feat: allow EIP7702 wallets to batch transactions#7844
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying explorer-dev with
|
| Latest commit: |
43f9906
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://189fffe1.explorer-dev-dxz.pages.dev |
| Branch Preview URL: | https://feat-7702-batch-support.explorer-dev-dxz.pages.dev |
| * WalletConnect in mobile browsers initiates a request with confirmation to the wallet | ||
| * to get the capabilities. It breaks the flow with perpetual requests. | ||
| */ | ||
| export async function getShouldSkipCapabilitiesCheck( |
There was a problem hiding this comment.
This function was removed in #7742 and replaced with a 5s timeout. It was reintroduced during conflict resolution.
Deploying swap-dev with
|
| Latest commit: |
43f9906
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://db03e14e.swap-dev-5u6.pages.dev |
| Branch Preview URL: | https://feat-7702-batch-support.swap-dev-5u6.pages.dev |
|
|
||
| logWallet.debug('Fetching wallet capabilities', { account, chainId }) | ||
|
|
||
| // TODO remove this completely: it doesn't resolve capabilities for no wallet: MM, Safe, Ambire. |
There was a problem hiding this comment.
From my testing wagmi is useless, it never resolves capabilities...
kernelwhisperer
changed the title
elena-zh
left a comment
elena-zh
left a comment
There was a problem hiding this comment.
Hey @kernelwhisperer , thank you.
Base smart account is working perfectly fine now.
What is not working/not working as expected:
- Safe+WC: bundling stopped working
- MM smart account: now it does not use gasless transactions for placing orders with permittable tokens
- MM+Smart account: impossible to place a ETH-flow order without wrapping
4 MM+regular account (not smart one): impossible to sign a permit
- MM+ regular account on Avalanche, Plasma, Ink (chains that do not support smart accounts): impossible to place an order with a gasless permit inside
Could you please review this issues and fix them?
fairlighteth
left a comment
fairlighteth
left a comment
There was a problem hiding this comment.
⚠️ AI Review (Codex GPT-5, worked 25m): atomic batching can partially execute or use wrong-chain capabilities
Finding: [BLOCKING] Require atomic execution for ready wallets
- Location:
libs/wallet/src/api/state/walletCapabilitiesAtom.ts:177andlibs/wallet/src/api/hooks/useSendBatchTransactions.ts:36 - This one is important: the PR accepts
atomic.status === 'ready', but the sender omitsforceAtomic. - viem defaults
forceAtomictofalse, producingatomicRequired: false. EIP-5792 then permits sequential execution and does not require areadywallet to upgrade. - Approve/presign and wrap/approve/presign flows can partially execute, leaving allowances or wrapped funds behind, or activating a posted order after token preparation failed.
- Security classification:
verified-vulnerability,P2 (Medium). A targeted viem reproduction capturedatomicRequiredas[false, true]without and withforceAtomic.
Suggested fix
- Pass
forceAtomic: truefromuseSendBatchTransactions. - Add a boundary test asserting the resulting
wallet_sendCalls.atomicRequired, including upgrade rejection and unsupported atomicity.
Finding: [BLOCKING] Do not reuse another chain's batching capability
- Location:
libs/wallet/src/api/state/walletCapabilitiesAtom.ts:35 resolveCapabilitiesForChainreturns the first response entry when the active chain is absent. EIP-5792 states that atomic support is chain-specific and an absent chain means unsupported.- With
readynow accepted, a Mainnet entry can incorrectly enable batching on Avalanche, Plasma, or Ink. - Commit
171de9b93previously restricted this fallback to confirmed Safe-via-WalletConnect connections specifically to prevent non-Safe cross-chain false positives.
Suggested fix
- Require the exact numeric/hex active-chain key for non-Safe wallets. Preserve a Safe-WC fallback only if it remains necessary.
- Replace the current mismatched-chain test with assertions that non-Safe batching stays disabled.
Finding: [NON-BLOCKING] Keep batching-incompatible Safes out of compatible analytics
- Location:
apps/cowswap-frontend/src/modules/twap/containers/TwapFormWidget/index.tsx:132 - The warning handles both unsupported states, but analytics now checks only
WALLET_NOT_SUPPORTED. - A Safe-WC connection with failed capability detection remains
TX_BUNDLING_NOT_SUPPORTED, then falls through tocompatibleorsafe-that-could-be-convertedeven though TWAP is disabled.
Suggested fix
- Handle both unsupported states before the fallback-handler branches, or add a distinct batching-unavailable event.
- Add effect-level coverage for a Safe with batching disabled.
Review scope and related context
- DeepSec PR mode ran against the exact PR file list: run
20260710151419-a335c60ae97dff7f, exit1, artifact/tmp/deepsec-comment-pr-7844-review-2055455.md. - DeepSec confirmed the wrong-chain fallback. Its other two findings were pre-existing behavior outside this PR's changes.
- The existing changes-requested review already covers Safe-WC, permit, gasless, ETH-flow, and unsupported-chain symptoms; those are not repeated here.
- Targeted verification passed: 29 wallet tests, 4 TWAP tests, and changed-file ESLint.
- The failing Cypress cases reproduce identically on the base branch and
develop, so they are not attributable to this PR.
🤖 Prompt for AI agents
Verify these findings against PR 7844's current head.
1. Require atomic execution when `ready` enables batching and test the final wallet_sendCalls payload.
2. Reject non-Safe capability responses that omit the active chain.
3. Keep TX_BUNDLING_NOT_SUPPORTED out of compatible TWAP analytics.
Keep changes focused and rerun the wallet capability and TWAP tests.
Generated using the pr-review skill from the CoW Protocol skills repo.
Generated using the security-review skill from the CoW Protocol skills repo.
3 participants
Summary
Implements https://linear.app/cowswap/issue/FE-265/batch-support-for-eoas-and-eip7702-delegated-eoas
Adds EIP-7702 batching capability detection while keeping TWAP restricted to Safe wallets.
atomic.statusvaluessupportedandreadyatomicBatch.supporteddetectionTo Test
Screencast.From.2026-07-10.10-58-16.webm
Screencast.From.2026-07-10.10-59-24.webm
Background
Capability detection is independent from TWAP wallet eligibility: this change recognizes EIP-7702 batching, but TWAP remains restricted to Safe wallets.