Release / v2.107.0, v2.107.1, v2.107.2, v2.107.3, v2.107.4

AGENTS.md

@@ -29,7 +29,7 @@ Note: This package does not include compiled JS and TS output in the repository.
 
 ### Code quality:
 - Code usually runs continuously for long periods of time (especially in browser extension environments), so memory leaks, listeners, and orphaned async processes can accumulate and cause performance, stability, or reliability issues over time.
-- Always ensure subscriptions, event listeners, timers and other side effects are properly cleaned up
+- Always ensure subscriptions, event listeners, timers and other side effects are properly cleaned up. Even if it's a simple `setTimeout` used to reject a promise, it should be cleared.
 - NEVER delete existing comments when updating a code block; update inaccurate comments instead. Delete a comment only if the logic it describes is completely removed or the new logic is entirely self-explanatory
 - NEVER swallow errors; log them and handle appropriately.
 - NEVER modify git config or run destructive git operations
@@ -38,6 +38,7 @@ Note: This package does not include compiled JS and TS output in the repository.
 - Avoid TypeScript casts when possible. Prefer narrowing with if statements, discriminated unions, assertion functions, and type guards. Cast only at trusted boundaries, and keep it local
 - Avoid regex for parsing strings or business logic. Prefer explicit parsing, small helper functions, existing parsers or available library functions.
 - All warnings, errors, and other user-facing strings (controller `errors`/banners, e.g. `signAccountOp.ts`, `swapAndBridge.ts`; humanized strings in `src/libs/humanizer`, `src/libs/errorHumanizer`) must be phrased in plain language a non-technical user can understand. NEVER assume Web3/blockchain knowledge — avoid unexplained jargon (e.g. "RPC", "nonce", "gas limit", "Paymaster", "Bundler", "EOA", "Smart Account", "delegatecall", "calldata", "simulation failed") and instead describe the real-world action, cause, or risk in plain terms (e.g. "a pending transaction" instead of "nonce too low", "insufficient funds to cover the fee" instead of "low gas")
+- Comments of reusable functions, types and constants should be public to allow reading them on hover (but don't edit existing comments that are outside of the scope of the task).
 
 ## Tests:
 - ALWAYS write test cases that cover positive, negative, edge cases and security implications of the code you change or add.

package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.106.5",
+  "version": "2.107.4",
   "name": "ambire-common",
   "description": "Common ground for the Ambire apps",
   "scripts": {

src/classes/session.ts

@@ -116,6 +116,13 @@ export class Session {
 
   constructor({ tabId, windowId, url, wcTopic, frameId, topFrameUrl }: SessionInitProps = {}) {
     if (url) {
+      // SECURITY: `origin` must stay exactly what the browser/WebView reports, trailing dot and
+      // all - it is later compared byte-for-byte against the page's own read-only `location.origin`
+      // before a response or broadcast is delivered to it (see the mobile WebView's origin gate).
+      // A live, unmodified page cannot be "canonicalized" - only our copy of its origin could be -
+      // so normalizing it here would make that comparison fail for a legitimate page and silently
+      // drop data meant for it. `id` (below) is the canonicalized identity that every phishing and
+      // permission check resolves against; do not canonicalize `origin` to "fix" that too.
       this.origin = new URL(url).origin
     } else {
       this.origin = 'internal'

src/consts/featureFlags.ts

@@ -12,6 +12,11 @@ export interface FeatureFlags {
    * will need an EOA account just like using a Safe)
    */
   erc4337: boolean
+  /**
+   * Allow the user to opt out of upgrading EOA accounts through ERC-7702.
+   * Existing onchain delegations are not revoked when this is disabled.
+   */
+  eip7702: boolean
   /**
    * Off by default for privacy: passively bulk-resolving ENS/Namoshi for all
    * accounts links them together. When enabled, the wallet keeps every account's
@@ -32,6 +37,7 @@ export const defaultFeatureFlags: FeatureFlags = {
   tokenAndDefiAutoDiscovery: true,
   apiForFunctionSelectors: true,
   erc4337: true,
+  eip7702: true,
   keepEnsProfilesUpToDate: false,
   // @TODO: Introduce a setting and flip to false
   namoshiDomains: true,

src/consts/hardwareWallets.ts

@@ -4,5 +4,6 @@ export const HARDWARE_WALLET_DEVICE_NAMES: { [key in ExternalKey['type']]: strin
   ledger: 'Ledger',
   trezor: 'Trezor',
   lattice: 'GridPlus',
-  qr: 'QR-based'
+  qr: 'QR-based',
+  nfc: 'NFC-based'
 }

