@sidhujag/sysweb3-keyring 2.1.7 → 2.1.8

package/cjs/transactions/ethereum.js

@@ -7,6 +7,7 @@ exports.EthereumTransactions = void 0;
 const eth_sig_util_1 = require("@metamask/eth-sig-util");
 const sysweb3_network_1 = require("@sidhujag/sysweb3-network");
 const sysweb3_utils_1 = require("@sidhujag/sysweb3-utils");
+const address_1 = require("ethers/address");
 const transaction_1 = require("ethers/transaction");
 const utils_1 = require("ethers/utils");
 const omit_1 = __importDefault(require("lodash/omit"));
@@ -15,8 +16,10 @@ const evm_fees_1 = require("../evm-fees");
 const providers_1 = require("../providers");
 const types_1 = require("../types");
 const evm_cancellation_1 = require("./evm-cancellation");
+const evm_envelope_1 = require("./evm-envelope");
 const evm_local_signer_1 = require("./evm-local-signer");
 const evm_submission_1 = require("./evm-submission");
+const ledger_signing_1 = require("./ledger-signing");
 const prepared_evm_1 = require("./prepared-evm");
 const derivation_paths_1 = require("../utils/derivation-paths");
 const hardwareSignerUnavailable = (hardware) => Object.assign(new Error(`${hardware} signer is unavailable in this host`), {
@@ -160,7 +163,7 @@ class EthereumTransactions {
             }
             return () => assertSynchronousOriginalValidation(guard(), 'Signing context guard must be synchronous');
         };
-        this.captureEvmSigningContext = (target) => {
+        this.captureEvmAccountContext = (target) => {
             this.assertHardwareSignerAvailable(target);
             const state = this.getState();
             const selectedType = state.activeAccountType;
@@ -174,7 +177,6 @@ class EthereumTransactions {
             const account = { address: selectedAccount.address };
             const network = { ...state.activeNetwork };
             const assertSession = this.captureSessionGuard();
-            const provider = this.web3Provider;
             const assertCurrent = () => {
                 assertSession();
                 const current = this.getState();
@@ -188,8 +190,7 @@ class EthereumTransactions {
                     [current.activeNetwork, this.getNetwork()].some((selected) => selected.kind !== network.kind ||
                         selected.chainId !== network.chainId ||
                         selected.slip44 !== network.slip44 ||
-                        selected.url !== network.url) ||
-                    this.web3Provider !== provider)
+                        selected.url !== network.url))
                     throw new Error('Wallet signing context changed');
             };
             assertCurrent();
@@ -198,10 +199,20 @@ class EthereumTransactions {
                 activeAccountType,
                 activeAccountId,
                 activeNetwork: network,
-                provider,
                 assertCurrent,
             };
         };
+        this.captureEvmSigningContext = (target) => {
+            const context = this.captureEvmAccountContext(target);
+            const provider = this.web3Provider;
+            const assertCurrent = () => {
+                context.assertCurrent();
+                if (this.web3Provider !== provider)
+                    throw new Error('Wallet signing context changed');
+            };
+            assertCurrent();
+            return { ...context, provider, assertCurrent };
+        };
         this.captureSubmission = (operation, account, type, id, network, assertCurrent, details = {}) => {
             if (!this.captureSubmissionLifecycle)
                 throw new TypeError('A durable EVM submission lifecycle is required');
@@ -302,10 +313,51 @@ class EthereumTransactions {
                 throw error;
             }
         };
-        this.ethSign = async (params) => {
-            const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey();
-            const { accounts, activeAccountId, activeAccountType, activeNetwork } = this.getState();
-            const activeAccount = accounts[activeAccountType][activeAccountId];
+        this.ethSign = async (params, input) => {
+            const selected = this.captureEvmAccountContext();
+            if (!Array.isArray(params) || params.length !== 2)
+                throw new Error('Invalid digest request');
+            const first = Object.getOwnPropertyDescriptor(params, '0');
+            const second = Object.getOwnPropertyDescriptor(params, '1');
+            if (!first ||
+                !second ||
+                !('value' in first) ||
+                !('value' in second) ||
+                typeof first.value !== 'string' ||
+                typeof second.value !== 'string')
+                throw new Error('Invalid digest request');
+            params = [first.value, second.value];
+            const options = (0, evm_envelope_1.readEvmOwnData)(input, [
+                'selectedAccount',
+                'targetAccount',
+                'assertCurrent',
+            ]);
+            const selectedAccount = (0, prepared_evm_1.snapshotEvmSigningIdentity)(options.selectedAccount);
