Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
lwin-kyaw
force-pushed
the
feat/7702-5792-support
branch
from
298e9e6 to
7418945
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
...ages/no-modal/src/providers/ethereum-mpc-provider/providers/signingProviders/signingUtils.ts
Outdated
Show resolved
Hide resolved
...ages/no-modal/src/providers/ethereum-mpc-provider/providers/signingProviders/signingUtils.ts
Outdated
Show resolved
Hide resolved
...ages/no-modal/src/providers/ethereum-mpc-provider/providers/signingProviders/signingUtils.ts
Outdated
Show resolved
Hide resolved
...ages/no-modal/src/providers/ethereum-mpc-provider/providers/signingProviders/signingUtils.ts
Outdated
Show resolved
Hide resolved
packages/no-modal/src/providers/ethereum-provider/rpc/eip7702Middleware.ts
Outdated
Show resolved
Hide resolved
...ages/no-modal/src/providers/ethereum-mpc-provider/providers/signingProviders/signingUtils.ts
Outdated
Show resolved
Hide resolved
.../providers/ethereum-provider/providers/privateKeyProviders/TransactionFormatter/formatter.ts
Show resolved
Hide resolved
| }); | ||
| return (code || "0x") as `0x${string}`; | ||
| }; | ||
| } |
There was a problem hiding this comment.
createGetEthCode ignores chainId causing cross-chain misqueries
Medium Severity
createGetEthCode silently ignores the _chainId parameter, always querying eth_getCode against the currently connected chain. In eip7702Middleware, getAccountUpgradeStatus passes a user-specified chainId to getIsEip7702UpgradeSupported and getDelegationAddress, which forward it to getEthCode — but the chain ID is discarded. If the requested chain differs from the connected chain, the upgrade status and delegation address will be incorrect.
Additional Locations (1)
packages/no-modal/src/providers/ethereum-provider/rpc/eip7702Middleware.ts
Outdated
Show resolved
Hide resolved
| method: "wallet_sendCalls", | ||
| params: [ | ||
| { | ||
| version: "2.0", |
There was a problem hiding this comment.
EIP-5792 version string doesn't match specification
Medium Severity
The wallet_sendCalls request uses version: "2.0" but the EIP-5792 specification requires "2.0.0" (three-part semver). This mismatch may cause compliant wallet providers to reject the request or fall back to unexpected behavior. Since this is a demo app showcasing EIP-5792 support, the version string needs to match the spec exactly.
| onClick={getAccountUpgradeStatus} | ||
| className="card" | ||
| style={{ borderColor: "#8b5cf6", color: "#8b5cf6" }} | ||
| disabled={eipLoading === "upgradeStatus"} |
There was a problem hiding this comment.
Shared loading state allows concurrent conflicting EIP operations
Low Severity
The eipLoading state is a single string shared across all five EIP operation buttons, but each button only disables itself when its own key matches (e.g., disabled={eipLoading === "upgradeStatus"}). This means while one operation is in-flight, other EIP buttons remain clickable. Clicking a second button overwrites eipLoading, and when the first operation's finally block runs setEipLoading(null), it prematurely clears the loading state for the still-in-progress second operation. The eipResult state is also clobbered. Each button's disabled check likely needs to be eipLoading !== null instead of checking a specific key.
Additional Locations (2)
| }); | ||
| if (batchId && typeof batchId === "string") { | ||
| setLastBatchId(batchId); | ||
| } |
There was a problem hiding this comment.
Wrong EIP-5792 version string and response handling
Medium Severity
The wallet_sendCalls request uses version: "2.0" but the EIP-5792 spec defines "2.0.0" as the official version string. More critically, the v2 response is a structured object ({ id: "...", capabilities: {...} }) rather than a plain string, but the code checks typeof batchId === "string" — this condition will always be false for a v2 response, so lastBatchId is never set and the "Get Calls Status" feature becomes permanently non-functional.
1 participant
Motivation and Context
Jira Link:
Description
How has this been tested?
Screenshots (if appropriate):
Types of changes
Checklist:
Note
Medium Risk
Touches wallet transaction flows and introduces new provider RPC method usage (
wallet_*EIP-7702/5792), which can affect signing/sending behavior in demos; core logic changes appear limited and mostly additive.Overview
Adds an EIP-7702/EIP-5792 playground to the Next.js SSR demo
Main.tsx, including buttons to callwallet_getAccountUpgradeStatus,wallet_upgradeAccount,wallet_getCapabilities,wallet_sendCalls, andwallet_getCallsStatus, and a simplewagmi“send zero transaction” action with displayed tx hash/errors.Updates the demo Web3Auth provider config to set
defaultChainIdand enablewalletServicesConfigmodal confirmations/login mode. Also refreshes demo lockfiles to@web3auth/modal/@web3auth/no-modal10.14.1and related dependency bumps, and fixes a missing newline indemo/react-app-no-modal/src/web3RPC.ts.Written by Cursor Bugbot for commit 19a9ab9. This will update automatically on new commits. Configure here.