Skip to content

Conversation

@danielzhao122
Copy link
Contributor

@danielzhao122 danielzhao122 commented Nov 19, 2025

Fix AbstractEthLikeNewCoins.isWalletAddress forwarder version bypass

  • Remove unconditional return true for versions 0, 3, 5
  • Implement validation for these versions

Fix forwarder version bug in address verification

  • forwarder v4 requires feeAddress to calculate address
  • wallet v4 and v5 requires walletV4ForwarderFactoryAddress and walletV4ForwarderImplementationAddress

TICKET: WP-6461

zahin-mohammad
zahin-mohammad previously approved these changes Nov 21, 2025
Copy link
Contributor

@zahin-mohammad zahin-mohammad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, lets also get an ETH-ALT review for the same

@danielzhao122 danielzhao122 force-pushed the WP-6461-eth-address-verification branch from 857a725 to 3292e9d Compare November 21, 2025 19:08
@danielzhao122 danielzhao122 marked this pull request as ready for review November 25, 2025 05:45
@danielzhao122 danielzhao122 requested review from a team as code owners November 25, 2025 05:45
@abhishekagrawal080
Copy link
Contributor

@claude review this pr

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes critical security vulnerabilities in Ethereum wallet address verification by removing unconditional bypass logic for forwarder versions 0, 3, and 5, and implementing proper validation for MPC (TSS) wallets.

Key Changes:

  • Implements MPC-based address verification for wallet versions 3, 5 (base addresses), and 6 using secp256k1 curve derivation
  • Adds factory and implementation addresses for wallet versions 1, 2, and 4 across Ethereum networks
  • Refactors isWalletAddress to properly route between BIP32 and TSS verification based on wallet version and address type

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
modules/statics/src/networks.ts Adds wallet and forwarder factory/implementation addresses for V1, V2, and V4 wallets across Ethereum, Hoodi, Polygon, Optimism, and ZkSync networks
modules/statics/test/unit/resources/amsTokenConfig.ts Updates test configuration with new wallet factory addresses for consistency with network definitions
modules/sdk-core/src/index.ts Exports new address verification functions for MPC wallets
modules/sdk-core/src/bitgo/utils/tss/addressVerification.ts Implements unified MPC address verification supporting both secp256k1 and ed25519 curves with correct public key size handling
modules/sdk-core/src/bitgo/baseCoin/iBaseCoin.ts Updates TSS verification types to accept flexible index types and adds type guard for identifying TSS verification options
modules/abstract-eth/src/abstractEthLikeNewCoins.ts Major refactoring of isWalletAddress to properly handle TSS wallets (V3, V5, V6), BIP32 wallets (V1, V2, V4), and forwarder address verification with version-specific factory addresses
modules/sdk-coin-eth/test/unit/eth.ts Comprehensive test coverage for all wallet versions and forwarder types including TSS, BIP32, base addresses, and deposit addresses
modules/sdk-coin-polygon/test/unit/polygon.ts Adds test for Polygon wallet V5 with forwarder V4 address verification

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copy link
Contributor

@abhishekagrawal080 abhishekagrawal080 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me

zahin-mohammad
zahin-mohammad previously approved these changes Nov 25, 2025
Copy link
Contributor

@zahin-mohammad zahin-mohammad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think in general this lgtm, we can address some of the comments as a follow up.

@danielzhao122 danielzhao122 merged commit 6e0ef40 into master Nov 25, 2025
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants