nansen-cli 1.11.0 → 1.11.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.11.2
+
+### Patch Changes
+
+- [#205](https://github.com/nansen-ai/nansen-cli/pull/205) [`dba24aa`](https://github.com/nansen-ai/nansen-cli/commit/dba24aaa64b2083fdbaa85a002758bfe21d9f4a0) Thanks [@TimNooren](https://github.com/TimNooren)! - Add hot wallet and password handling warnings to wallet create output
+
+## 1.11.1
+
+### Patch Changes
+
+- [#194](https://github.com/nansen-ai/nansen-cli/pull/194) [`89225f5`](https://github.com/nansen-ai/nansen-cli/commit/89225f5d5b566f7eda77b1876c77545c2feb6a1c) Thanks [@TimNooren](https://github.com/TimNooren)! - fix: --help on trade subcommands and wallet subcommands now shows full help identical to the no-args case
+
+- [#199](https://github.com/nansen-ai/nansen-cli/pull/199) [`9ae981e`](https://github.com/nansen-ai/nansen-cli/commit/9ae981e6dcf7fa663e47a3608afab7f12e0a9463) Thanks [@TimNooren](https://github.com/TimNooren)! - fix: replace misleading `walletconnect connect` command reference in x402 payment error with actionable guidance mentioning both local wallet (`nansen wallet create`) and external WalletConnect CLI options
+
 ## 1.11.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nansen-cli",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "Command-line interface for Nansen API - designed for AI agents",
   "main": "src/index.js",
   "type": "module",
@@ -19,7 +19,8 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:live": "NANSEN_LIVE_TEST=1 vitest run",
-    "test:trade": "vitest run --config vitest.e2e.config.js",
+    "test:trade": "vitest run --config vitest.e2e.config.js src/__tests__/trade.e2e.test.js",
+    "test:send": "vitest run --config vitest.e2e.config.js src/__tests__/send.e2e.test.js",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "changeset": "changeset",
@@ -60,5 +61,11 @@
     "eslint": "^10.0.2",
     "globals": "^17.4.0",
     "vitest": "^4.0.18"
+  },
+  "dependencies": {
+    "@ethereumjs/rlp": "^10.1.1",
+    "@noble/curves": "^2.0.1",
+    "@noble/hashes": "^2.0.1",
+    "@scure/base": "^2.0.0"
   }
-}
+}

package/src/api.js

@@ -578,9 +578,20 @@ export class NansenAPI {
                     return await paidResponse.json();
                   }
                 } catch (x402Err) {
-                  message = `x402 auto-payment failed: ${x402Err.message}`;
+                  if (!this.apiKey) {
+                    // No API key and no payment wallet — guide the user to login rather than
+                    // showing a confusing x402 payment dump they can't act on.
+                    // TODO: full fix would skip x402 entirely when no apiKey is set — see PR #<this PR number>
+                    message = 'No API key configured. Run: nansen login --api-key <key>. Get your key at https://app.nansen.ai/api';
+                  } else {
+                    message = `x402 auto-payment failed: ${x402Err.message}`;
+                  }
+                }
+                // Only include raw payment requirements in the error details when the user
+                // has an API key — for unauthenticated users they add noise, not signal.
+                if (this.apiKey) {
+                  data.paymentRequirements = paymentRequirements;
                 }
-                data.paymentRequirements = paymentRequirements;
               }
             }
           }

package/src/cli.js

@@ -642,9 +642,10 @@ EXAMPLES:
   nansen research smart-money netflow --chain solana
   nansen research token screener --chain solana --timeframe 24h
   nansen research profiler balance --address 0x... --chain ethereum
-  nansen trade quote --chain ethereum --from ETH --to USDC --amount 1
+  nansen trade quote --chain base --from ETH --to USDC --amount 1
 