+            const targetAccount = (0, prepared_evm_1.snapshotEvmSigningIdentity)(options.targetAccount);
+            const hostGuard = (0, prepared_evm_1.preparedEvmGuard)({
+                assertCurrent: options.assertCurrent,
+            });
+            const target = {
+                id: targetAccount.id,
+                type: targetAccount.type,
+            };
+            const context = this.captureEvmAccountContext(target);
+            const assertCurrent = () => {
+                hostGuard();
+                selected.assertCurrent();
+                context.assertCurrent();
+                if (selected.activeAccountId !== selectedAccount.id ||
+                    selected.activeAccountType !== selectedAccount.type ||
+                    (0, address_1.getAddress)(selected.activeAccount.address) !==
+                        selectedAccount.expectedAddress ||
+                    (0, address_1.getAddress)(context.activeAccount.address) !==
+                        targetAccount.expectedAddress ||
+                    targetAccount.type === 'SmartAccount')
+                    throw new Error('EVM digest signing context changed');
+            };
+            assertCurrent();
+            const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey(target);
+            const { activeAccountId, activeAccountType, activeNetwork, activeAccount } = context;
             // Validate that the derived address matches the active account to prevent race conditions
             if (address.toLowerCase() !== activeAccount.address.toLowerCase()) {
                 throw {
@@ -374,14 +426,19 @@ class EthereumTransactions {
                     throw error;
                 }
             };
+            let signature;
             switch (activeAccountType) {
                 case types_1.KeyringAccountType.Trezor:
-                    return await signWithTrezor();
+                    signature = await signWithTrezor();
+                    break;
                 case types_1.KeyringAccountType.Ledger:
-                    return await signWithLedger();
+                    signature = await signWithLedger();
+                    break;
                 default:
-                    return sign();
+                    signature = sign();
             }
+            assertCurrent();
+            return signature;
         };
         this.signPersonalMessage = async (params) => {
             const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey();
@@ -951,33 +1008,18 @@ class EthereumTransactions {
                     const rawTx = serializeTransaction(txFormattedForEthers);
                     if (retained)
                         assertCancellationEnvelope(rawTx);
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
+                    const { rawTransaction: signedTx } = await (0, ledger_signing_1.signLedgerEvmTransaction)(this.requireLedgerSigner(), {
+                        unsignedTransaction: rawTx,
                         accountIndex: activeAccountId,
                         expectedAddress: activeAccount.address,
                     }, await this.authorizeHardwareTransaction(provider, assertCurrent));
                     assertCurrent();
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                    assertHardwareTransactionSender(signedTx, activeAccount.address);
+                    const transactionResponse = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
+                    return {
+                        isCanceled: true,
+                        transaction: transactionResponse,
                     };
-                    if (signature) {
-                        const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                        assertCurrent();
-                        assertHardwareTransactionSender(signedTx, activeAccount.address);
-                        const transactionResponse = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
-                        return {
-                            isCanceled: true,
-                            transaction: transactionResponse,
-                        };
-                    }
-                    else {
-                        return {
-                            isCanceled: false,
-                            error: true,
-                        };
-                    }
                 }
                 catch (error) {
                     return {
@@ -1108,12 +1150,21 @@ class EthereumTransactions {
                     typeof options !== 'object' ||
                     Array.isArray(options) ||
                     (options.mode !== 'reviewed-native' &&
+                        options.mode !== 'reviewed-generic' &&
                         options.mode !== 'specialized') ||
                     typeof options.assertCurrent !== 'function')
                     throw new Error('Explicit transaction approval is required');
                 // Capture once; later caller mutations cannot replace this invocation's
                 // admission decision while chain checks or device approval are pending.
