction: rawTx,
                         accountIndex: activeAccountId,
                         expectedAddress: activeAccount.address,
                     }, await this.authorizeHardwareTransaction(provider, assertCurrent));
                     assertCurrent();
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                    assertHardwareTransactionSender(signedTx, activeAccount.address);
+                    const transactionResponse = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
+                    return {
+                        isCanceled: true,
+                        transaction: transactionResponse,
                     };
-                    if (signature) {
-                        const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                        assertCurrent();
-                        assertHardwareTransactionSender(signedTx, activeAccount.address);
-                        const transactionResponse = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
-                        return {
-                            isCanceled: true,
-                            transaction: transactionResponse,
-                        };
-                    }
-                    else {
-                        return {
-                            isCanceled: false,
-                            error: true,
-                        };
-                    }
                 }
                 catch (error) {
                     return {
@@ -1102,12 +1144,21 @@ export class EthereumTransactions {
                     typeof options !== 'object' ||
                     Array.isArray(options) ||
                     (options.mode !== 'reviewed-native' &&
+                        options.mode !== 'reviewed-generic' &&
                         options.mode !== 'specialized') ||
                     typeof options.assertCurrent !== 'function')
                     throw new Error('Explicit transaction approval is required');
                 // Capture once; later caller mutations cannot replace this invocation's
                 // admission decision while chain checks or device approval are pending.
                 const { assertCurrent: assertHostCurrent, mode, walletNonce } = options;
+                const reviewId = mode === 'reviewed-generic' ? options.reviewId : undefined;
+                if (mode === 'reviewed-generic' &&
+                    (typeof reviewId !== 'string' ||
+                        !/^[A-Za-z0-9_-]{1,128}$/.test(reviewId) ||
+                        walletNonce === undefined))
+                    throw new Error('An issued fee review and approved nonce are required');
+                const selectedAccount = snapshotEvmSigningIdentity(options.selectedAccount);
+                const targetAccount = snapshotEvmSigningIdentity(options.targetAccount);
                 const nonceApproval = walletNonce === undefined ? undefined : { ...walletNonce };
                 const assertApproved = () => {
                     const result = assertHostCurrent();
@@ -1119,14 +1170,14 @@ export class EthereumTransactions {
                 assertApproved();
                 return await this.sendFormattedTransactionInternal(params, isLegacy, () => {
                     broadcastAttempted = true;
-                }, assertApproved, mode, nonceApproval);
+                }, assertApproved, mode, nonceApproval, selectedAccount, targetAccount, reviewId);
             }
             catch (error) {
                 // A broadcast transport error may mean the node accepted the signed
                 // transaction. Derive this marker from this invocation, never RPC data.
                 const submissionError = Object.assign(new Error(error instanceof Error ? error.message : String(error)), error, {
                     transactionNotBroadcast: !broadcastAttempted ||
-                        evmSubmissionFailure(error).transactionNotBroadcast,
+                        evmSubmissionFailure(error)?.transactionNotBroadcast === true,
                 });
                 if (error instanceof Error) {
                     submissionError.name = error.name;
@@ -1136,19 +1187,60 @@ export class EthereumTransactions {
                 throw submissionError;
             }
         };
-        this.sendFormattedTransactionInternal = async (input, isLegacy, beforeBroadcast, assertHostCurrent, mode, walletNonce) => {
+        this.sendFormattedTransactionInternal = async (input, isLegacy, beforeBroadcast, assertHostCurrent, mode, walletNonce, selectedIdentity, targetIdentity, reviewId) => {
             // Hardware approval may outlive the selected account, network or unlocked
             // session. Keep immutable identities and one provider for this invocation.
-            const { activeAccount, activeAccountType, activeAccountId, activeNetwork, provider, assertCurrent: assertKeyringCurrent, } = this.captureEvmSigningContext();
+            const selectedContext = this.captureEvmAccountContext();
+            const targetAccount = {
+                id: targetIdentity.id,
+                type: targetIdentity.type,
+            };
+            if (targetAccount.type === KeyringAccountType.SmartAccount)
+                throw new Error('Invalid EVM payer');
+            const { activeAccount, activeAccountType, activeAccountId, activeNetwork, provider, assertCurrent: assertKeyringCurrent, } = this.captureEvmSigningContext(targetAccount);
             const assertSigningCurrent = () => {
                 assertHostCurrent();
+                selectedContext.assertCurrent();
                 assertKeyringCurrent();
+                if (selectedContext.activeAccountId !== selectedIdentity.id ||
+                    selectedContext.activeAccountType !== selectedIdentity.type ||
+                    getAddress(selectedContext.activeAccount.address) !==
+                        selectedIdentity.expectedAddress ||
+                    getAddress(activeAccount.address) !== targetIdentity.expectedAddress)
+                    throw new Error('EVM payer approval context changed');
             };
+            assertSigningCurrent();
+            // Generic reviewed calls keep the exact prepared envelope, including
+            // contract creation, calldata and access lists, through existing signers.
+            const reviewed = mode === 'reviewed-generic'
+                ? snapshotPreparedEvmTransaction(input)
+                : undefined;
+            if (reviewed) {
+                if (reviewed.from !== targetIdentity.expectedAddress ||
+                    reviewed.chainId !== String(activeNetwork.chainId) ||
+                    reviewed.nonce !== String(walletNonce?.nonce) ||
+                    (isLegacy !== undefined && isLegacy !== (reviewed.type === 0)) ||
+                    (this.gasOverrides.minGasLimit &&
+                        BigInt(reviewed.gasLimit) < this.gasOverrides.minGasLimit.toBigInt()))
+                    throw new Error('Reviewed EVM transaction does not match its approval');
+                input = reviewed;
+                isLegacy = reviewed.type === 0;
+            }
             const assertBeforeBroadcast = () => {
                 assertCurrent();
                 beforeBroadcast();
             };
-            const submission = this.captureSubmission('send', activeAccount, activeAccountType, activeAccountId, activeNetwork, assertSigningCurrent, { walletNonce });
+            const submission = this.captureSubmission('send', activeAccount, activeAccountType, activeAccountId, activeNetwork, assertSigningCurrent, {
+                walletNonce,
+                ...(reviewed
+                    ? {
+                        review: {
+                            id: reviewId,
+                            unsignedHash: Transaction.from(serializePreparedEvmTransaction(reviewed)).unsignedHash,
+                        },
+                    }
+                    : {}),
+            });
             const assertCurrent = submission.assertCurrent;
             const approvedNonce = submission.context.walletNonce?.nonce;
             const assertApprovedNonce = (nonce) => {
@@ -1157,6 +1249,7 @@ export class EthereumTransactions {
             };
             if (mode === 'reviewed-native') {
                 const { transaction } = snapshotPreparedEvmRequest({
+                    selectedAccount: selectedIdentity,
                     account: {
                         id: activeAccountId,
                         type: activeAccountType,
@@ -1187,7 +1280,7 @@ export class EthereumTransactions {
                 assertCurrent();
                 if (this.gasOverrides.minGasLimit !== minimum)
                     throw new Error('Reviewed native gas policy changed');
-                const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey();
+                const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey(targetAccount);
                 if (address.toLowerCase() !== transaction.from.toLowerCase())
                     throw new Error('Reviewed native signer does not match the approved account');
                 assertCurrent();
@@ -1200,6 +1293,9 @@ export class EthereumTransactions {
             if (!params || typeof params !== 'object' || Array.isArray(params))
                 throw new TypeError('Invalid EVM transaction request');
             const supplied = { ...params };
+            if (supplied.from !== undefined &&
+                getAddress(supplied.from) !== targetIdentity.expectedAddress)
+                throw new Error('EVM transaction sender does not match the approved payer');
             // Validate original scalar spellings before conversion. Normalization's
             // permissive zero coercion must not bypass the bounded wire parser.
             for (const field of [
@@ -1252,7 +1348,8 @@ export class EthereumTransactions {
             const validateEip1559Fees = () => {
                 const maximum = nonNegativeFeeQuantity(params.maxFeePerGas, 'maximum fee');
                 const priority = nonNegativeFeeQuantity(params.maxPriorityFeePerGas, 'priority fee');
-                if (maximum.isZero() || priority.gt(maximum))
+                if ((mode !== 'reviewed-generic' && maximum.isZero()) ||
+                    priority.gt(maximum))
                     throw new Error('Invalid EIP-1559 fees');
                 params.maxFeePerGas = maximum;
                 params.maxPriorityFeePerGas = priority;
@@ -1263,7 +1360,9 @@ export class EthereumTransactions {
                 validateEip1559Fees();
             // Only apply a minimum gas limit when a network-specific override is set.
             // Otherwise keep the user/dapp-approved gas limit unchanged.
-            if (params.gasLimit != null && this.gasOverrides.minGasLimit) {
+            if (mode !== 'reviewed-generic' &&
+                params.gasLimit != null &&
+                this.gasOverrides.minGasLimit) {
                 const minGasLimit = this.gasOverrides.minGasLimit;
                 const currentGasLimit = BigNumber.from(params.gasLimit);
                 if (currentGasLimit.lt(minGasLimit)) {
@@ -1334,31 +1433,15 @@ export class EthereumTransactions {
                         type: 2, // Need explicit type for hardware wallet serialization
                     };
                 const rawTx = serializeTransaction(txFormattedForEthers);
-                const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                    rawTx: rawTx.replace('0x', ''),
+                const { rawTransaction: signedTx } = await signLedgerEvmTransaction(this.requireLedgerSigner(), {
+                    unsignedTransaction: rawTx,
                     accountIndex: activeAccountId,
                     expectedAddress: activeAccount.address,
                 }, await this.authorizeHardwareTransaction(provider, assertCurrent));
                 assertCurrent();
-                const formattedSignature = {
-                    r: `0x${signature.r}`,
-                    s: `0x${signature.s}`,
-                    v: parseInt(signature.v, 16),
-                };
-                if (signature) {
-                    try {
-                        const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                        assertHardwareTransactionSender(signedTx, activeAccount.address);
-                        const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, assertBeforeBroadcast, rawTx);
-                        return finalTx;
-                    }
-                    catch (error) {
-                        throw error;
-                    }
-                }
-                else {
-                    throw new Error(`Transaction Signature Failed. Error: ${signature}`);
-                }
+                assertHardwareTransactionSender(signedTx, activeAccount.address);
+                const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, assertBeforeBroadcast, rawTx);
+                return finalTx;
             };
             const sendEVMTrezorTransaction = async () => {
                 assertCurrent();
@@ -1452,7 +1535,7 @@ export class EthereumTransactions {
             };
             const sendEVMTransaction = async () => {
                 assertCurrent();
-                const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey();
+                const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey(targetAccount);
                 // Validate that we have the correct private key for the active account to prevent race conditions
                 // This is critical for transaction security during account switches
                 if (address.toLowerCase() !== activeAccount.address.toLowerCase()) {
@@ -1709,32 +1792,18 @@ export class EthereumTransactions {
                         };
                     const rawTx = serializeTransaction(txFormattedForEthers);
                     assertCurrent();
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
+                    const { rawTransaction: signedTx } = await signLedgerEvmTransaction(this.requireLedgerSigner(), {
+                        unsignedTransaction: rawTx,
                         accountIndex: activeAccountId,
                         expectedAddress: activeAccount.address,
                     }, await this.authorizeHardwareTransaction(provider, assertCurrent));
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                    assertSignedSender(signedTx);
+                    assertHardwareTransactionSender(signedTx, activeAccount.address);
+                    const transactionResponse = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, assertBeforeBroadcast, rawTx);
+                    return {
+                        isSpeedUp: true,
+                        transaction: transactionResponse,
                     };
-                    if (signature) {
-                        const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                        assertSignedSender(signedTx);
-                        assertHardwareTransactionSender(signedTx, activeAccount.address);
-                        const transactionResponse = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, assertBeforeBroadcast, rawTx);
-                        return {
-                            isSpeedUp: true,
-                            transaction: transactionResponse,
-                        };
-                    }
-                    else {
-                        return {
-                            isSpeedUp: false,
-                            error: true,
-                        };
-                    }
                 }
                 catch (error) {
                     console.error('[SpeedUp] Failed to send replacement transaction with Ledger:', error);
@@ -1947,73 +2016,51 @@ export class EthereumTransactions {
             };
             const sendERC20TokenOnLedger = async () => {
                 assertCurrent();
-                try {
-                    const _contract = new Contract(tokenAddress, getErc20Abi(), provider);
-                    const txData = _contract.interface.encodeFunctionData('transfer', [
-                        receiver,
-                        exactTokenAmount,
-                    ]);
-                    let txFormattedForEthers;
-                    if (isLegacy) {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit: gasLimit,
-                            gasPrice,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 0,
-                        };
-                    }
-                    else {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit: gasLimit,
-                            maxFeePerGas,
-                            maxPriorityFeePerGas,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 2, // Need explicit type for hardware wallet serialization
-                        };
-                    }
-                    const rawTx = serializeTransaction(txFormattedForEthers);
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
-                        accountIndex: activeAccountId,
-                        expectedAddress: activeAccount.address,
-                    }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
-                    assertCurrent();
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                const _contract = new Contract(tokenAddress, getErc20Abi(), provider);
