feat(x402): the signed domain follows the 402's network — Arc, Base, Base Sepolia - #69
Merged
Merged
Conversation
…Base Sepolia The chain table knew Base and Base Sepolia and fell back to Base for any other network, while `asset` and `extra` were taken from the 402 as given. Against arc.blockrun.ai (eip155:5042, USDC at 0x3600…, domain name "USDC") that signed chainId 8453 against Arc's contract — an invalid signature, a 401 from the facilitator, after the SDK had reported a payment. EVM_NETWORKS maps a 402's `network` to the SDK's OWN chain id, USDC address and EIP-712 domain; create_payment_payload signs those. The 402 SELECTS the network and supplies nothing else: its `extra` no longer reaches the domain (a hostile 402 cannot steer a signature onto another contract), an unknown network raises naming what is supported, and an `asset` that is not that network's USDC raises before signing. The twelve EVM clients that did not pass the 402's asset now do, so the check protects every route. get_chain_config / get_usdc_domain_name read the same table; the `base-sepolia` alias still resolves. Verified against arc.blockrun.ai with an unfunded throwaway key: Circle's /verify answers insufficient_funds and recovers the throwaway's own address as payer — the signature verifies on Arc's domain, only the balance is missing. Six new tests recover the signer against each domain (Arc passes, Base fails for an Arc payment), pin the refusals, and that a 402's `extra` is ignored. 983 unit tests, ruff and black clean. 1.17.0, mirroring @blockrun/llm 3.16.0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The chain table knew Base and Base Sepolia and fell back to Base for any other network, while
assetandextrawere taken from the 402 as given. Against arc.blockrun.ai (eip155:5042, USDC at0x3600…, domain nameUSDC) that signedchainId 8453against Arc's contract — an invalid signature, a 401 from the facilitator, after the SDK had reported a payment.What
EVM_NETWORKSinblockrun_llm.x402maps a 402'snetworkto the SDK's own chain id, USDC address and EIP-712 domain (Base, Arc, Base Sepolia;base-sepoliaalias kept).create_payment_payloadsigns those.extrano longer reaches the domain; unknown network →ValueErrornaming what is supported;asset≠ that network's USDC →ValueErrorbefore signing.assetnow do, so the check protects every route.@blockrun/llm3.16.0 (feat(x402): the signed domain follows the 402's network — Arc, Base, Base Sepolia blockrun-llm-ts#44).Verified
Against arc.blockrun.ai with an unfunded throwaway key: Circle's
/verifyanswersinsufficient_fundsand recovers the throwaway's own address aspayer— the signature verifies on Arc's domain; only the balance is missing.Six new tests recover the signer against each domain (Arc passes, Base fails for an Arc payment), pin the refusals, and that a 402's
extrais ignored. 983 unit tests, ruff and black clean.🤖 Generated with Claude Code