recon-crypto-mcp 0.1.0

package/dist/signing/pre-sign-check.js

@@ -0,0 +1,231 @@
+import { decodeFunctionData, toFunctionSelector } from "viem";
+import { erc20Abi } from "../abis/erc20.js";
+import { aavePoolAbi } from "../abis/aave-pool.js";
+import { stETHAbi, lidoWithdrawalQueueAbi } from "../abis/lido.js";
+import { eigenStrategyManagerAbi } from "../abis/eigenlayer-strategy-manager.js";
+import { cometAbi } from "../abis/compound-comet.js";
+import { morphoBlueAbi } from "../abis/morpho-blue.js";
+import { uniswapPositionManagerAbi } from "../abis/uniswap-position-manager.js";
+import { CONTRACTS } from "../config/contracts.js";
+/**
+ * Returns the pinned Aave V3 Pool address for `chain`. We deliberately DO NOT
+ * resolve this via PoolAddressesProvider.getPool() at sign time: the pre-sign
+ * check is our defense against a hostile RPC, so it must not delegate a trust-
+ * root lookup to that same RPC. Pool addresses are frozen per chain since
+ * Aave V3 launched and have not rotated; see contracts.ts for the source.
+ */
+function pinnedAavePool(chain) {
+    return CONTRACTS[chain].aave.pool;
+}
+/**
+ * Independent pre-sign safety check. Runs in send_transaction AFTER the handle
+ * is redeemed and chain id is verified, immediately before the tx is handed to
+ * Ledger Live. The goal is a second line of defense against a compromised /
+ * prompt-injected agent: even if a prepare_* tool produced a misleading
+ * description, this check reasons about the raw calldata alone and refuses
+ * anything that doesn't match a known-safe shape.
+ *
+ * Threat model: the canonical prompt-injection attack against a wallet agent is
+ * convincing the model to sign an `approve(attacker, MAX)` or a direct
+ * `transfer(attacker, amount)` on some token. This check closes the approve
+ * vector outright (spender allowlist) and narrows the call-surface to
+ * contracts we've explicitly recognized.
+ */
+/** LiFi Diamond — deterministic address across all our chains. Stable since 2022. */
+const LIFI_DIAMOND = "0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae";
+/** 4-byte selectors we treat as explicit allowlist entries. */
+const SELECTOR = {
+    approve: toFunctionSelector("approve(address,uint256)").toLowerCase(),
+    transfer: toFunctionSelector("transfer(address,uint256)").toLowerCase(),
+};
+function computeSelectorsFromAbi(abi) {
+    const out = new Set();
+    for (const item of abi) {
+        if (item.type !== "function")
+            continue;
+        try {
+            out.add(toFunctionSelector(item).toLowerCase());
+        }
+        catch {
+            // Skip items that don't encode cleanly (shouldn't happen in our curated ABIs).
+        }
+    }
+    return out;
+}
+const AAVE_SELECTORS = computeSelectorsFromAbi(aavePoolAbi);
+const COMET_SELECTORS = computeSelectorsFromAbi(cometAbi);
+const MORPHO_SELECTORS = computeSelectorsFromAbi(morphoBlueAbi);
+const LIDO_STETH_SELECTORS = computeSelectorsFromAbi(stETHAbi);
+const LIDO_QUEUE_SELECTORS = computeSelectorsFromAbi(lidoWithdrawalQueueAbi);
+const EIGEN_SELECTORS = computeSelectorsFromAbi(eigenStrategyManagerAbi);
+const UNISWAP_NPM_SELECTORS = computeSelectorsFromAbi(uniswapPositionManagerAbi);
+const ERC20_SELECTORS = computeSelectorsFromAbi(erc20Abi);
+async function classifyDestination(chain, to) {
+    const lo = to.toLowerCase();
+    // Aave V3 Pool — pinned from a hardcoded address, NOT a live RPC read.
+    const aavePool = pinnedAavePool(chain).toLowerCase();
+    if (lo === aavePool)
+        return { kind: "aave-v3-pool", allowedAbi: aavePoolAbi };
+    // Compound V3 Comet markets.
+    const compound = CONTRACTS[chain].compound;
+    if (compound) {
+        for (const addr of Object.values(compound)) {
+            if (lo === addr.toLowerCase()) {
+                return { kind: "compound-v3-comet", allowedAbi: cometAbi };
+            }
+        }
+    }
+    // Ethereum-only protocols.
+    if (chain === "ethereum") {
+        if (lo === CONTRACTS.ethereum.morpho.blue.toLowerCase()) {
+            return { kind: "morpho-blue", allowedAbi: morphoBlueAbi };
+        }
+        if (lo === CONTRACTS.ethereum.lido.stETH.toLowerCase()) {
+            return { kind: "lido-stETH", allowedAbi: stETHAbi };
+        }
+        if (lo === CONTRACTS.ethereum.lido.withdrawalQueue.toLowerCase()) {
+            return { kind: "lido-withdrawalQueue", allowedAbi: lidoWithdrawalQueueAbi };
+        }
+        if (lo === CONTRACTS.ethereum.eigenlayer.strategyManager.toLowerCase()) {
+            return { kind: "eigenlayer-strategyManager", allowedAbi: eigenStrategyManagerAbi };
+        }
+    }
+    // Uniswap V3 NonfungiblePositionManager (not currently written to by our prepare_*
+    // tools, but listed because it's in CONTRACTS and we may add LP mint/collect flows).
+    if (lo === CONTRACTS[chain].uniswap.positionManager.toLowerCase()) {
+        return { kind: "uniswap-v3-npm", allowedAbi: uniswapPositionManagerAbi };
+    }
+    // LiFi Diamond — accept but skip per-selector check (LiFi's ABI is huge and dynamic).
+    if (lo === LIFI_DIAMOND)
+        return { kind: "lifi-diamond", allowedAbi: null };
+    // Known ERC-20s (USDC, USDT, DAI, WETH, ...). Tokens ONLY — this path never
+    // covers a protocol contract that exposes transfer-like selectors, because
+    // the protocol branches above match first.
+    const tokens = CONTRACTS[chain].tokens;
+    if (tokens) {
+        for (const addr of Object.values(tokens)) {
+            if (lo === addr.toLowerCase())
+                return { kind: "known-erc20", allowedAbi: erc20Abi };
+        }
+    }
+    return null;
+}
+/** Spenders allowed for approve(spender, _). */
+function buildSpenderAllowlist(chain) {
+    const out = new Set();
+    out.add(pinnedAavePool(chain).toLowerCase());
+    const compound = CONTRACTS[chain].compound;
+    if (compound)
+        for (const a of Object.values(compound))
