@sip-protocol/sdk 0.7.3 → 0.8.0

package/src/chains/solana/scan.ts

@@ -31,9 +31,11 @@ import {
   SIP_MEMO_PREFIX,
   MEMO_PROGRAM_ID,
   getExplorerUrl,
-  SOLANA_TOKEN_MINTS,
+  DEFAULT_SCAN_LIMIT,
+  VIEW_TAG_MAX,
   type SolanaCluster,
 } from './constants'
+import { getTokenSymbol, parseTokenTransferFromBalances } from './utils'
 import type { SolanaRPCProvider } from './providers/interface'
 import { hexToBytes } from '@noble/hashes/utils'
 import { ed25519 } from '@noble/curves/ed25519'
@@ -70,7 +72,7 @@ export async function scanForPayments(
     spendingPublicKey,
     fromSlot,
     toSlot,
-    limit = 100,
+    limit = DEFAULT_SCAN_LIMIT,
     provider,
   } = params
 
@@ -119,32 +121,61 @@ export async function scanForPayments(
           const announcement = parseAnnouncement(memoContent)
           if (!announcement) continue
 
-          // Check if this payment is for us using view tag first
-          const ephemeralPubKeyHex = solanaAddressToEd25519PublicKey(
-            announcement.ephemeralPublicKey
-          )
+          // M5 FIX: Wrap ephemeral key conversion in try-catch
+          let ephemeralPubKeyHex: HexString
+          try {
+            ephemeralPubKeyHex = solanaAddressToEd25519PublicKey(
+              announcement.ephemeralPublicKey
+            )
+          } catch {
+            // Invalid ephemeral key format, skip this announcement
+            continue
+          }
 
           // Construct stealth address object for checking
           // viewTag is a number (0-255), parse from hex string
           const viewTagNumber = parseInt(announcement.viewTag, 16)
-          const stealthAddressToCheck: StealthAddress = {
-            address: announcement.stealthAddress
+
+          // M5 FIX: Validate view tag range
+          if (!Number.isInteger(viewTagNumber) || viewTagNumber < 0 || viewTagNumber > VIEW_TAG_MAX) {
+            continue
+          }
+
+          let stealthAddressHex: HexString
+          try {
+            stealthAddressHex = announcement.stealthAddress
               ? solanaAddressToEd25519PublicKey(announcement.stealthAddress)
-              : ('0x' + '00'.repeat(32)) as HexString, // Will be computed
+              : ('0x' + '00'.repeat(32)) as HexString
+          } catch {
+            continue
+          }
+
+          const stealthAddressToCheck: StealthAddress = {
+            address: stealthAddressHex,
             ephemeralPublicKey: ephemeralPubKeyHex,
             viewTag: viewTagNumber,
           }
 
-          // Check if this is our payment
-          const isOurs = checkEd25519StealthAddress(
-            stealthAddressToCheck,
-            viewingPrivateKey,
-            spendingPublicKey
-          )
+          // M5 FIX: Wrap checkEd25519StealthAddress in try-catch
+          // This can throw for invalid curve points
+          let isOurs = false
+          try {
+            isOurs = checkEd25519StealthAddress(
+              stealthAddressToCheck,
+              viewingPrivateKey,
+              spendingPublicKey
+            )
+          } catch {
+            // Invalid keys or malformed data - not our payment
+            continue
+          }
 
           if (isOurs) {
-            // Parse token transfer from transaction
-            const transferInfo = parseTokenTransfer(tx)
+            // Parse token transfer from transaction using shared utility
+            const transferInfo = parseTokenTransferFromBalances(
+              tx?.meta?.preTokenBalances as Parameters<typeof parseTokenTransferFromBalances>[0],
+              tx?.meta?.postTokenBalances as Parameters<typeof parseTokenTransferFromBalances>[1]
+            )
             if (transferInfo) {
               // If provider is available, use it for more accurate current balance
               let amount = transferInfo.amount
@@ -179,14 +210,15 @@ export async function scanForPayments(
             }
           }
         }
-      } catch (err) {
-        // Skip failed transaction parsing
-        console.warn(`Failed to parse tx ${sigInfo.signature}:`, err)
+      } catch {
+        // M10 FIX: Skip failed transaction parsing silently
+        // Individual tx parse failures shouldn't block scanning
       }
     }
   } catch (err) {
-    console.error('Scan failed:', err)
-    throw new Error(`Failed to scan for payments: ${err}`)
+    // M10 FIX: Remove console.error, throw proper error
+    const message = err instanceof Error ? err.message : String(err)
+    throw new Error(`Failed to scan for payments: ${message}`)
   }
 
   return results
@@ -215,6 +247,9 @@ export async function scanForPayments(
  * console.log('Claimed! Tx:', result.txSignature)
  * ```
  */
+/** Minimum SOL balance required for transaction fees (in lamports) */
+const MIN_SOL_FOR_FEES = 5000n // ~0.000005 SOL, typical tx fee
+
 export async function claimStealthPayment(
   params: SolanaClaimParams
 ): Promise<SolanaClaimResult> {
@@ -228,6 +263,17 @@ export async function claimStealthPayment(
     mint,
   } = params
 
+  // M7 FIX: Check SOL balance for fees before attempting claim
+  const stealthPubkeyForBalance = new PublicKey(stealthAddress)
+  const solBalance = await connection.getBalance(stealthPubkeyForBalance)
+  if (BigInt(solBalance) < MIN_SOL_FOR_FEES) {
+    throw new Error(
+      `Insufficient SOL for transaction fees. Stealth address has ${solBalance} lamports, ` +
+      `needs at least ${MIN_SOL_FOR_FEES} lamports (~0.000005 SOL). ` +
+      `Fund the stealth address with SOL before claiming.`
+    )
+  }
+
   // Convert addresses to hex for SDK functions
   const stealthAddressHex = solanaAddressToEd25519PublicKey(stealthAddress)
   const ephemeralPubKeyHex = solanaAddressToEd25519PublicKey(ephemeralPublicKey)
@@ -391,51 +437,16 @@ export async function getStealthBalance(
   }
 }
 
-/**
- * Parse token transfer info from a transaction
- */
-function parseTokenTransfer(
-  tx: Awaited<ReturnType<typeof import('@solana/web3.js').Connection.prototype.getTransaction>>
-): { mint: string; amount: bigint } | null {
-  if (!tx?.meta?.postTokenBalances || !tx.meta.preTokenBalances) {
-    return null
-  }
-
-  // Find token balance changes
-  for (let i = 0; i < tx.meta.postTokenBalances.length; i++) {
-    const post = tx.meta.postTokenBalances[i]
-    const pre = tx.meta.preTokenBalances.find(
-      (p) => p.accountIndex === post.accountIndex
-    )
-
-    const postAmount = BigInt(post.uiTokenAmount.amount)
-    const preAmount = pre ? BigInt(pre.uiTokenAmount.amount) : 0n
-
-    if (postAmount > preAmount) {
-      return {
-        mint: post.mint,
-        amount: postAmount - preAmount,
-      }
-    }
-  }
-
-  return null
-}
-
-/**
- * Get token symbol from mint address
- */
-function getTokenSymbol(mint: string): string | undefined {
-  for (const [symbol, address] of Object.entries(SOLANA_TOKEN_MINTS)) {
-    if (address === mint) {
-      return symbol
-    }
-  }
-  return undefined
-}
+// Token transfer parsing and symbol lookup moved to ./utils.ts (L3 fix)
 
 /**
- * Detect Solana cluster from RPC endpoint
+ * Detect Solana cluster from RPC endpoint URL
+ *
+ * Parses the endpoint URL to determine which Solana cluster it connects to.
+ *
+ * @param endpoint - RPC endpoint URL
+ * @returns Detected cluster name
+ * @internal
  */
 function detectCluster(endpoint: string): SolanaCluster {
   if (endpoint.includes('devnet')) {
@@ -451,7 +462,13 @@ function detectCluster(endpoint: string): SolanaCluster {
 }
 
 /**
- * Convert bytes to bigint (little-endian, for ed25519 scalars)
+ * Convert bytes to bigint in little-endian format
+ *
+ * Used for ed25519 scalar conversion where bytes are in little-endian order.
+ *
+ * @param bytes - Byte array to convert
+ * @returns BigInt representation of the bytes
+ * @internal
  */
 function bytesToBigIntLE(bytes: Uint8Array): bigint {
   let result = 0n