                 const { assertCurrent: assertHostCurrent, mode, walletNonce } = options;
+                const reviewId = mode === 'reviewed-generic' ? options.reviewId : undefined;
+                if (mode === 'reviewed-generic' &&
+                    (typeof reviewId !== 'string' ||
+                        !/^[A-Za-z0-9_-]{1,128}$/.test(reviewId) ||
+                        walletNonce === undefined))
+                    throw new Error('An issued fee review and approved nonce are required');
+                const selectedAccount = (0, prepared_evm_1.snapshotEvmSigningIdentity)(options.selectedAccount);
+                const targetAccount = (0, prepared_evm_1.snapshotEvmSigningIdentity)(options.targetAccount);
                 const nonceApproval = walletNonce === undefined ? undefined : { ...walletNonce };
                 const assertApproved = () => {
                     const result = assertHostCurrent();
@@ -1125,14 +1176,14 @@ class EthereumTransactions {
                 assertApproved();
                 return await this.sendFormattedTransactionInternal(params, isLegacy, () => {
                     broadcastAttempted = true;
-                }, assertApproved, mode, nonceApproval);
+                }, assertApproved, mode, nonceApproval, selectedAccount, targetAccount, reviewId);
             }
             catch (error) {
                 // A broadcast transport error may mean the node accepted the signed
                 // transaction. Derive this marker from this invocation, never RPC data.
                 const submissionError = Object.assign(new Error(error instanceof Error ? error.message : String(error)), error, {
                     transactionNotBroadcast: !broadcastAttempted ||
-                        (0, evm_submission_1.evmSubmissionFailure)(error).transactionNotBroadcast,
+                        (0, evm_submission_1.evmSubmissionFailure)(error)?.transactionNotBroadcast === true,
                 });
                 if (error instanceof Error) {
                     submissionError.name = error.name;
@@ -1142,19 +1193,60 @@ class EthereumTransactions {
                 throw submissionError;
             }
         };
-        this.sendFormattedTransactionInternal = async (input, isLegacy, beforeBroadcast, assertHostCurrent, mode, walletNonce) => {
+        this.sendFormattedTransactionInternal = async (input, isLegacy, beforeBroadcast, assertHostCurrent, mode, walletNonce, selectedIdentity, targetIdentity, reviewId) => {
             // Hardware approval may outlive the selected account, network or unlocked
             // session. Keep immutable identities and one provider for this invocation.
-            const { activeAccount, activeAccountType, activeAccountId, activeNetwork, provider, assertCurrent: assertKeyringCurrent, } = this.captureEvmSigningContext();
+            const selectedContext = this.captureEvmAccountContext();
+            const targetAccount = {
+                id: targetIdentity.id,
+                type: targetIdentity.type,
+            };
+            if (targetAccount.type === types_1.KeyringAccountType.SmartAccount)
+                throw new Error('Invalid EVM payer');
+            const { activeAccount, activeAccountType, activeAccountId, activeNetwork, provider, assertCurrent: assertKeyringCurrent, } = this.captureEvmSigningContext(targetAccount);
             const assertSigningCurrent = () => {
                 assertHostCurrent();
+                selectedContext.assertCurrent();
                 assertKeyringCurrent();
+                if (selectedContext.activeAccountId !== selectedIdentity.id ||
+                    selectedContext.activeAccountType !== selectedIdentity.type ||
+                    (0, address_1.getAddress)(selectedContext.activeAccount.address) !==
+                        selectedIdentity.expectedAddress ||
+                    (0, address_1.getAddress)(activeAccount.address) !== targetIdentity.expectedAddress)
+                    throw new Error('EVM payer approval context changed');
             };
+            assertSigningCurrent();
+            // Generic reviewed calls keep the exact prepared envelope, including
+            // contract creation, calldata and access lists, through existing signers.