+            out.add(a.toLowerCase());
+    if (chain === "ethereum") {
+        out.add(CONTRACTS.ethereum.morpho.blue.toLowerCase());
+        out.add(CONTRACTS.ethereum.lido.withdrawalQueue.toLowerCase());
+        out.add(CONTRACTS.ethereum.eigenlayer.strategyManager.toLowerCase());
+    }
+    out.add(CONTRACTS[chain].uniswap.positionManager.toLowerCase());
+    out.add(LIFI_DIAMOND);
+    return out;
+}
+/**
+ * Throws a descriptive error if `tx` looks unsafe to sign. Call synchronously
+ * before every WalletConnect submission. "Unsafe" is conservative: unknown
+ * destination + non-empty data, approves to non-allowlisted spenders, or
+ * selectors that don't belong to the contract we think we're calling.
+ */
+export async function assertTransactionSafe(tx) {
+    // 1) Pure native send — data must be empty. Allow the transfer; the user
+    //    picks the recipient, and the Ledger screen shows it.
+    if (tx.data === "0x" || tx.data === "0x0" || tx.data === "0x00") {
+        return;
+    }
+    if (tx.data.length < 10) {
+        throw new Error(`Pre-sign check: calldata (${tx.data}) is too short to carry a function selector. ` +
+            `Refusing to sign.`);
+    }
+    const selector = tx.data.slice(0, 10).toLowerCase();
+    const dest = await classifyDestination(tx.chain, tx.to);
+    // 2) approve(): the single highest-leverage attack vector. Spender MUST be on
+    //    the protocol allowlist. Destination is whichever ERC-20 we're approving.
+    if (selector === SELECTOR.approve) {
+        if (!dest) {
+            throw new Error(`Pre-sign check: refusing approve() on ${tx.to} (${tx.chain}) — token is not in our ` +
+                `recognized set. If this is a legitimate token, add it to CONTRACTS[${tx.chain}].tokens.`);
+        }
+        // `to` must be a token (ERC-20 or a protocol token surface like stETH),
+        // not, say, the Aave Pool. approve() on the pool itself is nonsensical.
+        if (dest.kind !== "known-erc20" &&
+            dest.kind !== "lido-stETH" // stETH IS an ERC-20; approvals to spenders happen on it
+        ) {
+            throw new Error(`Pre-sign check: refusing approve() on ${dest.kind} (${tx.to}) — approvals should ` +
+                `target ERC-20 tokens, not protocol contracts.`);
+        }
+        let spender;
+        try {
+            const decoded = decodeFunctionData({ abi: erc20Abi, data: tx.data });
+            spender = (decoded.args?.[0]).toLowerCase();
+        }
+        catch {
+            throw new Error(`Pre-sign check: could not decode approve() calldata on ${tx.to}. Refusing to sign.`);
+        }
+        const allowlist = buildSpenderAllowlist(tx.chain);
+        if (!allowlist.has(spender)) {
+            throw new Error(`Pre-sign check: refusing approve(spender=${spender}, ...) on ${tx.chain} — spender is ` +
+                `not in the protocol allowlist (Aave Pool, Compound Comet, Morpho Blue, Lido Queue, ` +
+                `EigenLayer, Uniswap NPM, LiFi Diamond). This is the canonical phishing/prompt-injection ` +
+                `pattern. If you need to approve a different spender, do it from the Ledger Live app directly.`);
+        }
+        return;
+    }
+    // 3) transfer(): user-directed token move. Destination must still be a token
+    //    we recognize (otherwise the agent is calling transfer() on an arbitrary
+    //    contract with matching 4-byte — unlikely but worth rejecting).
+    if (selector === SELECTOR.transfer) {
+        if (!dest || (dest.kind !== "known-erc20" && dest.kind !== "lido-stETH")) {
+            throw new Error(`Pre-sign check: refusing transfer() on ${tx.to} (${tx.chain}) — token is not in our ` +
+                `recognized set. Add it to CONTRACTS[${tx.chain}].tokens if this is a legitimate asset.`);
+        }
+        return;
+    }
+    // 4) Every other selector: must be a known protocol destination.
+    if (!dest) {
+        throw new Error(`Pre-sign check: refusing to sign against unknown contract ${tx.to} on ${tx.chain} ` +
+            `(selector ${selector}). Accepted destinations: Aave V3 Pool, Compound V3 Comet markets, ` +
+            `Morpho Blue, Lido (stETH/Queue), EigenLayer StrategyManager, Uniswap V3 NPM, LiFi Diamond, ` +
+            `and known ERC-20s. An unknown destination with non-empty calldata is exactly the shape of ` +
+            `a prompt-injection attack.`);
+    }
+    // 5) For destinations where we have a tight ABI, verify the selector is one
+    //    of its functions. LiFi Diamond is the explicit exception (allowedAbi=null).
+    if (dest.allowedAbi === null)
+        return;
+    // Pick the right precomputed selector set.
+    const allowedSelectors = (() => {
+        switch (dest.kind) {
+            case "aave-v3-pool":
+                return AAVE_SELECTORS;
+            case "compound-v3-comet":
+                return COMET_SELECTORS;
+            case "morpho-blue":
+                return MORPHO_SELECTORS;
+            case "lido-stETH":
+                // stETH is both the Lido submit surface AND an ERC-20 (transfer/approve).
+                return new Set([...LIDO_STETH_SELECTORS, ...ERC20_SELECTORS]);
+            case "lido-withdrawalQueue":
+                return LIDO_QUEUE_SELECTORS;
+            case "eigenlayer-strategyManager":
+                return EIGEN_SELECTORS;
+            case "uniswap-v3-npm":
+                return UNISWAP_NPM_SELECTORS;
+            case "known-erc20":
+                return ERC20_SELECTORS;
+            case "lifi-diamond":
+                return null; // handled above
+        }
+    })();
+    if (allowedSelectors && !allowedSelectors.has(selector)) {
+        throw new Error(`Pre-sign check: selector ${selector} is not a known function on ${dest.kind} (${tx.to}). ` +
+            `Refusing to sign.`);
+    }
+}
+//# sourceMappingURL=pre-sign-check.js.map

