fix: validate autoswap session management calls

Author: gakonst

src/tempo/session/precompile/Chain.test.ts

@@ -12,7 +12,7 @@ import {
   type Hex,
 } from 'viem'
 import { privateKeyToAccount } from 'viem/accounts'
-import { Transaction } from 'viem/tempo'
+import { Abis, Addresses, Transaction } from 'viem/tempo'
 import { describe, expect, test } from 'vp/test'
 
 import { VerificationFailedError } from '../../../Errors.js'
@@ -36,6 +36,7 @@ const descriptor = {
 const deposit = Types.uint96(1_000_000n)
 const chainId = 42431
 const txHash = `0x${'ab'.repeat(32)}` as const
+const sourceToken = '0x6666666666666666666666666666666666666666' as const
 const feePayer = privateKeyToAccount(
   '0x59c6995e998f97a5a0044966f0945389d1fc6e60e7346d6c36c49d32f75b9a1b',
 )
@@ -192,6 +193,28 @@ async function createSerializedTransaction(parameters: {
   } as never)) as `0x${string}`
 }
 
+function autoSwapCalls(amountOut: bigint = deposit) {
+  const maxAmountIn = amountOut + 1_000n
+  return [
+    {
+      to: sourceToken,
+      data: encodeFunctionData({
+        abi: Abis.tip20,
+        functionName: 'approve',
+        args: [Addresses.stablecoinDex, maxAmountIn],
+      }),
+    },
+    {
+      to: Addresses.stablecoinDex,
+      data: encodeFunctionData({
+        abi: Abis.stablecoinDex,
+        functionName: 'swapExactAmountOut',
+        args: [sourceToken, descriptor.token, amountOut, maxAmountIn],
+      }),
+    },
+  ] as const
+}
+
 async function createOpenTransaction(
   parameters: {
     authorizedSigner?: `0x${string}` | undefined
@@ -201,6 +224,7 @@ async function createOpenTransaction(
     signed?: boolean | undefined
     token?: `0x${string}` | undefined
     to?: `0x${string}` | undefined
+    prefixCalls?: readonly { to: `0x${string}`; data: `0x${string}` }[] | undefined
   } = {},
 ) {
   const data = encodeFunctionData({
@@ -216,7 +240,7 @@ async function createOpenTransaction(
     ],
   })
   return createSerializedTransaction({
-    calls: [{ to: parameters.to ?? tip20ChannelEscrow, data }],
+    calls: [...(parameters.prefixCalls ?? []), { to: parameters.to ?? tip20ChannelEscrow, data }],
     gas: parameters.gas,
     signed: parameters.signed,
   })
@@ -229,6 +253,7 @@ async function createTopUpTransaction(
     gas?: bigint | undefined
     signed?: boolean | undefined
     to?: `0x${string}` | undefined
+    prefixCalls?: readonly { to: `0x${string}`; data: `0x${string}` }[] | undefined
   } = {},
 ) {
   const data = encodeFunctionData({
@@ -240,7 +265,7 @@ async function createTopUpTransaction(
     ],
   })
   return createSerializedTransaction({
-    calls: [{ to: parameters.to ?? tip20ChannelEscrow, data }],
+    calls: [...(parameters.prefixCalls ?? []), { to: parameters.to ?? tip20ChannelEscrow, data }],
     gas: parameters.gas,
     signed: parameters.signed,
   })
@@ -446,7 +471,31 @@ describe('precompile broadcastOpenTransaction', () => {
         expectedPayer: descriptor.payer,
         serializedTransaction,
       }),
-    ).rejects.toThrow('TIP-1034 open transaction must contain exactly one call')
+    ).rejects.toThrow(
+      'TIP-1034 open transaction must contain one management call, optionally preceded by an auto-swap',
+    )
+  })
+
+  test('rejects an auto-swap whose output does not match the open deposit', async () => {
+    const serializedTransaction = await createOpenTransaction({
+      prefixCalls: autoSwapCalls(deposit + 1n),
+    })
+
+    await expect(
+      Chain.broadcastOpenTransaction({
+        chainId,
+        client: createMockClient(),
+        escrowContract: tip20ChannelEscrow,
+        expectedAuthorizedSigner: descriptor.authorizedSigner,
+        expectedChannelId: `0x${'11'.repeat(32)}`,
+        expectedCurrency: descriptor.token,
+        expectedExpiringNonceHash: expectedExpiringNonceHash(serializedTransaction),
+        expectedOperator: descriptor.operator,
+        expectedPayee: descriptor.payee,
+        expectedPayer: descriptor.payer,
+        serializedTransaction,
+      }),
+    ).rejects.toThrow('TIP-1034 open auto-swap output amount does not match channel deposit')
   })
 
   test('rejects open transactions targeting the wrong escrow contract', async () => {
@@ -715,8 +764,8 @@ describe('precompile broadcastOpenTransaction', () => {
     ).rejects.toThrow('credential expiringNonceHash does not match transaction')
   })
 
-  test('returns tx hash, descriptor, event fields, and read-back state on success', async () => {
-    const serializedTransaction = await createOpenTransaction()
+  test('accepts an exact-output auto-swap before open', async () => {
+    const serializedTransaction = await createOpenTransaction({ prefixCalls: autoSwapCalls() })
     const expiringNonceHash = expectedExpiringNonceHash(serializedTransaction)
     const expectedDescriptor = { ...descriptor, expiringNonceHash }
     const channelId = Channel.computeId({
@@ -858,7 +907,9 @@ describe('precompile broadcastTopUpTransaction', () => {
         expectedCurrency: descriptor.token,
         serializedTransaction,
       }),
-    ).rejects.toThrow('TIP-1034 topUp transaction must contain exactly one call')
+    ).rejects.toThrow(
+      'TIP-1034 topUp transaction must contain one management call, optionally preceded by an auto-swap',
+    )
   })
 
   test('rejects top-up transactions targeting the wrong escrow contract', async () => {
@@ -1025,8 +1076,8 @@ describe('precompile broadcastTopUpTransaction', () => {
     ).rejects.toThrow('topUp deposit does not match credential')
   })
 
-  test('returns tx hash, new deposit, and read-back state on success', async () => {
-    const serializedTransaction = await createTopUpTransaction()
+  test('accepts an exact-output auto-swap before top-up', async () => {
+    const serializedTransaction = await createTopUpTransaction({ prefixCalls: autoSwapCalls() })
     const channelId = Channel.computeId({ ...descriptor, chainId, escrow: tip20ChannelEscrow })
     const newDeposit = deposit * 2n
     const state = { settled: 0n, deposit: newDeposit, closeRequestedAt: 0 }

src/tempo/session/precompile/Chain.ts

@@ -1,5 +1,5 @@
 import type { Account, Address, Client, Hex } from 'viem'
-import { encodeFunctionData, isAddressEqual, parseEventLogs } from 'viem'
+import { decodeFunctionData, encodeFunctionData, isAddressEqual, parseEventLogs } from 'viem'
 import {
   call,
   prepareTransactionRequest,
@@ -10,7 +10,7 @@ import {
   signTransaction,
   waitForTransactionReceipt,
 } from 'viem/actions'
-import { Transaction } from 'viem/tempo'
+import { Abis, Addresses, Transaction } from 'viem/tempo'
 
 import { BadRequestError, VerificationFailedError } from '../../../Errors.js'
 import * as FeePayer from '../../internal/fee-payer.js'
@@ -401,6 +401,7 @@ export type ChannelTransactionOptions = {
 
 type ParsedPrecompileCredentialTransaction = {
   call: Transaction.TransactionTempo['calls'][number] & { data: Hex; to: Address }
+  prefixCalls: readonly Transaction.TransactionTempo['calls'][number][]
   transaction: ReturnType<(typeof Transaction)['deserialize']>
 }
 
