@vultisig/core-chain 2.23.3 → 2.24.1

package/dist/coin/utils/findByTicker.js

@@ -1,2 +1,16 @@
-export const findByTicker = ({ coins, ticker }) => coins.find(c => c.ticker === ticker) ?? null;
+// SDK2-02 (audit r2): a bare ticker like "USDC" exists on many chains (Ethereum/Polygon/Arbitrum/Base/…).
+// The old `coins.find(c => c.ticker === ticker)` returned the ARRAY-ORDER first match — if this ever got
+// wired into a fund path, "USDC" would silently resolve to whichever chain happened to be first, sending to
+// the wrong network. Refuse to guess: return the unique match (or null when absent), and THROW when the
+// ticker is ambiguous across more than one chain so the caller must disambiguate by chain.
+export const findByTicker = ({ coins, ticker }) => {
+    const matches = coins.filter(c => c.ticker === ticker);
+    if (matches.length === 0)
+        return null;
+    const chains = new Set(matches.map(c => c.chain));
+    if (chains.size > 1) {
+        throw new Error(`findByTicker: ticker "${ticker}" is ambiguous across ${chains.size} chains (${[...chains].join(', ')}); pass a chain-scoped lookup instead of a bare ticker`);
+    }
+    return matches[0] ?? null;
+};
 //# sourceMappingURL=findByTicker.js.map

package/dist/coin/utils/findByTicker.js.map

@@ -1 +1 @@
-{"version":3,"file":"findByTicker.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/coin/utils/findByTicker.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAiB,EAAE,KAAK,EAAE,MAAM,EAAwB,EAAY,EAAE,CAChG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAA"}
+{"version":3,"file":"findByTicker.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/coin/utils/findByTicker.ts"],"names":[],"mappings":"AAOA,0GAA0G;AAC1G,yGAAyG;AACzG,4GAA4G;AAC5G,wGAAwG;AACxG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAiB,EAAE,KAAK,EAAE,MAAM,EAAwB,EAAY,EAAE;IAChG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,yBAAyB,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,CAC9J,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AAC3B,CAAC,CAAA"}

package/dist/swap/general/cowswap/api/getCowSwapQuote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getCowSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/cowswap/api/getCowSwapQuote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAGL,kBAAkB,EAEnB,MAAM,WAAW,CAAA;AAiBlB,KAAK,oBAAoB,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,wBAAsB,eAAe,CAAC,EACpC,SAAS,EACT,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,YAAY,GACb,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+DlD"}
+{"version":3,"file":"getCowSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/cowswap/api/getCowSwapQuote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAIL,kBAAkB,EAEnB,MAAM,WAAW,CAAA;AAiBlB,KAAK,oBAAoB,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AASD,wBAAsB,eAAe,CAAC,EACpC,SAAS,EACT,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,YAAY,GACb,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsIlD"}

package/dist/swap/general/cowswap/api/getCowSwapQuote.js

@@ -1,6 +1,12 @@
 import { queryUrl } from '@vultisig/lib-utils/query/queryUrl';
-import { COWSWAP_DEFAULT_AFFILIATE_BPS, COWSWAP_FEE_RECIPIENT, KNOWN_PERMIT_TOKENS, } from '../config.js';
+import { COWSWAP_DEFAULT_AFFILIATE_BPS, COWSWAP_FEE_RECIPIENT, COWSWAP_VALID_TO_SECONDS, KNOWN_PERMIT_TOKENS, } from '../config.js';
 import { buildCowSwapAppData, keccak256Hex } from '../sign/buildCowSwapOrder.js';
+// This SDK only ever requests a sell order that must fill completely — named here (rather than
+// inlined at both the request body below AND the AGG-01 response-echo checks) so the two stay
+// in lockstep if that ever changes; comparing against a variable is more robust than duplicating
+// the literal in two places (codex review, PR #1082).
+const REQUESTED_KIND = 'sell';
+const REQUESTED_PARTIALLY_FILLABLE = false;
 export async function getCowSwapQuote({ sellToken, buyToken, sellAmount, from, receiver, chainConfig, affiliateBps, }) {
     const bps = affiliateBps ?? COWSWAP_DEFAULT_AFFILIATE_BPS;
     const appData = buildCowSwapAppData(bps, COWSWAP_FEE_RECIPIENT);
@@ -11,9 +17,9 @@ export async function getCowSwapQuote({ sellToken, buyToken, sellAmount, from, r
         sellAmountBeforeFee: sellAmount.toString(),
         from: from.toLowerCase(),
         receiver: receiver.toLowerCase(),
-        kind: 'sell',
+        kind: REQUESTED_KIND,
         signingScheme: 'eip712',
-        partiallyFillable: false,
+        partiallyFillable: REQUESTED_PARTIALLY_FILLABLE,
         appData,
         appDataHash,
     };
@@ -22,6 +28,52 @@ export async function getCowSwapQuote({ sellToken, buyToken, sellAmount, from, r
         body,
     });
     const { quote } = response;
+    // AGG-01 fund-safety fix (round-2 spec-level audit): sellToken/buyToken/kind/
+    // partiallyFillable were previously taken straight from this untrusted /quote response and
+    // signed as-is via the EIP-712 GPv2 Order struct (buildCowSwapOrderTypedData.ts). `receiver`
+    // just below already uses the caller-supplied local, not quote.receiver — the "don't trust
+    // the API for security-critical fields" pattern already existed here, just not applied to
+    // these 4 fields. A compromised/buggy apiBase response substituting a token address, or
+    // flipping `kind` from 'sell' to 'buy', would get signed: a `kind` flip specifically inverts
+    // GPv2's semantics (sell: sellAmount is authoritative post-fee; buy: buyAmount is the fixed
+    // target, sellAmount becomes a ceiling) while grossSellAmount below is computed assuming
+    // sell-order semantics — the SDK would sign a fundamentally different economic contract than
+    // the one it believes it built. This SDK only ever requests kind:'sell' + partiallyFillable:
+    // false (the request body above), so any other value in the response is definitionally wrong.
+    if (quote.sellToken.toLowerCase() !== sellToken.toLowerCase()) {
+        throw new Error(`CowSwap quote returned a mismatched sellToken (requested ${sellToken}, got ${quote.sellToken}) — refusing to sign.`);
+    }
+    if (quote.buyToken.toLowerCase() !== buyToken.toLowerCase()) {
+        throw new Error(`CowSwap quote returned a mismatched buyToken (requested ${buyToken}, got ${quote.buyToken}) — refusing to sign.`);
+    }
+    if (quote.kind !== REQUESTED_KIND) {
+        throw new Error(`CowSwap quote returned kind '${quote.kind}' (requested '${REQUESTED_KIND}') — refusing to sign.`);
+    }
+    if (quote.partiallyFillable !== REQUESTED_PARTIALLY_FILLABLE) {
+        throw new Error(`CowSwap quote returned partiallyFillable=${quote.partiallyFillable} (requested ${REQUESTED_PARTIALLY_FILLABLE}) — refusing to sign.`);
+    }
+    // AGG-01 follow-up (codex review, PR #1082): validTo is entirely server-determined (the
+    // request sends no validTo of its own, so there is no request-side value to equality-check
+    // against — unlike the fields above). Still part of the signed Order struct, so bound it to a
+    // generous ceiling (buildCowSwapOrder.ts's sibling implementation computes its OWN local
+    // validTo instead of trusting the response at all — this is the softer version of that same
+    // instinct): reject a response whose validTo is unreasonably far in the future (a malicious/
+    // malfunctioning response making the order executable far beyond user intent) or already in
+    // the past (an expired/garbage quote).
+    //
+    // The ceiling is 4x COWSWAP_VALID_TO_SECONDS, not 2x — live-verified (2026-07-08, real
+    // api.cow.fi/mainnet request) that CoW's actual returned validTo is `now + 1800s` (30 min),
+    // NOT ~15 min as COWSWAP_VALID_TO_SECONDS alone would suggest (that constant is
+    // buildCowSwapOrder.ts's OWN locally-computed TTL, a different value from what the live API
+    // returns). A 2x/30-min cap would have sat RIGHT AT the observed real value with zero headroom
+    // for clock skew or normal timing variance — exactly the false-block risk the zkSync router
+    // case flagged (team-lead review). 4x/60-min gives real headroom over the observed 30-min
+    // reality while still catching genuinely-absurd values (hours/days out — the actual threat).
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const maxReasonableValidTo = nowSeconds + 4 * COWSWAP_VALID_TO_SECONDS;
+    if (quote.validTo <= nowSeconds || quote.validTo > maxReasonableValidTo) {
+        throw new Error(`CowSwap quote returned an unreasonable validTo (${quote.validTo}, now=${nowSeconds}, max=${maxReasonableValidTo}) — refusing to sign.`);
+    }
     const permitRequired = KNOWN_PERMIT_TOKENS[chainConfig.chainId]?.some(addr => addr.toLowerCase() === sellToken.toLowerCase());
     // The CoW orderbook requires submitted orders to carry `feeAmount = 0` — the
     // network/solver fee is folded into the price (taken from order surplus), not
@@ -32,6 +84,19 @@ export async function getCowSwapQuote({ sellToken, buyToken, sellAmount, from, r
     // quoted for the net amount. This value is signed AND submitted, so both stay
     // consistent.
     const grossSellAmount = (BigInt(quote.sellAmount) + BigInt(quote.feeAmount)).toString();
+    // AGG-01 follow-up (codex review, PR #1082): grossSellAmount becomes the signed Order's
+    // sellAmount — the SDK's authorized spend — and was, like the 4 fields above, taken entirely
+    // from the untrusted response with no check against what was actually requested. CoW's
+    // `sellAmountBeforeFee` request param is specifically designed so the API solves for
+    // `quote.sellAmount + quote.feeAmount === sellAmountBeforeFee` exactly — live-verified against
+    // the real api.cow.fi/mainnet quote endpoint on two different pairs/amounts on 2026-07-08,
+    // both matched byte-for-byte, not just approximately. A compromised/buggy response inflating
+    // sellAmount or feeAmount would sign authorization to sell MORE than the user requested —
+    // the most direct fund-safety consequence of any field in this struct. Same "refuse to sign
+    // on mismatch" treatment as the fields above.
+    if (grossSellAmount !== sellAmount.toString()) {
+        throw new Error(`CowSwap quote's sellAmount+feeAmount (${grossSellAmount}) does not match the requested sellAmountBeforeFee (${sellAmount}) — refusing to sign.`);
+    }
     return {
         dstAmount: quote.buyAmount,
         provider: 'cowswap',

package/dist/swap/general/cowswap/api/getCowSwapQuote.js.map

@@ -1 +1 @@
-{"version":3,"file":"getCowSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/cowswap/api/getCowSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAG7D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EAErB,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AA0B7E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,SAAS,EACT,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,YAAY,GACS;IACrB,MAAM,GAAG,GAAG,YAAY,IAAI,6BAA6B,CAAA;IACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;IAC/D,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAEzC,MAAM,IAAI,GAAwB;QAChC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChC,mBAAmB,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC1C,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;QACxB,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChC,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,QAAQ;QACvB,iBAAiB,EAAE,KAAK;QACxB,OAAO;QACP,WAAW;KACZ,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAA0B,GAAG,WAAW,CAAC,OAAO,eAAe,EAAE;QAC9F,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAA;IAEF,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAA;IAE1B,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,CACnE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CACvD,CAAA;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,+DAA+D;IAC/D,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,8EAA8E;IAC9E,cAAc;IACd,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEvF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE;YACF,aAAa,EAAE;gBACb,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ;gBACR,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO;gBACP,WAAW;gBACX,SAAS,EAAE,GAAG;gBACd,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,gBAAgB,EAAE,OAAO;gBACzB,eAAe,EAAE,OAAO;gBACxB,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD;SACF;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"getCowSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/cowswap/api/getCowSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAG7D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EAExB,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AA0B7E,+FAA+F;AAC/F,8FAA8F;AAC9F,iGAAiG;AACjG,sDAAsD;AACtD,MAAM,cAAc,GAAG,MAAe,CAAA;AACtC,MAAM,4BAA4B,GAAG,KAAc,CAAA;AAEnD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,SAAS,EACT,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,YAAY,GACS;IACrB,MAAM,GAAG,GAAG,YAAY,IAAI,6BAA6B,CAAA;IACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;IAC/D,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAEzC,MAAM,IAAI,GAAwB;QAChC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChC,mBAAmB,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC1C,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;QACxB,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChC,IAAI,EAAE,cAAc;QACpB,aAAa,EAAE,QAAQ;QACvB,iBAAiB,EAAE,4BAA4B;QAC/C,OAAO;QACP,WAAW;KACZ,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAA0B,GAAG,WAAW,CAAC,OAAO,eAAe,EAAE;QAC9F,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAA;IAEF,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAA;IAE1B,8EAA8E;IAC9E,2FAA2F;IAC3F,6FAA6F;IAC7F,2FAA2F;IAC3F,0FAA0F;IAC1F,wFAAwF;IACxF,6FAA6F;IAC7F,4FAA4F;IAC5F,yFAAyF;IACzF,6FAA6F;IAC7F,6FAA6F;IAC7F,8FAA8F;IAC9F,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,SAAS,KAAK,CAAC,SAAS,uBAAuB,CACrH,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,2DAA2D,QAAQ,SAAS,KAAK,CAAC,QAAQ,uBAAuB,CAClH,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,IAAI,iBAAiB,cAAc,wBAAwB,CAAC,CAAA;IACpH,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,4BAA4B,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,iBAAiB,eAAe,4BAA4B,uBAAuB,CACtI,CAAA;IACH,CAAC;IACD,wFAAwF;IACxF,2FAA2F;IAC3F,8FAA8F;IAC9F,yFAAyF;IACzF,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,uCAAuC;IACvC,EAAE;IACF,uFAAuF;IACvF,4FAA4F;IAC5F,gFAAgF;IAChF,4FAA4F;IAC5F,+FAA+F;IAC/F,4FAA4F;IAC5F,0FAA0F;IAC1F,6FAA6F;IAC7F,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAChD,MAAM,oBAAoB,GAAG,UAAU,GAAG,CAAC,GAAG,wBAAwB,CAAA;IACtE,IAAI,KAAK,CAAC,OAAO,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,GAAG,oBAAoB,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,mDAAmD,KAAK,CAAC,OAAO,SAAS,UAAU,SAAS,oBAAoB,uBAAuB,CACxI,CAAA;IACH,CAAC;IAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,CACnE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CACvD,CAAA;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,+DAA+D;IAC/D,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,8EAA8E;IAC9E,cAAc;IACd,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEvF,wFAAwF;IACxF,6FAA6F;IAC7F,uFAAuF;IACvF,qFAAqF;IACrF,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,0FAA0F;IAC1F,4FAA4F;IAC5F,8CAA8C;IAC9C,IAAI,eAAe,KAAK,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,yCAAyC,eAAe,uDAAuD,UAAU,uBAAuB,CACjJ,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE;YACF,aAAa,EAAE;gBACb,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ;gBACR,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO;gBACP,WAAW;gBACX,SAAS,EAAE,GAAG;gBACd,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,gBAAgB,EAAE,OAAO;gBACzB,eAAe,EAAE,OAAO;gBACxB,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD;SACF;KACF,CAAA;AACH,CAAC"}

