4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	575f1658ae	fix: estimate a request even when the site sends its gas limit (closes #554) ... ethers asks the node for a gas estimate only when the request has no gas limit, and that estimate is the wallet's only check that a transaction does not revert. Since a site's `gas` became the gas limit, a reverting request carrying one opened the approval window and could be signed and mined to fail. Such a request is now estimated first, with the site's limit and under the same timeout; a failure goes back to the site with no window, and the site's gas limit is still the one shown and signed. A limit too low for the call now fails the same way. Model: opus-5-5	2026-10-14 19:46:01 +02:00
clawbot	2442441830	fix: use the gas limit a site sends as gas (closes #207) ... Sites send the gas limit under its JSON-RPC name, `gas`. ethers only reads `gasLimit`, so the field was dropped and the node's estimate was shown and signed instead. The page's request now takes `gas` as the gas limit, and the existing ceiling, display and comparison with the signed transaction cover it as they already did `gasLimit`. A request that gives both with different values is refused. Model: opus-5-5	2026-10-14 13:48:52 +02:00
clawbot	de3f7a9a11	harden: ignore a nonce the page supplies with eth_sendTransaction (closes #404) ... A site could fix the nonce of the transaction the user was asked to sign: the same nonce as a pending transaction, at a higher fee, replaces it, and a nonce above the account's next one leaves the new transaction stuck behind a gap. `nonce` is no longer one of the fields taken from the request, so the transaction always gets the account's next nonce from the network, and that is the nonce the approval screen shows and the popup signs. Model: opus-5-5	2026-10-04 18:43:04 +02:00
clawbot	918e581ef3	harden: verify the signed transaction against what the popup displayed (closes #216) ... Verification compared the signed artifact against the dApp's request object. For every field the dApp omitted -- normally nonce, gas limit and all the fee fields, since the popup filled them in -- the number the user actually read on screen was verified by nothing, and only absolute ceilings stood behind it. The transaction is now populated in the background before the approval window opens, and that populated object is both what the popup displays and what the signed artifact is verified against. Every consequential field becomes an equality comparison; the ceilings remain as a backstop. Population failing means no approval and no window, and the error goes to the requesting page -- earlier than before, where the same estimate failed after the password had been typed. The account is pinned too: `from` is compared against the address named at approval time rather than whichever address is active at signing, so switching accounts mid-flow refuses instead of signing from an account the approval did not name. The message-signing path had the same defect and gets the same fix. Nonce selection moves earlier as a consequence; the concurrent-approval case that follows from it is tracked at #271.	2026-08-12 12:15:25 +02:00