@@ -418,11 +419,11 @@ function parsePrecompileCredentialTransaction(parameters: {
     serializedTransaction as Transaction.TransactionSerializedTempo,
   )
   const calls = transaction.calls
-  if (calls.length !== 1)
+  if (calls.length !== 1 && calls.length !== 3)
     throw new VerificationFailedError({
-      reason: `TIP-1034 ${label} transaction must contain exactly one call`,
+      reason: `TIP-1034 ${label} transaction must contain one management call, optionally preceded by an auto-swap`,
     })
-  const call = calls[0]!
+  const call = calls.at(-1)!
   if (!call.to || !isAddressEqual(call.to, escrowContract))
     throw new VerificationFailedError({
       reason: `TIP-1034 ${label} transaction targets the wrong address`,
@@ -431,7 +432,88 @@ function parsePrecompileCredentialTransaction(parameters: {
     throw new VerificationFailedError({
       reason: `TIP-1034 ${label} transaction is missing calldata`,
     })
-  return { transaction, call: { ...call, data: call.data, to: call.to } }
+  return {
+    transaction,
+    call: { ...call, data: call.data, to: call.to },
+    prefixCalls: calls.slice(0, -1),
+  }
+}
+
+function validateAutoSwapPrefix(parameters: {
+  amountOut: bigint
+  currency: Address
+  label: 'open' | 'topUp'
+  prefixCalls: readonly Transaction.TransactionTempo['calls'][number][]
+}) {
+  const { amountOut, currency, label, prefixCalls } = parameters
+  if (prefixCalls.length === 0) return
+
+  const fail = (reason: string): never => {
+    throw new VerificationFailedError({ reason: `TIP-1034 ${label} auto-swap ${reason}` })
+  }
+  if (prefixCalls.length !== 2) fail('must contain exactly approve and swap calls')
+
+  const approveCall = prefixCalls[0]!
+  const swapCall = prefixCalls[1]!
+  const approveTo = approveCall.to
+  const approveData = approveCall.data
+  const swapTo = swapCall.to
+  const swapData = swapCall.data
+  if (!approveTo || !approveData || !swapTo || !swapData)
+    fail('call is missing a target or calldata')
+  const checkedApproveTo = approveTo as Address
+  const checkedApproveData = approveData as Hex
+  const checkedSwapTo = swapTo as Address
+  const checkedSwapData = swapData as Hex
+  if ((approveCall.value ?? 0n) !== 0n || (swapCall.value ?? 0n) !== 0n)
+    fail('calls must not transfer native value')
+  if (!isAddressEqual(checkedSwapTo, Addresses.stablecoinDex)) fail('targets the wrong DEX')
+
+  const approve = (() => {
+    try {
+      return decodeFunctionData({ abi: Abis.tip20, data: checkedApproveData })
+    } catch {
+      return fail('approval calldata is invalid')
+    }
+  })()
+  const swap = (() => {
+    try {
+      return decodeFunctionData({ abi: Abis.stablecoinDex, data: checkedSwapData })
+    } catch {
+      return fail('swap calldata is invalid')
+    }
+  })()
+  if (approve.functionName !== 'approve' || swap.functionName !== 'swapExactAmountOut')
+    fail('must contain approve followed by swapExactAmountOut')
+
+  const [spender, approvedAmount] = approve.args as readonly [Address, bigint]
+  const [tokenIn, tokenOut, swapAmountOut, maxAmountIn] = swap.args as readonly [
+    Address,
+    Address,
+    bigint,
+    bigint,
+  ]
+  if (!isAddressEqual(checkedApproveTo, tokenIn)) fail('approval token does not match swap input')
+  if (!isAddressEqual(spender, Addresses.stablecoinDex)) fail('approval spender is not the DEX')
+  if (approvedAmount !== maxAmountIn) fail('approval amount does not match swap maximum input')
+  if (!isAddressEqual(tokenOut, currency)) fail('output token does not match channel currency')
+  if (swapAmountOut !== amountOut) fail('output amount does not match channel deposit')
+  if (isAddressEqual(tokenIn, tokenOut)) fail('input and output tokens must differ')
+
+  const canonicalApprove = encodeFunctionData({
+    abi: Abis.tip20,
+    functionName: 'approve',
+    args: [spender, approvedAmount],
+  })
+  const canonicalSwap = encodeFunctionData({
+    abi: Abis.stablecoinDex,
+    functionName: 'swapExactAmountOut',
+    args: [tokenIn, tokenOut, swapAmountOut, maxAmountIn],
+  })
+  if (checkedApproveData.toLowerCase() !== canonicalApprove.toLowerCase())
+    fail('approval calldata is not canonical')
+  if (checkedSwapData.toLowerCase() !== canonicalSwap.toLowerCase())
+    fail('swap calldata is not canonical')
 }
 
 async function simulateTempoTransaction(client: Client, request: unknown) {
@@ -796,7 +878,7 @@ export type BroadcastOpenTransactionParameters = {
 export async function broadcastOpenTransaction(
   parameters: BroadcastOpenTransactionParameters,
 ): Promise<BroadcastOpenTransactionResult> {
-  const { transaction, call } = parsePrecompileCredentialTransaction({
+  const { transaction, call, prefixCalls } = parsePrecompileCredentialTransaction({
     escrowContract: parameters.escrowContract,
     feePayer: parameters.feePayer,
     label: 'open',
@@ -812,6 +894,12 @@ export async function broadcastOpenTransaction(
       authorizedSigner: parameters.expectedAuthorizedSigner,
     },
   })
+  validateAutoSwapPrefix({
+    amountOut: open.deposit,
+    currency: parameters.expectedCurrency,
+    label: 'open',
+    prefixCalls,
+  })
   const descriptor = ChannelOps.descriptorFromOpen({
     chainId: parameters.chainId,
     escrow: parameters.escrowContract,
@@ -920,7 +1008,7 @@ export type BroadcastTopUpTransactionParameters = {
 export async function broadcastTopUpTransaction(
   parameters: BroadcastTopUpTransactionParameters,
 ): Promise<BroadcastTopUpTransactionResult> {
-  const { transaction, call } = parsePrecompileCredentialTransaction({
+  const { transaction, call, prefixCalls } = parsePrecompileCredentialTransaction({
     escrowContract: parameters.escrowContract,
     feePayer: parameters.feePayer,
     label: 'topUp',
@@ -933,6 +1021,12 @@ export async function broadcastTopUpTransaction(
       additionalDeposit: parameters.additionalDeposit,
     },
   })
+  validateAutoSwapPrefix({
+    amountOut: parameters.additionalDeposit,
+    currency: parameters.expectedCurrency,
+    label: 'topUp',
+    prefixCalls,
+  })
   const receipt = await sendCredentialTransaction({
     challengeExpires: parameters.challengeExpires,
     chainId: parameters.chainId,