Skip to content

v0.28.1

Choose a tag to compare

View all tags
@ryanio ryanio released this 10 Jul 15:07
· 5 commits to main since this release
v0.28.1
575a995

What's Changed

Security

  • eip3009AuthenticatedFetch now validates the 402 challenge's asset and network before signing: the network must be supported and the asset must be the canonical USDC contract for that network. This closes a signature-phishing surface where a zero-value challenge could name an arbitrary verifying contract / EIP-712 domain and still get signed (#507).
  • eip3009AuthenticatedFetch enforces the documented zero-value guarantee: it only signs X-Payment authorizations with value: 0, and returns non-zero (or unparseable-amount) 402 challenges as-is instead of signing an authorization that could move USDC to the server's advertised payTo (#504).

Internal

  • Deduplicate CLI command boilerplate: shared WALLET_PROVIDER_OPTION_DESCRIPTION constant and parseToolId() helper in cli/commands/shared.ts. No behavior change (#501).
  • Deduplicate predicate-client boilerplate: shared openSeaAssetLinks() helper plus typed read()/write() helpers on BasePredicateClient. No behavior change (#503).

Community Contributions

  • Thanks to @Nexory for raising the x402-signing hardening that motivated the eip3009AuthenticatedFetch asset/network and zero-value validation in this release (tool-sdk#11).

Full Changelog: ProjectOpenSea/opensea-devtools@tool-sdk-v0.28.0...tool-sdk-v0.28.1

Contributors

Nexory
Assets 2
Loading