npm - @vultisig/core-chain - Versions diffs - 2.24.0 → 2.24.1 - Mend

@vultisig/core-chain 2.24.0 → 2.24.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (74) hide show

package/dist/swap/general/jupiter/api/getJupiterSwapQuote.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { Chain } from '@vultisig/core-chain/Chain';
 import { solanaConfig } from '@vultisig/core-chain/chains/solana/solanaConfig';
 import { getJupiterConfig, jupiterFeeOwnerAddress, normalizeJupiterBaseUrl, } from '@vultisig/core-chain/swap/general/jupiter/config';
+import { assertJupiterPriceImpactWithinCeiling } from '@vultisig/core-chain/swap/general/priceImpactGuard';
 import { deriveJupiterFeeAccount, prependJupiterFeeAta } from './jupiterFeeAta.js';
 /** Canonical wrapped-SOL mint, used as the mint address for native SOL legs. */
 const solanaNativeMint = 'So11111111111111111111111111111111111111112';
@@ -53,6 +54,12 @@ export const getJupiterSwapQuote = async ({ from, to, amount, affiliateBps = 0,
     const quoteResponse = await requestJson(`${baseUrl}/swap/v1/quote?${quoteParams.toString()}`, {
         headers: { Accept: 'application/json' },
     });
+    // Price-impact ceiling (fund-safety, audit finding SOL-02). Jupiter's
+    // priceImpactPct is a FRACTION ("0.05" = 5%); refuse to build a signable
+    // swap transaction above the ceiling — a thin-pool / sandwich-bait quote
+    // that would lose most of the user's funds. Fail-safe: a missing /
+    // unparsable impact passes (see evaluatePriceImpactPercent).
+    assertJupiterPriceImpactWithinCeiling(quoteResponse.priceImpactPct);
     // Gate the fee-account flow on the actually quoted fee, not just the requested
     // bps: Jupiter can floor `platformFee.amount` to 0 (tiny amounts, route with no
     // fee-eligible mint) even when we asked for a fee. Deriving a fee account and

package/dist/swap/general/jupiter/api/getJupiterSwapQuote.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getJupiterSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/jupiter/api/getJupiterSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AAG9E,OAAO,EACL,gBAAgB,EAEhB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kDAAkD,CAAA;~~AAIzD~~,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE/E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,6CAA6C,CAAA;AAEtE,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,EAAE,CAAA;AAkCvC,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,EAAe,EAAU,EAAE,CAAC,EAAE,IAAI,gBAAgB,CAAA;AAEvE,MAAM,WAAW,GAAG,KAAK,EAAK,GAAW,EAAE,IAAkB,EAAc,EAAE;IAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,IAAI,EACJ,EAAE,EACF,MAAM,EACN,YAAY,GAAG,CAAC,EAChB,aAAa,EACb,WAAW,GAAG,4BAA4B,GACpC,EAA6B,EAAE;IACrC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,iBAAiB,CAAA;IACpF,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAA;IAE1E,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAA;IAE9B,MAAM,mBAAmB,GAAG,YAAY,GAAG,CAAC,CAAA;IAE5C,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC;QACtC,QAAQ,EAAE,SAAS;QACnB,SAAS;QACT,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IACF,IAAI,mBAAmB,EAAE,CAAC;QACxB,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAuB,GAAG,OAAO,kBAAkB,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE;QAClH,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,0CAA0C;IAC1C,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,GAAG,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,mBAAmB,IAAI,aAAa,GAAG,EAAE,CAAA;IAE5D,4EAA4E;IAC5E,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvG,MAAM,YAAY,GAAG,MAAM,WAAW,CAAsB,GAAG,OAAO,eAAe,EAAE;QACrF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa;YACb,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,gBAAgB,EAAE,IAAI;YACtB,uBAAuB,EAAE,IAAI;YAC7B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,cAAc;QACzB,CAAC,CAAC,MAAM,oBAAoB,CAAC;YACzB,MAAM,EAAE,YAAY,CAAC,eAAe;YACpC,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,cAAc,EAAE,cAAc,CAAC,cAAc;SAC9C,CAAC;QACJ,CAAC,CAAC,YAAY,CAAC,eAAe,CAAA;IAEhC,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAE1G,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE;YACF,MAAM,EAAE;gBACN,IAAI;gBACJ,UAAU;gBACV,OAAO,EAAE;oBACP,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,KAAK,EAAE,KAAK,CAAC,MAAM;oBACnB,EAAE,EAAE,EAAE,CAAC,EAAE;iBACV;aACF;SACF;KACF,CAAA;AACH,CAAC,CAAA"}
1	+ {"version":3,"file":"getJupiterSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/jupiter/api/getJupiterSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AAG9E,OAAO,EACL,gBAAgB,EAEhB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kDAAkD,CAAA;AAEzD,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAA;AAG1G,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE/E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,6CAA6C,CAAA;AAEtE,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,EAAE,CAAA;AAkCvC,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,EAAe,EAAU,EAAE,CAAC,EAAE,IAAI,gBAAgB,CAAA;AAEvE,MAAM,WAAW,GAAG,KAAK,EAAK,GAAW,EAAE,IAAkB,EAAc,EAAE;IAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,IAAI,EACJ,EAAE,EACF,MAAM,EACN,YAAY,GAAG,CAAC,EAChB,aAAa,EACb,WAAW,GAAG,4BAA4B,GACpC,EAA6B,EAAE;IACrC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,iBAAiB,CAAA;IACpF,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAA;IAE1E,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAA;IAE9B,MAAM,mBAAmB,GAAG,YAAY,GAAG,CAAC,CAAA;IAE5C,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC;QACtC,QAAQ,EAAE,SAAS;QACnB,SAAS;QACT,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IACF,IAAI,mBAAmB,EAAE,CAAC;QACxB,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAuB,GAAG,OAAO,kBAAkB,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE;QAClH,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAA;IAEF,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,6DAA6D;IAC7D,qCAAqC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAA;IAEnE,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,0CAA0C;IAC1C,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,GAAG,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,mBAAmB,IAAI,aAAa,GAAG,EAAE,CAAA;IAE5D,4EAA4E;IAC5E,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvG,MAAM,YAAY,GAAG,MAAM,WAAW,CAAsB,GAAG,OAAO,eAAe,EAAE;QACrF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa;YACb,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,gBAAgB,EAAE,IAAI;YACtB,uBAAuB,EAAE,IAAI;YAC7B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,cAAc;QACzB,CAAC,CAAC,MAAM,oBAAoB,CAAC;YACzB,MAAM,EAAE,YAAY,CAAC,eAAe;YACpC,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,cAAc,EAAE,cAAc,CAAC,cAAc;SAC9C,CAAC;QACJ,CAAC,CAAC,YAAY,CAAC,eAAe,CAAA;IAEhC,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAE1G,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE;YACF,MAAM,EAAE;gBACN,IAAI;gBACJ,UAAU;gBACV,OAAO,EAAE;oBACP,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,KAAK,EAAE,KAAK,CAAC,MAAM;oBACnB,EAAE,EAAE,EAAE,CAAC,EAAE;iBACV;aACF;SACF;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/swap/general/knownAggregatorRouters.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+import { Chain } from '../../Chain.js';
+export type EnforcedRouterProvider = '1inch' | 'kyber';
+/**
+ * Throws if `address` isn't the known router for `provider` on `chain`. Call this at quote
+ * construction, before a GeneralSwapQuote carrying `address` as `tx.evm.to` can exist.
+ */
+export declare function assertKnownAggregatorRouter(provider: EnforcedRouterProvider, address: string, chain: Chain): void;
+/**
+ * Log-only (never throws) — for LiFi/SwapKit, whose legitimate routes span many different
+ * contracts. Structured so the data is queryable (provider + address) and a future allowlist
+ * is easy to build if a stable pattern emerges from real usage.
+ */
+export declare function logUnenforcedAggregatorDestination(provider: 'li.fi' | 'swapkit', address: string): void;
+//# sourceMappingURL=knownAggregatorRouters.d.ts.map

package/dist/swap/general/knownAggregatorRouters.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"knownAggregatorRouters.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AA8DnC,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,CAAA;AAEtD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAcjH;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKvG"}

package/dist/swap/general/knownAggregatorRouters.js ADDED Viewed

@@ -0,0 +1,83 @@
+import { Chain } from '../../Chain.js';
+/**
+ * Fund-safety allowlist for the general-purpose EVM swap aggregators (AGG-02, round-2
+ * spec-level fund-safety audit, 2026-07-08).
+ *
+ * Each aggregator's quote-construction function (getOneInchSwapQuote.ts, kyber/api/tx.ts,
+ * getLifiSwapQuote.ts, getSwapKitQuote.ts) is the TRUST BOUNDARY where an untrusted HTTP
+ * response gets parsed into an internal GeneralSwapQuote. That quote's `tx.evm.to` goes on
+ * to become BOTH the ERC-20 approval spender (getSwapDestinationAddress ->
+ * mpc/keysign/swap/build.ts's allowance check) AND, independently, the actual on-chain swap
+ * transaction's destination (build.ts's own txMsg construction -> signingInputs/resolvers/
+ * evm/index.ts's WalletCore SigningInput). Two SEPARATE downstream reads of the same field —
+ * so validating at either downstream site alone would leave the other unguarded. Validating
+ * HERE, at construction, means every consumer (present and future) inherits an
+ * already-verified address by construction, instead of needing its own check.
+ *
+ * 1inch and Kyber can be enforced (fail closed / throw) because their router is a small,
+ * stable, deterministically-deployed constant on almost every chain — verified against each
+ * provider's OWN live quote API (not just docs/explorers), chain by chain, on 2026-07-08.
+ *
+ * CHAIN-SCOPING MATTERS (codex review, PR #1079): 1inch's V6 router is NOT the same address
+ * on zkSync Era — confirmed live (a real 200 response from a real quote request returned a
+ * DIFFERENT contract there). This is exactly the caveat chains/evm/contract/knownContracts.ts
+ * already documents for 1inch V5 ("not zkSync Era — different V5 router"); it turns out to
+ * also hold for V6. A flat, chain-agnostic allowlist would have hard-blocked every legitimate
+ * zkSync 1inch swap. Kyber showed no such variance on every chain that returned a live
+ * response (see the per-chain notes below) — its allowlist stays flat.
+ *
+ * LiFi and SwapKit CANNOT be enforced the same way — they route through many different
+ * bridge/DEX contracts by design (diamond routing, multi-hop, chain-specific deployments),
+ * so a hard allowlist would false-block legitimate routes. Those two are logged (never
+ * thrown) via logUnenforcedAggregatorDestination so an anomaly is queryable, and so a future
+ * allowlist has real usage data to build from if a pattern emerges.
+ */
+// 1inch Aggregation Router V5 (legacy). Same address as
+// chains/evm/contract/knownContracts.ts's display-only registry; kept separate here since
+// THIS one gates signing, not just UI labeling. NOTE: the implementation below only accepts
+// this on non-zkSync chains (same exclusive branch as V6) — getOneInchSwapQuote.ts only
+// calls the v6.0 API today, so a V5 address is never actually seen through this path
+// regardless; harmless defense-in-depth either way.
+const ONE_INCH_V5_ROUTER = '0x1111111254eeb25477b68fb85ed929f73a960582';
+// V6's standard address — live-confirmed 2026-07-08 on Ethereum, Arbitrum, BSC, Base,
+// Optimism, Avalanche, Polygon (7 of 8 oneInchSwapEnabledChains chains).
+const ONE_INCH_V6_STANDARD_ROUTER = '0x111111125421ca6dc452d289314280a0f8842a65';
+// V6 on zkSync Era ONLY — live-confirmed 2026-07-08 via a real api.vultisig.com/1inch
+// v6.0 quote request returning this address (NOT the standard one above).
+const ONE_INCH_V6_ZKSYNC_ROUTER = '0x6fd4383cb451173d5f9304f041c7bcbf27d561ff';
+// KyberSwap MetaAggregationRouterV2 — same address confirmed live 2026-07-08 on every chain
+// that returned a response through aggregator-api.kyberswap.com's /routes (Ethereum, BSC,
+// Arbitrum, Optimism, Avalanche, Base, Polygon — 7 of 9 kyberSwapEnabledChains chains).
+// zkSync/Blast 404'd on this exact API path during verification — that looks like those two
+// chains aren't actually live through this aggregator endpoint today (a pre-existing,
+// separate question from this fix — kyberSwapEnabledChains may be ahead of what the live API
+// serves), not evidence of a differing router address. No chain-scoping needed unless that
+// changes.
+const KYBER_STANDARD_ROUTER = '0x6131b5fae19ea4f9d964eac0408e4408b66337b5';
+/**
+ * Throws if `address` isn't the known router for `provider` on `chain`. Call this at quote
+ * construction, before a GeneralSwapQuote carrying `address` as `tx.evm.to` can exist.
+ */
+export function assertKnownAggregatorRouter(provider, address, chain) {
+    const normalized = address.toLowerCase();
+    const isKnown = provider === 'kyber'
+        ? normalized === KYBER_STANDARD_ROUTER
+        : chain === Chain.Zksync
+            ? normalized === ONE_INCH_V6_ZKSYNC_ROUTER
+            : normalized === ONE_INCH_V5_ROUTER || normalized === ONE_INCH_V6_STANDARD_ROUTER;
+    if (!isKnown) {
+        throw new Error(`${provider} swap quote returned an unrecognized router address (${address}) on ${chain} — refusing to build a signable transaction against it.`);
+    }
+}
+/**
+ * Log-only (never throws) — for LiFi/SwapKit, whose legitimate routes span many different
+ * contracts. Structured so the data is queryable (provider + address) and a future allowlist
+ * is easy to build if a stable pattern emerges from real usage.
+ */
+export function logUnenforcedAggregatorDestination(provider, address) {
+    console.info('[swap-router-telemetry] general-swap destination (not enforced, logged for future analysis):', {
+        provider,
+        address,
+    });
+}
+//# sourceMappingURL=knownAggregatorRouters.js.map

package/dist/swap/general/knownAggregatorRouters.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"knownAggregatorRouters.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,wDAAwD;AACxD,0FAA0F;AAC1F,4FAA4F;AAC5F,wFAAwF;AACxF,qFAAqF;AACrF,oDAAoD;AACpD,MAAM,kBAAkB,GAAG,4CAA4C,CAAA;AAEvE,sFAAsF;AACtF,yEAAyE;AACzE,MAAM,2BAA2B,GAAG,4CAA4C,CAAA;AAEhF,sFAAsF;AACtF,0EAA0E;AAC1E,MAAM,yBAAyB,GAAG,4CAA4C,CAAA;AAE9E,4FAA4F;AAC5F,0FAA0F;AAC1F,wFAAwF;AACxF,4FAA4F;AAC5F,sFAAsF;AACtF,6FAA6F;AAC7F,2FAA2F;AAC3F,WAAW;AACX,MAAM,qBAAqB,GAAG,4CAA4C,CAAA;AAI1E;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC,EAAE,OAAe,EAAE,KAAY;IACzG,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACxC,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;QAClB,CAAC,CAAC,UAAU,KAAK,qBAAqB;QACtC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM;YACtB,CAAC,CAAC,UAAU,KAAK,yBAAyB;YAC1C,CAAC,CAAC,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,2BAA2B,CAAA;IAEvF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,wDAAwD,OAAO,QAAQ,KAAK,yDAAyD,CACjJ,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAA6B,EAAE,OAAe;IAC/F,OAAO,CAAC,IAAI,CAAC,8FAA8F,EAAE;QAC3G,QAAQ;QACR,OAAO;KACR,CAAC,CAAA;AACJ,CAAC"}

package/dist/swap/general/kyber/api/tx.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/kyber/api/tx.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAG1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;~~AACzD~~,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAIL,4BAA4B,EAG7B,MAAM,WAAW,CAAA;AAGlB,KAAK,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAC,GAAG;IACzF,YAAY,EAAE,GAAG,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB,EAAE,OAAO,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,4BAA4B,CAAA;IAC1C,oGAAoG;IACpG,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAsCD,eAAO,MAAM,cAAc,GAAU,uHAUlC,mBAAmB,KAAG,OAAO,CAAC,gBAAgB,~~CA4DhD~~,CAAA"}
1	+ {"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/kyber/api/tx.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAG1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAIL,4BAA4B,EAG7B,MAAM,WAAW,CAAA;AAGlB,KAAK,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAC,GAAG;IACzF,YAAY,EAAE,GAAG,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB,EAAE,OAAO,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,4BAA4B,CAAA;IAC1C,oGAAoG;IACpG,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAsCD,eAAO,MAAM,cAAc,GAAU,uHAUlC,mBAAmB,KAAG,OAAO,CAAC,gBAAgB,CAgFhD,CAAA"}

package/dist/swap/general/kyber/api/tx.js CHANGED Viewed

@@ -3,6 +3,7 @@ import { isInError } from '@vultisig/lib-utils/error/isInError';
 import { queryUrl } from '@vultisig/lib-utils/query/queryUrl';
 import { convertDuration } from '@vultisig/lib-utils/time/convertDuration';
 import { isFeeCoin } from '../../../../coin/utils/isFeeCoin.js';
+import { assertKnownAggregatorRouter } from '../../knownAggregatorRouters.js';
 import { getKyberSwapAffiliateParams, hasAffiliateBps, kyberSwapAffiliateConfig, kyberSwapSlippageTolerance, kyberSwapTxLifespan, } from '../config.js';
 import { getKyberSwapBaseUrl } from './baseUrl.js';
 const getKyberSwapAffiliateFee = ({ amountOut, to, affiliateBps, }) => {
@@ -52,14 +53,30 @@ export const getKyberSwapTx = async ({ from, to, routeSummary, routerAddress, am
         }
         throw new Error('Failed to build transaction');
     }
-    const { amountOut, data, gas } = buildResponse.data;
+    const { amountOut, data, gas, routerAddress: buildRouterAddress } = buildResponse.data;
+    // AGG-02 fund-safety fix: verify BOTH the /routes response's routerAddress (route.ts,
+    // threaded in as the `routerAddress` param) AND /route/build's OWN routerAddress field
+    // are Kyber's actual router before this untrusted data can become a signable
+    // GeneralSwapQuote. The two calls are separate HTTP round-trips; if they ever disagree
+    // (API drift/version mismatch), `data` (the calldata /route/build just generated) may
+    // have been built against a DIFFERENT router than the one this quote's tx.to claims —
+    // codex review finding, PR #1079. See knownAggregatorRouters.ts.
+    assertKnownAggregatorRouter('kyber', routerAddress, from.chain);
+    assertKnownAggregatorRouter('kyber', buildRouterAddress, from.chain);
+    if (buildRouterAddress.toLowerCase() !== routerAddress.toLowerCase()) {
+        throw new Error(`Kyber /route and /route/build disagree on the router address (${routerAddress} vs ${buildRouterAddress}) — refusing to build a signable transaction against mismatched calldata.`);
+    }
     return {
         dstAmount: amountOut,
         provider: 'kyber',
         tx: {
             evm: {
                 from: from.address,
-                to: routerAddress,
+                // AGG-04: bind tx.to to /route/build's OWN routerAddress — the router paired with
+                // `data` (the calldata this call just generated) — not the stale /routes param.
+                // The equality guard above already proves they match today (AGG-02 / #1079); this
+                // keeps tx.to authoritative-by-construction as defense-in-depth if that guard ever moves.
+                to: buildRouterAddress,
                 data,
                 value: isFeeCoin(from) ? amount.toString() : '0',
                 gasLimit: gas ? BigInt(gas) : undefined,

package/dist/swap/general/kyber/api/tx.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tx.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/kyber/api/tx.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAA;AAI1E,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;~~AAI5D~~,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EAExB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAwB/C,MAAM,wBAAwB,GAAG,CAAC,EAChC,SAAS,EACT,EAAE,EACF,YAAY,GAKb,EAAuB,EAAE;IACxB,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;IAEnE,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,MAAM,EAAE,cAAc,GAAG,YAAY;KACtC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,EACnC,IAAI,EACJ,EAAE,EACF,YAAY,EACZ,aAAa,EACb,MAAM,EACN,mBAAmB,EACnB,YAAY,EACZ,WAAW,GAAG,wBAAwB,EACtC,iBAAiB,GAAG,0BAA0B,GAC1B,EAA6B,EAAE;IACnD,MAAM,YAAY,GAAG;QACnB,YAAY;QACZ,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,iBAAiB;QACjB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChH,mBAAmB;QACnB,GAAG,2BAA2B,CAAC,YAAY,EAAE,WAAW,CAAC;QACzD,oBAAoB,EAAE,KAAK;KAC5B,CAAA;IAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAyB,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QAC7G,OAAO,EAAE;YACP,aAAa,EAAE,WAAW,CAAC,MAAM;SAClC;QACD,IAAI,EAAE,YAAY;KACnB,CAAC,CAAA;IAEF,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;YAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAA;YAEjC,IAAI,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAA;YACvD,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAA;YACnD,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,CAAA;~~IACnD~~,OAAO;QACL,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE;YACF,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI,CAAC,OAAO;gBAClB,EAAE,EAAE,~~aAAa~~;~~gBACjB~~,IAAI;gBACJ,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG;gBAChD,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvC,YAAY,EAAE,wBAAwB,CAAC;oBACrC,SAAS;oBACT,EAAE;oBACF,YAAY;iBACb,CAAC;aACH;SACF;KACF,CAAA;AACH,CAAC,CAAA"}
1	+ {"version":3,"file":"tx.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/kyber/api/tx.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAA;AAI1E,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;AAG5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAE1E,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EAExB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAwB/C,MAAM,wBAAwB,GAAG,CAAC,EAChC,SAAS,EACT,EAAE,EACF,YAAY,GAKb,EAAuB,EAAE;IACxB,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;IAEnE,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,MAAM,EAAE,cAAc,GAAG,YAAY;KACtC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,EACnC,IAAI,EACJ,EAAE,EACF,YAAY,EACZ,aAAa,EACb,MAAM,EACN,mBAAmB,EACnB,YAAY,EACZ,WAAW,GAAG,wBAAwB,EACtC,iBAAiB,GAAG,0BAA0B,GAC1B,EAA6B,EAAE;IACnD,MAAM,YAAY,GAAG;QACnB,YAAY;QACZ,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,iBAAiB;QACjB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChH,mBAAmB;QACnB,GAAG,2BAA2B,CAAC,YAAY,EAAE,WAAW,CAAC;QACzD,oBAAoB,EAAE,KAAK;KAC5B,CAAA;IAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAyB,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QAC7G,OAAO,EAAE;YACP,aAAa,EAAE,WAAW,CAAC,MAAM;SAClC;QACD,IAAI,EAAE,YAAY;KACnB,CAAC,CAAA;IAEF,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;YAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAA;YAEjC,IAAI,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAA;YACvD,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAA;YACnD,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,aAAa,CAAC,IAAI,CAAA;IAEtF,sFAAsF;IACtF,uFAAuF;IACvF,6EAA6E;IAC7E,uFAAuF;IACvF,sFAAsF;IACtF,sFAAsF;IACtF,iEAAiE;IACjE,2BAA2B,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,2BAA2B,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACpE,IAAI,kBAAkB,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,iEAAiE,aAAa,OAAO,kBAAkB,2EAA2E,CACnL,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE;YACF,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI,CAAC,OAAO;gBAClB,kFAAkF;gBAClF,gFAAgF;gBAChF,kFAAkF;gBAClF,0FAA0F;gBAC1F,EAAE,EAAE,kBAAkB;gBACtB,IAAI;gBACJ,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG;gBAChD,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvC,YAAY,EAAE,wBAAwB,CAAC;oBACrC,SAAS;oBACT,EAAE;oBACF,YAAY;iBACb,CAAC;aACH;SACF;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/swap/general/lifi/api/getLifiSwapQuote.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getLifiSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/lifi/api/getLifiSwapQuote.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,mBAAmB,EAGpB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAmB,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAKpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;~~AAGzD~~,KAAK,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,oBAAoB,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IACnG,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;4EACwE;IACxE,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;qDACiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAKD,6CAA6C;AAC7C,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAa7C,CAAA;AAKF,6CAA6C;AAC7C,eAAO,MAAM,YAAY,GAAI,MAAM;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,OACxB,CAAA;AAkG1D,eAAO,MAAM,gBAAgB,GAAU,wFAMpC,KAAK,KAAG,OAAO,CAAC,gBAAgB,~~CAiLlC~~,CAAA"}
1	+ {"version":3,"file":"getLifiSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/lifi/api/getLifiSwapQuote.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,mBAAmB,EAGpB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAmB,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAKpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAIzD,KAAK,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,oBAAoB,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IACnG,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;4EACwE;IACxE,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;qDACiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAKD,6CAA6C;AAC7C,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAa7C,CAAA;AAKF,6CAA6C;AAC7C,eAAO,MAAM,YAAY,GAAI,MAAM;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,OACxB,CAAA;AAkG1D,eAAO,MAAM,gBAAgB,GAAU,wFAMpC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAuLlC,CAAA"}

package/dist/swap/general/lifi/api/getLifiSwapQuote.js CHANGED Viewed

@@ -8,6 +8,7 @@ import { shouldBePresent } from '@vultisig/lib-utils/assert/shouldBePresent';
 import { match } from '@vultisig/lib-utils/match';
 import { memoize } from '@vultisig/lib-utils/memoize';
 import { mirrorRecord } from '@vultisig/lib-utils/record/mirrorRecord';
+import { logUnenforcedAggregatorDestination } from '../../knownAggregatorRouters.js';
 import { injectSolanaAtaIfMissing } from './injectSolanaAtaIfMissing.js';
 // Stable-pair detection: tickers that commonly trade within a tight peg.
 // DAI is included because on most DEXs DAI/USDC depth is comparable to
@@ -253,10 +254,16 @@ export const getLifiSwapQuote = async ({ amount, affiliateBps, lifiAffiliateConf
                 const swapFeeAssetId = swapFee &&
                     ([fromToken, toToken].find(token => token.toLowerCase() === swapFeeAddress) ||
                         chainFeeCoin[transfer.from.chain].id);
+                const evmTo = shouldBePresent(to);
+                // AGG-02: LiFi routes through many different bridge/DEX contracts by design
+                // (diamond routing, multi-hop, chain-specific deployments) — a hard allowlist
+                // would false-block legitimate routes, so log (never throw). See
+                // knownAggregatorRouters.ts.
+                logUnenforcedAggregatorDestination('li.fi', evmTo);
                 return {
                     evm: {
                         from: shouldBePresent(from),
-                        to: shouldBePresent(to),
+                        to: evmTo,
                         data: shouldBePresent(data),
                         value: BigInt(shouldBePresent(value)).toString(),
                         gasLimit: gasLimit ? BigInt(gasLimit) : undefined,

package/dist/swap/general/lifi/api/getLifiSwapQuote.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getLifiSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/lifi/api/getLifiSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAmB,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EACL,aAAa,EAEb,UAAU,EACV,SAAS,GACV,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,eAAe,EAAwB,MAAM,8DAA8D,CAAA;AACpH,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAA;AAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAA;AAKtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AAarE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAW,EAAE,CAC7D,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AAElE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAyB,EAAE,EAAuB,EAAW,EAAE,CAC1F,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;AAE1D;;;;oDAIoD;AACpD,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,EAAE;IACxC,SAAS,EAAE,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,+DAA+D;AAC/D,oEAAoE;AACpE,gEAAgE;AAChE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,6DAA6D;AAC7D,kEAAkE;AAClE,8DAA8D;AAC9D,yDAAyD;AACzD,iEAAiE;AACjE,gEAAgE;AAChE,kEAAkE;AAClE,8DAA8D;AAC9D,+DAA+D;AAC/D,oDAAoD;AACpD,EAAE;AACF,iEAAiE;AACjE,iEAAiE;AACjE,kEAAkE;AAClE,oEAAoE;AACpE,sEAAsE;AACtE,mEAAmE;AACnE,8DAA8D;AAC9D,oDAAoD;AACpD,EAAE;AACF,2DAA2D;AAC3D,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,gEAAgE;AAChE,mEAAmE;AACnE,gEAAgE;AAChE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,iEAAiE;AACjE,oEAAoE;AACpE,iEAAiE;AACjE,8DAA8D;AAC9D,EAAE;AACF,gCAAgC;AAChC,gEAAgE;AAChE,iEAAiE;AACjE,yCAAyC;AACzC,oEAAoE;AACpE,kEAAkE;AAClE,MAAM,+BAA+B,GAAG,IAAI,CAAA;AAC5C,MAAM,mCAAmC,GAAG,KAAK,CAAA;AAEjD,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,0BAA0B;AAC1B,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAEjC,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,8DAA8D;AAC9D,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAE,QAA8B,EAAwB,EAAE;IACrG,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,wCAAwC,OAAO,4CAA4C,QAAQ,EAAE,CAAC,CAAA;QACnH,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,EACrC,MAAM,EACN,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,QAAQ,EACL,EAA6B,EAAE;IACrC,oBAAoB,EAAE,CAAA;IAEtB,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAEpG,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IAClH,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE3F,MAAM,QAAQ,GACZ,gBAAgB;QAChB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAA;IAEpH,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAA;IAC9D,IAAI,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,iEAAiE,qBAAqB,QAAQ,eAAe,KAAK,CACnH,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,wEAAwE;IACxE,MAAM,UAAU,GAAG,mBAAmB,EAAE,cAAc,IAAI,UAAU,CAAC,cAAc,CAAA;IAEnF,yEAAyE;IACzE,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE;QAC5C,SAAS;QACT,OAAO;QACP,SAAS;QACT,OAAO;QACP,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC7B,WAAW;QACX,SAAS;QACT,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,gDAAgD;QAChD,GAAG,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;QAClE,QAAQ;QACR,UAAU;KACX,CAAC,CAAA;IAEF,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAE9C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEnD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAA;IAE/E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;QACvC,MAAM,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3F,MAAM,cAAc,GAClB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;QAE7G,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACnH,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,8EAA8E;QAC9E,gFAAgF;QAEhF,wFAAwF;QACxF,kFAAkF;QAClF,iFAAiF;QACjF,gHAAgH;QAChH,mFAAmF;QACnF,kFAAkF;QAClF,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAE7E,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;YAC5B,QAAQ,EAAE,OAAO;YACjB,EAAE,EAAE;gBACF,MAAM,EAAE;oBACN,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,aAAa;oBACrD,OAAO,EAAE;wBACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;wBAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;wBAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;wBACtE,EAAE,EAAE,cAAc;qBACnB;iBACF;aACF;SACF,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE,KAAK,CAAgE,SAAS,EAAE;YAClF,MAAM,EAAE,GAAG,EAAE;gBACX,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;gBACvC,MAAM,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAE9C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAEtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAE3F,MAAM,cAAc,GAClB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;gBAE7G,OAAO;oBACL,MAAM,EAAE;wBACN,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;wBACrC,OAAO,EAAE;4BACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;4BAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;4BAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtE,EAAE,EAAE,cAAc;yBACnB;qBACF;iBACF,CAAA;YACH,CAAC;YACD,GAAG,EAAE,GAAG,EAAE;gBACR,0DAA0D;gBAC1D,mEAAmE;gBACnE,kEAAkE;gBAClE,mEAAmE;gBACnE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,yDAAyD;gBACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAA;gBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC1E,+DAA+D;gBAC/D,+DAA+D;gBAC/D,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,cAAc,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;gBAC3D,MAAM,cAAc,GAClB,OAAO;oBACP,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC;wBACzE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;gBACzC,OAAO;oBACL,GAAG,EAAE;wBACH,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,EAAE,EAAE,~~eAAe,CAAC,EAAE,CAAC~~;~~wBACvB~~,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;wBAChD,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;wBACjD,GAAG,CAAC,OAAO;4BACT,CAAC,CAAC;gCACE,YAAY,EAAE;oCACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oCAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;oCAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;oCACtE,EAAE,EAAE,cAAc;iCACnB;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF,CAAA;YACH,CAAC;SACF,CAAC;KACH,CAAA;AACH,CAAC,CAAA"}
1	+ {"version":3,"file":"getLifiSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/lifi/api/getLifiSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAmB,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EACL,aAAa,EAEb,UAAU,EACV,SAAS,GACV,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,eAAe,EAAwB,MAAM,8DAA8D,CAAA;AACpH,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAA;AAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAA;AAKtE,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAA;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AAarE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAW,EAAE,CAC7D,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AAElE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAyB,EAAE,EAAuB,EAAW,EAAE,CAC1F,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;AAE1D;;;;oDAIoD;AACpD,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,EAAE;IACxC,SAAS,EAAE,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,+DAA+D;AAC/D,oEAAoE;AACpE,gEAAgE;AAChE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,6DAA6D;AAC7D,kEAAkE;AAClE,8DAA8D;AAC9D,yDAAyD;AACzD,iEAAiE;AACjE,gEAAgE;AAChE,kEAAkE;AAClE,8DAA8D;AAC9D,+DAA+D;AAC/D,oDAAoD;AACpD,EAAE;AACF,iEAAiE;AACjE,iEAAiE;AACjE,kEAAkE;AAClE,oEAAoE;AACpE,sEAAsE;AACtE,mEAAmE;AACnE,8DAA8D;AAC9D,oDAAoD;AACpD,EAAE;AACF,2DAA2D;AAC3D,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,gEAAgE;AAChE,mEAAmE;AACnE,gEAAgE;AAChE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,iEAAiE;AACjE,oEAAoE;AACpE,iEAAiE;AACjE,8DAA8D;AAC9D,EAAE;AACF,gCAAgC;AAChC,gEAAgE;AAChE,iEAAiE;AACjE,yCAAyC;AACzC,oEAAoE;AACpE,kEAAkE;AAClE,MAAM,+BAA+B,GAAG,IAAI,CAAA;AAC5C,MAAM,mCAAmC,GAAG,KAAK,CAAA;AAEjD,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,0BAA0B;AAC1B,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAEjC,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,8DAA8D;AAC9D,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAE,QAA8B,EAAwB,EAAE;IACrG,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,wCAAwC,OAAO,4CAA4C,QAAQ,EAAE,CAAC,CAAA;QACnH,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,EACrC,MAAM,EACN,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,QAAQ,EACL,EAA6B,EAAE;IACrC,oBAAoB,EAAE,CAAA;IAEtB,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAEpG,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IAClH,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE3F,MAAM,QAAQ,GACZ,gBAAgB;QAChB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAA;IAEpH,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAA;IAC9D,IAAI,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,iEAAiE,qBAAqB,QAAQ,eAAe,KAAK,CACnH,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,wEAAwE;IACxE,MAAM,UAAU,GAAG,mBAAmB,EAAE,cAAc,IAAI,UAAU,CAAC,cAAc,CAAA;IAEnF,yEAAyE;IACzE,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE;QAC5C,SAAS;QACT,OAAO;QACP,SAAS;QACT,OAAO;QACP,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC7B,WAAW;QACX,SAAS;QACT,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,gDAAgD;QAChD,GAAG,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;QAClE,QAAQ;QACR,UAAU;KACX,CAAC,CAAA;IAEF,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAE9C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEnD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAA;IAE/E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;QACvC,MAAM,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3F,MAAM,cAAc,GAClB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;QAE7G,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACnH,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,8EAA8E;QAC9E,gFAAgF;QAEhF,wFAAwF;QACxF,kFAAkF;QAClF,iFAAiF;QACjF,gHAAgH;QAChH,mFAAmF;QACnF,kFAAkF;QAClF,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAE7E,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;YAC5B,QAAQ,EAAE,OAAO;YACjB,EAAE,EAAE;gBACF,MAAM,EAAE;oBACN,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,aAAa;oBACrD,OAAO,EAAE;wBACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;wBAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;wBAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;wBACtE,EAAE,EAAE,cAAc;qBACnB;iBACF;aACF;SACF,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE,KAAK,CAAgE,SAAS,EAAE;YAClF,MAAM,EAAE,GAAG,EAAE;gBACX,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;gBACvC,MAAM,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAE9C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAEtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAE3F,MAAM,cAAc,GAClB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;gBAE7G,OAAO;oBACL,MAAM,EAAE;wBACN,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;wBACrC,OAAO,EAAE;4BACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;4BAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;4BAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtE,EAAE,EAAE,cAAc;yBACnB;qBACF;iBACF,CAAA;YACH,CAAC;YACD,GAAG,EAAE,GAAG,EAAE;gBACR,0DAA0D;gBAC1D,mEAAmE;gBACnE,kEAAkE;gBAClE,mEAAmE;gBACnE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,yDAAyD;gBACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAA;gBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC1E,+DAA+D;gBAC/D,+DAA+D;gBAC/D,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,cAAc,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;gBAC3D,MAAM,cAAc,GAClB,OAAO;oBACP,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC;wBACzE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;gBACzC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAA;gBACjC,4EAA4E;gBAC5E,8EAA8E;gBAC9E,iEAAiE;gBACjE,6BAA6B;gBAC7B,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAClD,OAAO;oBACL,GAAG,EAAE;wBACH,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,EAAE,EAAE,KAAK;wBACT,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;wBAC3B,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;wBAChD,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;wBACjD,GAAG,CAAC,OAAO;4BACT,CAAC,CAAC;gCACE,YAAY,EAAE;oCACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oCAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;oCAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;oCACtE,EAAE,EAAE,cAAc;iCACnB;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF,CAAA;YACH,CAAC;SACF,CAAC;KACH,CAAA;AACH,CAAC,CAAA"}

package/dist/swap/general/oneInch/api/getOneInchSwapQuote.d.ts CHANGED Viewed

@@ -1,4 +1,6 @@
+import { EvmChain } from '@vultisig/core-chain/Chain';
 import { ChainAccount } from '@vultisig/core-chain/ChainAccount';
+import { AccountCoin } from '@vultisig/core-chain/coin/AccountCoin';
 import { GeneralSwapQuote } from '@vultisig/core-chain/swap/general/GeneralSwapQuote';
 import { oneInchAffiliateConfig } from '@vultisig/core-chain/swap/general/oneInch/oneInchAffiliateConfig';
 export type OneInchAffiliateConfig = typeof oneInchAffiliateConfig;
@@ -6,12 +8,15 @@ type Input = {
     account: ChainAccount;
     fromCoinId: string;
     toCoinId: string;
+    /** Destination coin metadata. When set alongside affiliateBps, populates a display-only
+     * affiliateFee (AGG-05) matching the Kyber/LiFi convention. */
+    to?: AccountCoin<EvmChain>;
     amount: bigint;
     affiliateBps?: number;
     oneInchConfig?: OneInchAffiliateConfig;
     /** Slippage tolerance in percent (e.g. 0.5 = 0.5%). Defaults to 0.5. */
     slippage?: number;
 };
-export declare const getOneInchSwapQuote: ({ account, fromCoinId, toCoinId, amount, affiliateBps, oneInchConfig, slippage, }: Input) => Promise<GeneralSwapQuote>;
+export declare const getOneInchSwapQuote: ({ account, fromCoinId, toCoinId, to, amount, affiliateBps, oneInchConfig, slippage, }: Input) => Promise<GeneralSwapQuote>;
 export {};
 //# sourceMappingURL=getOneInchSwapQuote.d.ts.map

package/dist/swap/general/oneInch/api/getOneInchSwapQuote.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getOneInchSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/oneInch/api/getOneInchSwapQuote.ts"],"names":[],"mappings":"~~AACA~~,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;~~AAGhE~~,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAA;~~AAErF~~,OAAO,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAA;~~AAQzG~~,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAA;AAElE,KAAK,KAAK,GAAG;IACX,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,sBAAsB,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;~~AAID~~,eAAO,MAAM,mBAAmB,GAAU,~~mFAQvC~~,KAAK,KAAG,OAAO,CAAC,gBAAgB,~~CAkClC~~,CAAA"}
1	+ {"version":3,"file":"getOneInchSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/oneInch/api/getOneInchSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAEhE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAA;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAA;AAGrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAA;AASzG,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAA;AAElE,KAAK,KAAK,GAAG;IACX,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB;mEAC+D;IAC/D,EAAE,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,sBAAsB,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAgCD,eAAO,MAAM,mBAAmB,GAAU,uFASvC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAwClC,CAAA"}

package/dist/swap/general/oneInch/api/getOneInchSwapQuote.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { getEvmChainId } from '@vultisig/core-chain/chains/evm/chainInfo';
 import { isFeeCoin } from '@vultisig/core-chain/coin/utils/isFeeCoin';
+import { assertKnownAggregatorRouter } from '@vultisig/core-chain/swap/general/knownAggregatorRouters';
 import { oneInchAffiliateConfig } from '@vultisig/core-chain/swap/general/oneInch/oneInchAffiliateConfig';
 import { rootApiUrl } from '@vultisig/core-config';
 import { hexToNumber } from '@vultisig/lib-utils/hex/hexToNumber';
@@ -7,7 +8,24 @@ import { addQueryParams } from '@vultisig/lib-utils/query/addQueryParams';
 import { queryUrl } from '@vultisig/lib-utils/query/queryUrl';
 import { evmNativeCoinAddress } from '../../../../chains/evm/config.js';
 const getBaseUrl = (chainId) => `${rootApiUrl}/1inch/swap/v6.0/${chainId}/swap`;
-export const getOneInchSwapQuote = async ({ account, fromCoinId, toCoinId, amount, affiliateBps, oneInchConfig = oneInchAffiliateConfig, slippage = 0.5, }) => {
+// 1inch's `fee` param deducts the affiliate cut from dstAmount before returning it — same
+// convention as Kyber's /route/build. Gross the net amount back up to derive the fee for
+// display, mirroring getKyberSwapAffiliateFee (kyber/api/tx.ts).
+const getOneInchAffiliateFee = ({ dstAmount, to, affiliateBps, }) => {
+    if (!affiliateBps || !to) {
+        return undefined;
+    }
+    const netAmountOut = BigInt(dstAmount);
+    const feeRate = BigInt(affiliateBps);
+    const grossAmountOut = (netAmountOut * 10000n) / (10000n - feeRate);
+    return {
+        chain: to.chain,
+        id: to.id,
+        decimals: to.decimals,
+        amount: grossAmountOut - netAmountOut,
+    };
+};
+export const getOneInchSwapQuote = async ({ account, fromCoinId, toCoinId, to, amount, affiliateBps, oneInchConfig = oneInchAffiliateConfig, slippage = 0.5, }) => {
     const chain = account.chain;
     const chainId = hexToNumber(getEvmChainId(chain));
     const params = {
@@ -27,6 +45,10 @@ export const getOneInchSwapQuote = async ({ account, fromCoinId, toCoinId, amoun
     };
     const url = addQueryParams(getBaseUrl(chainId), params);
     const { dstAmount, tx } = await queryUrl(url);
+    // AGG-02 fund-safety fix: verify tx.to is 1inch's actual router before this untrusted
+    // response can become a signable GeneralSwapQuote. Chain-scoped: 1inch's router differs
+    // on zkSync Era. See knownAggregatorRouters.ts.
+    assertKnownAggregatorRouter('1inch', tx.to, chain);
     return {
         dstAmount,
         provider: '1inch',
@@ -34,6 +56,7 @@ export const getOneInchSwapQuote = async ({ account, fromCoinId, toCoinId, amoun
             evm: {
                 ...tx,
                 gasLimit: tx.gas ? BigInt(tx.gas) : undefined,
+                affiliateFee: getOneInchAffiliateFee({ dstAmount, to, affiliateBps }),
             },
         },
     };

package/dist/swap/general/oneInch/api/getOneInchSwapQuote.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getOneInchSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/oneInch/api/getOneInchSwapQuote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAA;~~AACzE~~,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;~~AAGrE~~,OAAO,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAA;~~AACzG~~,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;~~AAepE~~,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,UAAU,oBAAoB,OAAO,OAAO,CAAA;AAEvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,MAAM,EACN,YAAY,EACZ,aAAa,GAAG,sBAAsB,EACtC,QAAQ,GAAG,GAAG,GACR,EAA6B,EAAE;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAiB,CAAA;IACvC,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;IAEjD,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU;QAC5F,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ;QACxF,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,QAAQ;QACR,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,GAAG,EAAE,YAAY,GAAG,GAAG;aACxB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IAEvD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAA6B,MAAM,QAAQ,CAA2B,GAAG,CAAC,CAAA;IAEjG,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE;YACF,GAAG,EAAE;gBACH,GAAG,EAAE;gBACL,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;~~aAC9C~~;SACF;KACF,CAAA;AACH,CAAC,CAAA"}
1	+ {"version":3,"file":"getOneInchSwapQuote.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/oneInch/api/getOneInchSwapQuote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAA;AAEzE,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AAErE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAA;AAEtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAA;AAEzG,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAkBpE,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,UAAU,oBAAoB,OAAO,OAAO,CAAA;AAEvF,0FAA0F;AAC1F,yFAAyF;AACzF,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,CAAC,EAC9B,SAAS,EACT,EAAE,EACF,YAAY,GAKb,EAAuB,EAAE;IACxB,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;IAEnE,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,MAAM,EAAE,cAAc,GAAG,YAAY;KACtC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,EAAE,EACF,MAAM,EACN,YAAY,EACZ,aAAa,GAAG,sBAAsB,EACtC,QAAQ,GAAG,GAAG,GACR,EAA6B,EAAE;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAiB,CAAA;IACvC,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;IAEjD,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU;QAC5F,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ;QACxF,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,QAAQ;QACR,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,GAAG,EAAE,YAAY,GAAG,GAAG;aACxB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IAEvD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAA6B,MAAM,QAAQ,CAA2B,GAAG,CAAC,CAAA;IAEjG,sFAAsF;IACtF,wFAAwF;IACxF,gDAAgD;IAChD,2BAA2B,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAElD,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,OAAO;QACjB,EAAE,EAAE;YACF,GAAG,EAAE;gBACH,GAAG,EAAE;gBACL,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7C,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;aACtE;SACF;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/swap/general/priceImpactGuard.d.ts ADDED Viewed

@@ -0,0 +1,73 @@
+/**
+ * Shared price-impact fund-safety guard for swap providers that EXPOSE a
+ * price-impact field on their quote.
+ *
+ * Fund-safety gap (audit finding SOL-02, vultisig-sdk#1049): a thin-pool /
+ * sandwich-bait Jupiter quote at 50-90% price impact still built a fully
+ * signable, MPC-ready swap transaction with zero protection — the provider's
+ * own min-out was the only guard, and for wide-default routes that loses most
+ * of the user's funds. This module adds a PRICE-IMPACT CEILING: any quote
+ * whose exposed impact exceeds {@link MAX_PRICE_IMPACT_PCT} is refused.
+ *
+ * Ported from mcp-ts `src/tools/swap/priceImpactGuard.ts` (bead
+ * vultisig-ops-1m48), which enforces the identical 10% ceiling against the
+ * identical Jupiter `priceImpactPct` fraction convention on the production
+ * agent path. Keeping the SDK swap-build path and the agent swap path on the
+ * same ceiling avoids the exact drift this finding flagged.
+ */
+/**
+ * Maximum tolerated price impact, in PERCENT, before a swap quote is refused.
+ *
+ * 10% is far above any normal swap (the vast majority quote <1%, and even a
+ * chunky trade through a deep pool stays well under a few percent), yet
+ * comfortably below the 50-90% sandwich-bait / thin-pool range this guards
+ * against. Intentionally conservative on the safe side: a false refusal is
+ * recoverable (the user re-confirms with a smaller size or deeper route), a
+ * false pass drains funds.
+ */
+export declare const MAX_PRICE_IMPACT_PCT = 10;
+export type PriceImpactDecision = {
+    ok: true;
+    impactPct: number | null;
+} | {
+    ok: false;
+    impactPct: number;
+};
+/**
+ * Evaluate a price-impact value (already normalised to PERCENT units)
+ * against the ceiling.
+ *
+ * Fail-SAFE semantics: a missing / non-finite / negative impact is treated
+ * as "no usable signal" and PASSES (`ok: true, impactPct: null`). We never
+ * reject on a sometimes-undefined field — that would over-block normal swaps
+ * whenever the provider omits the value. Rejection only fires on a finite
+ * impact strictly above the ceiling.
+ */
+export declare const evaluatePriceImpactPercent: (impactPercent: number | null | undefined) => PriceImpactDecision;
+/**
+ * Parse a provider impact string expressed as a FRACTION (e.g. Jupiter's
+ * `priceImpactPct` = "0.05" meaning 5%) and evaluate it. The fraction is
+ * multiplied by 100 to normalise to percent before comparing against the
+ * ceiling.
+ */
+export declare const evaluateImpactFromFractionString: (raw: string | null | undefined) => PriceImpactDecision;
+/**
+ * Build a human-readable refusal message for a high-impact quote.
+ */
+export declare const highImpactMessage: (impactPct: number) => string;
+/**
+ * Thrown when a quote's price impact exceeds {@link MAX_PRICE_IMPACT_PCT}.
+ * Carried as a distinct type so callers/tests can recognise a high-impact
+ * refusal versus a generic quote/build failure.
+ */
+export declare class PriceImpactTooHighError extends Error {
+    readonly impactPercent: number;
+    constructor(impactPercent: number);
+}
+/**
+ * Parse + evaluate a provider's fraction-convention `priceImpactPct` and
+ * throw {@link PriceImpactTooHighError} when it exceeds the ceiling. No-op
+ * (returns) when the impact is missing, unparsable, or within bounds.
+ */
+export declare const assertJupiterPriceImpactWithinCeiling: (priceImpactPct: string | null | undefined) => void;
+//# sourceMappingURL=priceImpactGuard.d.ts.map

package/dist/swap/general/priceImpactGuard.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"priceImpactGuard.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/priceImpactGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3G;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,mBAQrF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,mBAGjF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,MAIK,CAAA;AAE3D;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;gBAElB,aAAa,EAAE,MAAM;CAKlC;AAED;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,GAAI,gBAAgB,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,IAKjG,CAAA"}

package/dist/swap/general/priceImpactGuard.js ADDED Viewed

@@ -0,0 +1,89 @@
+/**
+ * Shared price-impact fund-safety guard for swap providers that EXPOSE a
+ * price-impact field on their quote.
+ *
+ * Fund-safety gap (audit finding SOL-02, vultisig-sdk#1049): a thin-pool /
+ * sandwich-bait Jupiter quote at 50-90% price impact still built a fully
+ * signable, MPC-ready swap transaction with zero protection — the provider's
+ * own min-out was the only guard, and for wide-default routes that loses most
+ * of the user's funds. This module adds a PRICE-IMPACT CEILING: any quote
+ * whose exposed impact exceeds {@link MAX_PRICE_IMPACT_PCT} is refused.
+ *
+ * Ported from mcp-ts `src/tools/swap/priceImpactGuard.ts` (bead
+ * vultisig-ops-1m48), which enforces the identical 10% ceiling against the
+ * identical Jupiter `priceImpactPct` fraction convention on the production
+ * agent path. Keeping the SDK swap-build path and the agent swap path on the
+ * same ceiling avoids the exact drift this finding flagged.
+ */
+/**
+ * Maximum tolerated price impact, in PERCENT, before a swap quote is refused.
+ *
+ * 10% is far above any normal swap (the vast majority quote <1%, and even a
+ * chunky trade through a deep pool stays well under a few percent), yet
+ * comfortably below the 50-90% sandwich-bait / thin-pool range this guards
+ * against. Intentionally conservative on the safe side: a false refusal is
+ * recoverable (the user re-confirms with a smaller size or deeper route), a
+ * false pass drains funds.
+ */
+export const MAX_PRICE_IMPACT_PCT = 10;
+/**
+ * Evaluate a price-impact value (already normalised to PERCENT units)
+ * against the ceiling.
+ *
+ * Fail-SAFE semantics: a missing / non-finite / negative impact is treated
+ * as "no usable signal" and PASSES (`ok: true, impactPct: null`). We never
+ * reject on a sometimes-undefined field — that would over-block normal swaps
+ * whenever the provider omits the value. Rejection only fires on a finite
+ * impact strictly above the ceiling.
+ */
+export const evaluatePriceImpactPercent = (impactPercent) => {
+    if (impactPercent == null || !Number.isFinite(impactPercent) || impactPercent < 0) {
+        return { ok: true, impactPct: null };
+    }
+    if (impactPercent > MAX_PRICE_IMPACT_PCT) {
+        return { ok: false, impactPct: impactPercent };
+    }
+    return { ok: true, impactPct: impactPercent };
+};
+/**
+ * Parse a provider impact string expressed as a FRACTION (e.g. Jupiter's
+ * `priceImpactPct` = "0.05" meaning 5%) and evaluate it. The fraction is
+ * multiplied by 100 to normalise to percent before comparing against the
+ * ceiling.
+ */
+export const evaluateImpactFromFractionString = (raw) => {
+    const parsed = raw == null ? NaN : Number.parseFloat(raw);
+    return evaluatePriceImpactPercent(Number.isFinite(parsed) ? parsed * 100 : null);
+};
+/**
+ * Build a human-readable refusal message for a high-impact quote.
+ */
+export const highImpactMessage = (impactPct) => `This swap has ${impactPct.toFixed(2)}% price impact, above the ${MAX_PRICE_IMPACT_PCT}% ceiling. ` +
+    `A price impact this high usually means a thin pool or an oversized trade and would lose most of the ` +
+    `value being swapped. Refusing to build a signable transaction. If you genuinely want to proceed, ` +
+    `reduce the trade size or pick a deeper-liquidity route.`;
+/**
+ * Thrown when a quote's price impact exceeds {@link MAX_PRICE_IMPACT_PCT}.
+ * Carried as a distinct type so callers/tests can recognise a high-impact
+ * refusal versus a generic quote/build failure.
+ */
+export class PriceImpactTooHighError extends Error {
+    impactPercent;
+    constructor(impactPercent) {
+        super(highImpactMessage(impactPercent));
+        this.name = 'PriceImpactTooHighError';
+        this.impactPercent = impactPercent;
+    }
+}
+/**
+ * Parse + evaluate a provider's fraction-convention `priceImpactPct` and
+ * throw {@link PriceImpactTooHighError} when it exceeds the ceiling. No-op
+ * (returns) when the impact is missing, unparsable, or within bounds.
+ */
+export const assertJupiterPriceImpactWithinCeiling = (priceImpactPct) => {
+    const decision = evaluateImpactFromFractionString(priceImpactPct);
+    if (!decision.ok) {
+        throw new PriceImpactTooHighError(decision.impactPct);
+    }
+};
+//# sourceMappingURL=priceImpactGuard.js.map

package/dist/swap/general/priceImpactGuard.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"priceImpactGuard.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/priceImpactGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAItC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,aAAwC,EAAuB,EAAE;IAC1G,IAAI,aAAa,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IACtC,CAAC;IACD,IAAI,aAAa,GAAG,oBAAoB,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;AAC/C,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAA8B,EAAuB,EAAE;IACtG,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACzD,OAAO,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAClF,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC7D,iBAAiB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,oBAAoB,aAAa;IACnG,sGAAsG;IACtG,mGAAmG;IACnG,yDAAyD,CAAA;AAE3D;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,aAAa,CAAQ;IAE9B,YAAY,aAAqB;QAC/B,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,cAAyC,EAAQ,EAAE;IACvG,MAAM,QAAQ,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACvD,CAAC;AACH,CAAC,CAAA"}

package/dist/swap/general/swapkit/api/getSwapKitQuote.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getSwapKitQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/swapkit/api/getSwapKitQuote.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAA;AAEnE,OAAO,EAAE,gBAAgB,EAAiB,MAAM,oDAAoD,CAAA;~~AAEpG~~,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gEAAgE,CAAA;AAYxH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAGzE,KAAK,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC,GAAG;IACzE,IAAI,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;~~AAkrBD~~,eAAO,MAAM,eAAe,GAAU,+CAMnC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAiDlC,CAAA"}
1	+ {"version":3,"file":"getSwapKitQuote.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/swapkit/api/getSwapKitQuote.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAA;AAEnE,OAAO,EAAE,gBAAgB,EAAiB,MAAM,oDAAoD,CAAA;AAGpG,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gEAAgE,CAAA;AAYxH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAGzE,KAAK,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC,GAAG;IACzE,IAAI,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAurBD,eAAO,MAAM,eAAe,GAAU,+CAMnC,KAAK,KAAG,OAAO,CAAC,gBAAgB,CAiDlC,CAAA"}

package/dist/swap/general/swapkit/api/getSwapKitQuote.js CHANGED Viewed

@@ -2,6 +2,7 @@ import { base64Decode } from '@bufbuild/protobuf/wire';
 import { toChainAmount } from '@vultisig/core-chain/amount/toChainAmount';
 import { Chain } from '@vultisig/core-chain/Chain';
 import { chainFeeCoin } from '@vultisig/core-chain/coin/chainFeeCoin';
+import { logUnenforcedAggregatorDestination } from '@vultisig/core-chain/swap/general/knownAggregatorRouters';
 import { getSwapKitConfig } from '@vultisig/core-chain/swap/general/swapkit/config';
 import { SwapKitAmountBelowMinimumError, SwapKitNoEligibleRoutesError, } from '@vultisig/core-chain/swap/general/swapkit/SwapKitErrors';
 import { isSwapKitPairSupported, normalizeSwapKitProvider, swapKitExcludedProviders, } from '@vultisig/core-chain/swap/general/swapkit/SwapKitProviders';
@@ -217,6 +218,10 @@ const buildEvmTx = (tx, fromAddress) => {
     if (!evmTx.to) {
         throw new Error('SwapKit EVM transaction is missing a required to field.');
     }
+    // AGG-02: SwapKit routes through many different bridge/DEX contracts by design
+    // (diamond routing, multi-hop, chain-specific deployments) — a hard allowlist would
+    // false-block legitimate routes, so log (never throw). See knownAggregatorRouters.ts.
+    logUnenforcedAggregatorDestination('swapkit', evmTx.to);
     const gas = evmTx.gasLimit ?? evmTx.gas;
     return {
         evm: {