-Chains: ethereum, solana, base, bnb, arbitrum, polygon, optimism, avalanche, linea, scroll, mantle, ronin, sei, plasma, sonic, monad, hyperevm, iotaevm
+Research chains: ethereum, solana, base, bnb, arbitrum, polygon, optimism, avalanche, linea, scroll, mantle, ronin, sei, plasma, sonic, monad, hyperevm, iotaevm
+Trade chains: solana, base
 Labels: Fund, Smart Trader, 30D/90D/180D Smart Trader, Smart HL Perps Trader
 
 Docs: https://docs.nansen.ai
@@ -1079,6 +1080,28 @@ export function buildCommands(deps = {}) {
 
       let result = await handlers[subcommand]();
 
+      // Warn when OHLCV price data is null (backend coverage gap)
+      // Volume comes from on-chain DEX data and is always available, but price/market_cap
+      // requires a price oracle — some tokens are not tracked and return all-null price fields.
+      if (subcommand === 'ohlcv') {
+        const candles = Array.isArray(result?.data) ? result.data : [];
+        if (candles.length === 0) {
+          process.stderr.write(`⚠️  No OHLCV data returned for token ${tokenAddress} on ${chain}.\n`);
+        } else {
+          const hasPrice = candles.some(c => c.open !== null || c.close !== null);
+          const hasVolume = candles.some(c => c.volume !== null);
+          if (!hasPrice && hasVolume) {
+            process.stderr.write(
+              `⚠️  Price data unavailable for token ${tokenAddress} on ${chain}.\n` +
+              `   open/high/low/close, volume_usd, and market_cap are null.\n` +
+              `   Volume (raw token units) is available. This token may not be tracked by Nansen's price oracle.\n`
+            );
+          } else if (!hasPrice && !hasVolume) {
+            process.stderr.write(`⚠️  No OHLCV data available for token ${tokenAddress} on ${chain}.\n`);
+          }
+        }
+      }
+
       // Enrich transfers with Nansen labels for from/to addresses
       if (subcommand === 'transfers' && (options.enrich || flags.enrich)) {
         result = await enrichTransfers(result, apiInstance, chain);
@@ -1360,17 +1383,9 @@ export async function runCLI(rawArgs, deps = {}) {
           return { type: 'command-help', command: `research ${category}` };
         }
       }
-      // Handle 'trade <sub> --help'
-      if (command === 'trade' && subcommand) {
-        const tradeSchema = SCHEMA.commands.trade?.subcommands?.[subcommand];
-        if (tradeSchema) {
-          output(`\ntrade ${subcommand} - ${tradeSchema.description}\n`);
-          notify();
-          return { type: 'subcommand-help', command: 'trade', subcommand };
-        }
-      }
       // First try subcommand help
-      if (command && subcommand) {
+      // Skip for 'trade' — its handlers show their own rich usage when required args are missing
+      if (command && subcommand && command !== 'trade') {
         const subHelp = generateSubcommandHelp(command, subcommand);
         if (subHelp) {
           output(subHelp);
@@ -1379,7 +1394,8 @@ export async function runCLI(rawArgs, deps = {}) {
         }
       }
       // Then try command-level help (list subcommands)
-      const cmdSchemaLookup = SCHEMA.commands[command] || SCHEMA.commands.research.subcommands[command];
+      // Skip for 'trade' — let the handler show its own usage
+      const cmdSchemaLookup = command !== 'trade' && (SCHEMA.commands[command] || SCHEMA.commands.research.subcommands[command]);
       if (command && cmdSchemaLookup) {
         const cmdSchema = cmdSchemaLookup;
         const lines = [`${command} — ${cmdSchema.description}`];

package/src/crypto.js

@@ -1,178 +1,46 @@
 /**
  * Shared cryptographic primitives for EVM transaction signing.
  * Exports keccak256, secp256k1 ECDSA signing, RLP encoding.
- * Zero external dependencies — uses Node.js built-in crypto only.
+ * Uses audited libraries: @noble/hashes, @noble/curves, @ethereumjs/rlp.
  */
 
-import crypto from "crypto";
+import { keccak_256 } from "@noble/hashes/sha3.js";
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { RLP } from "@ethereumjs/rlp";
 
 // ============= Keccak-256 =============
 
-// Keccak-256 (NOT SHA3-256; Ethereum uses original Keccak with 0x01 padding).
-// Uses a flat 25-element state array (lanes indexed as state[x + 5*y])
-// with BigInt64 arithmetic.
-
-const RC = [
-  0x0000000000000001n, 0x0000000000008082n, 0x800000000000808an, 0x8000000080008000n,
-  0x000000000000808bn, 0x0000000080000001n, 0x8000000080008081n, 0x8000000000008009n,
-  0x000000000000008an, 0x0000000000000088n, 0x0000000080008009n, 0x000000008000000an,
-  0x000000008000808bn, 0x800000000000008bn, 0x8000000000008089n, 0x8000000000008003n,
-  0x8000000000008002n, 0x8000000000000080n, 0x000000000000800an, 0x800000008000000an,
-  0x8000000080008081n, 0x8000000000008080n, 0x0000000080000001n, 0x8000000080008008n,
-];
-
-const ROT = [
-   0,  1, 62, 28, 27,
-  36, 44,  6, 55, 20,
-   3, 10, 43, 25, 39,
-  41, 45, 15, 21,  8,
-  18,  2, 61, 56, 14,
-];
-
-const M = 0xffffffffffffffffn;
-
-function rot64(v, r) {
-  return r === 0 ? v : ((v << BigInt(r)) | (v >> BigInt(64 - r))) & M;
-}
-
-function keccakF(s) {
-  for (let round = 0; round < 24; round++) {
-    const c0 = s[0] ^ s[5] ^ s[10] ^ s[15] ^ s[20];
-    const c1 = s[1] ^ s[6] ^ s[11] ^ s[16] ^ s[21];
-    const c2 = s[2] ^ s[7] ^ s[12] ^ s[17] ^ s[22];
-    const c3 = s[3] ^ s[8] ^ s[13] ^ s[18] ^ s[23];
-    const c4 = s[4] ^ s[9] ^ s[14] ^ s[19] ^ s[24];
-    const d0 = (c4 ^ rot64(c1, 1)) & M;
-    const d1 = (c0 ^ rot64(c2, 1)) & M;
-    const d2 = (c1 ^ rot64(c3, 1)) & M;
-    const d3 = (c2 ^ rot64(c4, 1)) & M;
-    const d4 = (c3 ^ rot64(c0, 1)) & M;
-    for (let y = 0; y < 25; y += 5) {
-      s[y]     = (s[y]     ^ d0) & M;
-      s[y + 1] = (s[y + 1] ^ d1) & M;
-      s[y + 2] = (s[y + 2] ^ d2) & M;
-      s[y + 3] = (s[y + 3] ^ d3) & M;
-      s[y + 4] = (s[y + 4] ^ d4) & M;
-    }
-    const t = new Array(25);
-    for (let x = 0; x < 5; x++) {
-      for (let y = 0; y < 5; y++) {
-        const src = x + 5 * y;
-        const dst = y + 5 * ((2 * x + 3 * y) % 5);
-        t[dst] = rot64(s[src], ROT[src]);
-      }
-    }
-    for (let y = 0; y < 25; y += 5) {
-      const t0 = t[y], t1 = t[y+1], t2 = t[y+2], t3 = t[y+3], t4 = t[y+4];
-      s[y]   = (t0 ^ ((~t1 & M) & t2)) & M;
-      s[y+1] = (t1 ^ ((~t2 & M) & t3)) & M;
-      s[y+2] = (t2 ^ ((~t3 & M) & t4)) & M;
-      s[y+3] = (t3 ^ ((~t4 & M) & t0)) & M;
-      s[y+4] = (t4 ^ ((~t0 & M) & t1)) & M;
-    }
-    s[0] = (s[0] ^ RC[round]) & M;
-  }
-}
-
 export function keccak256(input) {
-  const rate = 136;
-  const s = new Array(25).fill(0n);
-  const blocks = Math.max(1, Math.ceil((input.length + 1) / rate));
-  const padded = Buffer.alloc(blocks * rate);
-  input.copy(padded);
-  padded[input.length] ^= 0x01;
-  padded[padded.length - 1] ^= 0x80;
-  for (let off = 0; off < padded.length; off += rate) {
-    for (let i = 0; i < 17; i++) {
-      s[i] ^= padded.readBigUInt64LE(off + i * 8);
-    }
-    keccakF(s);
-  }
-  const out = Buffer.alloc(32);
-  for (let i = 0; i < 4; i++) {
-    out.writeBigUInt64LE(s[i] & M, i * 8);
-  }
-  return out;
+  const hash = keccak_256(input);
+  return Buffer.from(hash);
 }
 