package/dist/swap/general/jupiter/api/getJupiterSwapQuote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getJupiterSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/jupiter/api/getJupiterSwapQuote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAA;AACrF,OAAO,EAEL,KAAK,sBAAsB,EAG5B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oEAAoE,CAAA;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAUzE,KAAK,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAC,GAAG;IAC7E,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,sBAAsB,CAAA;IACtC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AA2CD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAAU,iEAOvC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAuFlC,CAAA"}
+{"version":3,"file":"getJupiterSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/jupiter/api/getJupiterSwapQuote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAA;AACrF,OAAO,EAEL,KAAK,sBAAsB,EAG5B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oEAAoE,CAAA;AAE5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAUzE,KAAK,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAC,GAAG;IAC7E,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,sBAAsB,CAAA;IACtC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AA2CD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAAU,iEAOvC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CA8FlC,CAAA"}

package/dist/swap/general/jupiter/api/getJupiterSwapQuote.js

@@ -1,6 +1,7 @@
 import { Chain } from '@vultisig/core-chain/Chain';
 import { solanaConfig } from '@vultisig/core-chain/chains/solana/solanaConfig';
 import { getJupiterConfig, jupiterFeeOwnerAddress, normalizeJupiterBaseUrl, } from '@vultisig/core-chain/swap/general/jupiter/config';
+import { assertJupiterPriceImpactWithinCeiling } from '@vultisig/core-chain/swap/general/priceImpactGuard';
 import { deriveJupiterFeeAccount, prependJupiterFeeAta } from './jupiterFeeAta.js';
 /** Canonical wrapped-SOL mint, used as the mint address for native SOL legs. */
 const solanaNativeMint = 'So11111111111111111111111111111111111111112';
@@ -53,6 +54,12 @@ export const getJupiterSwapQuote = async ({ from, to, amount, affiliateBps = 0,
     const quoteResponse = await requestJson(`${baseUrl}/swap/v1/quote?${quoteParams.toString()}`, {
         headers: { Accept: 'application/json' },
     });
+    // Price-impact ceiling (fund-safety, audit finding SOL-02). Jupiter's
+    // priceImpactPct is a FRACTION ("0.05" = 5%); refuse to build a signable
+    // swap transaction above the ceiling — a thin-pool / sandwich-bait quote
+    // that would lose most of the user's funds. Fail-safe: a missing /
+    // unparsable impact passes (see evaluatePriceImpactPercent).
+    assertJupiterPriceImpactWithinCeiling(quoteResponse.priceImpactPct);
     // Gate the fee-account flow on the actually quoted fee, not just the requested
     // bps: Jupiter can floor `platformFee.amount` to 0 (tiny amounts, route with no
     // fee-eligible mint) even when we asked for a fee. Deriving a fee account and

package/dist/swap/general/jupiter/api/getJupiterSwapQuote.js.map

@@ -1 +1 @@
-{"version":3,"file":"getJupiterSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/jupiter/api/getJupiterSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AAG9E,OAAO,EACL,gBAAgB,EAEhB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kDAAkD,CAAA;AAIzD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE/E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,6CAA6C,CAAA;AAEtE,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,EAAE,CAAA;AAkCvC,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,EAAe,EAAU,EAAE,CAAC,EAAE,IAAI,gBAAgB,CAAA;AAEvE,MAAM,WAAW,GAAG,KAAK,EAAK,GAAW,EAAE,IAAkB,EAAc,EAAE;IAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,IAAI,EACJ,EAAE,EACF,MAAM,EACN,YAAY,GAAG,CAAC,EAChB,aAAa,EACb,WAAW,GAAG,4BAA4B,GACpC,EAA6B,EAAE;IACrC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,iBAAiB,CAAA;IACpF,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAA;IAE1E,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAA;IAE9B,MAAM,mBAAmB,GAAG,YAAY,GAAG,CAAC,CAAA;IAE5C,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC;QACtC,QAAQ,EAAE,SAAS;QACnB,SAAS;QACT,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IACF,IAAI,mBAAmB,EAAE,CAAC;QACxB,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAuB,GAAG,OAAO,kBAAkB,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE;QAClH,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,0CAA0C;IAC1C,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,GAAG,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,mBAAmB,IAAI,aAAa,GAAG,EAAE,CAAA;IAE5D,4EAA4E;IAC5E,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvG,MAAM,YAAY,GAAG,MAAM,WAAW,CAAsB,GAAG,OAAO,eAAe,EAAE;QACrF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa;YACb,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,gBAAgB,EAAE,IAAI;YACtB,uBAAuB,EAAE,IAAI;YAC7B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,cAAc;QACzB,CAAC,CAAC,MAAM,oBAAoB,CAAC;YACzB,MAAM,EAAE,YAAY,CAAC,eAAe;YACpC,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,cAAc,EAAE,cAAc,CAAC,cAAc;SAC9C,CAAC;QACJ,CAAC,CAAC,YAAY,CAAC,eAAe,CAAA;IAEhC,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAE1G,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE;YACF,MAAM,EAAE;gBACN,IAAI;gBACJ,UAAU;gBACV,OAAO,EAAE;oBACP,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,KAAK,EAAE,KAAK,CAAC,MAAM;oBACnB,EAAE,EAAE,EAAE,CAAC,EAAE;iBACV;aACF;SACF;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"getJupiterSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/jupiter/api/getJupiterSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AAG9E,OAAO,EACL,gBAAgB,EAEhB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kDAAkD,CAAA;AAEzD,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAA;AAG1G,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE/E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,6CAA6C,CAAA;AAEtE,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,EAAE,CAAA;AAkCvC,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,EAAe,EAAU,EAAE,CAAC,EAAE,IAAI,gBAAgB,CAAA;AAEvE,MAAM,WAAW,GAAG,KAAK,EAAK,GAAW,EAAE,IAAkB,EAAc,EAAE;IAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,IAAI,EACJ,EAAE,EACF,MAAM,EACN,YAAY,GAAG,CAAC,EAChB,aAAa,EACb,WAAW,GAAG,4BAA4B,GACpC,EAA6B,EAAE;IACrC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,iBAAiB,CAAA;IACpF,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAA;IAE1E,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAA;IAE9B,MAAM,mBAAmB,GAAG,YAAY,GAAG,CAAC,CAAA;IAE5C,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC;QACtC,QAAQ,EAAE,SAAS;QACnB,SAAS;QACT,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IACF,IAAI,mBAAmB,EAAE,CAAC;QACxB,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAuB,GAAG,OAAO,kBAAkB,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE;QAClH,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAA;IAEF,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,6DAA6D;IAC7D,qCAAqC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAA;IAEnE,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,0CAA0C;IAC1C,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,GAAG,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,mBAAmB,IAAI,aAAa,GAAG,EAAE,CAAA;IAE5D,4EAA4E;IAC5E,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvG,MAAM,YAAY,GAAG,MAAM,WAAW,CAAsB,GAAG,OAAO,eAAe,EAAE;QACrF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa;YACb,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,gBAAgB,EAAE,IAAI;YACtB,uBAAuB,EAAE,IAAI;YAC7B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,cAAc;QACzB,CAAC,CAAC,MAAM,oBAAoB,CAAC;YACzB,MAAM,EAAE,YAAY,CAAC,eAAe;YACpC,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,cAAc,EAAE,cAAc,CAAC,cAAc;SAC9C,CAAC;QACJ,CAAC,CAAC,YAAY,CAAC,eAAe,CAAA;IAEhC,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAE1G,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE;YACF,MAAM,EAAE;gBACN,IAAI;gBACJ,UAAU;gBACV,OAAO,EAAE;oBACP,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,KAAK,EAAE,KAAK,CAAC,MAAM;oBACnB,EAAE,EAAE,EAAE,CAAC,EAAE;iBACV;aACF;SACF;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/swap/general/knownAggregatorRouters.d.ts