+            const reviewed = mode === 'reviewed-generic'
+                ? (0, evm_envelope_1.snapshotPreparedEvmTransaction)(input)
+                : undefined;
+            if (reviewed) {
+                if (reviewed.from !== targetIdentity.expectedAddress ||
+                    reviewed.chainId !== String(activeNetwork.chainId) ||
+                    reviewed.nonce !== String(walletNonce?.nonce) ||
+                    (isLegacy !== undefined && isLegacy !== (reviewed.type === 0)) ||
+                    (this.gasOverrides.minGasLimit &&
+                        BigInt(reviewed.gasLimit) < this.gasOverrides.minGasLimit.toBigInt()))
+                    throw new Error('Reviewed EVM transaction does not match its approval');
+                input = reviewed;
+                isLegacy = reviewed.type === 0;
+            }
             const assertBeforeBroadcast = () => {
                 assertCurrent();
                 beforeBroadcast();
             };
-            const submission = this.captureSubmission('send', activeAccount, activeAccountType, activeAccountId, activeNetwork, assertSigningCurrent, { walletNonce });
+            const submission = this.captureSubmission('send', activeAccount, activeAccountType, activeAccountId, activeNetwork, assertSigningCurrent, {
+                walletNonce,
+                ...(reviewed
+                    ? {
+                        review: {
+                            id: reviewId,
+                            unsignedHash: transaction_1.Transaction.from((0, evm_envelope_1.serializePreparedEvmTransaction)(reviewed)).unsignedHash,
+                        },
+                    }
+                    : {}),
+            });
             const assertCurrent = submission.assertCurrent;
             const approvedNonce = submission.context.walletNonce?.nonce;
             const assertApprovedNonce = (nonce) => {
@@ -1163,6 +1255,7 @@ class EthereumTransactions {
             };
             if (mode === 'reviewed-native') {
                 const { transaction } = (0, prepared_evm_1.snapshotPreparedEvmRequest)({
+                    selectedAccount: selectedIdentity,
                     account: {
                         id: activeAccountId,
                         type: activeAccountType,
@@ -1193,7 +1286,7 @@ class EthereumTransactions {
                 assertCurrent();
                 if (this.gasOverrides.minGasLimit !== minimum)
                     throw new Error('Reviewed native gas policy changed');
-                const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey();
+                const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey(targetAccount);
                 if (address.toLowerCase() !== transaction.from.toLowerCase())
                     throw new Error('Reviewed native signer does not match the approved account');
                 assertCurrent();
@@ -1206,6 +1299,9 @@ class EthereumTransactions {
             if (!params || typeof params !== 'object' || Array.isArray(params))
                 throw new TypeError('Invalid EVM transaction request');
             const supplied = { ...params };
+            if (supplied.from !== undefined &&
+                (0, address_1.getAddress)(supplied.from) !== targetIdentity.expectedAddress)
+                throw new Error('EVM transaction sender does not match the approved payer');
             // Validate original scalar spellings before conversion. Normalization's
             // permissive zero coercion must not bypass the bounded wire parser.
             for (const field of [
@@ -1258,7 +1354,8 @@ class EthereumTransactions {
             const validateEip1559Fees = () => {
                 const maximum = nonNegativeFeeQuantity(params.maxFeePerGas, 'maximum fee');
                 const priority = nonNegativeFeeQuantity(params.maxPriorityFeePerGas, 'priority fee');
-                if (maximum.isZero() || priority.gt(maximum))
+                if ((mode !== 'reviewed-generic' && maximum.isZero()) ||
+                    priority.gt(maximum))
                     throw new Error('Invalid EIP-1559 fees');
                 params.maxFeePerGas = maximum;
                 params.maxPriorityFeePerGas = priority;
@@ -1269,7 +1366,9 @@ class EthereumTransactions {
                 validateEip1559Fees();
             // Only apply a minimum gas limit when a network-specific override is set.
             // Otherwise keep the user/dapp-approved gas limit unchanged.
-            if (params.gasLimit != null && this.gasOverrides.minGasLimit) {
+            if (mode !== 'reviewed-generic' &&
+                params.gasLimit != null &&
+                this.gasOverrides.minGasLimit) {
                 const minGasLimit = this.gasOverrides.minGasLimit;
                 const currentGasLimit = ethers_v6_1.BigNumber.from(params.gasLimit);
                 if (currentGasLimit.lt(minGasLimit)) {
@@ -1340,31 +1439,15 @@ class EthereumTransactions {
                         type: 2, // Need explicit type for hardware wallet serialization
                     };
                 const rawTx = serializeTransaction(txFormattedForEthers);
-                const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                    rawTx: rawTx.replace('0x', ''),
+                const { rawTransaction: signedTx } = await (0, ledger_signing_1.signLedgerEvmTransaction)(this.requireLedgerSigner(), {
+                    unsignedTransaction: rawTx,
                     accountIndex: activeAccountId,
                     expectedAddress: activeAccount.address,
                 }, await this.authorizeHardwareTransaction(provider, assertCurrent));
                 assertCurrent();
-                const formattedSignature = {
-                    r: `0x${signature.r}`,
-                    s: `0x${signature.s}`,
-                    v: parseInt(signature.v, 16),
-                };
-                if (signature) {
-                    try {
-                        const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                        assertHardwareTransactionSender(signedTx, activeAccount.address);
-                        const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, assertBeforeBroadcast, rawTx);
-                        return finalTx;
-                    }
-                    catch (error) {
-                        throw error;
-                    }
-                }
-                else {
-                    throw new Error(`Transaction Signature Failed. Error: ${signature}`);
-                }
+                assertHardwareTransactionSender(signedTx, activeAccount.address);
+                const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, assertBeforeBroadcast, rawTx);
+                return finalTx;
             };
             const sendEVMTrezorTransaction = async () => {
                 assertCurrent();
@@ -1458,7 +1541,7 @@ class EthereumTransactions {
             };
             const sendEVMTransaction = async () => {
                 assertCurrent();
-                const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey();
+                const { address, decryptedPrivateKey } = this.getDecryptedPrivateKey(targetAccount);
                 // Validate that we have the correct private key for the active account to prevent race conditions
                 // This is critical for transaction security during account switches
                 if (address.toLowerCase() !== activeAccount.address.toLowerCase()) {
@@ -1715,32 +1798,18 @@ class EthereumTransactions {
                         };
                     const rawTx = serializeTransaction(txFormattedForEthers);
                     assertCurrent();
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
+                    const { rawTransaction: signedTx } = await (0, ledger_signing_1.signLedgerEvmTransaction)(this.requireLedgerSigner(), {
+                        unsignedTransaction: rawTx,
                         accountIndex: activeAccountId,
                         expectedAddress: activeAccount.address,
                     }, await this.authorizeHardwareTransaction(provider, assertCurrent));
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                    assertSignedSender(signedTx);
+                    assertHardwareTransactionSender(signedTx, activeAccount.address);
+                    const transactionResponse = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, assertBeforeBroadcast, rawTx);
+                    return {
+                        isSpeedUp: true,
+                        transaction: transactionResponse,
                     };
-                    if (signature) {
-                        const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                        assertSignedSender(signedTx);
-                        assertHardwareTransactionSender(signedTx, activeAccount.address);
-                        const transactionResponse = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, assertBeforeBroadcast, rawTx);
-                        return {
-                            isSpeedUp: true,
-                            transaction: transactionResponse,
-                        };
-                    }
-                    else {
-                        return {
-                            isSpeedUp: false,
-                            error: true,
-                        };
-                    }
                 }
                 catch (error) {
                     console.error('[SpeedUp] Failed to send replacement transaction with Ledger:', error);
@@ -1953,73 +2022,51 @@ class EthereumTransactions {
             };
             const sendERC20TokenOnLedger = async () => {
                 assertCurrent();
-                try {
