feat(vault): hardware-verifiable x402 payments - #403
Merged
Conversation
Cherry-picked from the stale draft #383 (b373dfc). Its companion commit, "chore: pin canonical x402 dependencies", is NOT taken: it moved device-protocol and hdwallet to pins that develop already contains, so it would have walked both submodules backwards for no gain. The x402 payment intent from the server is never trusted on its own — the signing path re-derives what the transaction actually does (SPL transfer, ATA, memo, PDA validity) and reconciles it against the declared intent, so the device screen and the payment request cannot disagree. Two fixes on top of the cherry-pick, both needed to hold the typecheck gate at its 636 baseline: - solana-x402.ts imported from 'node:crypto', which does not resolve under this tsconfig. Every other module here imports from 'crypto'. - Added both x402 test files to make test-unit. They were not in the target on the source branch, so they would never have run in CI. Pre-existing and left alone: getNestedValue in eip712-decoder.ts is dead code on develop already, not something this change orphaned.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the stale draft #383 by cherry-picking its vault-side commit (
b373dfc7) onto current develop.Why not just rebase #383
#383 has not moved since 2026-07-31 and shows as CONFLICTING. Its second commit,
chore: pin canonical x402 dependencies, movesmodules/device-protocolto5a8e2702andmodules/hdwalletto25310f2c— both of which develop's current pins already contain. Merging it would have walked two tier-1 submodules backwards days before a release, for no gain. This branch takes the code and leaves the pins alone.What this does
The x402 payment intent supplied by the server is never trusted on its own. The signing path re-derives what the Solana transaction actually does — SPL transfer, associated-token-account creation, memo, and PDA validity (including the on-curve check) — and reconciles that against the declared intent. The device screen and the payment request therefore cannot disagree.
Two fixes on top of the cherry-pick
Both were needed to hold the typecheck gate at its 636 baseline — as-is the branch pushed it to 637.
solana-x402.tsimported fromnode:crypto, which does not resolve under this tsconfig. Every other module insrc/bun/imports fromcrypto.make test-unit. They were not in the target on the source branch, so they would never have run in CI.Left alone:
getNestedValueineip712-decoder.tsreports as unused, but it is already dead on develop — pre-existing, not orphaned by this change.Verification
make preflight— all gates pass; no submodule pins movedmake test-unit— 351 pass / 0 fail across 20 filesmake build— cleanNot verified: on-device. No x402 payment has been signed on hardware from this branch.