agentwallet-mcp 1.12.4 → 1.12.5

package/README.md

@@ -43,7 +43,7 @@ Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key
 
 `AGENTWALLET_MAX_TX_NATIVE` is a per-transaction ceiling in native units (ETH, MATIC and so on). In hosted mode the server enforces limits; in local mode there is no server, so these guards are the only ones there are. Set them.
 
-`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance` and Permit2 `approve`, the approvals because an unbounded allowance is a drain waiting to happen. Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open.
+`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance` and Permit2 `approve`, the approvals because an unbounded allowance is a drain waiting to happen. Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed; a contract counts as "other" only when it demonstrably declines `decimals()`, so an absurd or malformed answer, or an RPC that cannot be reached, refuses rather than allows. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open.
 
 ### Solana local signing
 

package/build/index.js

@@ -467,7 +467,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.12.4',
+    version: '1.12.5',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 

package/build/local-wallet.js

@@ -15,7 +15,7 @@
  * on the custodial path and say so explicitly rather than silently downgrading.
  */
 import { readFileSync } from 'node:fs';
-import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, } from 'viem';
+import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, BaseError, ContractFunctionZeroDataError, ContractFunctionRevertedError, ExecutionRevertedError, AbiDecodingDataSizeTooSmallError, AbiDecodingDataSizeInvalidError, } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { lookupTrustedDecimals } from './x402-payment.js';
 import { typedDataFor } from './x402-eip3009.js';
@@ -195,8 +195,7 @@ export async function localTokenBalance(chainId, token) {
 const decimalsCache = new Map();
 /**
  * Decimals for `token`: the trusted registry, then the contract's own
- * decimals() (cached on success). Null when the address does not answer like
- * an ERC-20 at all, which is how the guard tells a token from a router.
+ * decimals() (cached on success). See DecimalsProbe for the other outcomes.
  */
 async function probeTokenDecimals(chainId, token) {
     const known = lookupTrustedDecimals(chainId, token);
@@ -206,28 +205,47 @@ async function probeTokenDecimals(chainId, token) {
     const cached = decimalsCache.get(key);
     if (typeof cached === 'number')
         return cached;
+    let onChain;
     try {
         const { pub } = clients(chainId);
-        const onChain = await pub.readContract({
+        onChain = await pub.readContract({
             address: token,
             abi: ERC20_ABI,
             functionName: 'decimals',
         });
-        const d = Number(onChain);
-        // Reject nonsense rather than trusting it; an out-of-range value would
-        // widen the ceiling exactly like the old assumption did.
-        if (Number.isInteger(d) && d >= 0 && d <= 36) {
-            decimalsCache.set(key, d);
-            return d;
-        }
     }
-    catch {
-        // Unreachable RPC, non-standard token, not a token at all.
+    catch (err) {
+        // viem wraps every readContract failure in ContractFunctionExecutionError;
+        // the cause says whether the contract itself declined (revert, empty
+        // return: not an ERC-20) or the answer never arrived (RPC down, timeout,
+        // malformed response). Only the first is evidence of anything.
+        const declined = err instanceof BaseError && err.walk((e) => e instanceof ContractFunctionZeroDataError
+            || e instanceof ContractFunctionRevertedError
+            || e instanceof ExecutionRevertedError // nodes that report a revert as -32000 rather than 3
+        ) !== null;
+        if (declined)
+            return 'not-a-token';
+        // A decode failure on non-empty data means the contract answered
+        // decimals() with something that is not a uint8: a token, just a broken one.
+        const decodeFailed = err instanceof BaseError && err.walk((e) => e instanceof AbiDecodingDataSizeTooSmallError || e instanceof AbiDecodingDataSizeInvalidError) !== null;
+        return decodeFailed ? 'unusable' : 'unreachable';
     }
-    return null;
+    const d = Number(onChain);
+    // Reject nonsense rather than trusting it; an out-of-range value would
+    // widen the ceiling exactly like the old assumption did.
+    if (Number.isInteger(d) && d >= 0 && d <= 36) {
+        decimalsCache.set(key, d);
+        return d;
+    }
+    return 'unusable';
 }
+/**
+ * Decimals to price a known transfer or approval at. Anything short of a
+ * usable answer is evaluated at 0, the only value that cannot fail open.
+ */
 async function resolveTokenDecimals(chainId, token) {
-    return (await probeTokenDecimals(chainId, token)) ?? 0;
+    const probe = await probeTokenDecimals(chainId, token);
+    return typeof probe === 'number' ? probe : 0;
 }
 /** Canonical Permit2, the same address on every EVM chain it is deployed to. */
 const PERMIT2 = '0x000000000022d473030f116ddee9f6b43ac78ba3';
@@ -263,12 +281,18 @@ async function assertWithinTokenCap(chainId, to, data) {
     if (!priced) {
         if (process.env.AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS === '1')
             return;
-        const looksLikeToken = isPermit2 || (await probeTokenDecimals(chainId, to)) !== null;
-        if (looksLikeToken) {
-            throw new Error(`Blocked by local guard: calldata selector 0x${selector} sent to ` +
-                `${isPermit2 ? 'Permit2' : 'a token contract'} is not one AGENTWALLET_MAX_TX_TOKEN can price, ` +
-                `so it is refused rather than let through uncapped. Use transfer, transferFrom, approve, ` +
-                `increaseAllowance or Permit2 approve, or set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1 to allow it deliberately.`);
+        // Only a contract that demonstrably declines decimals() is let through.
+        // "Answered nonsense" and "could not ask" both refuse: the first is a
+        // token with a broken or hostile decimals(), the second is no evidence at
+        // all, and this guard does not allow on no evidence (2026-09-26 report).
+        const probe = isPermit2 ? 'unusable' : await probeTokenDecimals(chainId, to);
+        if (probe !== 'not-a-token') {
+            const why = probe === 'unreachable'
+                ? `the RPC for chain ${chainId} could not be reached to classify the target, so the guard cannot tell a token from a router`
+                : `the target is ${isPermit2 ? 'Permit2' : 'a token contract'} and this calldata is not one AGENTWALLET_MAX_TX_TOKEN can price`;
+            throw new Error(`Blocked by local guard: calldata selector 0x${selector} refused rather than let through uncapped: ${why}. ` +
+                `Use transfer, transferFrom, approve, increaseAllowance or Permit2 approve, ` +
+                `or set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1 to allow it deliberately.`);
         }
         return; // an ordinary contract call; it can only pull what an approval already allowed
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.12.4",
+  "version": "1.12.5",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [