Skip to content

Revert "Merge pull request #8462 from BitGo/WAL-375-mpcv2-sign-tx-req#8538

Merged
mrdanish26 merged 1 commit intomasterfrom
revert-WAL-375-8462
Apr 16, 2026
Merged

Revert "Merge pull request #8462 from BitGo/WAL-375-mpcv2-sign-tx-req#8538
mrdanish26 merged 1 commit intomasterfrom
revert-WAL-375-8462

Conversation

@mrdanish26
Copy link
Copy Markdown
Contributor

@mrdanish26 mrdanish26 commented Apr 16, 2026 •
edited
Loading

Revert WAL-375

PR #8462 added a guard in signRequestBase() (ECDSA + MPCv2) that throws before verifyTransaction if txParams.recipients is empty or missing. This breaks TSS transaction types:

  • Smart contract interactions (e.g. Tempo supplyController) — recipients live in txRequest.intent, not txParams.recipients

Follow-up

A targeted fix is tracked in WAL-375 that:

  1. Falls back to txRequest.intent.recipients (mapped to ITransactionRecipient) for smart contract interactions
  2. Exempts known no-recipient types by mirroring the bypass list in abstractEthLikeNewCoins.ts:3112

@linear
Copy link
Copy Markdown

linear bot commented Apr 16, 2026 •
edited
Loading

WAL-375 [Security] MPCv2 signTxRequest() Defaults txParams to Empty Recipients — Transaction Verification Bypass

CGD-782 Signing fails with misleading recipient validation

@mrdanish26
Revert "#8462 from BWAL-375-mpcv2-sign-tx-require-txparams"
dfbcd47 
This reverts commit 1b9c75b, reversing
changes made to 26a1c8e.

WAL-375

TICKET: WAL-375
@mrdanish26 mrdanish26 force-pushed the revert-WAL-375-8462 branch from 96ba3bb to dfbcd47 Compare April 16, 2026 21:33
@mrdanish26 mrdanish26 marked this pull request as ready for review April 16, 2026 21:56
@mrdanish26 mrdanish26 requested review from a team as code owners April 16, 2026 21:56
@mrdanish26 mrdanish26 merged commit 4584ba5 into master Apr 16, 2026
22 checks passed
@mrdanish26 mrdanish26 mentioned this pull request Apr 17, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gokulhost gokulhost gokulhost approved these changes

@zahin-mohammad zahin-mohammad Awaiting requested review from zahin-mohammad zahin-mohammad is a code owner automatically assigned from BitGo/wallet-core

@Marzooqa Marzooqa Awaiting requested review from Marzooqa Marzooqa is a code owner automatically assigned from BitGo/wallet-core-india

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mrdanish26 @gokulhost