 // ============= secp256k1 ECDSA =============
 
-const P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2Fn;
-const N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141n;
-const Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798n;
-const Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8n;
-
-function modInv(a, m) {
-  let [old_r, r] = [((a % m) + m) % m, m];
-  let [old_s, s] = [1n, 0n];
-  while (r !== 0n) {
-    const q = old_r / r;
-    [old_r, r] = [r, old_r - q * r];
-    [old_s, s] = [s, old_s - q * s];
-  }
-  return ((old_s % m) + m) % m;
-}
-
-function ptAdd(x1, y1, x2, y2) {
-  if (x1 === null) return [x2, y2];
-  if (x2 === null) return [x1, y1];
-  if (x1 === x2 && y1 === y2) {
-    const lam = (3n * x1 * x1 * modInv(2n * y1, P)) % P;
-    const x3 = ((lam * lam - 2n * x1) % P + P) % P;
-    return [x3, ((lam * (x1 - x3) - y1) % P + P) % P];
-  }
-  if (x1 === x2) return [null, null];
-  const lam = (((y2 - y1) % P + P) * modInv(((x2 - x1) % P + P) % P, P)) % P;
-  const x3 = ((lam * lam - x1 - x2) % P + P) % P;
-  return [x3, ((lam * (x1 - x3) - y1) % P + P) % P];
-}
-
-function ptMul(k, x, y) {
-  let [rx, ry] = [null, null];
-  let [qx, qy] = [x, y];
-  while (k > 0n) {
-    if (k & 1n) [rx, ry] = ptAdd(rx, ry, qx, qy);
-    [qx, qy] = ptAdd(qx, qy, qx, qy);
-    k >>= 1n;
-  }
-  return [rx, ry];
-}
-
-function rfc6979k(privBuf, hash) {
-  let v = Buffer.alloc(32, 0x01);
-  let k = Buffer.alloc(32, 0x00);
-  k = crypto.createHmac('sha256', k).update(Buffer.concat([v, Buffer.from([0x00]), privBuf, hash])).digest();
-  v = crypto.createHmac('sha256', k).update(v).digest();
-  k = crypto.createHmac('sha256', k).update(Buffer.concat([v, Buffer.from([0x01]), privBuf, hash])).digest();
-  v = crypto.createHmac('sha256', k).update(v).digest();
-  while (true) {
-    v = crypto.createHmac('sha256', k).update(v).digest();
-    const candidate = BigInt('0x' + v.toString('hex'));
-    if (candidate >= 1n && candidate < N) return candidate;
-    k = crypto.createHmac('sha256', k).update(Buffer.concat([v, Buffer.from([0x00])])).digest();
-    v = crypto.createHmac('sha256', k).update(v).digest();
-  }
-}
-
 /**
  * Sign a 32-byte hash with secp256k1 ECDSA.
  * Uses RFC 6979 deterministic k and low-S normalization (EIP-2).
  * Returns { r, s, v } where v is the recovery ID (0 or 1).
  */
 export function signSecp256k1(hash, privateKey) {
-  const z = BigInt('0x' + hash.toString('hex'));
-  const d = BigInt('0x' + privateKey.toString('hex'));
-  const k = rfc6979k(privateKey, hash);
-  const [rx, ry] = ptMul(k, Gx, Gy);
-  const r = rx % N;
-  if (r === 0n) throw new Error('Invalid signature: r=0');
-  let s = (modInv(k, N) * ((z + r * d) % N)) % N;
-  if (s === 0n) throw new Error('Invalid signature: s=0');
-  let v = (ry % 2n === 0n) ? 0 : 1;
-  if (s > N >> 1n) { s = N - s; v ^= 1; }
+  const sigBytes = secp256k1.sign(hash, privateKey, { prehash: false, lowS: true });
+  const sig = secp256k1.Signature.fromBytes(sigBytes);
+  const pubKey = secp256k1.getPublicKey(privateKey, false);
+  const pubKeyHex = Buffer.from(pubKey).toString("hex");
+
+  // Determine recovery bit by trying both values
+  let v = 0;
+  for (const bit of [0, 1]) {
+    const recovered = sig.addRecoveryBit(bit).recoverPublicKey(hash);
+    if (Buffer.from(recovered.toBytes(false)).toString("hex") === pubKeyHex) {
+      v = bit;
+      break;
+    }
+  }
+
   return {
-    r: Buffer.from(r.toString(16).padStart(64, '0'), 'hex'),
-    s: Buffer.from(s.toString(16).padStart(64, '0'), 'hex'),
+    r: Buffer.from(sig.r.toString(16).padStart(64, "0"), "hex"),
+    s: Buffer.from(sig.s.toString(16).padStart(64, "0"), "hex"),
     v,
   };
 }
@@ -182,34 +50,39 @@ export function signSecp256k1(hash, privateKey) {
 export function bigIntToMinBuf(n) {
   if (n === 0n) return Buffer.alloc(0);
   const hex = n.toString(16);
-  return Buffer.from(hex.length % 2 ? '0' + hex : hex, 'hex');
+  return Buffer.from(hex.length % 2 ? "0" + hex : hex, "hex");
 }
 
 export function rlpEncode(input) {
+  return Buffer.from(RLP.encode(toRlpInput(input)));
+}
+
+/**
+ * Convert our legacy input format to what @ethereumjs/rlp expects.
+ * Handles: arrays (recursive), Buffers, hex strings, empty values.
+ */
+function toRlpInput(input) {
   if (Array.isArray(input)) {
-    const encoded = input.map(rlpEncode);
-    const payload = Buffer.concat(encoded);
-    if (payload.length < 56) {
-      return Buffer.concat([Buffer.from([0xc0 + payload.length]), payload]);
-    }
-    const lenBytes = bigIntToMinBuf(BigInt(payload.length));
-    return Buffer.concat([Buffer.from([0xf7 + lenBytes.length]), lenBytes, payload]);
+    return input.map(toRlpInput);
   }
 
-  let data;
   if (Buffer.isBuffer(input)) {
-    data = input;
-  } else {
-    let hex = (typeof input === 'string' ? input : '').replace(/^0x/, '');
-    hex = hex.replace(/^0+/, '');
-    if (hex === '' || hex.length === 0) return Buffer.from([0x80]);
-    if (hex.length % 2) hex = '0' + hex;
-    data = Buffer.from(hex, 'hex');
+    return Uint8Array.from(input);
+  }
+
+  if (input instanceof Uint8Array) {
+    return input;
+  }
+
+  if (typeof input === "string") {
+    let hex = input.replace(/^0x/, "");
+    // Strip leading zeros to match legacy behavior for hex-string values
+    // (chain IDs, nonces, gas prices, etc. passed as hex strings)
+    hex = hex.replace(/^0+/, "");
+    if (hex === "" || hex.length === 0) return Uint8Array.from([]);
+    if (hex.length % 2) hex = "0" + hex;
+    return Uint8Array.from(Buffer.from(hex, "hex"));
   }
 
