mppx 0.8.0 → 0.8.2

package/src/tempo/internal/fee-payer.test.ts

@@ -499,6 +499,10 @@ describe('fillHostedFeePayerTransaction', () => {
     signature: { r: 1n, s: 1n, yParity: 0 } as any,
     validBefore: Math.floor(Date.now() / 1_000) + 300,
   } as const
+  const hostedContext = {
+    chainId: defaults.chainId.mainnet,
+    details,
+  } as const
 
   test('uses hosted fillTransaction and preserves sender-committed fields', async () => {
     // Sign over the payload built from the actual RPC request body so this
@@ -569,6 +573,7 @@ describe('fillHostedFeePayerTransaction', () => {
 
     const result = await fillHostedFeePayerTransaction({
       allowedFeeTokens: defaultAllowedFeeTokens(defaults.chainId.mainnet),
+      ...hostedContext,
       transaction: hostedTransaction as any,
       url: 'https://sponsor.example/tp_key',
     })
@@ -621,6 +626,7 @@ describe('fillHostedFeePayerTransaction', () => {
     await expect(
       fillHostedFeePayerTransaction({
         allowedFeeTokens: defaultAllowedFeeTokens(defaults.chainId.mainnet),
+        ...hostedContext,
         transaction: hostedTransaction as any,
         url: 'https://sponsor.example/tp_key',
       }),
@@ -643,6 +649,7 @@ describe('fillHostedFeePayerTransaction', () => {
     await expect(
       fillHostedFeePayerTransaction({
         allowedFeeTokens: defaultAllowedFeeTokens(defaults.chainId.mainnet),
+        ...hostedContext,
         transaction: hostedTransaction as any,
         url: 'https://sponsor.example/tp_key',
       }),
@@ -663,11 +670,69 @@ describe('fillHostedFeePayerTransaction', () => {
     await expect(
       fillHostedFeePayerTransaction({
         allowedFeeTokens: defaultAllowedFeeTokens(defaults.chainId.mainnet),
+        ...hostedContext,
         transaction: hostedTransaction as any,
         url: 'https://sponsor.example/tp_key',
       }),
     ).rejects.toThrow('Invalid or revoked API key')
   })
+
+  test('error: enforces sponsor policy before requesting hosted fill', async () => {
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      fillHostedFeePayerTransaction({
+        allowedFeeTokens: defaultAllowedFeeTokens(defaults.chainId.mainnet),
+        ...hostedContext,
+        policy: { maxGas: hostedTransaction.gas - 1n },
+        transaction: hostedTransaction as any,
+        url: 'https://sponsor.example/tp_key',
+      }),
+    ).rejects.toThrow('gas exceeds sponsor policy')
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  test('error: rejects non-empty access lists before requesting hosted fill', async () => {
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      fillHostedFeePayerTransaction({
+        allowedFeeTokens: defaultAllowedFeeTokens(defaults.chainId.mainnet),
+        ...hostedContext,
+        transaction: {
+          ...hostedTransaction,
+          accessList: [{ address: bogus, storageKeys: [] }],
+        } as any,
+        url: 'https://sponsor.example/tp_key',
+      }),
+    ).rejects.toThrow('accessList is not allowed')
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  test('error: rejects padded calldata before requesting hosted fill', async () => {
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      fillHostedFeePayerTransaction({
+        allowedFeeTokens: defaultAllowedFeeTokens(defaults.chainId.mainnet),
+        ...hostedContext,
+        transaction: {
+          ...hostedTransaction,
+          calls: [
+            {
+              ...hostedTransaction.calls[0],
+              data: `${hostedTransaction.calls[0]!.data}01`,
+            },
+          ],
+        } as any,
+        url: 'https://sponsor.example/tp_key',
+      }),
+    ).rejects.toThrow('calldata is not canonical')
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
 })
 
