agentwallet-mcp 1.10.4 → 1.10.6

package/build/index.js

@@ -424,82 +424,82 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.10.4',
+    version: '1.10.6',
 }, {
-    instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
-
-## Getting Started
-1. Call list_wallets to see existing wallets, or create_wallet to make a new one.
-2. Fund the wallet by sending tokens to its address from an external source.
-3. Use transfer (native tokens) or transfer_token (ERC-20/SPL tokens) to send funds.
-
-## Supported Chains
-- **EVM chains:** Ethereum (1), Base (8453), Arbitrum (42161), Optimism (10), Polygon (137), Avalanche (43114), BSC (56), Zora (7777777), PulseChain (369)
-- **Solana:** Mainnet (900), Devnet (901)
-- Call get_chains for the full list with native tokens and stablecoin contract addresses.
-
-## EVM vs Solana
-- **Addresses:** EVM uses 0x-prefixed hex (42 chars). Solana uses Base58 (32-44 chars).
-- **Native tokens:** EVM = ETH/POL/BNB/etc (18 decimals, wei). Solana = SOL (9 decimals, lamports).
-- **Token standards:** EVM uses ERC-20. Solana uses SPL tokens.
-- **EVM-only tools:** approve_token, get_allowance, wrap_eth, unwrap_eth, call_contract, get_token_info. These do not work on Solana.
-- **Works on both:** create_wallet, transfer, transfer_token, send_transaction, sign_transaction, get_balance, get_token_balance.
-
-## Common Workflows
-
-### Send native tokens (ETH, SOL, etc.)
-Use the transfer tool with a human-readable amount (e.g. "0.1" ETH). It auto-converts to wei/lamports.
-
-### Send ERC-20 or SPL tokens
-Use transfer_token. You need: wallet_id, token contract address, recipient, amount, chain_id, and decimals (6 for USDC, 18 for most ERC-20s). Call get_chains to find stablecoin addresses.
-
-### Interact with DeFi (EVM only)
-1. Check allowance with get_allowance.
-2. If needed, call approve_token to let the DeFi contract spend your tokens.
-3. Use send_transaction with the contract's calldata to execute the interaction.
-
-### Wrap/unwrap native tokens (EVM only)
-Use wrap_eth to convert ETH → WETH (required by many DeFi protocols). Use unwrap_eth to convert back.
-
-### Read on-chain data (EVM only)
-Use call_contract for gas-free read-only calls (eth_call). Provide ABI-encoded calldata.
-
-## x402 Payments — Paying for Resources
-The pay_x402 tool handles the full x402 payment flow automatically:
-1. Fetches the URL.
-2. If the server returns HTTP 402, parses the payment requirements.
-3. Pays on-chain using your wallet.
-4. Retries the request with proof of payment.
-Always set max_payment to prevent overspending (e.g. "1.00" for max 1 USDC).
-
-## x402 Paywalls — Accepting Payments
-Create paywalls to charge other agents for accessing your resources:
-1. create_paywall — set price, token, chain, and the resource URL to protect.
-2. Share the access URL. Clients that pay on-chain get the resource; others get HTTP 402.
-3. list_paywalls and get_paywall_payments to track revenue.
-4. get_x402_revenue for aggregate stats across all paywalls.
-
-## Wallet Security
-- Use pause_wallet to immediately freeze a wallet if compromised. No transactions can be signed while paused.
-- Use unpause_wallet to resume operations.
-- Use delete_wallet to permanently disable a wallet.
-- Wallets have server-enforced spending limits.
-
-## Tool Selection Guide
-| Goal | Tool |
-|------|------|
-| Send ETH/SOL/native tokens | transfer |
-| Send USDC/ERC-20/SPL tokens | transfer_token |
-| Check native balance | get_balance |
-| Check token balance | get_token_balance |
-| Look up token details | get_token_info (EVM only) |
-| Approve DeFi spending | approve_token (EVM only) |
-| Check approval amount | get_allowance (EVM only) |
-| Read smart contract | call_contract (EVM only) |
-| Custom transaction | send_transaction |
-| Sign without broadcasting | sign_transaction |
-| Pay for x402 resource | pay_x402 |