package/dist/signing/pre-sign-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-sign-check.js","sourceRoot":"","sources":["../../src/signing/pre-sign-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAY,MAAM,MAAM,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAqB;IAC3C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAqB,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AAEH,qFAAqF;AACrF,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAElE,+DAA+D;AAC/D,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,kBAAkB,CAAC,0BAA0B,CAAC,CAAC,WAAW,EAAE;IACrE,QAAQ,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC,WAAW,EAAE;CAC/D,CAAC;AAoBX,SAAS,uBAAuB,CAAC,GAAQ;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;QACjF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;AAChE,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC/D,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;AAC7E,MAAM,eAAe,GAAG,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;AACzE,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;AACjF,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAE1D,KAAK,UAAU,mBAAmB,CAChC,KAAqB,EACrB,EAAiB;IAEjB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5B,uEAAuE;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAE9E,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,QAA8C,CAAC;IACjF,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC9B,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;YACvE,OAAO,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAC;QACrF,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,qFAAqF;IACrF,IAAI,EAAE,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC;IAC3E,CAAC;IAED,sFAAsF;IACtF,IAAI,EAAE,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAE3E,4EAA4E;IAC5E,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,MAA4C,CAAC;IAC7E,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,IAAI,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,qBAAqB,CAAC,KAAqB;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,QAA8C,CAAC;IACjF,IAAI,QAAQ;QAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAc;IACxD,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChE,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,6BAA6B,EAAE,CAAC,IAAI,+CAA+C;YACjF,mBAAmB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAmB,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAExD,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,QAAQ,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,yCAAyC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,0BAA0B;gBACnF,sEAAsE,EAAE,CAAC,KAAK,WAAW,CAC5F,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,IACE,IAAI,CAAC,IAAI,KAAK,aAAa;YAC3B,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,yDAAyD;UACpF,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,uBAAuB;gBACjF,+CAA+C,CAClD,CAAC;QACJ,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAY,CAAA,CAAC,WAAW,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,0DAA0D,EAAE,CAAC,EAAE,qBAAqB,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,aAAa,EAAE,CAAC,KAAK,gBAAgB;gBACtF,qFAAqF;gBACrF,0FAA0F;gBAC1F,+FAA+F,CAClG,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CACb,0CAA0C,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,0BAA0B;gBACpF,uCAAuC,EAAE,CAAC,KAAK,yCAAyC,CAC3F,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,iEAAiE;IACjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,6DAA6D,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,GAAG;YAClF,aAAa,QAAQ,qEAAqE;YAC1F,6FAA6F;YAC7F,4FAA4F;YAC5F,4BAA4B,CAC/B,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,iFAAiF;IACjF,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IAErC,2CAA2C;IAC3C,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE;QAC7B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,cAAc;gBACjB,OAAO,cAAc,CAAC;YACxB,KAAK,mBAAmB;gBACtB,OAAO,eAAe,CAAC;YACzB,KAAK,aAAa;gBAChB,OAAO,gBAAgB,CAAC;YAC1B,KAAK,YAAY;gBACf,0EAA0E;gBAC1E,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,oBAAoB,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;YACxE,KAAK,sBAAsB;gBACzB,OAAO,oBAAoB,CAAC;YAC9B,KAAK,4BAA4B;gBAC/B,OAAO,eAAe,CAAC;YACzB,KAAK,gBAAgB;gBACnB,OAAO,qBAAqB,CAAC;YAC/B,KAAK,aAAa;gBAChB,OAAO,eAAe,CAAC;YACzB,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,CAAC,gBAAgB;QACjC,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,+BAA+B,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,KAAK;YACzF,mBAAmB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/signing/session.d.ts

@@ -0,0 +1,28 @@
+export interface SessionStatus {
+    paired: boolean;
+    accounts: `0x${string}`[];
+    topic?: string;
+    expiresAt?: number;
+    /** Peer-advertised app name (e.g. "Ledger Live"). Self-reported — NOT a trusted identity. */
+    wallet?: string;
+    /** Peer-advertised URL. Self-reported — NOT a trusted identity. */
+    peerUrl?: string;
+    /** Peer-advertised description. Self-reported — NOT a trusted identity. */
+    peerDescription?: string;
+    /**
+     * Guidance for the agent: WalletConnect peer metadata is self-reported and any
+     * app can claim to be "Ledger Live". Surface `wallet`/`peerUrl` to the user
+     * before sending a tx they can't physically verify on the Ledger device.
+     */
+    peerTrustWarning: string;
+    /**
+     * Set when a local session record exists but the peer did not respond to the
+     * liveness ping on restore. The session may still be valid (peer just
+     * offline) or dead (relay didn't deliver a rejection in time) — callers
+     * should treat it as unverified and avoid submitting transactions until the
+     * peer comes back online or the user re-pairs.
+     */
+    peerUnreachable?: boolean;
+}
+export declare const PEER_TRUST_WARNING: string;
+export declare function getSessionStatus(): Promise<SessionStatus>;

package/dist/signing/session.js

@@ -0,0 +1,26 @@
+import { getConnectedAccounts, getCurrentSession, getSignClient, isPeerUnreachable, } from "./walletconnect.js";
+export const PEER_TRUST_WARNING = "WalletConnect peer metadata is self-reported — any app can claim to be 'Ledger Live'. " +
+    "If the paired wallet/URL above is unexpected (e.g. not 'Ledger Live' / ledger.com), ask the user " +
+    "to confirm before calling send_transaction. The ultimate check is that the tx shows up on the " +
+    "user's physical Ledger device for on-screen approval.";
+export async function getSessionStatus() {
+    await getSignClient(); // triggers restore + liveness check
+    const session = getCurrentSession();
+    if (!session)
+        return { paired: false, accounts: [], peerTrustWarning: PEER_TRUST_WARNING };
+    const accounts = await getConnectedAccounts();
+    const meta = session.peer?.metadata;
+    const unreachable = isPeerUnreachable();
+    return {
+        paired: true,
+        accounts,
+        topic: session.topic,
+        expiresAt: session.expiry * 1000,
+        ...(meta?.name ? { wallet: meta.name } : {}),
+        ...(meta?.url ? { peerUrl: meta.url } : {}),
+        ...(meta?.description ? { peerDescription: meta.description } : {}),
+        peerTrustWarning: PEER_TRUST_WARNING,
+        ...(unreachable ? { peerUnreachable: true } : {}),
+    };
+}
+//# sourceMappingURL=session.js.map

package/dist/signing/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/signing/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AA6B5B,MAAM,CAAC,MAAM,kBAAkB,GAC7B,wFAAwF;IACxF,mGAAmG;IACnG,gGAAgG;IAChG,uDAAuD,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,aAAa,EAAE,CAAC,CAAC,oCAAoC;IAC3D,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO;QACV,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IAC/E,MAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;IACpC,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI;QAChC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,gBAAgB,EAAE,kBAAkB;QACpC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/signing/tx-store.d.ts