src/consts/intervals.ts

@@ -12,6 +12,9 @@ export const BLACKLIST_UPDATE_INTERVAL = 8 * 60 * 60 * 1000 // 8 hrs
 export const PHISHING_INACTIVE_UPDATE_INTERVAL = 6 * 60 * 60 * 1000 // 6 hrs
 export const PHISHING_ACTIVE_UPDATE_INTERVAL = 15 * 60 * 1000 // 15 minutes
 export const PHISHING_FAILED_TO_GET_UPDATE_INTERVAL = 600000 // 10 minutes
+export const TRENDING_TOKENS_ACTIVE_UPDATE_INTERVAL = 10 * 60 * 1000 // 10 minutes
+export const TRENDING_TOKENS_INACTIVE_UPDATE_INTERVAL = 4 * 60 * 60 * 1000 // 4 hours
+export const TRENDING_TOKENS_FAILED_UPDATE_INTERVAL = 60 * 1000 // 1 minute
 export const ESTIMATE_UPDATE_INTERVAL = 30000
 export const GAS_PRICE_UPDATE_INTERVAL = 12000
 export const FETCH_SAFE_TXNS = 3 * 60 * 1000 // 3 minutes

src/consts/safe.ts

@@ -10,6 +10,9 @@ export const SAFE_NETWORKS = [
 
 export const SAFE_API_TIMEOUT_MS = 15000
 
+// Keep Safe Transaction Service requests below its bulk request limits.
+export const SAFE_API_BATCH_SIZE = 4
+
 /**
  * SimulateTxAccessor addresses by Safe version.
  */

src/consts/signAccountOp/errorHandling.ts

@@ -7,30 +7,23 @@ const ERRORS = {
 const WARNINGS: Record<
   | 'significantBalanceDecrease'
   | 'unknownToken'
-  | 'possibleBalanceDecrease'
   | 'feeTokenPriceUnavailable'
   | 'v1Acc'
   | 'safeDelegateCall',
   Warning
 > = {
   significantBalanceDecrease: {
     id: 'significantBalanceDecrease',
-    title: 'Significant Account Balance Decrease',
-    text: 'The transaction you are about to sign will significantly decrease your account balance. Please review the transaction details carefully.',
-    promptBefore: ['sign']
+    title: 'Significant balance decrease detected',
+    text: 'Our checks indicate this transaction may significantly reduce your account balance.',
+    secondaryText: 'May be inaccurate when moving funds to another network or providing liquidity.'
   },
   unknownToken: {
     id: 'unknownToken',
     title: 'Unknown token detected',
     text: 'The transaction you are about to sign contains an unknown token. Please review carefully, as this token may be misleading.',
     promptBefore: ['sign']
   },
-  possibleBalanceDecrease: {
-    id: 'possibleBalanceDecrease',
-    title: 'Significant Account Balance Decrease (Possibly Inaccurate)',
-    text: 'The transaction you are about to sign may significantly decrease your account balance. However, due to temporary issues in discovering new portfolio tokens, this information might not be fully accurate. Please review the transaction details carefully.',
-    promptBefore: ['sign']
-  },
   feeTokenPriceUnavailable: {
     id: 'feeTokenPriceUnavailable',
     title: 'Unable to estimate the transaction fee in USD.'

src/controllers/accountPicker/accountPicker.test.ts

@@ -1,8 +1,8 @@
 import { Wallet } from 'ethers'
 
-import { describe, expect, test } from '@jest/globals'
+import { describe, expect, jest, test } from '@jest/globals'
 
-import { suppressConsoleBeforeEach } from '../../../test/helpers/console'
+import { suppressConsole, suppressConsoleBeforeEach } from '../../../test/helpers/console'
 import { makeMainController } from '../../../test/helpers/mainController'
 import { DEFAULT_ACCOUNT_LABEL } from '../../consts/account'
 import {
@@ -149,6 +149,136 @@ describe('AccountPicker', () => {
     expect(controller.accountsOnPage.filter((a) => !isSmartAccount(a.account))).toHaveLength(5)
   })
 
+  test('should update basic account usage while smart accounts are still loading', async () => {
+    const { controller } = await prepareTest()
+    const pageSize = 5
+    const keyIterator = new KeyIterator(process.env.SEED)
+    const retrieve = keyIterator.retrieve.bind(keyIterator)
+    let resolveSmartAccountKeys: (keys: string[]) => void = () => {}
+    const smartAccountKeysPromise = new Promise<string[]>((resolve) => {
+      resolveSmartAccountKeys = resolve
+    })
+
+    jest.spyOn(keyIterator, 'retrieve').mockImplementation((indices, hdPathTemplate) => {
+      if ((indices[0]?.from || 0) >= SMART_ACCOUNT_SIGNER_KEY_DERIVATION_OFFSET) {
+        return smartAccountKeysPromise
+      }
+
+      return retrieve(indices, hdPathTemplate)
+    })
+
+    controller.setInitParams({
+      keyIterator,
+      pageSize,
+      hdPathTemplate: BIP44_STANDARD_DERIVATION_TEMPLATE,
+      shouldGetAccountsUsedOnNetworks: false,
+      shouldSearchForLinkedAccounts: false,
+      shouldAddNextAccountAutomatically: false
+    })
+    await controller.init()
+
+    const setPagePromise = controller.setPage({ page: 1 })
+
+    while (!controller.smartAccountsLoading) await wait(0)
+    await wait(0)
+
+    expect(controller.accountsLoading).toBe(false)
+    expect(controller.accountsOnPage).toHaveLength(pageSize)
+    expect(controller.accountsOnPage.every((a) => !isSmartAccount(a.account))).toBe(true)
+    expect(controller.accountsOnPage.every((a) => a.account.usedOnNetworks === null)).toBe(true)
+
+    controller.selectAccount(controller.accountsOnPage[0]!.account)
+    expect(controller.selectedAccounts).toHaveLength(1)
+
+    resolveSmartAccountKeys(
+      key1to11BasicAccUsedForSmartAccKeysOnlyPublicAddresses.slice(0, pageSize)
+    )
+    await setPagePromise
+
+    expect(controller.smartAccountsLoading).toBe(false)
+    expect(controller.accountsOnPage).toHaveLength(pageSize + 1)
+    expect(controller.selectedAccounts).toHaveLength(1)
+  })
+
+  test('should keep basic accounts available when smart account retrieval fails', async () => {
+    const { controller } = await prepareTest()
+    const pageSize = 5
+    const keyIterator = new KeyIterator(process.env.SEED)
+    const retrieve = keyIterator.retrieve.bind(keyIterator)
+
+    jest.spyOn(keyIterator, 'retrieve').mockImplementation((indices, hdPathTemplate) => {
+      if ((indices[0]?.from || 0) >= SMART_ACCOUNT_SIGNER_KEY_DERIVATION_OFFSET) {
+        return Promise.reject(new Error('Smart account key retrieval failed'))
+      }
+
+      return retrieve(indices, hdPathTemplate)
+    })
+
+    controller.setInitParams({
+      keyIterator,
+      pageSize,
+      hdPathTemplate: BIP44_STANDARD_DERIVATION_TEMPLATE,
+      shouldGetAccountsUsedOnNetworks: false,
+      shouldSearchForLinkedAccounts: false,
+      shouldAddNextAccountAutomatically: false
+    })
+    await controller.init()
+    const { restore } = suppressConsole()
+    await controller.setPage({ page: 1 })
+    restore()
+
+    expect(controller.accountsLoading).toBe(false)
+    expect(controller.smartAccountsLoading).toBe(false)
+    expect(controller.accountsOnPage).toHaveLength(pageSize)
+    expect(controller.pageError).toBeNull()
+    expect(controller.emittedErrors.at(-1)?.level).toBe('minor')
+    expect(controller.emittedErrors.at(-1)?.message).toBe(
+      'We could not finish loading smart accounts. You can still import the accounts already shown.'
+    )
+
+    controller.selectAccount(controller.accountsOnPage[0]!.account)
+    expect(controller.selectedAccounts).toHaveLength(1)
+  })
+
+  test('should ignore smart accounts retrieved after the account picker is reset', async () => {
+    const { controller } = await prepareTest()
+    const keyIterator = new KeyIterator(process.env.SEED)
+    const retrieve = keyIterator.retrieve.bind(keyIterator)
+    let resolveSmartAccountKeys: (keys: string[]) => void = () => {}
+    const smartAccountKeysPromise = new Promise<string[]>((resolve) => {
+      resolveSmartAccountKeys = resolve
+    })
+
+    jest.spyOn(keyIterator, 'retrieve').mockImplementation((indices, hdPathTemplate) => {
+      if ((indices[0]?.from || 0) >= SMART_ACCOUNT_SIGNER_KEY_DERIVATION_OFFSET) {
+        return smartAccountKeysPromise
+      }
+
+      return retrieve(indices, hdPathTemplate)
+    })
+
+    controller.setInitParams({
+      keyIterator,
+      pageSize: 5,
+      hdPathTemplate: BIP44_STANDARD_DERIVATION_TEMPLATE,
+      shouldGetAccountsUsedOnNetworks: false,
+      shouldSearchForLinkedAccounts: false,
+      shouldAddNextAccountAutomatically: false
+    })
+    await controller.init()
+
+    const setPagePromise = controller.setPage({ page: 1 })
+    while (!controller.smartAccountsLoading) await wait(0)
+
+    await controller.reset()
+    resolveSmartAccountKeys(key1to11BasicAccUsedForSmartAccKeysOnlyPublicAddresses.slice(0, 5))
+    await setPagePromise
+
+    expect(controller.isInitialized).toBe(false)
+    expect(controller.smartAccountsLoading).toBe(false)
+    expect(controller.accountsOnPage).toHaveLength(0)
+  })
+
   test('should find linked accounts', async () => {
     const { controller } = await prepareTest()
     const keyIterator = new KeyIterator(process.env.SEED)