fix(backend)!: derive OnRamper signed wallet addresses from caller principal by AntonioVentilii · Pull Request #13167 · dfinity/oisy-wallet

AntonioVentilii · 2026-06-22T13:03:06Z

Motivation

sign_onramper_widget_url was an open signing oracle: it HMAC-signed the wallets / network_wallets / wallet_address_tags parameters exactly as supplied by any authenticated caller, without checking the addresses belonged to msg_caller(). An attacker could get the backend to sign their own address and phish a victim into funding it via a valid, OISY-branded OnRamper URL — the HMAC is OnRamper's sole URL-integrity check, so a valid signature reads as OISY authorization.

This closes the oracle by deriving the caller's own receiving addresses server-side and signing only those. A caller can now only ever obtain a signature bound to their own wallet.

Spec: docs/ai/spec-driven-development/specs/2026-06-22-fix-onramper-signing-oracle.md (#13164). Stacked on #13166 (the address encoders).

Changes

Endpoint is now argument-less and async. sign_onramper_widget_url takes no request; it derives the caller's BTC/ETH/ICP/SOL receiving addresses from msg_caller() and signs them as networkWallets. The caller_is_not_anonymous guard and per-caller rate limiter are unchanged.
Server-side derivation via management-canister public-key reads (signer/service.rs): ETH (secp256k1 schema 1 + keccak/EIP-55) and SOL (Ed25519 schnorr + base58) reuse the same canister_id = cfs_canister_id pattern as the existing BTC derivation; ICP is local principal2account. These are pubkey reads — no chain-fusion-signer call, no allow_signing/allowance flow, no signing fee. A chain is omitted if its derivation fails (ICP always succeeds), and AddressDerivationFailed is returned only if nothing derives.
Breaking Candid change: removed wallets / network_wallets / wallet_address_tags from the request (type removed); added the AddressDerivationFailed error variant; backend.did + src/declarations/backend/ regenerated via npm run generate.
Frontend no longer derives or sends wallet addresses: buildOnramperLink and the canister/api layer call the endpoint with the identity only; OnramperWidget.svelte drops the address-store wiring; the now-dead mapOnramperNetworkWallets util and Onramper*Wallet* types are removed.
docs/ai/PRODUCT.md gains a Buy (OnRamper) section with the explicit negative guarantee.

Tests

Backend unit (encoders, in feat(backend): add ETH/SOL public-key-to-address encoders #13166) + signer::service cover the pubkey→address encoding against known vectors.
Integration (tests/it/onramper.rs): anonymous rejection, SecretNotConfigured, rate limit, deterministic signing of the caller's own derived addresses, and a positive anti-oracle proof — two distinct callers get different signed content (a caller can only sign their own addresses).
Frontend: onramper.utils.spec.ts rewritten for the argument-less call; affected buy specs pass.
Gates: cargo fmt / lint.rust.sh / lint.did.sh, npm run check (clean except a pre-existing unrelated sol-instructions-system.utils.ts error not in this diff), scoped ESLint, and the affected vitest specs all pass. The heavy pocketIC integration suite runs in CI.

Parity note: byte-for-byte parity between the backend-derived addresses and the wallet's own addresses must be confirmed on staging before the buy flow is un-gated — there is no signer wasm in the test harness to assert it automatically (by design — production never calls the signer).

BREAKING CHANGE: sign_onramper_widget_url no longer accepts wallets / network_wallets / wallet_address_tags and takes no arguments; it derives and signs the caller's own addresses. Clients must stop sending wallet parameters (frontend binding regenerated in this PR).

…incipal

…into feat/onramper-derive-server-side

…server-side

…server-side # Conflicts: # src/backend/src/signer/service.rs

zeropath-ai · 2026-06-23T11:57:44Z

✅ No security or compliance issues detected. Reviewed everything up to a9eedad.