-| Charge for your resource | create_paywall |
+    instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
+
+## Getting Started
+1. Call list_wallets to see existing wallets, or create_wallet to make a new one.
+2. Fund the wallet by sending tokens to its address from an external source.
+3. Use transfer (native tokens) or transfer_token (ERC-20/SPL tokens) to send funds.
+
+## Supported Chains
+- **EVM chains:** Ethereum (1), Base (8453), Arbitrum (42161), Optimism (10), Polygon (137), Avalanche (43114), BSC (56), Zora (7777777), PulseChain (369)
+- **Solana:** Mainnet (900), Devnet (901)
+- Call get_chains for the full list with native tokens and stablecoin contract addresses.
+
+## EVM vs Solana
+- **Addresses:** EVM uses 0x-prefixed hex (42 chars). Solana uses Base58 (32-44 chars).
+- **Native tokens:** EVM = ETH/POL/BNB/etc (18 decimals, wei). Solana = SOL (9 decimals, lamports).
+- **Token standards:** EVM uses ERC-20. Solana uses SPL tokens.
+- **EVM-only tools:** approve_token, get_allowance, wrap_eth, unwrap_eth, call_contract, get_token_info. These do not work on Solana.
+- **Works on both:** create_wallet, transfer, transfer_token, send_transaction, sign_transaction, get_balance, get_token_balance.
+
+## Common Workflows
+
+### Send native tokens (ETH, SOL, etc.)
+Use the transfer tool with a human-readable amount (e.g. "0.1" ETH). It auto-converts to wei/lamports.
+
+### Send ERC-20 or SPL tokens
+Use transfer_token. You need: wallet_id, token contract address, recipient, amount, chain_id, and decimals (6 for USDC, 18 for most ERC-20s). Call get_chains to find stablecoin addresses.
+
+### Interact with DeFi (EVM only)
+1. Check allowance with get_allowance.
+2. If needed, call approve_token to let the DeFi contract spend your tokens.
+3. Use send_transaction with the contract's calldata to execute the interaction.
+
+### Wrap/unwrap native tokens (EVM only)
+Use wrap_eth to convert ETH → WETH (required by many DeFi protocols). Use unwrap_eth to convert back.
+
+### Read on-chain data (EVM only)
+Use call_contract for gas-free read-only calls (eth_call). Provide ABI-encoded calldata.
+
+## x402 Payments — Paying for Resources
+The pay_x402 tool handles the full x402 payment flow automatically:
+1. Fetches the URL.
+2. If the server returns HTTP 402, parses the payment requirements.
+3. Pays on-chain using your wallet.
+4. Retries the request with proof of payment.
+Always set max_payment to prevent overspending (e.g. "1.00" for max 1 USDC).
+
+## x402 Paywalls — Accepting Payments
+Create paywalls to charge other agents for accessing your resources:
+1. create_paywall — set price, token, chain, and the resource URL to protect.
+2. Share the access URL. Clients that pay on-chain get the resource; others get HTTP 402.
+3. list_paywalls and get_paywall_payments to track revenue.
+4. get_x402_revenue for aggregate stats across all paywalls.
+
+## Wallet Security
+- Use pause_wallet to immediately freeze a wallet if compromised. No transactions can be signed while paused.
+- Use unpause_wallet to resume operations.
+- Use delete_wallet to permanently disable a wallet.
+- Wallets have server-enforced spending limits.
+
+## Tool Selection Guide
+| Goal | Tool |
+|------|------|
+| Send ETH/SOL/native tokens | transfer |
+| Send USDC/ERC-20/SPL tokens | transfer_token |
+| Check native balance | get_balance |
+| Check token balance | get_token_balance |
+| Look up token details | get_token_info (EVM only) |
+| Approve DeFi spending | approve_token (EVM only) |
+| Check approval amount | get_allowance (EVM only) |
+| Read smart contract | call_contract (EVM only) |
+| Custom transaction | send_transaction |
+| Sign without broadcasting | sign_transaction |
+| Pay for x402 resource | pay_x402 |
+| Charge for your resource | create_paywall |
 | Check usage/billing | get_usage |`,
 });
 // ─── Tool: create_wallet ─────────────────────────────────────────

package/build/local-solana.js

@@ -122,19 +122,46 @@ function assertWithinSolCap(lamports) {
  * AGENTWALLET_MAX_TX_TOKEN on the EVM side and uses the same variable so an
  * operator sets one token cap, not one per chain family.
  *
- * Decimals for the cap come from the trusted table when the mint is known.
- * The caller-supplied value is not used for the ceiling: an inflated one would
- * inflate the cap exactly like the x402 bypass. When the mint is unknown we
- * assume 6, the tightest common value, so it fails closed.
+ * Decimals for the cap come from the trusted table when the mint is known, then
+ * from the mint account itself, and finally 0. The caller-supplied value is
+ * never used for the ceiling: an inflated one would inflate the cap exactly
+ * like the x402 bypass.
+ *
+ * 0 is the only safe fallback. Assuming 6 for an unknown mint is what AW-001
+ * exploited: for a mint with d decimals, a ceiling evaluated at 6 is 10**(6-d)
+ * times too permissive, and SPL mints with 0 to 5 decimals are common.
  */
-function assertWithinSplCap(mint, rawAmount) {
+const splDecimalsCache = new Map();
+async function resolveMintDecimals(mint, chainId) {
+    const known = lookupTrustedDecimals(900, mint);
+    if (typeof known === 'number')
+        return known;
+    const cached = splDecimalsCache.get(mint);
+    if (typeof cached === 'number')
+        return cached;
+    try {
+        const conn = connection(chainId);
+        const info = await conn.getParsedAccountInfo(new PublicKey(mint));
+        const data = info?.value?.data;
+        const d = Number(data?.parsed?.info?.decimals);
+        if (Number.isInteger(d) && d >= 0 && d <= 36) {
+            splDecimalsCache.set(mint, d);
+            return d;
+        }
+    }
+    catch {
+        // Unreachable RPC or non-standard mint: fall through to the safe floor.
+    }
+    return 0;
+}
+async function assertWithinSplCap(mint, rawAmount, chainId = 900) {
     const cap = (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim();
     if (!cap)
         return;
     if (!/^\d+(\.\d+)?$/.test(cap)) {
         throw new Error(`AGENTWALLET_MAX_TX_TOKEN must be a decimal number, got "${cap}".`);
     }
-    const decimals = lookupTrustedDecimals(900, mint) ?? 6;
+    const decimals = await resolveMintDecimals(mint, chainId);
     const [whole, frac = ''] = cap.split('.');
     const capRaw = BigInt(whole + frac.padEnd(decimals, '0').slice(0, decimals));
     if (rawAmount > capRaw) {
@@ -252,7 +279,7 @@ function createAtaIdempotentIx(payer, ata, owner, mint, tokenProgram) {
 export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId = 900) {
     // Checked before any RPC round trip: a blocked transfer should cost nothing
     // and should not announce itself to the RPC provider first.
-    assertWithinSplCap(mintStr, BigInt(rawAmount));
+    await assertWithinSplCap(mintStr, BigInt(rawAmount), chainId);
     const conn = connection(chainId);
     const payer = getSolanaKeypair();
     const mint = new PublicKey(mintStr);

package/build/local-wallet.js

@@ -178,11 +178,48 @@ export async function localTokenBalance(chainId, token) {
  * waiting to happen.
  *
  * Opt-in via AGENTWALLET_MAX_TX_TOKEN, expressed in human units of the token.
- * When the token's decimals are not known locally we assume 6, the smallest in
- * common use, which makes the raw ceiling the tightest one and fails closed
- * rather than open.
+ *
+ * Decimals decide the ceiling, so getting them wrong breaks the guard. They are
+ * resolved in this order: the trusted registry, then the token's own decimals()
+ * on chain (cached), and finally 0. Assuming 0 for an unresolvable token is the
+ * only value that cannot fail open: any real token has decimals >= 0, so a cap
+ * evaluated at 0 is never larger than the true one.
+ *
+ * Do not "assume 6 because it is the smallest in common use". It is not: GUSD
+ * and EURS use 2, and some tokens use 0. For a token with d decimals, a ceiling
+ * evaluated at 6 is 10**(6-d) times too permissive, which is how AW-001 let a
+ * 2-decimal token move 10,000x the configured cap.
  */
-function assertWithinTokenCap(chainId, token, data) {
+const decimalsCache = new Map();
+async function resolveTokenDecimals(chainId, token) {
+    const known = lookupTrustedDecimals(chainId, token);
+    if (typeof known === 'number')
+        return known;
+    const key = `${chainId}:${token.toLowerCase()}`;
+    const cached = decimalsCache.get(key);
+    if (typeof cached === 'number')
+        return cached;
+    try {
+        const { pub } = clients(chainId);
+        const onChain = await pub.readContract({
+            address: token,
+            abi: ERC20_ABI,
+            functionName: 'decimals',
+        });
+        const d = Number(onChain);
+        // Reject nonsense rather than trusting it; an out-of-range value would
+        // widen the ceiling exactly like the old assumption did.
+        if (Number.isInteger(d) && d >= 0 && d <= 36) {
+            decimalsCache.set(key, d);
+            return d;
+        }
+    }
+    catch {
+        // Unreachable RPC, non-standard token, anything at all: fall through to 0.
+    }
+    return 0;
+}
+async function assertWithinTokenCap(chainId, token, data) {
     const cap = (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim();
     if (!cap)
         return;
@@ -200,7 +237,7 @@ function assertWithinTokenCap(chainId, token, data) {
     if (word.length !== 64)
         return; // malformed; leave it to the node to reject
     const amount = BigInt('0x' + word);
-    const decimals = lookupTrustedDecimals(chainId, token) ?? 6;
+    const decimals = await resolveTokenDecimals(chainId, token);
     const [whole, frac = ''] = cap.split('.');
     const capRaw = BigInt(whole + frac.padEnd(decimals, '0').slice(0, decimals));
     if (amount > capRaw) {
@@ -213,7 +250,7 @@ function assertWithinTokenCap(chainId, token, data) {
 export async function localSend(chainId, to, valueWei, data) {
     assertWithinNativeCap(valueWei);
     if (data && data.length >= 10)
-        assertWithinTokenCap(chainId, to, data);
+        await assertWithinTokenCap(chainId, to, data);
     const { wallet } = clients(chainId);
     const hash = await wallet.sendTransaction({
         to,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.10.4",
+  "version": "1.10.6",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [