fix(sdk-core): allow ERC-7984 PA rebuild without recipients (CHALO-1957)

pendingApproval.approve() on a custodial multi-sig ERC-7984 leg PA
(wrapApprove/wrap/unwrap user legs, wrap/finalizeUnwrap server-originated
legs) merges the PA's stored info.transactionRequest.recipients into the
prebuild params, tripping the prebuildAndSignTransaction no-recipients
guard before any network call.

recreateAndSignTransaction now strips recipients for the four ERC-7984
intent types before prebuilding: stored recipients are display-only for
the approval UI, and the /tx/build PA-rebuild carve-out (CHALO-1954)
re-derives the real intent inputs server-side from the pendingApprovalId
approve() injects. Other PA types forward recipients unchanged, and the
guard still rejects direct sendMany/prebuild calls without a
pendingApprovalId.

Ticket: CHALO-1957

Author: 0xPrabh

modules/bitgo/test/v2/unit/pendingApproval.ts

@@ -1,7 +1,7 @@
 /**
  * @prettier
  */
-import 'should';
+import should = require('should');
 import nock = require('nock');
 import * as sinon from 'sinon';
 import { TestableBG, TestBitGo } from '@bitgo/sdk-test';
@@ -449,5 +449,95 @@ describe('Pending Approvals:', () => {
       const prebuildParamsArg = prebuildAndSignStub.getCall(0).args[0]!;
       (prebuildParamsArg.verification === undefined).should.be.true();
     });
+
+    function makeEthIntentPendingApproval(legType: 'wrap' | 'finalizeUnwrap') {
+      const htethCoin = bitgo.coin('hteth');
+      const paData: PendingApprovalData = {
+        id: `pa-${legType}`,
+        info: {
+          type: Type.TRANSACTION_REQUEST,
+          transactionRequest: {
+            coinSpecific: { hteth: {} },
+            recipients: [{ address: '0x7db562c4dd465cc895761c56f83b6af0e32689ba', amount: '1000000' }],
+            buildParams: { type: legType },
+            sourceWallet: walletId,
+          },
+        },
+        wallet: walletId,
+        state: State.PENDING,
+        creator: 'test',
+      };
+      const ethWallet = new Wallet(bitgo, htethCoin, {
+        id: walletId,
+        coin: 'hteth',
+        pendingApprovals: [paData],
+      });
+      return { pendingApproval: ethWallet.pendingApprovals()[0], htethCoin, paData };
+    }
+
+    (['wrap', 'finalizeUnwrap'] as const).forEach((legType) => {
+      it(`strips stored recipients when approving a ${legType} intent pending approval`, async () => {
+        const { pendingApproval, htethCoin, paData } = makeEthIntentPendingApproval(legType);
+
+        const prebuildAndSignStub = sandbox
+          .stub(Wallet.prototype, 'prebuildAndSignTransaction')
+          .resolves({ halfSigned: { txHex: 'half-signed-hex' } });
+        sandbox.stub(htethCoin, 'parseTransaction').resolves({});
+
+        const paScope = nock(bgUrl)
+          .put(`/api/v2/hteth/pendingapprovals/pa-${legType}`, (body) => {
+            body.state.should.equal('approved');
+            body.halfSigned.txHex.should.equal('half-signed-hex');
+            return true;
+          })
+          .reply(200, { ...paData, state: 'approved' });
+
+        await pendingApproval.approve({ xprv: 'nonsense', walletPassphrase: 'pw' });
+
+        paScope.isDone().should.be.true();
+        prebuildAndSignStub.calledOnce.should.be.true();
+        const prebuildParamsArg = prebuildAndSignStub.getCall(0).args[0]!;
+        should.not.exist(prebuildParamsArg.recipients);
+        prebuildParamsArg.type!.should.equal(legType);
+        (prebuildParamsArg.pendingApprovalId as string).should.equal(`pa-${legType}`);
+      });
+    });
+
+    it('keeps forwarding stored recipients for a transfer-type pending approval rebuild', async () => {
+      const htethCoin = bitgo.coin('hteth');
+      const transferPaData: PendingApprovalData = {
+        id: 'pa-transfer',
+        info: {
+          type: Type.TRANSACTION_REQUEST,
+          transactionRequest: {
+            coinSpecific: { hteth: {} },
+            recipients: [{ address: '0x7db562c4dd465cc895761c56f83b6af0e32689ba', amount: '1000000' }],
+            buildParams: {},
+            sourceWallet: walletId,
+          },
+        },
+        wallet: walletId,
+        state: State.PENDING,
+        creator: 'test',
+      };
+      const ethWallet = new Wallet(bitgo, htethCoin, {
+        id: walletId,
+        coin: 'hteth',
+        pendingApprovals: [transferPaData],
+      });
+      const pendingApproval = ethWallet.pendingApprovals()[0];
+
+      const prebuildAndSignStub = sandbox
+        .stub(Wallet.prototype, 'prebuildAndSignTransaction')
+        .resolves({ txHex: 'signed-tx-hex' });
+      sandbox.stub(htethCoin, 'parseTransaction').resolves({});
+
+      await pendingApproval.recreateAndSignTransaction({});
+
+      const prebuildParamsArg = prebuildAndSignStub.getCall(0).args[0]!;
+      prebuildParamsArg.recipients!.should.deepEqual([
+        { address: '0x7db562c4dd465cc895761c56f83b6af0e32689ba', amount: '1000000' },
+      ]);
+    });
   });
 });

