Skip to content

Commit 61daef3

Browse files
authored
Merge pull request #7502 from BitGo/derek/SC-3865-update-amount-erc20-check-for-walletconnect
feat: update erc20 token transfer amount check for walletconnect
2 parents 7388ddd + edc636b commit 61daef3

File tree

2 files changed

+17
-11
lines changed

2 files changed

+17
-11
lines changed

modules/abstract-eth/src/abstractEthLikeNewCoins.ts

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2853,25 +2853,30 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
28532853
['address', 'uint256'],
28542854
getBufferedByteCode('0xa9059cbb', txJson.data)
28552855
);
2856-
if (expectedAmount !== amount.toString()) {
2857-
throwRecipientMismatch('the transaction amount in txPrebuild does not match the value given by client', [
2858-
{ address: addHexPrefix(recipientAddress.toString()), amount: amount.toString() },
2859-
]);
2860-
}
28612856

28622857
// Check if recipients[0].data exists (WalletConnect flow)
28632858
let expectedRecipientAddress: string;
2859+
let expectedTokenAmount: string;
28642860
const recipientData = (recipients[0] as any).data;
2861+
28652862
if (recipientData && recipientData.startsWith('0xa9059cbb')) {
2866-
// WalletConnect: decode expected recipient from recipients[0].data
2867-
const [expectedRecipient] = getRawDecoded(
2863+
// WalletConnect: decode expected recipient and amount from recipients[0].data
2864+
const [expectedRecipient, expectedAmount] = getRawDecoded(
28682865
['address', 'uint256'],
28692866
getBufferedByteCode('0xa9059cbb', recipientData)
28702867
);
28712868
expectedRecipientAddress = addHexPrefix(expectedRecipient.toString()).toLowerCase();
2869+
expectedTokenAmount = expectedAmount.toString();
28722870
} else {
2873-
// Normal flow: use recipients[0].address
2871+
// Normal flow: use recipients[0].address and recipients[0].amount
28742872
expectedRecipientAddress = expectedDestination.toLowerCase();
2873+
expectedTokenAmount = expectedAmount;
2874+
}
2875+
2876+
if (expectedTokenAmount !== amount.toString()) {
2877+
throwRecipientMismatch('the transaction amount in txPrebuild does not match the value given by client', [
2878+
{ address: addHexPrefix(recipientAddress.toString()), amount: amount.toString() },
2879+
]);
28752880
}
28762881

28772882
if (expectedRecipientAddress !== addHexPrefix(recipientAddress.toString()).toLowerCase()) {

modules/bitgo/test/v2/unit/internal/tssUtils/ecdsa.ts

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -858,7 +858,8 @@ describe('TSS Ecdsa Utils:', async function () {
858858

859859
it('signTxRequest should succeed for WalletConnect ERC20 transfer with data field', async function () {
860860
nock.cleanAll();
861-
// WalletConnect ERC20 transfer: recipients[0].address is token contract, recipients[0].data contains the actual recipient
861+
// WalletConnect ERC20 transfer: recipients[0].address is token contract, recipients[0].amount is 0 (no native coins)
862+
// recipients[0].data contains the actual recipient and token amount
862863
const signableHex =
863864
'02f86f83088bb00283e1d7dd84768ea6898301e04b94d9327fd36c3312466efed23ff0493453ee32f55180b844a9059cbb0000000000000000000000007d7e63af583ba73ba5c927dbd028153963566bef00000000000000000000000000000000000000000000000000470de4df820000c0';
864865
const serializedTxHex =
@@ -880,8 +881,8 @@ describe('TSS Ecdsa Utils:', async function () {
880881
recipients: [
881882
{
882883
address: '0xd9327fd36c3312466efed23ff0493453ee32f551', // Token contract address
883-
amount: '20000000000000000',
884-
data: '0xa9059cbb0000000000000000000000007d7e63af583ba73ba5c927dbd028153963566bef00000000000000000000000000000000000000000000000000470de4df820000', // ERC20 transfer calldata with actual recipient
884+
amount: '0', // No native coins sent
885+
data: '0xa9059cbb0000000000000000000000007d7e63af583ba73ba5c927dbd028153963566bef00000000000000000000000000000000000000000000000000470de4df820000', // ERC20 transfer calldata with actual recipient and token amount
885886
},
886887
],
887888
type: 'transfer',

0 commit comments

Comments
 (0)