+                const txData = _contract.interface.encodeFunctionData('transfer', [
+                    receiver,
+                    exactTokenAmount,
+                ]);
+                let txFormattedForEthers;
+                if (isLegacy) {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit: gasLimit,
+                        gasPrice,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 0,
                     };
-                    if (signature) {
-                        try {
-                            const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                            assertCurrent();
-                            assertHardwareTransactionSender(signedTx, activeAccount.address);
-                            const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, async ({ rawTransaction, admit }) => {
-                                const response = await admit(() => provider.sendTransaction(rawTransaction));
-                                saveTrezorTx && saveTrezorTx(response);
-                                return response;
-                            }, submission, undefined, rawTx);
-                            return finalTx;
-                        }
-                        catch (error) {
-                            throw error;
-                        }
-                    }
-                    else {
-                        throw new Error(`Transaction Signature Failed. Error: ${signature}`);
-                    }
                 }
-                catch (error) {
-                    throw error;
+                else {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit: gasLimit,
+                        maxFeePerGas,
+                        maxPriorityFeePerGas,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 2, // Need explicit type for hardware wallet serialization
+                    };
                 }
+                const rawTx = serializeTransaction(txFormattedForEthers);
+                const { rawTransaction: signedTx } = await signLedgerEvmTransaction(this.requireLedgerSigner(), {
+                    unsignedTransaction: rawTx,
+                    accountIndex: activeAccountId,
+                    expectedAddress: activeAccount.address,
+                }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
+                assertCurrent();
+                assertHardwareTransactionSender(signedTx, activeAccount.address);
+                const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, async ({ rawTransaction, admit }) => {
+                    const response = await admit(() => provider.sendTransaction(rawTransaction));
+                    saveTrezorTx && saveTrezorTx(response);
+                    return response;
+                }, submission, undefined, rawTx);
+                return finalTx;
             };
             const sendERC20TokenOnTrezor = async () => {
                 assertCurrent();
@@ -2174,70 +2221,48 @@ export class EthereumTransactions {
             };
             const sendERC721TokenOnLedger = async () => {
                 assertCurrent();
-                try {
-                    const _contract = new Contract(tokenAddress, getErc21Abi(), provider);
-                    const txData = _contract.interface.encodeFunctionData('transferFrom', [
-                        activeAccountAddress,
-                        receiver,
-                        normalizedTokenId,
-                    ]);
-                    let txFormattedForEthers;
-                    if (isLegacy) {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit,
-                            gasPrice,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 0,
-                        };
-                    }
-                    else {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit,
-                            maxFeePerGas,
-                            maxPriorityFeePerGas,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 2, // Need explicit type for hardware wallet serialization
-                        };
-                    }
-                    const rawTx = serializeTransaction(txFormattedForEthers);
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
-                        accountIndex: activeAccountId,
-                        expectedAddress: activeAccount.address,
-                    }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
-                    assertCurrent();
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                const _contract = new Contract(tokenAddress, getErc21Abi(), provider);
+                const txData = _contract.interface.encodeFunctionData('transferFrom', [
+                    activeAccountAddress,
+                    receiver,
+                    normalizedTokenId,
+                ]);
+                let txFormattedForEthers;
+                if (isLegacy) {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit,
+                        gasPrice,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 0,
                     };
-                    if (signature) {
-                        try {
-                            const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                            assertCurrent();
-                            assertHardwareTransactionSender(signedTx, activeAccount.address);
-                            const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
-                            return finalTx;
-                        }
-                        catch (error) {
-                            throw error;
-                        }
-                    }
-                    else {
-                        throw new Error(`Transaction Signature Failed. Error: ${signature}`);
-                    }
                 }
-                catch (error) {
-                    throw error;
+                else {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit,
+                        maxFeePerGas,
+                        maxPriorityFeePerGas,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 2, // Need explicit type for hardware wallet serialization
+                    };
                 }
+                const rawTx = serializeTransaction(txFormattedForEthers);
+                const { rawTransaction: signedTx } = await signLedgerEvmTransaction(this.requireLedgerSigner(), {
+                    unsignedTransaction: rawTx,
+                    accountIndex: activeAccountId,
+                    expectedAddress: activeAccount.address,
+                }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
+                assertCurrent();
+                assertHardwareTransactionSender(signedTx, activeAccount.address);