Security Overview

🔎 Scanned files: 21 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/00881019-f162-4503-9567-953b0be667d7?scanId=0b912d9b-1209-441b-88b1-a896d692deda&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Documentation changes	► docs/ai/PRODUCT.md Add documentation for OnRamper widget and signing process
Refactor	► src/backend/backend.did Simplify `external_refs` type Remove unused `OnramperSignedEntry` type Update `sign_onramper_widget_url` signature and arguments Update `SignOnramperWidgetUrlError` variant
Enhancement	► src/backend/backend.did Update `sign_onramper_widget_url` description
Refactor	► src/backend/src/api/onramper.rs Remove unused imports Update `sign_onramper_widget_url` signature and arguments
Enhancement	► src/backend/src/api/onramper.rs Update `sign_onramper_widget_url` function description Derive caller's addresses server-side
Refactor	► src/backend/src/lib.rs Remove unused import `SignOnramperWidgetUrlRequest`
Refactor	► src/backend/src/onramper/service.rs Update `sign_onramper_widget_url` signature and arguments Remove unused `OnramperSignedEntry` type Implement address derivation for multiple networks
Enhancement	► src/backend/src/onramper/service.rs Update function documentation
Refactor	► src/backend/src/signer/mod.rs Add new exports for signer functions
Refactor	► src/backend/src/signer/service.rs Add new functions for deriving ETH and SOL addresses Add constants for derivation schemas Update `cfs_ecdsa_pubkey_of` to accept schema
Refactor	► src/backend/tests/it/onramper.rs Update test setup and assertions for new `sign_onramper_widget_url` signature Remove unused `sample_request` function Update test descriptions
Refactor	► src/declarations/backend/backend.did Remove unused `OnramperSignedEntry` type Update `sign_onramper_widget_url` signature and arguments Add `AddressDerivationFailed` variant to `SignOnramperWidgetUrlError`
Refactor	► src/declarations/backend/backend.did.d.ts Remove `OnramperSignedEntry` interface Update `ActiveUserTransaction` interface Update `SignOnramperWidgetUrlError` type Update `sign_onramper_widget_url` method signature Remove `SignOnramperWidgetUrlRequest` interface
Refactor	► src/declarations/backend/backend.factory.certified.did.js Remove `OnramperSignedEntry` definition Update `ActiveUserTransaction` definition Update `SignOnramperWidgetUrlError` definition Update `sign_onramper_widget_url` function definition Remove `SignOnramperWidgetUrlRequest` definition
Refactor	► src/declarations/backend/backend.factory.did.js Remove `OnramperSignedEntry` definition Update `ActiveUserTransaction` definition Update `SignOnramperWidgetUrlError` definition Update `sign_onramper_widget_url` function definition Remove `SignOnramperWidgetUrlRequest` definition
Refactor	► src/frontend/src/lib/api/backend.api.ts Remove `SignOnramperWidgetUrlRequest` type and related imports Update `signOnramperWidgetUrl` function signature

Copilot

Pull request overview

Closes an OnRamper URL-signing oracle by making the backend derive the authenticated caller’s receiving addresses (BTC/ETH/ICP/SOL) server-side and signing only those, removing all caller-supplied wallet-address inputs and updating the frontend + generated bindings accordingly.

Changes:

Backend sign_onramper_widget_url is now argument-less + async, derives caller addresses via management-canister public-key reads, and adds AddressDerivationFailed.
Frontend no longer derives/sends wallet addresses; it just calls the signing endpoint with the user identity and appends signed_query verbatim.
Regenerates Candid + TS declaration artifacts and updates product docs to state the negative guarantee (cannot sign attacker-chosen addresses).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/shared/src/types/onramper.rs	Removes request type; adds `AddressDerivationFailed` and updates error docs.
src/frontend/src/tests/lib/utils/onramper.utils.spec.ts	Updates unit tests for the argument-less signing call and backend-supplied signed query.
src/frontend/src/lib/utils/onramper.utils.ts	Removes wallet args; calls backend signing endpoint with identity only.
src/frontend/src/lib/types/onramper.ts	Removes now-dead OnRamper wallet address/wallet types.
src/frontend/src/lib/types/api.ts	Removes OnRamper signing request parameter types.
src/frontend/src/lib/components/onramper/OnramperWidget.svelte	Drops address-store wiring; relies on backend-derived addresses.
src/frontend/src/lib/canisters/backend.errors.ts	Maps new `AddressDerivationFailed` error variant.
src/frontend/src/lib/canisters/backend.canister.ts	Updates canister wrapper to call `sign_onramper_widget_url()` with no args.
src/frontend/src/lib/api/backend.api.ts	Updates API wrapper to call the no-arg canister method.
src/declarations/backend/backend.factory.did.js	Regenerated backend IDL factory (no-arg endpoint; type removals).
src/declarations/backend/backend.factory.certified.did.js	Regenerated certified IDL factory (no-arg endpoint; type removals).
src/declarations/backend/backend.did.d.ts	Regenerated TS declarations for breaking Candid changes + new error variant.
src/declarations/backend/backend.did	Regenerated Candid for breaking endpoint signature and type cleanup.
src/backend/tests/it/onramper.rs	Updates integration tests for caller-bound, server-derived signing.
src/backend/src/signer/service.rs	Adds ETH/SOL principal→address derivation via management-canister pubkey reads (schema-aware).
src/backend/src/signer/mod.rs	Re-exports new signer helpers used by OnRamper service wiring.
src/backend/src/onramper/service.rs	Derives caller networkWallets server-side and signs only those.
src/backend/src/lib.rs	Removes obsolete request-type import.
src/backend/src/api/onramper.rs	Makes `sign_onramper_widget_url` async + no-arg, binds to `msg_caller()`.
src/backend/backend.did	Regenerated backend Candid mirror (breaking endpoint signature and type cleanup).
docs/ai/PRODUCT.md	Documents Buy (OnRamper) behavior + explicit anti-oracle guarantee.

