mppx 0.8.9 → 0.8.11

package/src/tempo/internal/fee-payer.test.ts

@@ -11,8 +11,10 @@ import {
   defaultAllowedFeeTokens,
   FeePayerValidationError,
   fillHostedFeePayerTransaction,
+  preflightSponsorship,
   prepareSponsoredTransaction,
   simulationTransaction,
+  sponsoredSimulationTransaction,
   validateCalls,
 } from './fee-payer.js'
 import * as Selectors from './selectors.js'
@@ -768,6 +770,97 @@ describe('simulationTransaction', () => {
       feePayerSignature: undefined,
     })
   })
+
+  test('builds the final sponsored envelope without either signature', () => {
+    const transaction = {
+      calls: [{ to: bogus }],
+      feePayerSignature,
+      feeToken: swapTokenIn,
+      from: bogus,
+      signature: { r: 1n, s: 2n, yParity: 0 },
+    }
+
+    expect(
+      sponsoredSimulationTransaction(transaction as any, {
+        feePayer: swapTokenOut,
+        feeToken: bogus,
+      }),
+    ).toEqual({
+      ...transaction,
+      account: bogus,
+      calls: transaction.calls,
+      feePayer: swapTokenOut,
+      feePayerSignature: undefined,
+      feeToken: bogus,
+      signature: undefined,
+    })
+  })
+})
+
+describe('preflightSponsorship', () => {
+  const transaction = {
+    calls: [{ to: bogus }],
+    feeToken: swapTokenIn,
+    from: bogus,
+  }
+
+  test('simulates the sender before completion and the completed envelope after', async () => {
+    const simulations: Record<string, unknown>[] = []
+    let completions = 0
+
+    const result = await preflightSponsorship({
+      transaction: transaction as any,
+      async simulate(request) {
+        simulations.push(request)
+      },
+      async complete() {
+        completions += 1
+        return { feePayer: swapTokenOut, transaction: transaction as any }
+      },
+    })
+
+    expect(completions).toBe(1)
+    expect(result.feePayer).toBe(swapTokenOut)
+    expect(simulations).toEqual([
+      { account: bogus, calls: transaction.calls },
+      {
+        ...transaction,
+        account: bogus,
+        calls: transaction.calls,
+        feePayer: swapTokenOut,
+        feePayerSignature: undefined,
+        signature: undefined,
+      },
+    ])
+  })
+
+  test.each([
+    { completeCalls: 0, failingSimulation: 1, simulationCalls: 1 },
+    { completeCalls: 1, failingSimulation: 2, simulationCalls: 2 },
+  ])(
+    'stops at simulation $failingSimulation',
+    async ({ completeCalls, failingSimulation, simulationCalls }) => {
+      let completions = 0
+      let simulations = 0
+
+      await expect(
+        preflightSponsorship({
+          transaction: transaction as any,
+          async simulate() {
+            simulations += 1
+            if (simulations === failingSimulation) throw new Error('simulation failed')
+          },
+          async complete() {
+            completions += 1
+            return { feePayer: swapTokenOut, transaction: transaction as any }
+          },
+        }),
+      ).rejects.toThrow('simulation failed')
+
+      expect(completions).toBe(completeCalls)
+      expect(simulations).toBe(simulationCalls)
+    },
+  )
 })
 
 describe('prepareSponsoredTransaction', () => {

package/src/tempo/internal/fee-payer.ts

@@ -228,7 +228,7 @@ export async function fillHostedFeePayerTransaction(parameters: {
     ...(filled.feePayerSignature as Record<string, unknown>),
     yParity: Number((filled.feePayerSignature as { yParity?: unknown }).yParity),
   }
-  const feeToken = filled.feeToken
+  const feeToken = filled.feeToken as TempoAddress.Address
 
   // Recover the concrete sponsor address so the simulation can use a concrete
   // `feePayer` (the node rejects `eth_call` with `feePayer: true`).
@@ -266,7 +266,14 @@ export async function fillHostedFeePayerTransaction(parameters: {
   }
 }
 