modules/bitgo/test/v2/unit/wallet.ts

@@ -704,6 +704,26 @@ describe('V2 Wallet:', function () {
         e.message.should.equal('cannot provide recipients for transaction type finalizeUnwrap');
       }
     });
+
+    it('still rejects recipients when prebuilding wrapApprove without a pendingApprovalId', async function () {
+      const recipients = [
+        {
+          address: '0x7db562c4dd465cc895761c56f83b6af0e32689ba',
+          amount: 0,
+        },
+      ];
+
+      let caught: (Error & { code?: string }) | undefined;
+      try {
+        await ethWallet.prebuildAndSignTransaction({ recipients, type: 'wrapApprove' });
+      } catch (e) {
+        caught = e;
+      }
+
+      should.exist(caught);
+      caught!.message.should.equal('cannot provide recipients for transaction type wrapApprove');
+      caught!.code!.should.equal('recipients_not_allowed_for_fillnonce_and_acceleration_tx_type');
+    });
   });
 
   describe('OFC Create Address', () => {

modules/sdk-core/src/bitgo/pendingApproval/iPendingApproval.ts

@@ -43,7 +43,7 @@ export interface PendingApprovalInfo {
     coinSpecific: { [key: string]: any };
     recipients: any;
     buildParams: {
-      type?: 'fanout' | 'consolidate' | 'enabletoken';
+      type?: 'fanout' | 'consolidate' | 'enabletoken' | 'wrapApprove' | 'wrap' | 'unwrap' | 'finalizeUnwrap';
       [index: string]: any;
     };
     sourceWallet?: string;

modules/sdk-core/src/bitgo/pendingApproval/pendingApproval.ts

@@ -40,6 +40,15 @@ type ApprovePendingApprovalRequestBody = {
   halfSigned?: string | Omit<PreApproveResult, 'halfSigned'>;
 };
 
+// ERC-7984 shield/unshield intent types: calldata is built server-side from the intent, so a
+// pending approval's stored recipients are display-only for the approval UI, never build inputs.
+const ERC7984_INTENT_TX_TYPES: Record<string, true> = {
+  wrapApprove: true,
+  wrap: true,
+  unwrap: true,
+  finalizeUnwrap: true,
+};
+
 export class PendingApproval implements IPendingApproval {
   private readonly bitgo: BitGoBase;
   private readonly baseCoin: IBaseCoin;
@@ -304,6 +313,13 @@ export class PendingApproval implements IPendingApproval {
     const recipients = transactionRequest.recipients;
     let prebuildParams = _.extend({}, params, { recipients: recipients }, transactionRequest.buildParams);
 
+    // Stored recipients must not be forwarded for these intents — the prebuild guard rejects
+    // recipients for them, and the /tx/build PA-rebuild carve-out re-derives the real inputs
+    // server-side from the pendingApprovalId approve() injects.
+    if (ERC7984_INTENT_TX_TYPES[prebuildParams.type]) {
+      delete prebuildParams.recipients;
+    }
+
     if (!_.isUndefined(originalPrebuild.hopTransaction)) {
       prebuildParams.hop = true;
     }