KarpelesLab / libwallet / 24764611415

25%

push

github

Web3: EIP-2255 permission shape + EVM-only eth_accounts

Two related fixes the test-dapp surfaced:

1. wallet_requestPermissions / wallet_getPermissions emitted
   one permission entry per connected account, each with a
   single address in the caveat value array, AND no
   parentCapability field at all. Per EIP-2255 the wire shape
   is one entry per capability with all authorised addresses
   in the caveat:

     [{
       id: "perm:<host>",
       parentCapability: "eth_accounts",
       invoker: "<host>",
       caveats: [{ type: "restrictReturnedAccounts",
                   value: ["0xa", "0xb", ...] }]
     }]

   The missing parentCapability is why etherscan.io's "Request
   Permissions" button printed "undefined, undefined".

2. eth_accounts returned the Address field of every connected
   account verbatim, including ed25519 (Solana) accounts that a
   dApp may have picked up via chain_switch and accounts whose
   address had been re-derived to "N/A" by an earlier
   UpdateAddressForNetwork on a non-matching chain. Filter both
   server-side (curve != secp256k1, Address == "" / "N/A", or
   non-0x-prefixed) so dApps only ever see well-formed EVM
   addresses. Same filter feeds the new
   buildEthAccountsPermission so the perm + accounts surfaces
   stay in sync.

Both helpers always return [] (not nil) for the empty case so
the JSON wire shape doesn't surprise dApp code.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

0 of 37 new or added lines in 1 file covered. (0.0%)

2529 of 12125 relevant lines covered (20.86%)

65.47 hits per line