-/** Returns a transaction shape suitable for pre-broadcast simulation. */
+/**
+ * Returns a transaction shape suitable for pre-broadcast simulation.
+ *
+ * Sponsored transactions are first simulated as calls from the sender with no
+ * fee fields or signatures. This checks call execution without requiring the
+ * sender to hold the fee token; transferred value and call-level balances are
+ * still checked by the RPC.
+ */
 export function simulationTransaction(
   transaction: SponsoredTransaction,
   options: { feePayer: boolean },
@@ -284,6 +291,61 @@ export function simulationTransaction(
   }
 }
 
+/**
+ * Returns the final fee-sponsored transaction shape for pre-broadcast
+ * simulation. RPC `eth_call` does not carry either transaction signature.
+ */
+export function sponsoredSimulationTransaction(
+  transaction: SponsoredTransaction,
+  options: { feePayer: TempoAddress.Address; feeToken?: TempoAddress.Address | undefined },
+) {
+  const { feePayer, feeToken } = options
+  return {
+    ...transaction,
+    account: transaction.from,
+    calls: transaction.calls,
+    feePayer,
+    feePayerSignature: undefined,
+    ...(feeToken !== undefined ? { feeToken } : {}),
+    signature: undefined,
+  }
+}
+
+/** A completed sponsorship envelope that can be simulated before signing or broadcast. */
+export type PreflightSponsorship = {
+  feePayer: TempoAddress.Address
+  feeToken?: TempoAddress.Address | undefined
+  transaction: SponsoredTransaction
+}
+
+/**
+ * Runs execution-only sender and final-envelope simulations around sponsorship.
+ *
+ * First, it simulates the calls with the sender as `from`, omitting fee fields
+ * and signatures so the sender's fee balance is irrelevant. Next, `complete`
+ * resolves the sponsor and produces the co-signed transaction. Finally, it
+ * simulates that transaction with its concrete fee payer and fee token.
+ *
+ * `complete` runs only after sender-context execution succeeds, so a reverting
+ * transaction never reaches a local signer or hosted fee-payer.
+ */
+export async function preflightSponsorship<sponsorship extends PreflightSponsorship>(parameters: {
+  complete: () => Promise<sponsorship>
+  simulate: (request: Record<string, unknown>) => Promise<unknown>
+  transaction: SponsoredTransaction
+}): Promise<sponsorship> {
+  const { complete, simulate, transaction } = parameters
+  await simulate(simulationTransaction(transaction, { feePayer: true }))
+  const completed = await complete()
+  await simulate(
+    sponsoredSimulationTransaction(completed.transaction, {
+      feePayer: completed.feePayer,
+      feeToken: completed.feeToken,
+    }),
+  )
+  return completed
+}
+
 /**
  * maxTotalFee must be high enough to cover `transferWithMemo` and
  * swap transactions at peak gas prices. Bumped from 0.01 ETH in #327.

package/src/tempo/internal/fee-token.test.ts

@@ -77,6 +77,43 @@ describe.runIf(isLocalnet)('resolveFeeToken', () => {
     expectAddress(feeToken, asset)
   })
 
+  test('prioritizes funded allowed candidates', async () => {
+    const account = testAccount()
+    const client = clientFor(account)
+    await fundAccount({ address: account.address, token: asset })
+    await fundAccount({ address: account.address, token: Addresses.pathUsd })
+    await Actions.fee.setUserTokenSync(client, {
+      feeToken: asset,
+      token: asset,
+    } as never)
+
+    const feeToken = await resolveFeeToken({
+      account: account.address,
+      allowedTokens: [Addresses.pathUsd, asset],
+      candidateTokens: [Addresses.pathUsd, asset],
+      client,
+      prioritizeCandidates: true,
+    })
+
+    expectAddress(feeToken, Addresses.pathUsd)
+  })
+
+  test('falls through prioritized candidates when pathUSD is unfunded', async () => {
+    const account = testAccount()
+    const client = clientFor(account)
+    await fundAccount({ address: account.address, token: asset })
+
+    const feeToken = await resolveFeeToken({
+      account: account.address,
+      allowedTokens: [Addresses.pathUsd, asset],
+      candidateTokens: [Addresses.pathUsd, asset],
+      client,
+      prioritizeCandidates: true,
+    })
+
+    expectAddress(feeToken, asset)
+  })
+
   test('uses a funded chain fee token when configured', async () => {
     const account = testAccount()
     const client = createClient({

package/src/tempo/internal/fee-token.ts

@@ -4,8 +4,17 @@ import { Actions, TokenId } from 'viem/tempo'
 import * as TempoAddress from './address.js'
 import * as defaults from './defaults.js'
 
-function pushUnique(tokens: Address[], token: Address | undefined) {
+function pushUnique(
+  tokens: Address[],
+  token: Address | undefined,
+  allowedTokens?: readonly Address[] | undefined,
+) {
   if (!token) return
+  if (
+    allowedTokens &&
+    !allowedTokens.some((allowedToken) => TempoAddress.isEqual(allowedToken, token))
+  )
+    return
   if (tokens.some((t) => TempoAddress.isEqual(t, token))) return
   tokens.push(token)
 }
@@ -27,21 +36,33 @@ function getChainFeeToken(client: Client): Address | undefined {
   return chainId ? defaults.currency[chainId as keyof typeof defaults.currency] : undefined
 }
 
+/**
+ * Resolves a funded fee token from account, chain, and caller-supplied preferences.
+ *
+ * `prioritizeCandidates` checks candidate tokens before account and chain
+ * preferences. `allowedTokens` limits every preference to the caller's policy.
+ */
 export async function resolveFeeToken(parameters: {
   account: Address
+  allowedTokens?: readonly Address[] | undefined
   candidateTokens?: readonly Address[] | undefined
   client: Client
+  prioritizeCandidates?: boolean | undefined
 }): Promise<Address | undefined> {
-  const { account, candidateTokens, client } = parameters
+  const { account, allowedTokens, candidateTokens, client, prioritizeCandidates } = parameters
   const tokens: Address[] = []
 
+  if (prioritizeCandidates)
+    for (const token of candidateTokens ?? []) pushUnique(tokens, token, allowedTokens)
+
   const userToken = await Actions.fee
     .getUserToken(client as never, { account })
     .then((token) => token?.address as Address | undefined)
     .catch(() => undefined)
-  pushUnique(tokens, userToken)
-  pushUnique(tokens, getChainFeeToken(client))
-  for (const token of candidateTokens ?? []) pushUnique(tokens, token)
+  pushUnique(tokens, userToken, allowedTokens)
+  pushUnique(tokens, getChainFeeToken(client), allowedTokens)
+  if (!prioritizeCandidates)
+    for (const token of candidateTokens ?? []) pushUnique(tokens, token, allowedTokens)
 
   for (const token of tokens) {
     if (await hasBalance(client, account, token)) return token

package/src/tempo/legacy/session/Chain.test.ts

@@ -457,7 +457,7 @@ describe.runIf(isLocalnet)('on-chain', () => {
       ).rejects.toThrow('gas exceeds sponsor policy')
     })
 
-    test('fee-payer: simulates open before broadcasting', async () => {
+    test('fee-payer: simulates open before broadcasting and recovers duplicate opens', async () => {
       const rpcMethods: string[] = []
       const interceptingClient = createClient({
         account: accounts[0],
@@ -521,6 +521,22 @@ describe.runIf(isLocalnet)('on-chain', () => {
       expect(broadcastIndex).toBeGreaterThan(-1)
       expect(simulationIndex).toBeGreaterThan(-1)
       expect(simulationIndex).toBeLessThan(broadcastIndex)
+      expect(
+        rpcMethods.slice(0, broadcastIndex).filter((method) => method === 'eth_call'),
+      ).toHaveLength(2)
+
+      const recovered = await broadcastOpenTransaction({
+        client: interceptingClient,
+        serializedTransaction,
+        escrowContract,
+        channelId,
+        recipient,
+        currency,
+        feePayer: accounts[0],
+      })
+
+      expect(recovered.txHash).toBeUndefined()
+      expect(recovered.onChain.deposit).toBe(deposit)
     })
 
     test('fee-payer: rejects smuggled second open call', async () => {
@@ -620,6 +636,17 @@ describe.runIf(isLocalnet)('on-chain', () => {
     })
 
     test('waitForConfirmation: false returns derived on-chain state', async () => {
+      const rpcMethods: string[] = []
+      const interceptingClient = createClient({
+        account: accounts[0],
+        chain: client.chain,
+        transport: custom({
+          async request(args: any) {
+            rpcMethods.push(args.method)
+            return client.transport.request(args)
+          },
+        }),
+      })
       const salt = nextSalt()
       const deposit = 10_000_000n
 