…re is caller-bound

…' into feat/onramper-derive-server-side

AntonioVentilii · 2026-06-23T13:43:41Z

Superseded by a cleaner decomposition of the same fix, switched to the validate-ownership design (the FE keeps sending its derived addresses; the backend re-derives from the caller principal, verifies they match, and signs its own derived values — rejecting on mismatch or underivable network). This is non-breaking (the request shape is unchanged), so it splits cleanly:

feat(backend)!: add OnRamper address-validation error variants #13194 (parallel) — feat(shared): address-validation error variants + bindings + FE mapping.
fix(backend)!: verify FE-supplied OnRamper addresses against caller-derived ones #13195 (stacked on feat(backend)!: add OnRamper address-validation error variants #13194) — fix(backend): derivation helpers + endpoint validation + tests + docs.

Encoders already merged in #13166. Closing this in favor of that stack.

AntonioVentilii and others added 9 commits June 22, 2026 14:14

feat(backend): add ETH/SOL public-key-to-address encoders

48d7849

🤖 Apply formatting changes

c94f7c5

fix(backend)!: derive OnRamper signed wallet addresses from caller pr…

24be9db

…incipal

🤖 Apply bindings changes

bec9b54

Merge branch 'main' into feat/onramper-address-encoders

cee866b

chore(npm-deps): drop verbose tiny-keccak dependency comment

46ac310

Merge remote-tracking branch 'origin/feat/onramper-address-encoders' …

c0f8e35

…into feat/onramper-derive-server-side

refactor(backend): enforce 20-byte address in to_eip55_checksum via type

af09b87

Merge remote-tracking branch 'origin/feat/onramper-address-encoders' …

c098b76

…into feat/onramper-derive-server-side

Base automatically changed from feat/onramper-address-encoders to main June 23, 2026 09:58

AntonioVentilii added 2 commits June 23, 2026 12:00

Merge remote-tracking branch 'origin/main' into feat/onramper-derive-…

db0d437

…server-side

Merge remote-tracking branch 'origin/main' into feat/onramper-derive-…

8ef0e1a

…server-side # Conflicts: # src/backend/src/signer/service.rs

AntonioVentilii marked this pull request as ready for review June 23, 2026 11:56

AntonioVentilii requested a review from a team as a code owner June 23, 2026 11:56

Copilot AI review requested due to automatic review settings June 23, 2026 11:56

Merge branch 'main' into feat/onramper-derive-server-side

f7437f7

Copilot started reviewing on behalf of AntonioVentilii June 23, 2026 11:57 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Comment thread src/backend/tests/it/onramper.rs

Comment thread src/backend/src/onramper/service.rs

AntonioVentilii and others added 3 commits June 23, 2026 14:05

refactor(backend): derive ICP account-id hex directly; assert signatu…

58c61c1

…re is caller-bound

Merge remote-tracking branch 'origin/feat/onramper-derive-server-side…

a9eedad

…' into feat/onramper-derive-server-side

🤖 Apply formatting changes

293761a

DenysKarmazynDFINITY approved these changes Jun 23, 2026

View reviewed changes

AntonioVentilii mentioned this pull request Jun 23, 2026

fix(backend)!: verify FE-supplied OnRamper addresses against caller-derived ones #13195

Draft

AntonioVentilii closed this Jun 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(backend)!: derive OnRamper signed wallet addresses from caller principal#13167

fix(backend)!: derive OnRamper signed wallet addresses from caller principal#13167
AntonioVentilii wants to merge 15 commits into
mainfrom
feat/onramper-derive-server-side

AntonioVentilii commented Jun 22, 2026

Uh oh!

zeropath-ai Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

AntonioVentilii commented Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

AntonioVentilii commented Jun 22, 2026

Motivation

Changes

Tests

Uh oh!

zeropath-ai Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

AntonioVentilii commented Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zeropath-ai Bot commented Jun 23, 2026 •

edited

Loading