-  if (data.length === 0) return Buffer.from([0x80]);
-  if (data.length === 1 && data[0] < 0x80) return data;
-  if (data.length < 56) return Buffer.concat([Buffer.from([0x80 + data.length]), data]);
-  const lenBytes = bigIntToMinBuf(BigInt(data.length));
-  return Buffer.concat([Buffer.from([0xb7 + lenBytes.length]), lenBytes, data]);
+  return Uint8Array.from([]);
 }

package/src/schema.json

@@ -157,6 +157,14 @@
                 "page": {
                   "type": "number",
                   "description": "Page number for paginated results (default: 1)"
+                },
+                "sort": {
+                  "type": "string",
+                  "description": "Sort field:direction (e.g., value_usd:desc)"
+                },
+                "filters": {
+                  "type": "object",
+                  "description": "Additional filters as JSON"
                 }
               },
               "returns": [
@@ -178,6 +186,14 @@
                 "limit": {
                   "type": "number"
                 },
+                "labels": {
+                  "type": "string|array",
+                  "description": "Smart Money label filter"
+                },
+                "sort": {
+                  "type": "string",
+                  "description": "Sort field:direction (e.g., deposit_value_usd:desc)"
+                },
                 "filters": {
                   "type": "object"
                 },
@@ -224,6 +240,18 @@
                 "page": {
                   "type": "number",
                   "description": "Page number for paginated results (default: 1)"
+                },
+                "labels": {
+                  "type": "string|array",
+                  "description": "Smart Money label filter"
+                },
+                "sort": {
+                  "type": "string",
+                  "description": "Sort field:direction (e.g., value_usd:desc)"
+                },
+                "filters": {
+                  "type": "object",
+                  "description": "Additional filters as JSON"
                 }
               },
               "returns": [

package/src/transfer.js

@@ -1,10 +1,10 @@
 /**
  * Nansen CLI - Token Transfer
  * Send native and ERC-20/SPL tokens on EVM and Solana chains.
- * Zero external dependencies — uses Node.js built-in crypto only.
  */
 
 import crypto from 'crypto';
+import { base58 } from '@scure/base';
 import { base58Encode, exportWallet, getWalletConfig, verifyPassword } from './wallet.js';
 import { keccak256, signSecp256k1, rlpEncode } from './crypto.js';
 import { getWalletConnectAddress, sendTransactionViaWalletConnect } from './walletconnect-trading.js';
@@ -34,21 +34,8 @@ const CHAIN_IDS = { ...EVM_CHAIN_IDS, evm: 1 };
 
 // ============= Base58 =============
 
-const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
-
 function base58Decode(str) {
-  let num = 0n;
-  for (const ch of str) {
-    const idx = BASE58_ALPHABET.indexOf(ch);
-    if (idx === -1) throw new Error(`Invalid base58 character: ${ch}`);
-    num = num * 58n + BigInt(idx);
-  }
-  const hex = num.toString(16);
-  const paddedHex = hex.length % 2 ? '0' + hex : hex;
-  const bytes = num === 0n ? [] : [...Buffer.from(paddedHex, 'hex')];
-  let leadingZeros = 0;
-  for (const ch of str) { if (ch === '1') leadingZeros++; else break; }
-  return Buffer.from([...Array(leadingZeros).fill(0), ...bytes]);
+  return Buffer.from(base58.decode(str));
 }
 
 function base58DecodePubkey(str) {

package/src/wallet.js

@@ -1,13 +1,13 @@
 /**
  * Nansen CLI - Wallet Management
  * Local key generation and storage for EVM and Solana chains.
- * Zero external dependencies — uses Node.js built-in crypto only.
  */
 
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import * as readline from 'readline';
+import { base58 } from '@scure/base';
 
 // ============= Constants =============
 
@@ -32,31 +32,11 @@ import { keccak256 } from './crypto.js';
 
 // ============= Base58 Encoding (for Solana) =============
 
-const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
-
 /**
  * Encode a Buffer to base58 string.
  */
 export function base58Encode(buf) {
-  let num = 0n;
-  for (const byte of buf) {
-    num = num * 256n + BigInt(byte);
-  }
-
-  let str = '';
-  while (num > 0n) {
-    const rem = Number(num % 58n);
-    num = num / 58n;
-    str = BASE58_ALPHABET[rem] + str;
-  }
-
-  // Leading zeros → leading '1's
-  for (const byte of buf) {
-    if (byte === 0) str = '1' + str;
-    else break;
-  }
-
-  return str || '1';
+  return base58.encode(buf instanceof Uint8Array ? buf : Uint8Array.from(buf));
 }
 
 // ============= Encryption =============
@@ -519,6 +499,9 @@ export function buildWalletCommands(deps = {}) {
             log(`    Base (recommended, lower fees): send USDC to ${result.evm}`);
             log(`    Solana: send USDC to ${result.solana}`);
             log('');
+            log('  ⚠️  This is a hot wallet and is fundamentally insecure — do not deposit more than you can afford to lose.');
+            log('     Store and handle your password securely, e.g. using a secrets manager or system keychain.');
+            log('');
             return;
           } catch (err) {
             log(`❌ ${err.message}`);
@@ -753,6 +736,11 @@ EXAMPLES:
         return;
       }
 
+      // --help on any wallet subcommand shows wallet help instead of executing
+      if (flags.help || flags.h) {
+        return handlers['help']();
+      }
+
       return handlers[subcommand]();
     },
   };

package/src/walletconnect-x402.js

@@ -142,7 +142,9 @@ export async function handleX402Payment(paymentRequirements) {
   const wallet = await checkWalletConnection();
   if (!wallet) {
     throw new NansenError(
-      'x402 payment required but no wallet connected. Run `walletconnect connect` first.',
+      'x402 payment required but no wallet connected. ' +
+        'To pay automatically: create a local wallet with `nansen wallet create` (then set NANSEN_WALLET_PASSWORD), ' +
+        'or connect an external wallet via the `walletconnect` CLI (`walletconnect connect`).',
       ErrorCode.PAYMENT_REQUIRED,
       402
     );

package/src/x402-svm.js

@@ -1,30 +1,15 @@
 /**
  * Nansen CLI - x402 Solana Auto-Payment
  * Implements SPL TransferChecked transaction building for x402 payments.
- * Zero external dependencies — uses Node.js built-in crypto + wallet.js base58.
  */
 
 import crypto from 'crypto';
+import { base58 } from '@scure/base';
 
-// ============= Base58 Encode (inline from wallet.js PR #26) =============
-const BASE58_ALPHABET_STR = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+// ============= Base58 Encode =============
 
 export function base58Encode(buf) {
-  let num = 0n;
-  for (const byte of buf) {
-    num = num * 256n + BigInt(byte);
-  }
-  let str = '';
-  while (num > 0n) {
-    const rem = Number(num % 58n);
-    num = num / 58n;
-    str = BASE58_ALPHABET_STR[rem] + str;
-  }
-  for (const byte of buf) {
-    if (byte === 0) str = '1' + str;
-    else break;
-  }
-  return str || '1';
+  return base58.encode(buf instanceof Uint8Array ? buf : Uint8Array.from(buf));
 }
 
 // ============= Constants =============
@@ -41,33 +26,8 @@ const DEFAULT_COMPUTE_UNIT_PRICE_MICROLAMPORTS = 1;
 
 // ============= Base58 Decode =============
 
-const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
-const BASE58_MAP = new Uint8Array(128);
-for (let i = 0; i < BASE58_ALPHABET.length; i++) {
-  BASE58_MAP[BASE58_ALPHABET.charCodeAt(i)] = i;
-}
-
 export function base58Decode(str) {
-  let num = 0n;
-  for (const ch of str) {
-    num = num * 58n + BigInt(BASE58_MAP[ch.charCodeAt(0)]);
-  }
-
-  // Count leading '1's → leading zero bytes
-  let leadingZeros = 0;
-  for (const ch of str) {
-    if (ch === '1') leadingZeros++;
-    else break;
-  }
-
-  if (num === 0n) return Buffer.alloc(leadingZeros || 1);
-
-  // Convert to bytes
-  const hex = num.toString(16);
-  const paddedHex = hex.length % 2 ? '0' + hex : hex;
-  const bytes = Buffer.from(paddedHex, 'hex');
-
-  return Buffer.concat([Buffer.alloc(leadingZeros), bytes]);
+  return Buffer.from(base58.decode(str));
 }
 
 /**