@@ -633,7 +660,7 @@ describe.runIf(isLocalnet)('on-chain', () => {
       })
 
       const result = await broadcastOpenTransaction({
-        client,
+        client: interceptingClient,
         serializedTransaction,
         escrowContract,
         channelId,
@@ -649,6 +676,52 @@ describe.runIf(isLocalnet)('on-chain', () => {
       expect(result.onChain.deposit).toBe(deposit)
       expect(result.onChain.settled).toBe(0n)
       expect(result.onChain.finalized).toBe(false)
+      const simulationIndex = rpcMethods.indexOf('eth_call')
+      const broadcastIndex = rpcMethods.indexOf('eth_sendRawTransaction')
+      expect(simulationIndex).toBeGreaterThan(-1)
+      expect(broadcastIndex).toBeGreaterThan(-1)
+      expect(simulationIndex).toBeLessThan(broadcastIndex)
+    })
+
+    test('fee-payer relay: optimistic open simulates before broadcasting', async () => {
+      const rpcMethods: string[] = []
+      const interceptingClient = createClient({
+        account: accounts[0],
+        chain: client.chain,
+        transport: custom({
+          async request(args: any) {
+            rpcMethods.push(args.method)
+            return client.transport.request(args)
+          },
+        }),
+      })
+      const salt = nextSalt()
+      const deposit = 10_000_000n
+      const { channelId, serializedTransaction } = await signOpenChannel({
+        escrow: escrowContract,
+        payer,
+        payee: recipient,
+        token: currency,
+        deposit,
+        salt,
+      })
+
+      await broadcastOpenTransaction({
+        client: interceptingClient,
+        serializedTransaction,
+        escrowContract,
+        channelId,
+        recipient,
+        currency,
+        isSponsored: true,
+        waitForConfirmation: false,
+      })
+
+      const simulationIndex = rpcMethods.indexOf('eth_call')
+      const broadcastIndex = rpcMethods.indexOf('eth_sendRawTransaction')
+      expect(simulationIndex).toBeGreaterThan(-1)
+      expect(broadcastIndex).toBeGreaterThan(-1)
+      expect(simulationIndex).toBeLessThan(broadcastIndex)
     })
   })
 
@@ -1034,6 +1107,9 @@ describe.runIf(isLocalnet)('on-chain', () => {
       expect(broadcastIndex).toBeGreaterThan(-1)
       expect(simulationIndex).toBeGreaterThan(-1)
       expect(simulationIndex).toBeLessThan(broadcastIndex)
+      expect(
+        rpcMethods.slice(0, broadcastIndex).filter((method) => method === 'eth_call'),
+      ).toHaveLength(2)
     })
 
     test('fee-payer: rejects smuggled second topUp call', async () => {

package/src/tempo/legacy/session/Chain.ts

@@ -626,37 +626,47 @@ export async function broadcastOpenTransaction(
 
   await beforeBroadcast?.(pendingOnChain)
 
-  const serializedTransaction_final = await (async () => {
+  const completeTransaction = async () => {
     if (feePayer) {
       if (!sponsoredOpenCall)
         throw new BadRequestError({
           reason: 'transaction does not contain a valid escrow open call',
         })
 
-      const sponsored = FeePayer.prepareSponsoredTransaction({
-        account: feePayer,
-        allowedFeeTokens: defaultFeeToken ? [defaultFeeToken] : undefined,
-        challengeExpires,
-        chainId: client.chain!.id,
-        details: { channelId, currency, recipient },
-        policy: feePayerPolicy,
-        transaction: {
-          ...transaction,
-          ...(resolvedFeeToken ? { feeToken: resolvedFeeToken } : {}),
+      const completed = await FeePayer.preflightSponsorship({
+        transaction,
+        simulate: (request) => call(client, request as never),
+        async complete() {
+          const sponsored = FeePayer.prepareSponsoredTransaction({
+            account: feePayer,
+            allowedFeeTokens: defaultFeeToken ? [defaultFeeToken] : undefined,
+            challengeExpires,
+            chainId: client.chain!.id,
+            details: { channelId, currency, recipient },
+            policy: feePayerPolicy,
+            transaction: {
+              ...transaction,
+              ...(resolvedFeeToken ? { feeToken: resolvedFeeToken } : {}),
+            },
+          })
+          return { feePayer: feePayer.address, transaction: sponsored }
         },
       })
-      return signTransaction(client, sponsored as never)
+      return signTransaction(client, completed.transaction as never)
     }
     return serializedTransaction
-  })()
+  }
 
   if (!waitForConfirmation) {
-    await call(client, {
-      ...transaction,
-      account: transaction.from,
-      calls,
-      feePayerSignature: undefined,
-    } as never)
+    const serializedTransaction_final = await completeTransaction()
+    // Local sponsorship already ran sender-context preflight above. Every
+    // other optimistic path must still simulate before returning calldata as
+    // pending on-chain state, including hosted sponsorship (`isSponsored`).
+    if (!feePayer)
+      await call(
+        client,
+        FeePayer.simulationTransaction(transaction, { feePayer: isSponsored }) as never,
+      )
     const txHash = await sendRawTransaction(client, {
       serializedTransaction: serializedTransaction_final as Transaction.TransactionSerializedTempo,
     })
@@ -669,14 +679,9 @@ export async function broadcastOpenTransaction(
 
   let txHash: Hex | undefined
   try {
-    if (feePayer)
-      await call(client, {
-        ...transaction,
-        account: transaction.from,
-        calls,
-        feePayerSignature: undefined,
-      } as never)
-
+    // Keep local preflight inside recovery: a retry can legitimately revert
+    // during simulation after the original open was mined.
+    const serializedTransaction_final = await completeTransaction()
     const receipt = await sendRawTransactionSync(client, {
       serializedTransaction: serializedTransaction_final as Transaction.TransactionSerializedTempo,
     })
@@ -775,37 +780,36 @@ export async function broadcastTopUpTransaction(
         })
 
       const defaultFeeToken = defaults.currency[client.chain?.id as keyof typeof defaults.currency]
-      const sponsored = FeePayer.prepareSponsoredTransaction({
-        account: feePayer,
-        allowedFeeTokens: defaultFeeToken ? [defaultFeeToken] : undefined,
-        challengeExpires,
-        chainId: client.chain!.id,
-        details: {
-          additionalDeposit: declaredDeposit.toString(),
-          channelId,
-          currency,
-        },
-        policy: feePayerPolicy,
-        transaction: {
-          ...transaction,
-          ...((transaction.feeToken ?? defaultFeeToken)
-            ? { feeToken: transaction.feeToken ?? defaultFeeToken }
-            : {}),
+      const completed = await FeePayer.preflightSponsorship({
+        transaction,
+        simulate: (request) => call(client, request as never),
+        async complete() {
+          const sponsored = FeePayer.prepareSponsoredTransaction({
+            account: feePayer,
+            allowedFeeTokens: defaultFeeToken ? [defaultFeeToken] : undefined,
+            challengeExpires,
+            chainId: client.chain!.id,
+            details: {
+              additionalDeposit: declaredDeposit.toString(),
+              channelId,
+              currency,
+            },
+            policy: feePayerPolicy,
+            transaction: {
+              ...transaction,
+              ...((transaction.feeToken ?? defaultFeeToken)
+                ? { feeToken: transaction.feeToken ?? defaultFeeToken }
+                : {}),
+            },
+          })
+          return { feePayer: feePayer.address, transaction: sponsored }
         },
       })
-      return signTransaction(client, sponsored as never)
+      return signTransaction(client, completed.transaction as never)
     }
     return serializedTransaction
   })()
 
-  if (feePayer)
-    await call(client, {
-      ...transaction,
-      account: transaction.from,
-      calls,
-      feePayerSignature: undefined,
-    } as never)
-
   const receipt = await sendRawTransactionSync(client, {
     serializedTransaction: serializedTransaction_final as Transaction.TransactionSerializedTempo,
   })