Merge pull request #2050 from Web3Auth/feat/validateTypeData-viem

feat: validate typedData via viem lib
Web3Auth · Jan 10, 2025 · 02b0d16 · 02b0d16
2 parents e4876f9 + 085d851
commit 02b0d16
Show file tree

Hide file tree

Showing 7 changed files with 64 additions and 39 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/providers/account-abstraction-provider/package.json b/packages/providers/account-abstraction-provider/package.json
@@ -28,7 +28,7 @@
     "@web3auth/ethereum-provider": "^9.5.2",
     "ethers": "^6.13.4",
     "permissionless": "^0.2.23",
-    "viem": "^2.21.55"
+    "viem": "^2.22.5"
   },
   "peerDependencies": {
     "@babel/runtime": "7.x"

diff --git a/packages/providers/account-abstraction-provider/src/providers/utils.ts b/packages/providers/account-abstraction-provider/src/providers/utils.ts
@@ -47,6 +47,7 @@ export function getProviderHandlers({
     processTransaction: async (txParams: TransactionParams & { gas?: string }): Promise<string> => {
       if (txParams.input && !txParams.data) txParams.data = addHexPrefix(txParams.input);
       const { to, value, data } = txParams;
+      // @ts-expect-error viem types are too deep
       const userOperationParams: SendUserOperationParameters = {
         account: smartAccount,
         calls: [
@@ -59,7 +60,7 @@ export function getProviderHandlers({
         ],
         // should not use maxFeePerGas/maxPriorityFeePerGas from transaction params since that's fee for transaction not user operation and let bundler handle it instead
       };
-      // @ts-expect-error viem types are too deep
+
       const userOpHash = await bundlerClient.sendUserOperation(userOperationParams);
 
       const txReceipt = await bundlerClient.waitForUserOperationReceipt({ hash: userOpHash });

diff --git a/packages/providers/ethereum-mpc-provider/package.json b/packages/providers/ethereum-mpc-provider/package.json
@@ -26,7 +26,8 @@
     "@web3auth/base": "^9.5.2",
     "@web3auth/base-provider": "^9.5.2",
     "@web3auth/ethereum-provider": "^9.5.2",
-    "ethers": "^6.13.4"
+    "ethers": "^6.13.4",
+    "viem": "^2.22.5"
   },
   "peerDependencies": {
     "@babel/runtime": "7.x"

diff --git a/packages/providers/ethereum-mpc-provider/src/providers/signingProviders/signingUtils.ts b/packages/providers/ethereum-mpc-provider/src/providers/signingProviders/signingUtils.ts
@@ -5,14 +5,14 @@ import { log } from "@web3auth/base";
 import {
   IProviderHandlers,
   MessageParams,
-  SignTypedDataMessageV4,
   SignTypedDataVersion,
   TransactionFormatter,
   TransactionParams,
   TypedMessageParams,
   validateTypedSignMessageDataV4,
 } from "@web3auth/ethereum-provider";
-import { hashMessage, Signature, TypedDataEncoder } from "ethers";
+import { hashMessage, Signature } from "ethers";
+import { hashTypedData, hexToBytes, validateTypedData } from "viem";
 
 async function signTx(
   txParams: TransactionParams & { gas?: string },
@@ -89,9 +89,10 @@ async function signTypedData(
   if (data === null || data === undefined) {
     throw new Error("Missing data parameter");
   }
-  const message: SignTypedDataMessageV4 = typeof data === "string" ? JSON.parse(data) : data;
+  const message = typeof data === "string" ? JSON.parse(data) : data;
+  validateTypedData(message);
 
-  const { v, r, s } = await sign(Buffer.from(TypedDataEncoder.hash(message.domain, message.types, message.message).slice(2), "hex"));
+  const { v, r, s } = await sign(Buffer.from(hexToBytes(hashTypedData(message))));
 
   let modifiedV = v;
   if (modifiedV <= 1) {
@@ -170,7 +171,6 @@ export function getProviderHandlers({
       const chainId = await providerEngineProxy.request<unknown, string>({ method: "eth_chainId" });
       await validateTypedSignMessageDataV4(msgParams, chainId);
       const data = typeof msgParams.data === "string" ? JSON.parse(msgParams.data) : msgParams.data;
-      if (data.types.EIP712Domain) delete data.types.EIP712Domain;
       const sig = signTypedData(sign, data, SignTypedDataVersion.V4);
       return sig;
     },

diff --git a/packages/providers/ethereum-provider/package.json b/packages/providers/ethereum-provider/package.json
@@ -31,7 +31,8 @@
     "bignumber.js": "^9.1.2",
     "bn.js": "^5.2.1",
     "ethers": "^6.13.4",
-    "jsonschema": "^1.4.1"
+    "jsonschema": "^1.4.1",
+    "viem": "^2.22.5"
   },
   "devDependencies": {
     "@types/bn.js": "^5.1.6",

diff --git a/packages/providers/ethereum-provider/src/providers/privateKeyProviders/ethPrivatekeyUtils.ts b/packages/providers/ethereum-provider/src/providers/privateKeyProviders/ethPrivatekeyUtils.ts
@@ -3,9 +3,10 @@ import { signMessage } from "@toruslabs/base-controllers";
 import { getPublicCompressed } from "@toruslabs/eccrypto";
 import { JRPCRequest, providerErrors } from "@web3auth/auth";
 import { log, SafeEventEmitterProvider } from "@web3auth/base";
-import { hashMessage, SigningKey, TypedDataEncoder } from "ethers";
+import { hashMessage, SigningKey } from "ethers";
+import { hashTypedData, validateTypedData } from "viem";
 
-import { IProviderHandlers, MessageParams, SignTypedDataMessageV4, TransactionParams, TypedMessageParams } from "../../rpc/interfaces";
+import { IProviderHandlers, MessageParams, TransactionParams, TypedMessageParams } from "../../rpc/interfaces";
 import { TransactionFormatter } from "./TransactionFormatter/formatter";
 import { validateTypedSignMessageDataV4 } from "./TransactionFormatter/utils";
 
@@ -103,10 +104,10 @@ export function getProviderHandlers({
         });
       const chainId = await providerEngineProxy.request<never, string>({ method: "eth_chainId" });
       await validateTypedSignMessageDataV4(msgParams, chainId);
-      const data: SignTypedDataMessageV4 = typeof msgParams.data === "string" ? JSON.parse(msgParams.data) : msgParams.data;
+      const data = typeof msgParams.data === "string" ? JSON.parse(msgParams.data) : msgParams.data;
       const ethersPrivateKey = new SigningKey(privKeyBuffer);
-      if (data.types.EIP712Domain) delete data.types.EIP712Domain;
-      const signature = ethersPrivateKey.sign(TypedDataEncoder.hash(data.domain, data.types, data.message)).serialized;
+      validateTypedData(data);
+      const signature = ethersPrivateKey.sign(hashTypedData(data)).serialized;
       return signature;
     },
   };