 describe('simulationTransaction', () => {
@@ -948,4 +1013,69 @@ describe('prepareSponsoredTransaction', () => {
       }),
     ).toThrow('validity window exceeds sponsor policy')
   })
+
+  test('error: rejects non-empty access lists', () => {
+    expect(() =>
+      prepareSponsoredTransaction({
+        account: sponsor,
+        chainId: 42431,
+        details,
+        allowedFeeTokens: [bogus],
+        transaction: {
+          ...baseTransaction,
+          accessList: [{ address: bogus, storageKeys: [] }],
+        } as any,
+      }),
+    ).toThrow('accessList is not allowed')
+  })
+
+  test('error: rejects padded calldata', () => {
+    expect(() =>
+      prepareSponsoredTransaction({
+        account: sponsor,
+        chainId: 42431,
+        details,
+        allowedFeeTokens: [bogus],
+        transaction: {
+          ...baseTransaction,
+          calls: [
+            {
+              ...baseTransaction.calls[0],
+              data: `${baseTransaction.calls[0]!.data}01`,
+            },
+          ],
+        } as any,
+      }),
+    ).toThrow('calldata is not canonical')
+  })
+
+  test('error: rejects missing calls', () => {
+    expect(() =>
+      prepareSponsoredTransaction({
+        account: sponsor,
+        chainId: 42431,
+        details,
+        allowedFeeTokens: [bogus],
+        transaction: {
+          ...baseTransaction,
+          calls: undefined,
+        } as any,
+      }),
+    ).toThrow('must declare calls')
+  })
+
+  test('error: rejects nonzero call value', () => {
+    expect(() =>
+      prepareSponsoredTransaction({
+        account: sponsor,
+        chainId: 42431,
+        details,
+        allowedFeeTokens: [bogus],
+        transaction: {
+          ...baseTransaction,
+          calls: [{ ...baseTransaction.calls[0], value: 1n }],
+        } as any,
+      }),
+    ).toThrow('call value is not allowed')
+  })
 })

package/src/tempo/internal/fee-payer.ts

@@ -3,7 +3,7 @@ import type { TempoAddress } from 'ox/tempo'
 import { TxEnvelopeTempo } from 'ox/tempo'
 import type { Hex } from 'viem'
 import type { Account } from 'viem'
-import { decodeFunctionData, maxUint256, toHex } from 'viem'
+import { decodeFunctionData, encodeFunctionData, maxUint256, toHex } from 'viem'
 import { Abis, Addresses, Transaction } from 'viem/tempo'
 
 import * as TempoAddress_internal from './address.js'
@@ -181,10 +181,22 @@ function hostedFeePayerRequest(transaction: SponsoredTransaction) {
  */
 export async function fillHostedFeePayerTransaction(parameters: {
   allowedFeeTokens: readonly TempoAddress.Address[]
+  challengeExpires?: string | undefined
+  chainId: number
+  details: Record<string, string>
+  policy?: Partial<Policy> | undefined
   transaction: SponsoredTransaction
   url: string
 }) {
-  const { allowedFeeTokens, transaction, url } = parameters
+  const { allowedFeeTokens, challengeExpires, chainId, details, policy, transaction, url } =
+    parameters
+  assertTransactionPolicy({
+    challengeExpires,
+    chainId,
+    details,
+    policy,
+    transaction,
+  })
   const response = await fetch(url, {
     body: JSON.stringify(
       {
@@ -307,6 +319,74 @@ function isExpiringNonceKey(nonceKey: SponsoredTransaction['nonceKey']): boolean
   return nonceKey === 'expiring' || nonceKey === maxUint256
 }
 
+const sponsoredCallAbi = [...Abis.tip20, ...Abis.stablecoinDex] as const
+const sponsoredCallSelectors = new Set([
+  Selectors.approve,
+  Selectors.transfer,
+  Selectors.transferWithMemo,
+  Selectors.swapExactAmountOut,
+])
+
+function canonicalSponsoredCallData(
+  data: Hex,
+  call: string,
+  fail: (reason: string, extra?: Record<string, string>) => never,
+) {
+  if (!sponsoredCallSelectors.has(data.slice(0, 10) as Hex)) return undefined
+
+  let decoded: ReturnType<typeof decodeFunctionData<typeof sponsoredCallAbi>>
+  try {
+    decoded = decodeFunctionData({ abi: sponsoredCallAbi, data })
+  } catch {
+    fail('fee-sponsored transaction call calldata is invalid', { call })
+  }
+  return encodeFunctionData({
+    abi: sponsoredCallAbi,
+    functionName: decoded.functionName,
+    args: decoded.args,
+  })
+}
+
+/**
+ * Rejects sponsored transaction fields that increase intrinsic gas without
+ * changing the decoded payment intent.
+ */
+function assertCanonicalSponsoredTransaction(
+  transaction: SponsoredTransaction,
+  fail: (reason: string, extra?: Record<string, string>) => never,
+) {
+  if (transaction.accessList !== undefined && transaction.accessList.length > 0)
+    fail('fee-sponsored transaction accessList is not allowed', {
+      accessListEntries: String(transaction.accessList.length),
+    })
+
+  const calls = transaction.calls
+  if (!Array.isArray(calls) || calls.length === 0)
+    fail('fee-sponsored transaction must declare calls')
+
+  for (const [index, call] of calls.entries()) {
+    const callIndex = String(index)
+    const value = call.value
+    if (value !== undefined && value !== 0n)
+      fail('fee-sponsored transaction call value is not allowed', {
+        call: callIndex,
+        value: value.toString(),
+      })
+
+    const data = call.data
+    if (!data)
+      fail('fee-sponsored transaction call is missing calldata', {
+        call: callIndex,
+      })
+
+    const canonical = canonicalSponsoredCallData(data, callIndex, fail)
+    if (canonical && data.toLowerCase() !== canonical.toLowerCase())
+      fail('fee-sponsored transaction call calldata is not canonical', {
+        call: callIndex,
+      })
+  }
+}
+
 /** Validates that a set of transaction calls matches an allowed fee-payer pattern. */
 export function validateCalls(
   calls: readonly { data?: `0x${string}` | undefined; to?: TempoAddress.Address | undefined }[],
@@ -433,9 +513,8 @@ export function validateCalls(
   }
 }
 
-export function prepareSponsoredTransaction(parameters: {
-  account: Account
-  allowedFeeTokens?: readonly TempoAddress.Address[] | undefined
+/** Validates sponsor fee policy limits for a fee-payer transaction. */
+export function assertTransactionPolicy(parameters: {
   challengeExpires?: string | undefined
   chainId: number
   details: Record<string, string>
@@ -444,8 +523,6 @@ export function prepareSponsoredTransaction(parameters: {
   transaction: SponsoredTransaction
 }) {
   const {
-    account,
-    allowedFeeTokens,
     challengeExpires,
     chainId,
     details,
@@ -454,22 +531,12 @@ export function prepareSponsoredTransaction(parameters: {
     transaction,
   } = parameters
   const policy = getPolicy(chainId, policyOverrides)
-  const transactionRecord = transaction as Record<string, unknown>
-
   const {
-    accessList,
-    calls,
     chainId: transactionChainId,
-    feeToken,
-    from,
     gas,
-    keyAuthorization,
     maxFeePerGas,
     maxPriorityFeePerGas,
-    nonce,
     nonceKey,
-    signature,
-    validAfter,
     validBefore,
   } = transaction
 
@@ -477,25 +544,6 @@ export function prepareSponsoredTransaction(parameters: {
     throw new FeePayerValidationError(reason, { ...details, ...extra })
   }
 
-  const unsupportedKeys = Object.entries(transaction).flatMap(([key, value]) => {
-    if (value === undefined) return []
-    if (supportedTransactionKeys.has(key)) return []
-    return [key]
-  })
-  if (unsupportedKeys.length > 0)
-    fail('fee-sponsored transaction contains unsupported fields', {
-      unsupportedFields: unsupportedKeys.join(', '),
-    })
-
-  const rejectedKeys = rejectedTransactionKeys.filter((key) => {
-    const value = transactionRecord[key]
-    return value !== undefined && value !== null
-  })
-  if (rejectedKeys.length > 0)
-    fail('fee-sponsored transaction contains rejected fields', {
-      rejectedFields: rejectedKeys.join(', '),
-    })
-
   if (transaction.type !== undefined && transaction.type !== 'tempo')
     fail('fee-sponsored transaction type is invalid', {
       type: String(transaction.type),
@@ -506,6 +554,8 @@ export function prepareSponsoredTransaction(parameters: {
       chainId: String(transactionChainId),
     })
 
+  assertCanonicalSponsoredTransaction(transaction, fail)
+
   if (gas === undefined || gas <= 0n) fail('fee-sponsored transaction must declare gas')
   const gasLimit = gas
   if (gasLimit > policy.maxGas)
@@ -562,6 +612,77 @@ export function prepareSponsoredTransaction(parameters: {
       validBefore: String(validBeforeValue),
     })
 
+  return { gasLimit, maxFeePerGasValue, validBeforeValue }
+}
+
+export function prepareSponsoredTransaction(parameters: {
+  account: Account
+  allowedFeeTokens?: readonly TempoAddress.Address[] | undefined
+  challengeExpires?: string | undefined
+  chainId: number
+  details: Record<string, string>
+  now?: Date | undefined
+  policy?: Partial<Policy> | undefined
+  transaction: SponsoredTransaction
+}) {
+  const {
+    account,
+    allowedFeeTokens,
+    challengeExpires,
+    chainId,
+    details,
+    now = new Date(),
+    policy: policyOverrides,
+    transaction,
+  } = parameters
+  const transactionRecord = transaction as Record<string, unknown>
+
+  const {
+    accessList,
+    calls,
+    chainId: transactionChainId,
+    feeToken,
+    from,
+    keyAuthorization,
+    maxPriorityFeePerGas,
+    nonce,
+    nonceKey,
+    signature,
+    validAfter,
+  } = transaction
+
+  const fail = (reason: string, extra: Record<string, string> = {}) => {
+    throw new FeePayerValidationError(reason, { ...details, ...extra })
+  }
+
+  const unsupportedKeys = Object.entries(transaction).flatMap(([key, value]) => {
+    if (value === undefined) return []
+    if (supportedTransactionKeys.has(key)) return []
+    return [key]
+  })
+  if (unsupportedKeys.length > 0)
+    fail('fee-sponsored transaction contains unsupported fields', {
+      unsupportedFields: unsupportedKeys.join(', '),
+    })
+
+  const rejectedKeys = rejectedTransactionKeys.filter((key) => {
+    const value = transactionRecord[key]
+    return value !== undefined && value !== null
+  })
+  if (rejectedKeys.length > 0)
+    fail('fee-sponsored transaction contains rejected fields', {
+      rejectedFields: rejectedKeys.join(', '),
+    })
+
+  const { gasLimit, maxFeePerGasValue, validBeforeValue } = assertTransactionPolicy({
+    challengeExpires,
+    chainId,
+    details,
+    now,
+    policy: policyOverrides,
+    transaction,
+  })
+
   const normalizedFeeToken = (() => {
     if (feeToken === undefined) return undefined
     if (typeof feeToken !== 'string') fail('fee-sponsored transaction feeToken is invalid')

package/src/tempo/server/Charge.ts

@@ -441,6 +441,10 @@ export function charge<const parameters extends charge.Parameters>(
               if (feePayerUrl && isFeePayerTx) {
                 const hosted = await FeePayer.fillHostedFeePayerTransaction({
                   allowedFeeTokens,
+                  challengeExpires: expires,
+                  chainId: chainId ?? client.chain!.id,
+                  details: { amount, currency, recipient },
+                  policy: feePayerPolicy,
                   transaction,
                   url: feePayerUrl,
                 })

package/src/tempo/server/internal/html/package.json

@@ -3,8 +3,8 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "accounts": "0.14.9",
+    "accounts": "0.14.11",
     "mppx": "workspace:*",
-    "viem": "2.52.2"
+    "viem": "2.53.1"
   }
 }