@@ -0,0 +1,29 @@
+import type { UnsignedTx } from "../types/index.js";
+/**
+ * Recursively assign handles to `tx` and every node in its `.next` chain.
+ * Returns a new tx tree with `handle` populated on each node.
+ *
+ * Each handle stores ONLY the one tx node it names — not the full chain.
+ * The agent must call `send_transaction` once per handle, walking the chain
+ * explicitly. This makes every signature an independent, auditable event.
+ */
+export declare function issueHandles(tx: UnsignedTx): UnsignedTx;
+/**
+ * Retrieve the tx named by `handle`, or throw if unknown/expired. Does NOT
+ * delete the entry — we need retry-on-device-disconnect to work, so the handle
+ * stays valid until either:
+ *   (a) the tx is successfully submitted to the relay (caller invokes
+ *       `retireHandle` after the WalletConnect request resolves), or
+ *   (b) the TTL expires.
+ * Callers must call `retireHandle(handle)` on successful submission so replays
+ * fail loudly instead of silently re-submitting the same payload.
+ */
+export declare function consumeHandle(handle: string): UnsignedTx;
+/**
+ * Mark a handle as used. Called after the tx has been successfully submitted
+ * so the same handle cannot replay the submission. Safe to call on a handle
+ * that was already pruned.
+ */
+export declare function retireHandle(handle: string): void;
+/** Test-only: true if `handle` is still active (not retired, not expired). */
+export declare function hasHandle(handle: string): boolean;

package/dist/signing/tx-store.js

@@ -0,0 +1,85 @@
+import { randomUUID } from "node:crypto";
+/**
+ * In-memory registry of prepared transactions keyed by an opaque handle.
+ *
+ * Purpose: bind `send_transaction` to the exact tx built by a `prepare_*` tool.
+ * Without this, `send_transaction` accepts raw calldata — a prompt-injected
+ * agent (e.g. via a malicious Etherscan source comment or ENS reverse record)
+ * could convince the model to sign arbitrary bytes while the user thinks they
+ * approved the previewed tx.
+ *
+ * Each prepared tx and every node in its `.next` chain gets its own handle.
+ * The signing path looks up by handle and refuses anything not in the store.
+ *
+ * Lifetime: 15 minutes from issue, enough for a user to review and approve on
+ * their Ledger. Expired entries are lazily pruned on every access.
+ */
+const TX_TTL_MS = 15 * 60_000;
+const store = new Map();
+function prune(now = Date.now()) {
+    for (const [handle, entry] of store) {
+        if (entry.expiresAt < now)
+            store.delete(handle);
+    }
+}
+/**
+ * Recursively assign handles to `tx` and every node in its `.next` chain.
+ * Returns a new tx tree with `handle` populated on each node.
+ *
+ * Each handle stores ONLY the one tx node it names — not the full chain.
+ * The agent must call `send_transaction` once per handle, walking the chain
+ * explicitly. This makes every signature an independent, auditable event.
+ */
+export function issueHandles(tx) {
+    prune();
+    const now = Date.now();
+    const expiresAt = now + TX_TTL_MS;
+    const nextWithHandles = tx.next ? issueHandles(tx.next) : undefined;
+    const handle = randomUUID();
+    const withHandle = {
+        ...tx,
+        handle,
+        ...(nextWithHandles ? { next: nextWithHandles } : {}),
+    };
+    // Store a copy without `handle` on the stored value itself (not needed at
+    // lookup time) to avoid the tautology of storing the key inside the value.
+    const { handle: _h, next: _n, ...stored } = withHandle;
+    store.set(handle, {
+        tx: { ...stored, ...(nextWithHandles ? { next: nextWithHandles } : {}) },
+        expiresAt,
+    });
+    return withHandle;
+}
+/**
+ * Retrieve the tx named by `handle`, or throw if unknown/expired. Does NOT
+ * delete the entry — we need retry-on-device-disconnect to work, so the handle
+ * stays valid until either:
+ *   (a) the tx is successfully submitted to the relay (caller invokes
+ *       `retireHandle` after the WalletConnect request resolves), or
+ *   (b) the TTL expires.
+ * Callers must call `retireHandle(handle)` on successful submission so replays
+ * fail loudly instead of silently re-submitting the same payload.
+ */
+export function consumeHandle(handle) {
+    prune();
+    const entry = store.get(handle);
+    if (!entry) {
+        throw new Error(`Unknown or expired tx handle. Prepared transactions expire after 15 minutes and ` +
+            `are single-use after a successful submission. Re-run the prepare_* tool to get a fresh handle.`);
+    }
+    return entry.tx;
+}
+/**
+ * Mark a handle as used. Called after the tx has been successfully submitted
+ * so the same handle cannot replay the submission. Safe to call on a handle
+ * that was already pruned.
+ */
+export function retireHandle(handle) {
+    store.delete(handle);
+}
+/** Test-only: true if `handle` is still active (not retired, not expired). */
+export function hasHandle(handle) {
+    prune();
+    return store.has(handle);
+}
+//# sourceMappingURL=tx-store.js.map

package/dist/signing/tx-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx-store.js","sourceRoot":"","sources":["../../src/signing/tx-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC;AAO9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C,SAAS,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,EAAc;IACzC,KAAK,EAAE,CAAC;IACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,CAAC;IAElC,MAAM,eAAe,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAe;QAC7B,GAAG,EAAE;QACL,MAAM;QACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;IACvD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QAChB,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACxE,SAAS;KACV,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,KAAK,EAAE,CAAC;IACR,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,gGAAgG,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,KAAK,EAAE,CAAC;IACR,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC"}

package/dist/signing/walletconnect.d.ts

@@ -0,0 +1,33 @@
+import { SignClient } from "@walletconnect/sign-client";
+import type { SessionTypes } from "@walletconnect/types";
+import { type UnsignedTx } from "../types/index.js";
+/**
+ * EVM namespace requested when proposing a session. We deliberately omit
+ * `personal_sign` and `eth_signTypedData_v4` — no tool in this server produces
+ * either, so requesting them would be an over-broad capability grant. Blind
+ * typed-data signing is the canonical Permit2 / off-chain-order phishing
+ * surface; scoping the session away from it means a compromised process can't
+ * issue those requests against a live pairing without reconnecting (which the
+ * user would see prompted on their device).
+ */
+export declare const REQUIRED_NAMESPACES: {
+    eip155: {
+        methods: string[];
+        chains: string[];
+        events: string[];
+    };
+};
+export declare function isPeerUnreachable(): boolean;
+export declare function getSignClient(): Promise<InstanceType<typeof SignClient>>;
+export interface PairResult {
+    uri: string;
+    approval: Promise<SessionTypes.Struct>;
+}
+/** Create a new pairing + session proposal. The returned URI is what the user scans in Ledger Live. */
+export declare function initiatePairing(): Promise<PairResult>;
+export declare function getCurrentSession(): SessionTypes.Struct | null;
+/** Return the list of EVM accounts exposed by the connected wallet (across all namespaces). */
+export declare function getConnectedAccounts(): Promise<`0x${string}`[]>;
+/** Send an `eth_sendTransaction` request. Ledger Live shows it, user signs on device, we get tx hash back. */
+export declare function requestSendTransaction(tx: UnsignedTx): Promise<`0x${string}`>;
+export declare function disconnect(): Promise<void>;