agentwallet-mcp 1.10.4 → 1.10.5

package/build/local-solana.js

@@ -122,19 +122,46 @@ function assertWithinSolCap(lamports) {
  * AGENTWALLET_MAX_TX_TOKEN on the EVM side and uses the same variable so an
  * operator sets one token cap, not one per chain family.
  *
- * Decimals for the cap come from the trusted table when the mint is known.
- * The caller-supplied value is not used for the ceiling: an inflated one would
- * inflate the cap exactly like the x402 bypass. When the mint is unknown we
- * assume 6, the tightest common value, so it fails closed.
+ * Decimals for the cap come from the trusted table when the mint is known, then
+ * from the mint account itself, and finally 0. The caller-supplied value is
+ * never used for the ceiling: an inflated one would inflate the cap exactly
+ * like the x402 bypass.
+ *
+ * 0 is the only safe fallback. Assuming 6 for an unknown mint is what AW-001
+ * exploited: for a mint with d decimals, a ceiling evaluated at 6 is 10**(6-d)
+ * times too permissive, and SPL mints with 0 to 5 decimals are common.
  */
-function assertWithinSplCap(mint, rawAmount) {
+const splDecimalsCache = new Map();
+async function resolveMintDecimals(mint, chainId) {
+    const known = lookupTrustedDecimals(900, mint);
+    if (typeof known === 'number')
+        return known;
+    const cached = splDecimalsCache.get(mint);
+    if (typeof cached === 'number')
+        return cached;
+    try {
+        const conn = connection(chainId);
+        const info = await conn.getParsedAccountInfo(new PublicKey(mint));
+        const data = info?.value?.data;
+        const d = Number(data?.parsed?.info?.decimals);
+        if (Number.isInteger(d) && d >= 0 && d <= 36) {
+            splDecimalsCache.set(mint, d);
+            return d;
+        }
+    }
+    catch {
+        // Unreachable RPC or non-standard mint: fall through to the safe floor.
+    }
+    return 0;
+}
+async function assertWithinSplCap(mint, rawAmount, chainId = 900) {
     const cap = (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim();
     if (!cap)
         return;
     if (!/^\d+(\.\d+)?$/.test(cap)) {
         throw new Error(`AGENTWALLET_MAX_TX_TOKEN must be a decimal number, got "${cap}".`);
     }
-    const decimals = lookupTrustedDecimals(900, mint) ?? 6;
+    const decimals = await resolveMintDecimals(mint, chainId);
     const [whole, frac = ''] = cap.split('.');
     const capRaw = BigInt(whole + frac.padEnd(decimals, '0').slice(0, decimals));
     if (rawAmount > capRaw) {
@@ -252,7 +279,7 @@ function createAtaIdempotentIx(payer, ata, owner, mint, tokenProgram) {
 export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId = 900) {
     // Checked before any RPC round trip: a blocked transfer should cost nothing
     // and should not announce itself to the RPC provider first.
-    assertWithinSplCap(mintStr, BigInt(rawAmount));
+    await assertWithinSplCap(mintStr, BigInt(rawAmount), chainId);
     const conn = connection(chainId);
     const payer = getSolanaKeypair();
     const mint = new PublicKey(mintStr);

package/build/local-wallet.js

@@ -178,11 +178,48 @@ export async function localTokenBalance(chainId, token) {
  * waiting to happen.
  *
  * Opt-in via AGENTWALLET_MAX_TX_TOKEN, expressed in human units of the token.
- * When the token's decimals are not known locally we assume 6, the smallest in
- * common use, which makes the raw ceiling the tightest one and fails closed
- * rather than open.
+ *
+ * Decimals decide the ceiling, so getting them wrong breaks the guard. They are
+ * resolved in this order: the trusted registry, then the token's own decimals()
+ * on chain (cached), and finally 0. Assuming 0 for an unresolvable token is the
+ * only value that cannot fail open: any real token has decimals >= 0, so a cap
+ * evaluated at 0 is never larger than the true one.
+ *
+ * Do not "assume 6 because it is the smallest in common use". It is not: GUSD
+ * and EURS use 2, and some tokens use 0. For a token with d decimals, a ceiling
+ * evaluated at 6 is 10**(6-d) times too permissive, which is how AW-001 let a
+ * 2-decimal token move 10,000x the configured cap.
  */
-function assertWithinTokenCap(chainId, token, data) {
+const decimalsCache = new Map();
+async function resolveTokenDecimals(chainId, token) {
+    const known = lookupTrustedDecimals(chainId, token);
+    if (typeof known === 'number')
+        return known;
+    const key = `${chainId}:${token.toLowerCase()}`;
+    const cached = decimalsCache.get(key);
+    if (typeof cached === 'number')
+        return cached;
+    try {
+        const { pub } = clients(chainId);
+        const onChain = await pub.readContract({
+            address: token,
+            abi: ERC20_ABI,
+            functionName: 'decimals',
+        });
+        const d = Number(onChain);
+        // Reject nonsense rather than trusting it; an out-of-range value would
+        // widen the ceiling exactly like the old assumption did.
+        if (Number.isInteger(d) && d >= 0 && d <= 36) {
+            decimalsCache.set(key, d);
+            return d;
+        }
+    }
+    catch {
+        // Unreachable RPC, non-standard token, anything at all: fall through to 0.
+    }
+    return 0;
+}
+async function assertWithinTokenCap(chainId, token, data) {
     const cap = (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim();
     if (!cap)
         return;
@@ -200,7 +237,7 @@ function assertWithinTokenCap(chainId, token, data) {
     if (word.length !== 64)
         return; // malformed; leave it to the node to reject
     const amount = BigInt('0x' + word);
-    const decimals = lookupTrustedDecimals(chainId, token) ?? 6;
+    const decimals = await resolveTokenDecimals(chainId, token);
     const [whole, frac = ''] = cap.split('.');
     const capRaw = BigInt(whole + frac.padEnd(decimals, '0').slice(0, decimals));
     if (amount > capRaw) {
@@ -213,7 +250,7 @@ function assertWithinTokenCap(chainId, token, data) {
 export async function localSend(chainId, to, valueWei, data) {
     assertWithinNativeCap(valueWei);
     if (data && data.length >= 10)
-        assertWithinTokenCap(chainId, to, data);
+        await assertWithinTokenCap(chainId, to, data);
     const { wallet } = clients(chainId);
     const hash = await wallet.sendTransaction({
         to,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.10.4",
+  "version": "1.10.5",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [