nansen-cli 1.36.2 → 1.38.0

package/src/walletconnect-trading.js

@@ -10,6 +10,7 @@
 
 import { wcExec } from './walletconnect-exec.js';
 import { base58Encode } from './wallet.js';
+import { encodeApproveCalldata } from './trade-validation.js';
 
 const SOLANA_MAINNET_CHAIN = 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp';
 
@@ -104,19 +105,22 @@ export async function sendTransactionViaWalletConnect(txData, timeoutMs = 120000
 /**
  * Send an ERC-20 approval via WalletConnect.
  *
- * Builds approve(spender, MAX_UINT256) calldata and delegates to sendTransactionViaWalletConnect.
+ * Builds approve(spender, amount) calldata and delegates to sendTransactionViaWalletConnect.
+ * The amount is scoped to the swap's input (passed by the caller) so a bad quote
+ * can drain at most one trade, not the wallet's full token balance.
  *
  * @param {string} tokenAddress - ERC-20 token contract
  * @param {string} spenderAddress - Approval target (e.g. DEX router)
  * @param {number} chainId - EIP-155 chain ID
+ * @param {bigint|string|number} amount - Allowance to grant, in base units
+ * @param {bigint|string|number} [maxAllowance] - Hard cap from persisted request intent
  * @returns {{ txHash?: string, signedTransaction?: string }}
  */
-export async function sendApprovalViaWalletConnect(tokenAddress, spenderAddress, chainId) {
-  // ERC-20 approve(address spender, uint256 amount) selector = 0x095ea7b3
-  const MAX_UINT256_HEX = 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff';
-  const data = '0x095ea7b3'
-    + spenderAddress.slice(2).toLowerCase().padStart(64, '0')
-    + MAX_UINT256_HEX;
+export async function sendApprovalViaWalletConnect(tokenAddress, spenderAddress, chainId, amount, maxAllowance) {
+  // encodeApproveCalldata enforces a valid 20-byte spender, a bounded (< MAX)
+  // amount within the request cap, and exactly-68-byte calldata — so a
+  // malformed or tampered spender/amount can't reshape the ABI word layout.
+  const data = encodeApproveCalldata(spenderAddress, amount, { maxAllowance });
 
   return sendTransactionViaWalletConnect({
     to: tokenAddress,