[0xPrabh]

Summary

Part 2 of CHALO-1957, stacked on #10067 (the ETH-ecosystem verify change). Retarget to master once #10067 merges.

pendingApproval.approve() on a custodial multi-sig ERC-7984 leg PA merges the PA's stored info.transactionRequest.recipients into the prebuild params. The prebuildAndSignTransaction no-recipients guard then throws cannot provide recipients for transaction type wrap before any network call.

Fix

recreateAndSignTransaction strips recipients for the four ERC-7984 intent types (wrapApprove | wrap | unwrap | finalizeUnwrap) before prebuilding. The stored recipients are display-only for the approval UI. The /tx/build PA-rebuild carve-out re-derives the real inputs server-side from the pendingApprovalId that approve() already injects.

• Other PA types forward their stored recipients unchanged.
• The guard still rejects direct sendMany/prebuild calls with no pendingApprovalId.
• iPendingApproval.ts: the buildParams.type union now lists the four intent types.

Tests

• Approve-level tests for wrap and finalizeUnwrap PAs, plus a transfer-type regression that checks recipients are still forwarded.
• Approve tests for all three legs (wrap, finalizeUnwrap, unwrap) through the real prebuildAndSignTransaction and verifyTransaction, with only the signing seams stubbed. This needs the verify path from fix(abstract-eth): verify ERC-7984 wrap/unwrap/finalizeUnwrap on multisig (CHALO-1957) #10067.
• A negative case: a wrap rebuilt to mint to a non-base address is rejected.
• A guard regression: prebuildAndSignTransaction with recipients and wrapApprove and no pendingApprovalId still throws.

Ticket: CHALO-1957

[linear-code]

CHALO-1957

[github-actions]

⚠️ Unit tests are failing on Node 26.x (Current release line, non-blocking). This is not an LTS version yet, so it does not block merge, but it signals an incompatibility to fix before Node 26.x becomes LTS.

View run

[0xPrabh]

@claude review

[github-actions]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

The latest commit covers the three issues I raised earlier, and this pass found no new bugs. This code verifies multisig transactions before signing, so a human should still look at it.

What was reviewed:

• The non-TSS verifyTransaction path for wrap, unwrap and finalizeUnwrap. These no longer need recipients, and the new PA tests run the real prebuildAndSignTransaction.
• getErc7984WrappersForNetwork, which wrap, unwrap and finalizeUnwrap now all use to look up wrappers on this coin's network only.
• assertPrebuildRecipientMirrorsSendMultiSig, which requires exactly one recipient whose address, amount and data all match. wrapApprove and the new intents both use it.
• The recreateAndSignTransaction strip, which only applies to the four ERC-7984 types, so transfer PAs still forward their stored recipients.

Extended reasoning...

The change adds content-based verification of ERC-7984 wrap, unwrap and finalizeUnwrap transactions for onchain multisig ETH wallets in abstract-eth. It also stops PA rebuilds in sdk-core from forwarding stored recipients for those intent types. This is the check that runs before a user key signs a sendMultiSig operation hash, so mistakes here could approve the wrong transfers. The new commit plausibly addresses the earlier inline threads. Those threads were resolved only by the PR author, and this signing-critical logic (about 300 lines) warrants a human review rather than an automated approval.