KarpelesLab / libwallet / 24787652871

25%

push

github

Web3: rich payload on Connect / AddNetwork / WatchAsset requests

Same "decode it once server-side" philosophy as 5faf897's
TransactionSignRequest + MessageSignRequest, extended to the
three remaining event types.

ConnectRequest now carries:
  - method (eth_requestAccounts / wallet_requestPermissions /
    solana_connect / solana_requestAccounts / mpurse_getAddress)
  - family (evm / solana / bitcoin)
  - availableAccounts (curve-compatible accounts, pre-fetched so
    the picker doesn't have to round-trip accounts.list)
  - alreadyConnectedIds (pre-check connected accounts in the
    picker, or render "Reconnect" instead of "Connect")
  - requestedPermissions (EIP-2255 permission names)

AddNetworkRequest now flags phishing vectors:
  - isKnown (chainId in the static chain registry)
  - knownName (the canonical name — UI compares to network.name
    to detect "chainId 1 proposed with name 'MyMainnet'"
    impersonation)
  - alreadyExists (wallet already has this chain — approval is
    a no-op)
  - nameMismatch convenience getter

WatchAssetRequest gets typed accessors for the EIP-747 shape
(assetType, address, symbol, decimals, image, tokenId) plus
addressLooksInvalid + isAlreadyTracked flags.

No wire-shape breakage: AddNetworkRequest.network still resolves
when the old "Value = Network" shape is fed in (backward-compat
branch in the getter).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

0 of 105 new or added lines in 2 files covered. (0.0%)

2529 of 12724 relevant lines covered (19.88%)

62.73 hits per line