fix(tempo): bind encrypted deposits to sender - #5002
Merged
Conversation
Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>
🦋 Changeset detectedLatest commit: d5a9a4d The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
commit: |
struong
marked this pull request as ready for review
August 12, 2026 22:12
jxom
reviewed
Aug 13, 2026
| const { encrypted, keyIndex } = | ||
| await client.zone.encryptedDeposit.prepareRecipient({ | ||
| recipient: '0x0000000000000000000000000000000000000001', | ||
| sender: '0x0000000000000000000000000000000000000002', |
Member
There was a problem hiding this comment.
can we default sender to client.account?
jxom
enabled auto-merge (squash)
August 13, 2026 09:25
jxom
disabled auto-merge
August 13, 2026 09:25
Merged
jxom
added a commit
that referenced
this pull request
Aug 14, 2026
* feat: add block header watcher (#4999) * fix: complete block header watcher integration (#5001) * chore: version package (#5000) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(tempo): bind encrypted deposits to sender (#5002) * fix(tempo): bind encrypted deposits to sender Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * ci: test sender-bound zone deposits * ci: align Tempo and Zone fixtures * test(tempo): routed T10 fixtures through encrypted deposits * chore: logged local Zone provisioning stall * chore: ignored unpatched extract-zip advisory * fix(tempo): defaulted encrypted deposit sender * ci: skipped Wagmi verification * chore: remove friction log --------- Co-authored-by: 0xrusowsky <90208954+0xrusowsky@users.noreply.github.com> Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> Co-authored-by: Steven Truong <struong@users.noreply.github.com> Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * chore: version package (#5003) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(siwe): reject unparseable expirationTime and notBefore (#4990) * fix(siwe): reject unparseable expirationTime and notBefore Invalid Date values from parseSiweMessage (e.g. Expiration Time: never) are truthy, so comparisons like `time >= expirationTime` are always false and lifetime / nbf checks were skipped. Fail closed when either field is present but not a real date (sibling of thirdweb-dev/js#8875 / supabase/auth#2688). * fix(siwe): require EIP-4361 date-time strings and reject invalid time Validate raw SIWE timestamps against the RFC 3339 profile before Date coercion, and fail closed when the caller-supplied time is invalid so lifetime comparisons cannot be skipped. * fix(siwe): inline date validation --------- Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * fix: asset discovery in `simulateCalls` (#4997) * fix(simulateCalls): discover assets from simulated logs * refactor(simulateCalls): align asset discovery with repo conventions * fix(simulateCalls): pin both asset-tracing passes to one base block * test(simulateCalls): skip asset tracing on the pinned Anvil * chore: update accessListHints comment * fix(simulateCalls): preserve block tags and request errors * fix(simulateCalls): harden asset trace discovery * test: use reth for mainnet forks * test(simulateCalls): run asset tracing against reth * fix(simulateCalls): align asset trace simulations * fix(simulateCalls): stabilize asset tracing * chore: add static call source * fix(simulateCalls): simplify asset tracing * fix(simulateCalls): isolate asset balance probes * fix(simulateCalls): align asset probe callers * fix(simulateCalls): preserve pending block tag * fix(simulateCalls): normalize transfer topics * refactor(simulateCalls): remove redundant asset deduplication * test(simulateCalls): cover asset tracing edge cases * docs(simulateCalls): describe pending asset tracing --------- Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * fix: update nanoid security override * fix: increase package size limits * ci: remove docs deployment --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: struong <steven@tempo.xyz> Co-authored-by: 0xrusowsky <90208954+0xrusowsky@users.noreply.github.com> Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> Co-authored-by: Steven Truong <struong@users.noreply.github.com> Co-authored-by: Sash <sash@ela.city> Co-authored-by: Ghadi <92851745+Ghadi8@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Carries forward @decofe's work from #4995 to bind encrypted Zone deposit payloads to the authenticated parent-chain portal caller. The replacement branch was pushed directly to
wevm/viemso the full organization CI suite can run without fork-specific authorization constraints.Motivation
tempoxyz/zones#1028 changed encrypted-deposit HKDF derivation to include the portal caller. Viem, its Zone test images, and Wagmi's compatibility fixture must move together for generated payloads to decrypt successfully.
Changes
Testing
git diff --check.