Skip to content

fix(abstract-eth): harden EVM TSS payment and consolidation checks #10136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dpkjnr wants to merge 2 commits into
base: master
Choose a base branch
from
+812 −63
Open

fix(abstract-eth): harden EVM TSS payment and consolidation checks #10136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d52cc25
fix(abstract-eth): harden EVM TSS payment and consolidation checks
dpkjnr Nov 5, 2026
d4235db
fix(sdk-core): preserve token identity in MPCv2 approvals
dpkjnr Nov 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
369 changes: 310 additions & 59 deletions modules/abstract-eth/src/abstractEthLikeNewCoins.ts
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion modules/sdk-coin-bsc/test/unit/bsc.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,7 +224,7 @@ describe('Native BNB', function () {
txPrebuild: { txHex, coin: 'tbsc', walletId: 'fakeWalletId' } as any,
wallet,
})
.should.be.rejectedWith('destination address does not match with the recipient address');
.should.be.rejectedWith('transaction calldata does not match the calldata given by client');
});

describe('assertSignableConsistency (Gap 2 / WCI-1398)', function () {
Expand Down
491 changes: 491 additions & 0 deletions modules/sdk-coin-eth/test/unit/tssPaymentVerification.ts
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 2 additions & 1 deletion modules/sdk-coin-xdc/test/unit/xdcToken.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,8 @@ describe('XDC Token:', function () {
describe('verifyTssTransaction', function () {
const recipientAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
const wrongAddress = '0x7e85bdc27c050e3905ebf4b8e634d9ad6edd0de6';
const tokenContractAddress = '0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48';
// txdc:tmt's contract in statics: verifyTssTransaction checks the token contract being called.
const tokenContractAddress = '0xb283ec8dad644effc5c4c50bb7bb21442ac3c2db';

it('should accept an ERC-20 transfer where calldata matches declared recipient', async function () {
const token = bitgo.coin('txdc:tmt') as XdcToken;
Expand Down
4 changes: 2 additions & 2 deletions modules/sdk-core/src/bitgo/utils/tss/ecdsa/ecdsaMPCv2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -991,7 +991,7 @@ export class EcdsaMPCv2Utils extends BaseEcdsaUtils {
if (shouldVerifyWithSerializedTxHex(this.baseCoin) || shouldUsePreHashedSignable(this.baseCoin, unsignedTx)) {
await this.baseCoin.verifyTransaction({
txPrebuild: { txHex: unsignedTx.serializedTxHex, txInfo: unsignedTx.signableHex },
txParams: resolveEffectiveTxParams(txRequest, params.txParams),
txParams: resolveEffectiveTxParams(txRequest, params.txParams, this.baseCoin.getChain()),
wallet: this.wallet,
walletType: this.wallet.multisigType(),
});
Expand All @@ -1001,7 +1001,7 @@ export class EcdsaMPCv2Utils extends BaseEcdsaUtils {
} else {
await this.baseCoin.verifyTransaction({
txPrebuild: { txHex: unsignedTx.signableHex },
txParams: resolveEffectiveTxParams(txRequest, params.txParams),
txParams: resolveEffectiveTxParams(txRequest, params.txParams, this.baseCoin.getChain()),
wallet: this.wallet,
walletType: this.wallet.multisigType(),
});
Expand Down
3 changes: 3 additions & 0 deletions modules/sdk-core/src/bitgo/utils/tss/recipientUtils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,9 @@ export const NO_RECIPIENT_TX_TYPES = new Set([
*
* tokenName is derived from tokenData.tokenName when present, otherwise from
* amount.symbol when chainName is provided and symbol differs from it.
* MPCv2 callers supply the signing coin's chain name to retain token identity on
* stored-request approvals. This fallback only affects reconstructed recipients;
* a nonempty caller-supplied recipient list is preserved unchanged.
*
* Staking intents (BSC delegate/undelegate, CELO stake/unstake, etc.) are
* identified generically by the presence of `stakingRequestId` on the intent —
Expand Down
3 changes: 3 additions & 0 deletions modules/sdk-core/test/unit/bitgo/utils/tss/ecdsa/ecdsaMPCv2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,6 +635,7 @@ describe('ECDSA MPC v2', async () => {
getHashFunction: hashFunctionSpy,
verifyTransaction: sinon.stub().resolves(true),
getMPCAlgorithm: sinon.stub().returns('ecdsa'),
getChain: sinon.stub().returns('flrp'),
getConfig: sinon.stub().returns({ family: 'flrp' }),
isSignablePreHashed: (unsignedTx: { serializedTxHex?: string }) =>
unsignedTx.serializedTxHex?.startsWith('0000') ?? false,
Expand Down Expand Up @@ -706,6 +707,7 @@ describe('ECDSA MPC v2', async () => {
getHashFunction: hashFunctionSpy,
verifyTransaction: sinon.stub().resolves(true),
getMPCAlgorithm: sinon.stub().returns('ecdsa'),
getChain: sinon.stub().returns('flr'),
getConfig: sinon.stub().returns({ family: 'flr' }),
} as unknown as IBaseCoin;

Expand Down Expand Up @@ -780,6 +782,7 @@ describe('ECDSA MPC v2', async () => {
getHashFunction: sinon.stub().callsFake(() => createKeccakHash('keccak256') as Hash),
verifyTransaction: verifyTransactionSpy,
getMPCAlgorithm: sinon.stub().returns('ecdsa'),
getChain: sinon.stub().returns('hteth'),
getConfig: sinon.stub().returns({ family: 'hteth' }),
} as unknown as IBaseCoin;

Expand Down
Loading