@@ -0,0 +1,14 @@
+import { Chain } from '../../Chain.js';
+export type EnforcedRouterProvider = '1inch' | 'kyber';
+/**
+ * Throws if `address` isn't the known router for `provider` on `chain`. Call this at quote
+ * construction, before a GeneralSwapQuote carrying `address` as `tx.evm.to` can exist.
+ */
+export declare function assertKnownAggregatorRouter(provider: EnforcedRouterProvider, address: string, chain: Chain): void;
+/**
+ * Log-only (never throws) — for LiFi/SwapKit, whose legitimate routes span many different
+ * contracts. Structured so the data is queryable (provider + address) and a future allowlist
+ * is easy to build if a stable pattern emerges from real usage.
+ */
+export declare function logUnenforcedAggregatorDestination(provider: 'li.fi' | 'swapkit', address: string): void;
+//# sourceMappingURL=knownAggregatorRouters.d.ts.map

package/dist/swap/general/knownAggregatorRouters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knownAggregatorRouters.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AA8DnC,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,CAAA;AAEtD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAcjH;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKvG"}

package/dist/swap/general/knownAggregatorRouters.js

@@ -0,0 +1,83 @@
+import { Chain } from '../../Chain.js';
+/**
+ * Fund-safety allowlist for the general-purpose EVM swap aggregators (AGG-02, round-2
+ * spec-level fund-safety audit, 2026-07-08).
+ *
+ * Each aggregator's quote-construction function (getOneInchSwapQuote.ts, kyber/api/tx.ts,
+ * getLifiSwapQuote.ts, getSwapKitQuote.ts) is the TRUST BOUNDARY where an untrusted HTTP
+ * response gets parsed into an internal GeneralSwapQuote. That quote's `tx.evm.to` goes on
+ * to become BOTH the ERC-20 approval spender (getSwapDestinationAddress ->
+ * mpc/keysign/swap/build.ts's allowance check) AND, independently, the actual on-chain swap
+ * transaction's destination (build.ts's own txMsg construction -> signingInputs/resolvers/
+ * evm/index.ts's WalletCore SigningInput). Two SEPARATE downstream reads of the same field —
+ * so validating at either downstream site alone would leave the other unguarded. Validating
+ * HERE, at construction, means every consumer (present and future) inherits an
+ * already-verified address by construction, instead of needing its own check.
+ *
+ * 1inch and Kyber can be enforced (fail closed / throw) because their router is a small,
+ * stable, deterministically-deployed constant on almost every chain — verified against each
+ * provider's OWN live quote API (not just docs/explorers), chain by chain, on 2026-07-08.
+ *
+ * CHAIN-SCOPING MATTERS (codex review, PR #1079): 1inch's V6 router is NOT the same address
+ * on zkSync Era — confirmed live (a real 200 response from a real quote request returned a
+ * DIFFERENT contract there). This is exactly the caveat chains/evm/contract/knownContracts.ts
+ * already documents for 1inch V5 ("not zkSync Era — different V5 router"); it turns out to
+ * also hold for V6. A flat, chain-agnostic allowlist would have hard-blocked every legitimate
+ * zkSync 1inch swap. Kyber showed no such variance on every chain that returned a live
+ * response (see the per-chain notes below) — its allowlist stays flat.
+ *
+ * LiFi and SwapKit CANNOT be enforced the same way — they route through many different
+ * bridge/DEX contracts by design (diamond routing, multi-hop, chain-specific deployments),
+ * so a hard allowlist would false-block legitimate routes. Those two are logged (never
+ * thrown) via logUnenforcedAggregatorDestination so an anomaly is queryable, and so a future
+ * allowlist has real usage data to build from if a pattern emerges.
+ */
+// 1inch Aggregation Router V5 (legacy). Same address as
+// chains/evm/contract/knownContracts.ts's display-only registry; kept separate here since
+// THIS one gates signing, not just UI labeling. NOTE: the implementation below only accepts
+// this on non-zkSync chains (same exclusive branch as V6) — getOneInchSwapQuote.ts only
+// calls the v6.0 API today, so a V5 address is never actually seen through this path
+// regardless; harmless defense-in-depth either way.
+const ONE_INCH_V5_ROUTER = '0x1111111254eeb25477b68fb85ed929f73a960582';
+// V6's standard address — live-confirmed 2026-07-08 on Ethereum, Arbitrum, BSC, Base,
+// Optimism, Avalanche, Polygon (7 of 8 oneInchSwapEnabledChains chains).
+const ONE_INCH_V6_STANDARD_ROUTER = '0x111111125421ca6dc452d289314280a0f8842a65';
+// V6 on zkSync Era ONLY — live-confirmed 2026-07-08 via a real api.vultisig.com/1inch
+// v6.0 quote request returning this address (NOT the standard one above).
+const ONE_INCH_V6_ZKSYNC_ROUTER = '0x6fd4383cb451173d5f9304f041c7bcbf27d561ff';
+// KyberSwap MetaAggregationRouterV2 — same address confirmed live 2026-07-08 on every chain
+// that returned a response through aggregator-api.kyberswap.com's /routes (Ethereum, BSC,
+// Arbitrum, Optimism, Avalanche, Base, Polygon — 7 of 9 kyberSwapEnabledChains chains).
+// zkSync/Blast 404'd on this exact API path during verification — that looks like those two
+// chains aren't actually live through this aggregator endpoint today (a pre-existing,
+// separate question from this fix — kyberSwapEnabledChains may be ahead of what the live API
+// serves), not evidence of a differing router address. No chain-scoping needed unless that
+// changes.
+const KYBER_STANDARD_ROUTER = '0x6131b5fae19ea4f9d964eac0408e4408b66337b5';
+/**
+ * Throws if `address` isn't the known router for `provider` on `chain`. Call this at quote
+ * construction, before a GeneralSwapQuote carrying `address` as `tx.evm.to` can exist.
+ */
+export function assertKnownAggregatorRouter(provider, address, chain) {
+    const normalized = address.toLowerCase();
+    const isKnown = provider === 'kyber'
+        ? normalized === KYBER_STANDARD_ROUTER
+        : chain === Chain.Zksync
+            ? normalized === ONE_INCH_V6_ZKSYNC_ROUTER
+            : normalized === ONE_INCH_V5_ROUTER || normalized === ONE_INCH_V6_STANDARD_ROUTER;
+    if (!isKnown) {
+        throw new Error(`${provider} swap quote returned an unrecognized router address (${address}) on ${chain} — refusing to build a signable transaction against it.`);
+    }
+}
+/**
+ * Log-only (never throws) — for LiFi/SwapKit, whose legitimate routes span many different
+ * contracts. Structured so the data is queryable (provider + address) and a future allowlist
+ * is easy to build if a stable pattern emerges from real usage.
+ */
+export function logUnenforcedAggregatorDestination(provider, address) {
+    console.info('[swap-router-telemetry] general-swap destination (not enforced, logged for future analysis):', {
+        provider,
+        address,
+    });
+}
+//# sourceMappingURL=knownAggregatorRouters.js.map

package/dist/swap/general/knownAggregatorRouters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knownAggregatorRouters.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,wDAAwD;AACxD,0FAA0F;AAC1F,4FAA4F;AAC5F,wFAAwF;AACxF,qFAAqF;AACrF,oDAAoD;AACpD,MAAM,kBAAkB,GAAG,4CAA4C,CAAA;AAEvE,sFAAsF;AACtF,yEAAyE;AACzE,MAAM,2BAA2B,GAAG,4CAA4C,CAAA;AAEhF,sFAAsF;AACtF,0EAA0E;AAC1E,MAAM,yBAAyB,GAAG,4CAA4C,CAAA;AAE9E,4FAA4F;AAC5F,0FAA0F;AAC1F,wFAAwF;AACxF,4FAA4F;AAC5F,sFAAsF;AACtF,6FAA6F;AAC7F,2FAA2F;AAC3F,WAAW;AACX,MAAM,qBAAqB,GAAG,4CAA4C,CAAA;AAI1E;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC,EAAE,OAAe,EAAE,KAAY;IACzG,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACxC,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;QAClB,CAAC,CAAC,UAAU,KAAK,qBAAqB;QACtC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM;YACtB,CAAC,CAAC,UAAU,KAAK,yBAAyB;YAC1C,CAAC,CAAC,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,2BAA2B,CAAA;IAEvF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,wDAAwD,OAAO,QAAQ,KAAK,yDAAyD,CACjJ,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAA6B,EAAE,OAAe;IAC/F,OAAO,CAAC,IAAI,CAAC,8FAA8F,EAAE;QAC3G,QAAQ;QACR,OAAO;KACR,CAAC,CAAA;AACJ,CAAC"}

package/dist/swap/general/kyber/api/tx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/kyber/api/tx.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAG1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAIL,4BAA4B,EAG7B,MAAM,WAAW,CAAA;AAGlB,KAAK,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAC,GAAG;IACzF,YAAY,EAAE,GAAG,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB,EAAE,OAAO,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,4BAA4B,CAAA;IAC1C,oGAAoG;IACpG,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAsCD,eAAO,MAAM,cAAc,GAAU,uHAUlC,mBAAmB,KAAG,OAAO,CAAC,gBAAgB,CA4DhD,CAAA"}
+{"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/kyber/api/tx.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAG1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAIL,4BAA4B,EAG7B,MAAM,WAAW,CAAA;AAGlB,KAAK,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAC,GAAG;IACzF,YAAY,EAAE,GAAG,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB,EAAE,OAAO,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,4BAA4B,CAAA;IAC1C,oGAAoG;IACpG,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAsCD,eAAO,MAAM,cAAc,GAAU,uHAUlC,mBAAmB,KAAG,OAAO,CAAC,gBAAgB,CAgFhD,CAAA"}

package/dist/swap/general/kyber/api/tx.js

@@ -3,6 +3,7 @@ import { isInError } from '@vultisig/lib-utils/error/isInError';
 import { queryUrl } from '@vultisig/lib-utils/query/queryUrl';
 import { convertDuration } from '@vultisig/lib-utils/time/convertDuration';
 import { isFeeCoin } from '../../../../coin/utils/isFeeCoin.js';
+import { assertKnownAggregatorRouter } from '../../knownAggregatorRouters.js';
 import { getKyberSwapAffiliateParams, hasAffiliateBps, kyberSwapAffiliateConfig, kyberSwapSlippageTolerance, kyberSwapTxLifespan, } from '../config.js';
 import { getKyberSwapBaseUrl } from './baseUrl.js';
 const getKyberSwapAffiliateFee = ({ amountOut, to, affiliateBps, }) => {
@@ -52,14 +53,30 @@ export const getKyberSwapTx = async ({ from, to, routeSummary, routerAddress, am
         }
         throw new Error('Failed to build transaction');
     }
-    const { amountOut, data, gas } = buildResponse.data;
+    const { amountOut, data, gas, routerAddress: buildRouterAddress } = buildResponse.data;
+    // AGG-02 fund-safety fix: verify BOTH the /routes response's routerAddress (route.ts,
+    // threaded in as the `routerAddress` param) AND /route/build's OWN routerAddress field
+    // are Kyber's actual router before this untrusted data can become a signable
+    // GeneralSwapQuote. The two calls are separate HTTP round-trips; if they ever disagree
+    // (API drift/version mismatch), `data` (the calldata /route/build just generated) may
+    // have been built against a DIFFERENT router than the one this quote's tx.to claims —
+    // codex review finding, PR #1079. See knownAggregatorRouters.ts.
+    assertKnownAggregatorRouter('kyber', routerAddress, from.chain);
+    assertKnownAggregatorRouter('kyber', buildRouterAddress, from.chain);
+    if (buildRouterAddress.toLowerCase() !== routerAddress.toLowerCase()) {
+        throw new Error(`Kyber /route and /route/build disagree on the router address (${routerAddress} vs ${buildRouterAddress}) — refusing to build a signable transaction against mismatched calldata.`);
+    }
     return {
         dstAmount: amountOut,
         provider: 'kyber',
         tx: {
             evm: {
                 from: from.address,
-                to: routerAddress,
+                // AGG-04: bind tx.to to /route/build's OWN routerAddress — the router paired with
+                // `data` (the calldata this call just generated) — not the stale /routes param.
+                // The equality guard above already proves they match today (AGG-02 / #1079); this
+                // keeps tx.to authoritative-by-construction as defense-in-depth if that guard ever moves.
+                to: buildRouterAddress,
                 data,
                 value: isFeeCoin(from) ? amount.toString() : '0',
                 gasLimit: gas ? BigInt(gas) : undefined,

package/dist/swap/general/kyber/api/tx.js.map

@@ -1 +1 @@
-{"version":3,"file":"tx.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/kyber/api/tx.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAA;AAI1E,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;AAI5D,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EAExB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAwB/C,MAAM,wBAAwB,GAAG,CAAC,EAChC,SAAS,EACT,EAAE,EACF,YAAY,GAKb,EAAuB,EAAE;IACxB,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;IAEnE,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,MAAM,EAAE,cAAc,GAAG,YAAY;KACtC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,EACnC,IAAI,EACJ,EAAE,EACF,YAAY,EACZ,aAAa,EACb,MAAM,EACN,mBAAmB,EACnB,YAAY,EACZ,WAAW,GAAG,wBAAwB,EACtC,iBAAiB,GAAG,0BAA0B,GAC1B,EAA6B,EAAE;IACnD,MAAM,YAAY,GAAG;QACnB,YAAY;QACZ,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,iBAAiB;QACjB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChH,mBAAmB;QACnB,GAAG,2BAA2B,CAAC,YAAY,EAAE,WAAW,CAAC;QACzD,oBAAoB,EAAE,KAAK;KAC5B,CAAA;IAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAyB,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QAC7G,OAAO,EAAE;YACP,aAAa,EAAE,WAAW,CAAC,MAAM;SAClC;QACD,IAAI,EAAE,YAAY;KACnB,CAAC,CAAA;IAEF,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;YAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAA;YAEjC,IAAI,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAA;YACvD,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAA;YACnD,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,CAAA;IACnD,OAAO;QACL,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE;YACF,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI,CAAC,OAAO;gBAClB,EAAE,EAAE,aAAa;gBACjB,IAAI;gBACJ,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG;gBAChD,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvC,YAAY,EAAE,wBAAwB,CAAC;oBACrC,SAAS;oBACT,EAAE;oBACF,YAAY;iBACb,CAAC;aACH;SACF;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"tx.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/kyber/api/tx.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAA;AAI1E,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;AAG5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAE1E,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EAExB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAwB/C,MAAM,wBAAwB,GAAG,CAAC,EAChC,SAAS,EACT,EAAE,EACF,YAAY,GAKb,EAAuB,EAAE;IACxB,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;IAEnE,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,MAAM,EAAE,cAAc,GAAG,YAAY;KACtC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,EACnC,IAAI,EACJ,EAAE,EACF,YAAY,EACZ,aAAa,EACb,MAAM,EACN,mBAAmB,EACnB,YAAY,EACZ,WAAW,GAAG,wBAAwB,EACtC,iBAAiB,GAAG,0BAA0B,GAC1B,EAA6B,EAAE;IACnD,MAAM,YAAY,GAAG;QACnB,YAAY;QACZ,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,iBAAiB;QACjB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChH,mBAAmB;QACnB,GAAG,2BAA2B,CAAC,YAAY,EAAE,WAAW,CAAC;QACzD,oBAAoB,EAAE,KAAK;KAC5B,CAAA;IAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAyB,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QAC7G,OAAO,EAAE;YACP,aAAa,EAAE,WAAW,CAAC,MAAM;SAClC;QACD,IAAI,EAAE,YAAY;KACnB,CAAC,CAAA;IAEF,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;YAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAA;YAEjC,IAAI,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAA;YACvD,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAA;YACnD,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,aAAa,CAAC,IAAI,CAAA;IAEtF,sFAAsF;IACtF,uFAAuF;IACvF,6EAA6E;IAC7E,uFAAuF;IACvF,sFAAsF;IACtF,sFAAsF;IACtF,iEAAiE;IACjE,2BAA2B,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,2BAA2B,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACpE,IAAI,kBAAkB,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,iEAAiE,aAAa,OAAO,kBAAkB,2EAA2E,CACnL,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE;YACF,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI,CAAC,OAAO;gBAClB,kFAAkF;gBAClF,gFAAgF;gBAChF,kFAAkF;gBAClF,0FAA0F;gBAC1F,EAAE,EAAE,kBAAkB;gBACtB,IAAI;gBACJ,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG;gBAChD,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvC,YAAY,EAAE,wBAAwB,CAAC;oBACrC,SAAS;oBACT,EAAE;oBACF,YAAY;iBACb,CAAC;aACH;SACF;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/swap/general/lifi/api/getLifiSwapQuote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getLifiSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/lifi/api/getLifiSwapQuote.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,mBAAmB,EAGpB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAmB,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAKpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAGzD,KAAK,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,oBAAoB,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IACnG,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;4EACwE;IACxE,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;qDACiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAKD,6CAA6C;AAC7C,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAa7C,CAAA;AAKF,6CAA6C;AAC7C,eAAO,MAAM,YAAY,GAAI,MAAM;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,OACxB,CAAA;AAkG1D,eAAO,MAAM,gBAAgB,GAAU,wFAMpC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAiLlC,CAAA"}
+{"version":3,"file":"getLifiSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/lifi/api/getLifiSwapQuote.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,mBAAmB,EAGpB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAmB,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAKpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAIzD,KAAK,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,oBAAoB,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IACnG,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;4EACwE;IACxE,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;qDACiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAKD,6CAA6C;AAC7C,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAa7C,CAAA;AAKF,6CAA6C;AAC7C,eAAO,MAAM,YAAY,GAAI,MAAM;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,OACxB,CAAA;AAkG1D,eAAO,MAAM,gBAAgB,GAAU,wFAMpC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAuLlC,CAAA"}

package/dist/swap/general/lifi/api/getLifiSwapQuote.js

@@ -8,6 +8,7 @@ import { shouldBePresent } from '@vultisig/lib-utils/assert/shouldBePresent';
 import { match } from '@vultisig/lib-utils/match';
 import { memoize } from '@vultisig/lib-utils/memoize';
 import { mirrorRecord } from '@vultisig/lib-utils/record/mirrorRecord';
+import { logUnenforcedAggregatorDestination } from '../../knownAggregatorRouters.js';
 import { injectSolanaAtaIfMissing } from './injectSolanaAtaIfMissing.js';
 // Stable-pair detection: tickers that commonly trade within a tight peg.
 // DAI is included because on most DEXs DAI/USDC depth is comparable to
@@ -253,10 +254,16 @@ export const getLifiSwapQuote = async ({ amount, affiliateBps, lifiAffiliateConf
                 const swapFeeAssetId = swapFee &&
                     ([fromToken, toToken].find(token => token.toLowerCase() === swapFeeAddress) ||
                         chainFeeCoin[transfer.from.chain].id);
+                const evmTo = shouldBePresent(to);
+                // AGG-02: LiFi routes through many different bridge/DEX contracts by design
+                // (diamond routing, multi-hop, chain-specific deployments) — a hard allowlist
+                // would false-block legitimate routes, so log (never throw). See
+                // knownAggregatorRouters.ts.
+                logUnenforcedAggregatorDestination('li.fi', evmTo);
                 return {
                     evm: {
                         from: shouldBePresent(from),
-                        to: shouldBePresent(to),
+                        to: evmTo,
                         data: shouldBePresent(data),
                         value: BigInt(shouldBePresent(value)).toString(),
                         gasLimit: gasLimit ? BigInt(gasLimit) : undefined,

package/dist/swap/general/lifi/api/getLifiSwapQuote.js.map

@@ -1 +1 @@
-{"version":3,"file":"getLifiSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/lifi/api/getLifiSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAmB,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EACL,aAAa,EAEb,UAAU,EACV,SAAS,GACV,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,eAAe,EAAwB,MAAM,8DAA8D,CAAA;AACpH,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAA;AAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAA;AAKtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AAarE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAW,EAAE,CAC7D,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AAElE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAyB,EAAE,EAAuB,EAAW,EAAE,CAC1F,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;AAE1D;;;;oDAIoD;AACpD,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,EAAE;IACxC,SAAS,EAAE,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,+DAA+D;AAC/D,oEAAoE;AACpE,gEAAgE;AAChE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,6DAA6D;AAC7D,kEAAkE;AAClE,8DAA8D;AAC9D,yDAAyD;AACzD,iEAAiE;AACjE,gEAAgE;AAChE,kEAAkE;AAClE,8DAA8D;AAC9D,+DAA+D;AAC/D,oDAAoD;AACpD,EAAE;AACF,iEAAiE;AACjE,iEAAiE;AACjE,kEAAkE;AAClE,oEAAoE;AACpE,sEAAsE;AACtE,mEAAmE;AACnE,8DAA8D;AAC9D,oDAAoD;AACpD,EAAE;AACF,2DAA2D;AAC3D,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,gEAAgE;AAChE,mEAAmE;AACnE,gEAAgE;AAChE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,iEAAiE;AACjE,oEAAoE;AACpE,iEAAiE;AACjE,8DAA8D;AAC9D,EAAE;AACF,gCAAgC;AAChC,gEAAgE;AAChE,iEAAiE;AACjE,yCAAyC;AACzC,oEAAoE;AACpE,kEAAkE;AAClE,MAAM,+BAA+B,GAAG,IAAI,CAAA;AAC5C,MAAM,mCAAmC,GAAG,KAAK,CAAA;AAEjD,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,0BAA0B;AAC1B,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAEjC,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,8DAA8D;AAC9D,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAE,QAA8B,EAAwB,EAAE;IACrG,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,wCAAwC,OAAO,4CAA4C,QAAQ,EAAE,CAAC,CAAA;QACnH,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,EACrC,MAAM,EACN,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,QAAQ,EACL,EAA6B,EAAE;IACrC,oBAAoB,EAAE,CAAA;IAEtB,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAEpG,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IAClH,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE3F,MAAM,QAAQ,GACZ,gBAAgB;QAChB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAA;IAEpH,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAA;IAC9D,IAAI,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,iEAAiE,qBAAqB,QAAQ,eAAe,KAAK,CACnH,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,wEAAwE;IACxE,MAAM,UAAU,GAAG,mBAAmB,EAAE,cAAc,IAAI,UAAU,CAAC,cAAc,CAAA;IAEnF,yEAAyE;IACzE,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE;QAC5C,SAAS;QACT,OAAO;QACP,SAAS;QACT,OAAO;QACP,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC7B,WAAW;QACX,SAAS;QACT,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,gDAAgD;QAChD,GAAG,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;QAClE,QAAQ;QACR,UAAU;KACX,CAAC,CAAA;IAEF,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAE9C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEnD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAA;IAE/E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;QACvC,MAAM,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3F,MAAM,cAAc,GAClB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;QAE7G,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACnH,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,8EAA8E;QAC9E,gFAAgF;QAEhF,wFAAwF;QACxF,kFAAkF;QAClF,iFAAiF;QACjF,gHAAgH;QAChH,mFAAmF;QACnF,kFAAkF;QAClF,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAE7E,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;YAC5B,QAAQ,EAAE,OAAO;YACjB,EAAE,EAAE;gBACF,MAAM,EAAE;oBACN,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,aAAa;oBACrD,OAAO,EAAE;wBACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;wBAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;wBAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;wBACtE,EAAE,EAAE,cAAc;qBACnB;iBACF;aACF;SACF,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE,KAAK,CAAgE,SAAS,EAAE;YAClF,MAAM,EAAE,GAAG,EAAE;gBACX,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;gBACvC,MAAM,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAE9C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAEtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAE3F,MAAM,cAAc,GAClB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;gBAE7G,OAAO;oBACL,MAAM,EAAE;wBACN,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;wBACrC,OAAO,EAAE;4BACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;4BAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;4BAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtE,EAAE,EAAE,cAAc;yBACnB;qBACF;iBACF,CAAA;YACH,CAAC;YACD,GAAG,EAAE,GAAG,EAAE;gBACR,0DAA0D;gBAC1D,mEAAmE;gBACnE,kEAAkE;gBAClE,mEAAmE;gBACnE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,yDAAyD;gBACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAA;gBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC1E,+DAA+D;gBAC/D,+DAA+D;gBAC/D,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,cAAc,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;gBAC3D,MAAM,cAAc,GAClB,OAAO;oBACP,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC;wBACzE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;gBACzC,OAAO;oBACL,GAAG,EAAE;wBACH,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC;wBACvB,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;wBAChD,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;wBACjD,GAAG,CAAC,OAAO;4BACT,CAAC,CAAC;gCACE,YAAY,EAAE;oCACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oCAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;oCAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;oCACtE,EAAE,EAAE,cAAc;iCACnB;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF,CAAA;YACH,CAAC;SACF,CAAC;KACH,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"getLifiSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/lifi/api/getLifiSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAmB,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EACL,aAAa,EAEb,UAAU,EACV,SAAS,GACV,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,eAAe,EAAwB,MAAM,8DAA8D,CAAA;AACpH,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAA;AAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAA;AAKtE,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAA;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AAarE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAW,EAAE,CAC7D,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AAElE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAyB,EAAE,EAAuB,EAAW,EAAE,CAC1F,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;AAE1D;;;;oDAIoD;AACpD,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,EAAE;IACxC,SAAS,EAAE,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,+DAA+D;AAC/D,oEAAoE;AACpE,gEAAgE;AAChE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,6DAA6D;AAC7D,kEAAkE;AAClE,8DAA8D;AAC9D,yDAAyD;AACzD,iEAAiE;AACjE,gEAAgE;AAChE,kEAAkE;AAClE,8DAA8D;AAC9D,+DAA+D;AAC/D,oDAAoD;AACpD,EAAE;AACF,iEAAiE;AACjE,iEAAiE;AACjE,kEAAkE;AAClE,oEAAoE;AACpE,sEAAsE;AACtE,mEAAmE;AACnE,8DAA8D;AAC9D,oDAAoD;AACpD,EAAE;AACF,2DAA2D;AAC3D,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,gEAAgE;AAChE,mEAAmE;AACnE,gEAAgE;AAChE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,iEAAiE;AACjE,oEAAoE;AACpE,iEAAiE;AACjE,8DAA8D;AAC9D,EAAE;AACF,gCAAgC;AAChC,gEAAgE;AAChE,iEAAiE;AACjE,yCAAyC;AACzC,oEAAoE;AACpE,kEAAkE;AAClE,MAAM,+BAA+B,GAAG,IAAI,CAAA;AAC5C,MAAM,mCAAmC,GAAG,KAAK,CAAA;AAEjD,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,0BAA0B;AAC1B,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAEjC,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,8DAA8D;AAC9D,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAE,QAA8B,EAAwB,EAAE;IACrG,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,wCAAwC,OAAO,4CAA4C,QAAQ,EAAE,CAAC,CAAA;QACnH,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,EACrC,MAAM,EACN,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,QAAQ,EACL,EAA6B,EAAE;IACrC,oBAAoB,EAAE,CAAA;IAEtB,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAEpG,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IAClH,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE3F,MAAM,QAAQ,GACZ,gBAAgB;QAChB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAA;IAEpH,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAA;IAC9D,IAAI,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,iEAAiE,qBAAqB,QAAQ,eAAe,KAAK,CACnH,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,wEAAwE;IACxE,MAAM,UAAU,GAAG,mBAAmB,EAAE,cAAc,IAAI,UAAU,CAAC,cAAc,CAAA;IAEnF,yEAAyE;IACzE,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE;QAC5C,SAAS;QACT,OAAO;QACP,SAAS;QACT,OAAO;QACP,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC7B,WAAW;QACX,SAAS;QACT,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,gDAAgD;QAChD,GAAG,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;QAClE,QAAQ;QACR,UAAU;KACX,CAAC,CAAA;IAEF,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAE9C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEnD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAA;IAE/E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;QACvC,MAAM,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3F,MAAM,cAAc,GAClB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;QAE7G,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACnH,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,8EAA8E;QAC9E,gFAAgF;QAEhF,wFAAwF;QACxF,kFAAkF;QAClF,iFAAiF;QACjF,gHAAgH;QAChH,mFAAmF;QACnF,kFAAkF;QAClF,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAE7E,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;YAC5B,QAAQ,EAAE,OAAO;YACjB,EAAE,EAAE;gBACF,MAAM,EAAE;oBACN,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,aAAa;oBACrD,OAAO,EAAE;wBACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;wBAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;wBAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;wBACtE,EAAE,EAAE,cAAc;qBACnB;iBACF;aACF;SACF,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE,KAAK,CAAgE,SAAS,EAAE;YAClF,MAAM,EAAE,GAAG,EAAE;gBACX,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;gBACvC,MAAM,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAE9C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAEtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAE3F,MAAM,cAAc,GAClB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;gBAE7G,OAAO;oBACL,MAAM,EAAE;wBACN,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;wBACrC,OAAO,EAAE;4BACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;4BAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;4BAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtE,EAAE,EAAE,cAAc;yBACnB;qBACF;iBACF,CAAA;YACH,CAAC;YACD,GAAG,EAAE,GAAG,EAAE;gBACR,0DAA0D;gBAC1D,mEAAmE;gBACnE,kEAAkE;gBAClE,mEAAmE;gBACnE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,yDAAyD;gBACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAA;gBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC1E,+DAA+D;gBAC/D,+DAA+D;gBAC/D,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,cAAc,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;gBAC3D,MAAM,cAAc,GAClB,OAAO;oBACP,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC;wBACzE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;gBACzC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAA;gBACjC,4EAA4E;gBAC5E,8EAA8E;gBAC9E,iEAAiE;gBACjE,6BAA6B;gBAC7B,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAClD,OAAO;oBACL,GAAG,EAAE;wBACH,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,EAAE,EAAE,KAAK;wBACT,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;wBAChD,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;wBACjD,GAAG,CAAC,OAAO;4BACT,CAAC,CAAC;gCACE,YAAY,EAAE;oCACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oCAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;oCAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;oCACtE,EAAE,EAAE,cAAc;iCACnB;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF,CAAA;YACH,CAAC;SACF,CAAC;KACH,CAAA;AACH,CAAC,CAAA"}