-                    const _contract = new ethers_v6_1.Contract(tokenAddress, (0, sysweb3_utils_1.getErc20Abi)(), provider);
-                    const txData = _contract.interface.encodeFunctionData('transfer', [
-                        receiver,
-                        exactTokenAmount,
-                    ]);
-                    let txFormattedForEthers;
-                    if (isLegacy) {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit: gasLimit,
-                            gasPrice,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 0,
-                        };
-                    }
-                    else {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit: gasLimit,
-                            maxFeePerGas,
-                            maxPriorityFeePerGas,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 2, // Need explicit type for hardware wallet serialization
-                        };
-                    }
-                    const rawTx = serializeTransaction(txFormattedForEthers);
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
-                        accountIndex: activeAccountId,
-                        expectedAddress: activeAccount.address,
-                    }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
-                    assertCurrent();
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                const _contract = new ethers_v6_1.Contract(tokenAddress, (0, sysweb3_utils_1.getErc20Abi)(), provider);
+                const txData = _contract.interface.encodeFunctionData('transfer', [
+                    receiver,
+                    exactTokenAmount,
+                ]);
+                let txFormattedForEthers;
+                if (isLegacy) {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit: gasLimit,
+                        gasPrice,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 0,
                     };
-                    if (signature) {
-                        try {
-                            const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                            assertCurrent();
-                            assertHardwareTransactionSender(signedTx, activeAccount.address);
-                            const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, async ({ rawTransaction, admit }) => {
-                                const response = await admit(() => provider.sendTransaction(rawTransaction));
-                                saveTrezorTx && saveTrezorTx(response);
-                                return response;
-                            }, submission, undefined, rawTx);
-                            return finalTx;
-                        }
-                        catch (error) {
-                            throw error;
-                        }
-                    }
-                    else {
-                        throw new Error(`Transaction Signature Failed. Error: ${signature}`);
-                    }
                 }
-                catch (error) {
-                    throw error;
+                else {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit: gasLimit,
+                        maxFeePerGas,
+                        maxPriorityFeePerGas,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 2, // Need explicit type for hardware wallet serialization
+                    };
                 }
+                const rawTx = serializeTransaction(txFormattedForEthers);
+                const { rawTransaction: signedTx } = await (0, ledger_signing_1.signLedgerEvmTransaction)(this.requireLedgerSigner(), {
+                    unsignedTransaction: rawTx,
+                    accountIndex: activeAccountId,
+                    expectedAddress: activeAccount.address,
+                }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
+                assertCurrent();
+                assertHardwareTransactionSender(signedTx, activeAccount.address);
+                const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, async ({ rawTransaction, admit }) => {
+                    const response = await admit(() => provider.sendTransaction(rawTransaction));
+                    saveTrezorTx && saveTrezorTx(response);
+                    return response;
+                }, submission, undefined, rawTx);
+                return finalTx;
             };
             const sendERC20TokenOnTrezor = async () => {
                 assertCurrent();
@@ -2180,70 +2227,48 @@ class EthereumTransactions {
             };
             const sendERC721TokenOnLedger = async () => {
                 assertCurrent();
-                try {
-                    const _contract = new ethers_v6_1.Contract(tokenAddress, (0, sysweb3_utils_1.getErc21Abi)(), provider);
-                    const txData = _contract.interface.encodeFunctionData('transferFrom', [
-                        activeAccountAddress,
-                        receiver,
-                        normalizedTokenId,
-                    ]);
-                    let txFormattedForEthers;
-                    if (isLegacy) {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit,
-                            gasPrice,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 0,
-                        };
-                    }
-                    else {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit,
