starknet 10.7.1 → 10.7.2

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## [10.7.2](https://github.com/starknet-io/starknet.js/compare/v10.7.1...v10.7.2) (2026-09-08)
+
+### Bug Fixes
+
+- **paymaster:** accept a raw shortstring for the paymaster typed-data domain chainId ([4abd5ae](https://github.com/starknet-io/starknet.js/commit/4abd5aeec079e8ca14ce098d0ff8790a89aa1c62))
+- **paymaster:** bind paymaster typed-data domain to the account's provider chain ([f194c61](https://github.com/starknet-io/starknet.js/commit/f194c612cd2fa2ecb6515e484f89d6f2bb72892a))
+- **paymaster:** reject paymaster typed data declaring both "calls" and "Calls" ([e618f70](https://github.com/starknet-io/starknet.js/commit/e618f706fe543aa5dbce5b560098ad15d4ca341b))
+- **paymaster:** validate selector and calldata shape of the appended gas-token call ([4b72d35](https://github.com/starknet-io/starknet.js/commit/4b72d35cfe19424fb707dbfdfd4e3877532f86b5))
+- **paymaster:** validate the full u256 gas-token amount unconditionally ([3d1a1ec](https://github.com/starknet-io/starknet.js/commit/3d1a1ec420a769f31bb7fc94b2a68f36ae56630e))
+- **paymaster:** verify calls equality for sponsored paymaster transactions too ([c403643](https://github.com/starknet-io/starknet.js/commit/c403643b580ab5953a2e737d1aa39e083d5f0262))
+
 ## [10.7.1](https://github.com/starknet-io/starknet.js/compare/v10.7.0...v10.7.1) (2026-08-21)
 
 ### Bug Fixes

package/dist/index.d.ts

@@ -8936,10 +8936,38 @@ declare const getDefaultPaymasterNodeUrl: (networkName?: _NetworkName, mute?: bo
  * Asserts that the given calls are strictly equal, otherwise throws an error.
  * @param {Call[]} originalCalls - The original calls.
  * @param {Call[]} unsafeCalls - The unsafe calls.
+ * @param {boolean} [isSponsored] - Whether the transaction is sponsored. A sponsored
+ * transaction appends no gas-token fee-transfer call; a non-sponsored one appends exactly
+ * one. Defaults to `false` for backward compatibility.
  * @throws {Error} Throws an error if the calls are not strictly equal.
+ * @example
+ * ```typescript
+ * paymaster.assertCallsAreStrictlyEqual(originalCalls, unsafeCalls, true); // sponsored: no fee call
+ * ```
+ */
+declare function assertCallsAreStrictlyEqual(originalCalls: Call[], unsafeCalls: (OutsideCallV1 | OutsideCallV2)[], isSponsored?: boolean): void;
+/**
+ * Asserts that a paymaster-prepared transaction is safe to sign: the typed-data domain is
+ * bound to the account's own chain, and — for non-sponsored transactions — the calls and the
+ * appended gas-token transfer match what the user actually requested.
+ * @param {PreparedTransaction} preparedTransaction - The transaction returned by the paymaster.
+ * @param {Call[]} calls - The calls originally requested by the user.
+ * @param {PaymasterDetails} paymasterDetails - The fee mode and related paymaster details.
+ * @param {StarknetChainId} chainId - The chain id of the account's own provider.
+ * @param {BigNumberish} [maxFeeInGasToken] - Optional user-approved ceiling on the gas-token fee.
+ * @throws {Error} Throws an error if any of the above safety properties do not hold.
+ * @example
+ * ```typescript
+ * assertPaymasterTransactionSafety(
+ *   preparedTransaction,
+ *   calls,
+ *   { feeMode: { mode: 'default', gasToken: strkAddress } },
+ *   constants.StarknetChainId.SN_SEPOLIA
+ * );
+ * // does not throw if preparedTransaction is exactly what was requested
+ * ```
  */
-declare function assertCallsAreStrictlyEqual(originalCalls: Call[], unsafeCalls: (OutsideCallV1 | OutsideCallV2)[]): void;
-declare const assertPaymasterTransactionSafety: (preparedTransaction: PreparedTransaction, calls: Call[], paymasterDetails: PaymasterDetails, maxFeeInGasToken?: BigNumberish) => void;
+declare const assertPaymasterTransactionSafety: (preparedTransaction: PreparedTransaction, calls: Call[], paymasterDetails: PaymasterDetails, chainId: _StarknetChainId, maxFeeInGasToken?: BigNumberish) => void;
 
 declare const paymaster_assertCallsAreStrictlyEqual: typeof assertCallsAreStrictlyEqual;
 declare const paymaster_assertPaymasterTransactionSafety: typeof assertPaymasterTransactionSafety;

package/dist/index.global.js

@@ -16553,9 +16553,12 @@ ${indent}}` : "}";
   var assertGasFeeFromUnsafeCalls = (unsafeCalls, fees) => {
     const unsafeCall = toOutsideCallV2(unsafeCalls[unsafeCalls.length - 1]);
     const unsafeGasTokenCalldata = CallData.toCalldata(unsafeCall.Calldata);
-    const unsafeGasTokenValue = unsafeGasTokenCalldata[1];
+    const unsafeGasTokenValue = uint256ToBN({
+      low: unsafeGasTokenCalldata[1],
+      high: unsafeGasTokenCalldata[2]
+    });
     assert(
-      BigInt(unsafeGasTokenValue) === BigInt(fees),
+      unsafeGasTokenValue === BigInt(fees),
       "Gas token value is not equal to the provided gas fees"
     );
   };
@@ -16565,12 +16568,21 @@ ${indent}}` : "}";
       BigInt(unsafeCall.To) === BigInt(gasToken),
       "Gas token address is not equal to the provided gas token"
     );
+    assert(
+      unsafeCall.Selector === getSelectorFromName("transfer"),
+      "Gas token call selector is not a transfer"
+    );
+    assert(
+      CallData.toCalldata(unsafeCall.Calldata).length === 3,
+      "Gas token transfer calldata does not match the expected recipient/amount shape"
+    );
   };
-  function assertCallsAreStrictlyEqual(originalCalls, unsafeCalls) {
+  function assertCallsAreStrictlyEqual(originalCalls, unsafeCalls, isSponsored = false) {
     const baseError = "Provided calls are not strictly equal to the returned calls";
+    const expectedExtraCalls = isSponsored ? 0 : 1;
     assert(
-      unsafeCalls.length - 1 === originalCalls.length,
-      `${baseError}: Expected ${originalCalls.length + 1} calls, got ${unsafeCalls.length}`
+      unsafeCalls.length - expectedExtraCalls === originalCalls.length,
+      `${baseError}: Expected ${originalCalls.length + expectedExtraCalls} calls, got ${unsafeCalls.length}`
     );
     for (let callIndex = 0; callIndex < originalCalls.length; callIndex += 1) {
       const originalCall = originalCalls[callIndex];
@@ -16604,21 +16616,42 @@ ${indent}}` : "}";
       }
     }
   }
-  var assertPaymasterTransactionSafety = (preparedTransaction, calls, paymasterDetails, maxFeeInGasToken) => {
-    if (paymasterDetails.feeMode.mode !== "sponsored") {
-      if (preparedTransaction.type === "invoke" || preparedTransaction.type === "deploy_and_invoke") {
-        const unsafeCalls = "calls" in preparedTransaction.typed_data.message ? preparedTransaction.typed_data.message.calls : preparedTransaction.typed_data.message.Calls;
-        assertCallsAreStrictlyEqual(calls, unsafeCalls);
+  var domainFieldToFelt = (value) => {
+    try {
+      return toBigInt(value);
+    } catch {
+      return toBigInt(encodeShortString(String(value)));
+    }
+  };
+  var assertChainIdFromTypedData = (typedData, chainId) => {
+    assert(
+      typedData.domain.chainId !== void 0 && domainFieldToFelt(typedData.domain.chainId) === BigInt(chainId),
+      "Paymaster typed data domain chainId does not match the account's provider chain"
+    );
+  };
+  var assertPaymasterTransactionSafety = (preparedTransaction, calls, paymasterDetails, chainId, maxFeeInGasToken) => {
+    if (preparedTransaction.type === "invoke" || preparedTransaction.type === "deploy_and_invoke") {
+      assertChainIdFromTypedData(preparedTransaction.typed_data, chainId);
+      const { message } = preparedTransaction.typed_data;
+      const hasV1Calls = "calls" in message;
+      const hasV2Calls = "Calls" in message;
+      assert(
+        hasV1Calls !== hasV2Calls,
+        'Paymaster typed data must declare exactly one of "calls" (SNIP-9 V1) or "Calls" (SNIP-9 V2)'
+      );
+      const unsafeCalls = hasV1Calls ? message.calls : message.Calls;
+      assertCallsAreStrictlyEqual(calls, unsafeCalls, paymasterDetails.feeMode.mode === "sponsored");
+      if (paymasterDetails.feeMode.mode !== "sponsored") {
         assertGasTokenFromUnsafeCalls(unsafeCalls, paymasterDetails.feeMode.gasToken);
+        assertGasFeeFromUnsafeCalls(
+          unsafeCalls,
+          preparedTransaction.fee.suggested_max_fee_in_gas_token
+        );
         if (maxFeeInGasToken) {
           assert(
             preparedTransaction.fee.suggested_max_fee_in_gas_token <= maxFeeInGasToken,
             "Gas token price is too high"
           );
-          assertGasFeeFromUnsafeCalls(
-            unsafeCalls,
-            preparedTransaction.fee.suggested_max_fee_in_gas_token
-          );
         }
       }
     }
@@ -17743,6 +17776,7 @@ ${indent}}` : "}";
         preparedTransaction,
         calls,
         paymasterDetails,
+        await this.provider.getChainId(),
         maxFeeInGasToken
       );
       const transaction = await this.preparePaymasterTransaction(preparedTransaction);