package/dist/swap/general/oneInch/api/getOneInchSwapQuote.d.ts

@@ -1,4 +1,6 @@
+import { EvmChain } from '@vultisig/core-chain/Chain';
 import { ChainAccount } from '@vultisig/core-chain/ChainAccount';
+import { AccountCoin } from '@vultisig/core-chain/coin/AccountCoin';
 import { GeneralSwapQuote } from '@vultisig/core-chain/swap/general/GeneralSwapQuote';
 import { oneInchAffiliateConfig } from '@vultisig/core-chain/swap/general/oneInch/oneInchAffiliateConfig';
 export type OneInchAffiliateConfig = typeof oneInchAffiliateConfig;
@@ -6,12 +8,15 @@ type Input = {
     account: ChainAccount;
     fromCoinId: string;
     toCoinId: string;
+    /** Destination coin metadata. When set alongside affiliateBps, populates a display-only
+     * affiliateFee (AGG-05) matching the Kyber/LiFi convention. */
+    to?: AccountCoin<EvmChain>;
     amount: bigint;
     affiliateBps?: number;
     oneInchConfig?: OneInchAffiliateConfig;
     /** Slippage tolerance in percent (e.g. 0.5 = 0.5%). Defaults to 0.5. */
     slippage?: number;
 };
-export declare const getOneInchSwapQuote: ({ account, fromCoinId, toCoinId, amount, affiliateBps, oneInchConfig, slippage, }: Input) => Promise<GeneralSwapQuote>;
+export declare const getOneInchSwapQuote: ({ account, fromCoinId, toCoinId, to, amount, affiliateBps, oneInchConfig, slippage, }: Input) => Promise<GeneralSwapQuote>;
 export {};
 //# sourceMappingURL=getOneInchSwapQuote.d.ts.map

package/dist/swap/general/oneInch/api/getOneInchSwapQuote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getOneInchSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/oneInch/api/getOneInchSwapQuote.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAA;AAErF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAA;AAQzG,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAA;AAElE,KAAK,KAAK,GAAG;IACX,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,sBAAsB,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAID,eAAO,MAAM,mBAAmB,GAAU,mFAQvC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAkClC,CAAA"}
+{"version":3,"file":"getOneInchSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/oneInch/api/getOneInchSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAEhE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAA;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAA;AAGrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAA;AASzG,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAA;AAElE,KAAK,KAAK,GAAG;IACX,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB;mEAC+D;IAC/D,EAAE,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,sBAAsB,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAgCD,eAAO,MAAM,mBAAmB,GAAU,uFASvC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAwClC,CAAA"}

package/dist/swap/general/oneInch/api/getOneInchSwapQuote.js

@@ -1,5 +1,6 @@
 import { getEvmChainId } from '@vultisig/core-chain/chains/evm/chainInfo';
 import { isFeeCoin } from '@vultisig/core-chain/coin/utils/isFeeCoin';
+import { assertKnownAggregatorRouter } from '@vultisig/core-chain/swap/general/knownAggregatorRouters';
 import { oneInchAffiliateConfig } from '@vultisig/core-chain/swap/general/oneInch/oneInchAffiliateConfig';
 import { rootApiUrl } from '@vultisig/core-config';
 import { hexToNumber } from '@vultisig/lib-utils/hex/hexToNumber';
@@ -7,7 +8,24 @@ import { addQueryParams } from '@vultisig/lib-utils/query/addQueryParams';
 import { queryUrl } from '@vultisig/lib-utils/query/queryUrl';
 import { evmNativeCoinAddress } from '../../../../chains/evm/config.js';
 const getBaseUrl = (chainId) => `${rootApiUrl}/1inch/swap/v6.0/${chainId}/swap`;
-export const getOneInchSwapQuote = async ({ account, fromCoinId, toCoinId, amount, affiliateBps, oneInchConfig = oneInchAffiliateConfig, slippage = 0.5, }) => {
+// 1inch's `fee` param deducts the affiliate cut from dstAmount before returning it — same
+// convention as Kyber's /route/build. Gross the net amount back up to derive the fee for
+// display, mirroring getKyberSwapAffiliateFee (kyber/api/tx.ts).
+const getOneInchAffiliateFee = ({ dstAmount, to, affiliateBps, }) => {
+    if (!affiliateBps || !to) {
+        return undefined;
+    }
+    const netAmountOut = BigInt(dstAmount);
+    const feeRate = BigInt(affiliateBps);
+    const grossAmountOut = (netAmountOut * 10000n) / (10000n - feeRate);
+    return {
+        chain: to.chain,
+        id: to.id,
+        decimals: to.decimals,
+        amount: grossAmountOut - netAmountOut,
+    };
+};
+export const getOneInchSwapQuote = async ({ account, fromCoinId, toCoinId, to, amount, affiliateBps, oneInchConfig = oneInchAffiliateConfig, slippage = 0.5, }) => {
     const chain = account.chain;
     const chainId = hexToNumber(getEvmChainId(chain));
     const params = {
@@ -27,6 +45,10 @@ export const getOneInchSwapQuote = async ({ account, fromCoinId, toCoinId, amoun
     };
     const url = addQueryParams(getBaseUrl(chainId), params);
     const { dstAmount, tx } = await queryUrl(url);
+    // AGG-02 fund-safety fix: verify tx.to is 1inch's actual router before this untrusted
+    // response can become a signable GeneralSwapQuote. Chain-scoped: 1inch's router differs
+    // on zkSync Era. See knownAggregatorRouters.ts.
+    assertKnownAggregatorRouter('1inch', tx.to, chain);
     return {
         dstAmount,
         provider: '1inch',
@@ -34,6 +56,7 @@ export const getOneInchSwapQuote = async ({ account, fromCoinId, toCoinId, amoun
             evm: {
                 ...tx,
                 gasLimit: tx.gas ? BigInt(tx.gas) : undefined,
+                affiliateFee: getOneInchAffiliateFee({ dstAmount, to, affiliateBps }),
             },
         },
     };

package/dist/swap/general/oneInch/api/getOneInchSwapQuote.js.map

@@ -1 +1 @@
-{"version":3,"file":"getOneInchSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/oneInch/api/getOneInchSwapQuote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AAGrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAA;AACzG,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAepE,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,UAAU,oBAAoB,OAAO,OAAO,CAAA;AAEvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,MAAM,EACN,YAAY,EACZ,aAAa,GAAG,sBAAsB,EACtC,QAAQ,GAAG,GAAG,GACR,EAA6B,EAAE;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAiB,CAAA;IACvC,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;IAEjD,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU;QAC5F,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ;QACxF,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,QAAQ;QACR,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,GAAG,EAAE,YAAY,GAAG,GAAG;aACxB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IAEvD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAA6B,MAAM,QAAQ,CAA2B,GAAG,CAAC,CAAA;IAEjG,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE;YACF,GAAG,EAAE;gBACH,GAAG,EAAE;gBACL,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAC9C;SACF;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"getOneInchSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/oneInch/api/getOneInchSwapQuote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAA;AAEzE,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AAErE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAA;AAEtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAA;AAEzG,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAkBpE,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,UAAU,oBAAoB,OAAO,OAAO,CAAA;AAEvF,0FAA0F;AAC1F,yFAAyF;AACzF,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,CAAC,EAC9B,SAAS,EACT,EAAE,EACF,YAAY,GAKb,EAAuB,EAAE;IACxB,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;IAEnE,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,MAAM,EAAE,cAAc,GAAG,YAAY;KACtC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,EAAE,EACF,MAAM,EACN,YAAY,EACZ,aAAa,GAAG,sBAAsB,EACtC,QAAQ,GAAG,GAAG,GACR,EAA6B,EAAE;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAiB,CAAA;IACvC,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;IAEjD,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU;QAC5F,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ;QACxF,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,QAAQ;QACR,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,GAAG,EAAE,YAAY,GAAG,GAAG;aACxB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IAEvD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAA6B,MAAM,QAAQ,CAA2B,GAAG,CAAC,CAAA;IAEjG,sFAAsF;IACtF,wFAAwF;IACxF,gDAAgD;IAChD,2BAA2B,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAElD,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE;YACF,GAAG,EAAE;gBACH,GAAG,EAAE;gBACL,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7C,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;aACtE;SACF;KACF,CAAA;AACH,CAAC,CAAA"}