-                            maxFeePerGas,
-                            maxPriorityFeePerGas,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 2, // Need explicit type for hardware wallet serialization
-                        };
-                    }
-                    const rawTx = serializeTransaction(txFormattedForEthers);
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
-                        accountIndex: activeAccountId,
-                        expectedAddress: activeAccount.address,
-                    }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
-                    assertCurrent();
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                const _contract = new ethers_v6_1.Contract(tokenAddress, (0, sysweb3_utils_1.getErc21Abi)(), provider);
+                const txData = _contract.interface.encodeFunctionData('transferFrom', [
+                    activeAccountAddress,
+                    receiver,
+                    normalizedTokenId,
+                ]);
+                let txFormattedForEthers;
+                if (isLegacy) {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit,
+                        gasPrice,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 0,
                     };
-                    if (signature) {
-                        try {
-                            const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                            assertCurrent();
-                            assertHardwareTransactionSender(signedTx, activeAccount.address);
-                            const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
-                            return finalTx;
-                        }
-                        catch (error) {
-                            throw error;
-                        }
-                    }
-                    else {
-                        throw new Error(`Transaction Signature Failed. Error: ${signature}`);
-                    }
                 }
-                catch (error) {
-                    throw error;
+                else {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit,
+                        maxFeePerGas,
+                        maxPriorityFeePerGas,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 2, // Need explicit type for hardware wallet serialization
+                    };
                 }
+                const rawTx = serializeTransaction(txFormattedForEthers);
+                const { rawTransaction: signedTx } = await (0, ledger_signing_1.signLedgerEvmTransaction)(this.requireLedgerSigner(), {
+                    unsignedTransaction: rawTx,
+                    accountIndex: activeAccountId,
+                    expectedAddress: activeAccount.address,
+                }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
+                assertCurrent();
+                assertHardwareTransactionSender(signedTx, activeAccount.address);
+                const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
+                return finalTx;
             };
             const sendERC721TokenOnTrezor = async () => {
                 assertCurrent();
@@ -2410,66 +2435,44 @@ class EthereumTransactions {
             };
             const sendERC1155TokenOnLedger = async () => {
                 assertCurrent();
-                try {
-                    const _contract = new ethers_v6_1.Contract(tokenAddress, (0, sysweb3_utils_1.getErc55Abi)(), provider);
-                    const txData = _contract.interface.encodeFunctionData('safeTransferFrom', [activeAccountAddress, receiver, normalizedTokenId, amount, '0x']);
-                    let txFormattedForEthers;
-                    if (isLegacy) {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit,
-                            gasPrice,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 0,
-                        };
-                    }
-                    else {
-                        txFormattedForEthers = {
-                            to: tokenAddress,
-                            value: '0x0',
-                            gasLimit,
-                            maxFeePerGas,
-                            maxPriorityFeePerGas,
-                            data: txData,
-                            nonce,
-                            chainId: activeNetwork.chainId,
-                            type: 2, // Need explicit type for hardware wallet serialization
-                        };
-                    }
-                    const rawTx = serializeTransaction(txFormattedForEthers);
-                    const signature = await this.requireLedgerSigner().evm.signEVMTransaction({
-                        rawTx: rawTx.replace('0x', ''),
-                        accountIndex: activeAccountId,
-                        expectedAddress: activeAccount.address,
-                    }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
-                    assertCurrent();
-                    const formattedSignature = {
-                        r: `0x${signature.r}`,
-                        s: `0x${signature.s}`,
-                        v: parseInt(signature.v, 16),
+                const _contract = new ethers_v6_1.Contract(tokenAddress, (0, sysweb3_utils_1.getErc55Abi)(), provider);
+                const txData = _contract.interface.encodeFunctionData('safeTransferFrom', [activeAccountAddress, receiver, normalizedTokenId, amount, '0x']);
+                let txFormattedForEthers;
+                if (isLegacy) {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit,
+                        gasPrice,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 0,
                     };
-                    if (signature) {
-                        try {
-                            const signedTx = serializeTransaction(txFormattedForEthers, formattedSignature);
-                            assertCurrent();
-                            assertHardwareTransactionSender(signedTx, activeAccount.address);
-                            const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
-                            return finalTx;
-                        }
-                        catch (error) {
-                            throw error;
-                        }
-                    }
-                    else {
-                        throw new Error(`Transaction Signature Failed. Error: ${signature}`);
-                    }
                 }
-                catch (error) {
-                    throw error;
+                else {
+                    txFormattedForEthers = {
+                        to: tokenAddress,
+                        value: '0x0',
+                        gasLimit,
+                        maxFeePerGas,
+                        maxPriorityFeePerGas,
+                        data: txData,
+                        nonce,
+                        chainId: activeNetwork.chainId,
+                        type: 2, // Need explicit type for hardware wallet serialization
+                    };
                 }
+                const rawTx = serializeTransaction(txFormattedForEthers);
+                const { rawTransaction: signedTx } = await (0, ledger_signing_1.signLedgerEvmTransaction)(this.requireLedgerSigner(), {
+                    unsignedTransaction: rawTx,
+                    accountIndex: activeAccountId,
+                    expectedAddress: activeAccount.address,
+                }, await this.authorizeHardwareTransaction(provider, assertCurrent, signal));
+                assertCurrent();
+                assertHardwareTransactionSender(signedTx, activeAccount.address);
+                const finalTx = await this.submitSignedHardwareTransaction(provider, signedTx, ({ rawTransaction, admit }) => admit(() => provider.sendTransaction(rawTransaction)), submission, undefined, rawTx);
+                return finalTx;
             };
             const sendERC1155TokenOnTrezor = async () => {
                 assertCurrent();
@@ -2791,6 +2794,52 @@ class EthereumTransactions {
             console.log('[EthereumTransactions] Deferring provider initialization:', error?.message || error);
         }
     }
+    signPreparedEvmTransaction(input, options) {
+        const selected = this.captureEvmAccountContext();
+        const request = (0, prepared_evm_1.snapshotPreparedEvmRequest)(input);
+        const target = {
+            id: request.account.id,
+            type: request.account.type,
+        };
+        const context = this.captureEvmAccountContext(target);
+        const hostGuard = (0, prepared_evm_1.preparedEvmGuard)(options);
+        const targetRecord = this.getState().accounts[target.type]?.[target.id];
+        const encryptedKey = targetRecord?.xprv;
+        const assertCurrent = () => {
+            selected.assertCurrent();
+            context.assertCurrent();
+            const live = this.getState().accounts[target.type]?.[target.id];
+            if (!live ||
+                live.id !== target.id ||
+                live.isSmartAccount ||
+                live.isLedgerWallet ||
+                live.isTrezorWallet ||
+                typeof encryptedKey !== 'string' ||
+                !encryptedKey ||
+                live.xprv !== encryptedKey ||
+                selected.activeAccountId !== request.selectedAccount.id ||
+                selected.activeAccountType !== request.selectedAccount.type ||
+                (0, address_1.getAddress)(selected.activeAccount.address) !==
+                    request.selectedAccount.expectedAddress ||
+                (0, address_1.getAddress)(context.activeAccount.address) !==
+                    request.account.expectedAddress ||
+                context.activeNetwork.kind !== 'ethereum' ||
+                context.activeNetwork.slip44 !== 60 ||
+                String(context.activeNetwork.chainId) !== request.network.chainId ||
+                context.activeNetwork.url !== request.network.url)
+                throw new Error('Prepared EVM signing context changed or is unsupported');
+        };
+        assertCurrent();
+        hostGuard();
+        assertCurrent();
+        const key = this.getDecryptedPrivateKey(target);
+        if ((0, address_1.getAddress)(key.address) !== request.account.expectedAddress)
+            throw new Error('Prepared EVM signer address mismatch');
+        const { signed } = (0, prepared_evm_1.signPreparedEvmEnvelope)(request.transaction, key.decryptedPrivateKey);
+        hostGuard();
+        assertCurrent();
+        return signed;
+    }
     setWeb3Provider(network) {
         this.abortController.abort();
         this.abortController = new AbortController();