+                const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
+                return finalTx;
             };
             const sendERC721TokenOnTrezor = async () => {
                 assertCurrent();
@@ -2404,66 +2429,44 @@ export class EthereumTransactions {
             };
             const sendERC1155TokenOnLedger = async () => {
                 assertCurrent();
-                try {
-                    const _contract = new Contract(tokenAddress, getErc55Abi(), provider);
-                    const txData = _contract.interface.encodeFunctionData('safeTransferFrom', [activeAccountAddress, receiver, normalizedTokenId, amount, '0x']);
-                    let txFormattedForEthers;
-                    if (isLegacy) {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit,
-                            gasPrice,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 0,
-                        };
-                    }
-                    else {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit,
-                            maxFeePerGas,
-                            maxPriorityFeePerGas,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 2, // Need explicit type for hardware wallet serialization
-                        };
-                    }
-                    const rawTx = serializeTransaction(txFormattedForEthers);
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
-                        accountIndex: activeAccountId,
-                        expectedAddress: activeAccount.address,
-                    }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
-                    assertCurrent();
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                const _contract = new Contract(tokenAddress, getErc55Abi(), provider);
+                const txData = _contract.interface.encodeFunctionData('safeTransferFrom', [activeAccountAddress, receiver, normalizedTokenId, amount, '0x']);
+                let txFormattedForEthers;
+                if (isLegacy) {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit,
+                        gasPrice,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 0,
                     };
-                    if (signature) {
-                        try {
-                            const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                            assertCurrent();
-                            assertHardwareTransactionSender(signedTx, activeAccount.address);
-                            const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
-                            return finalTx;
-                        }
-                        catch (error) {
-                            throw error;
-                        }
-                    }
-                    else {
-                        throw new Error(`Transaction Signature Failed. Error: ${signature}`);
-                    }
                 }
-                catch (error) {
-                    throw error;
+                else {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit,
+                        maxFeePerGas,
+                        maxPriorityFeePerGas,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 2, // Need explicit type for hardware wallet serialization
+                    };
                 }
+                const rawTx = serializeTransaction(txFormattedForEthers);
+                const { rawTransaction: signedTx } = await signLedgerEvmTransaction(this.requireLedgerSigner(), {
+                    unsignedTransaction: rawTx,
+                    accountIndex: activeAccountId,
+                    expectedAddress: activeAccount.address,
+                }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
+                assertCurrent();
+                assertHardwareTransactionSender(signedTx, activeAccount.address);
+                const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
+                return finalTx;
             };
             const sendERC1155TokenOnTrezor = async () => {
                 assertCurrent();
@@ -2785,6 +2788,52 @@ export class EthereumTransactions {
             console.log('[EthereumTransactions] Deferring provider initialization:', error?.message || error);
         }
     }
+    signPreparedEvmTransaction(input, options) {
+        const selected = this.captureEvmAccountContext();
+        const request = snapshotPreparedEvmRequest(input);
+        const target = {
+            id: request.account.id,
+            type: request.account.type,
+        };
+        const context = this.captureEvmAccountContext(target);
+        const hostGuard = preparedEvmGuard(options);
+        const targetRecord = this.getState().accounts[target.type]?.[target.id];
+        const encryptedKey = targetRecord?.xprv;
+        const assertCurrent = () => {
+            selected.assertCurrent();
+            context.assertCurrent();
+            const live = this.getState().accounts[target.type]?.[target.id];
+            if (!live ||
+                live.id !== target.id ||
+                live.isSmartAccount ||
+                live.isLedgerWallet ||
+                live.isTrezorWallet ||
+                typeof encryptedKey !== 'string' ||
+                !encryptedKey ||
+                live.xprv !== encryptedKey ||
+                selected.activeAccountId !== request.selectedAccount.id ||
+                selected.activeAccountType !== request.selectedAccount.type ||
+                getAddress(selected.activeAccount.address) !==
+                    request.selectedAccount.expectedAddress ||
+                getAddress(context.activeAccount.address) !==
+                    request.account.expectedAddress ||
+                context.activeNetwork.kind !== 'ethereum' ||
+                context.activeNetwork.slip44 !== 60 ||
+                String(context.activeNetwork.chainId) !== request.network.chainId ||
+                context.activeNetwork.url !== request.network.url)
+                throw new Error('Prepared EVM signing context changed or is unsupported');
+        };
+        assertCurrent();
+        hostGuard();
+        assertCurrent();
+        const key = this.getDecryptedPrivateKey(target);
+        if (getAddress(key.address) !== request.account.expectedAddress)
+            throw new Error('Prepared EVM signer address mismatch');
+        const { signed } = signPreparedEvmEnvelope(request.transaction, key.decryptedPrivateKey);
+        hostGuard();
+        assertCurrent();
+        return signed;
+    }
     setWeb3Provider(network) {
         this.abortController.abort();
         this.abortController = new AbortController();