Skip to content

fix(sdk-core): skip auto-sign for message-sign approvals - #10102

Merged
nvjsr merged 1 commit into
masterfrom
DEFI-961
Oct 31, 2026
Merged

nvjsr merged 1 commit into
masterfrom
DEFI-961

Conversation

@nvjsr

@nvjsr nvjsr commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

postApprove() unconditionally ran the TSS recreate-and-sign flow for TRANSACTION_REQUEST_FULL approvals, which reads transactions[0].unsignedTx. Message-only txRequests have an empty transactions array, so this crashed. postApprove() now returns early when the approval's intent is a message-sign intent (signMessage / signTypedStructuredData), leaving the message to be signed separately via signAndSendMessageTxRequest.

Also hardens the ecdsa signTxRequest assertions to check length > 0 instead of truthiness (an empty array is truthy), and types the transactionRequestFull info field on PendingApprovalInfo.

TICKET: DEFI-1257

@nvjsr
nvjsr requested review from a team as code owners October 30, 2026 08:28

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

Tip: disable this comment in your organization's Code Review settings.

@linear-code

linear-code Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

DEFI-961

DEFI-1257

DEFI-1258

@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

⚠️ Compatibility checks are failing on Node.js 27-nightly (experimental, non-blocking). This does not block merge, but it signals an incompatibility to fix before this release becomes supported.

View run

@nvjsr

nvjsr commented Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

The @bitgo/sdk-coin-starknet test failure is a CI-wide issue affecting all BitGoJS PRs since Oct 30 ~03:00 UTC. The test calls https://api.cartridge.gg/x/starknet/sepolia ▏(test/unit/walletInitializationBuilder.ts:134) which now returns HTTP 410 Gone ("starknet sepolia is discontinued and no longer served"). This needs a fix from the starknet team — the RPC URL must be updated to a live Sepolia endpoint.

@nvjsr
nvjsr requested a review from shivam-bitgo October 30, 2026 12:16
@nvjsr
nvjsr force-pushed the DEFI-961 branch 2 times, most recently from 51df9c7 to f14f6df Compare October 30, 2026 12:19
postApprove() unconditionally ran the TSS recreate-and-sign flow for
TRANSACTION_REQUEST_FULL approvals, which reads transactions[0].unsignedTx.
Message-only txRequests have an empty transactions array, so this crashed.
postApprove() now returns early when the approval's intent is a
message-sign intent (signMessage / signTypedStructuredData), leaving the
message to be signed separately via signAndSendMessageTxRequest.

Also hardens the signTxRequest assertions in all TSS signer variants
(ecdsa, ecdsaMPCv2, eddsa, eddsaMPCv2) to check length > 0 instead of
truthiness (an empty array is truthy), and types the
transactionRequestFull info field on PendingApprovalInfo.

Refs: DEFI-1257

TICKET: DEFI-1257
@nvjsr
nvjsr merged commit 21c7ad5 into master Oct 31, 2026
27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants