fix(abstract-eth): fix TSS consolidation verification for ETH wallets

Ticket: COIN-6431

Author: dpkjnr

modules/abstract-eth/src/abstractEthLikeNewCoins.ts

@@ -3053,7 +3053,9 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
       !txParams?.recipients &&
       !(
         txParams.prebuildTx?.consolidateId ||
-        (txParams.type && ['acceleration', 'fillNonce', 'transferToken', 'tokenApproval'].includes(txParams.type))
+        txPrebuild?.consolidateId ||
+        (txParams.type &&
+          ['acceleration', 'fillNonce', 'transferToken', 'tokenApproval', 'consolidate'].includes(txParams.type))
       )
     ) {
       throw new Error('missing txParams');
@@ -3126,6 +3128,31 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
       }
     }
 
+    // Verify consolidation transactions send to base address
+    if (params.verification?.consolidationToBaseAddress) {
+      const coinSpecific = wallet.coinSpecific();
+      if (!coinSpecific || !coinSpecific.baseAddress) {
+        throw new Error('Unable to determine base address for consolidation');
+      }
+      const baseAddress = coinSpecific.baseAddress;
+
+      const txBuilder = this.getTransactionBuilder();
+      txBuilder.from(txPrebuild.txHex);
+      const tx = await txBuilder.build();
+      const txJson = tx.toJson();
+
+      // Verify the transaction recipient matches the base address
+      if (!txJson.to) {
+        throw new Error('Consolidation transaction is missing recipient address');
+      }
+
+      if (txJson.to.toLowerCase() !== baseAddress.toLowerCase()) {
+        throwRecipientMismatch('Consolidation transaction recipient does not match wallet base address', [
+          { address: txJson.to, amount: txJson.value },
+        ]);
+      }
+    }
+
     return true;
   }
 

modules/sdk-coin-eth/test/unit/eth.ts

@@ -663,6 +663,210 @@ describe('ETH:', function () {
     });
   });
 
+  describe('TSS Transaction Verification', function () {
+    it('should verify TSS consolidation transaction when txPrebuild has consolidateId', async function () {
+      const coin = bitgo.coin('hteth') as Hteth;
+      const baseAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
+      const wallet = new Wallet(bitgo, coin, {
+        coinSpecific: {
+          baseAddress: baseAddress,
+        },
+      });
+
+      // txParams without recipients (as in consolidation flow)
+      const txParams = {
+        wallet: wallet,
+        walletPassphrase: 'fakeWalletPassphrase',
+      };
+
+      // txPrebuild with consolidateId (set by server during consolidation build)
+      const txPrebuild = {
+        consolidateId: '68a7d5d0c66e74e216b97173bd558c6d',
+        txHex: '0x',
+        coin: 'hteth',
+        walletId: 'fakeWalletId',
+      };
+
+      const verification = {};
+
+      const isTransactionVerified = await coin.verifyTransaction({
+        txParams: txParams as any,
+        txPrebuild: txPrebuild as any,
+        wallet,
+        verification,
+        walletType: 'tss',
+      });
+      isTransactionVerified.should.equal(true);
+    });
+
+    it('should verify TSS transaction when txParams.type is consolidate', async function () {
+      const coin = bitgo.coin('hteth') as Hteth;
+      const baseAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
+      const wallet = new Wallet(bitgo, coin, {
+        coinSpecific: {
+          baseAddress: baseAddress,
+        },
+      });
+
+      const txParams = {
+        type: 'consolidate',
+        wallet: wallet,
+        walletPassphrase: 'fakeWalletPassphrase',
+      };
+
+      const txPrebuild = {
+        txHex: '0x',
+        coin: 'hteth',
+        walletId: 'fakeWalletId',
+      };
+
+      const verification = {};
+
+      const isTransactionVerified = await coin.verifyTransaction({
+        txParams: txParams as any,
+        txPrebuild: txPrebuild as any,
+        wallet,
+        verification,
+        walletType: 'tss',
+      });
+      isTransactionVerified.should.equal(true);
+    });
+
+    it('should verify TSS transaction when txParams.prebuildTx has consolidateId', async function () {
+      const coin = bitgo.coin('hteth') as Hteth;
+      const baseAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
+      const wallet = new Wallet(bitgo, coin, {
+        coinSpecific: {
+          baseAddress: baseAddress,
+        },
+      });
+
+      const txParams = {
+        wallet: wallet,
+        walletPassphrase: 'fakeWalletPassphrase',
+        prebuildTx: {
+          consolidateId: '68a7d5d0c66e74e216b97173bd558c6d',
+        },
+      };
+
+      const txPrebuild = {
+        txHex: '0x',
+        coin: 'hteth',
+        walletId: 'fakeWalletId',
+      };
+
+      const verification = {};
+
+      const isTransactionVerified = await coin.verifyTransaction({
+        txParams: txParams as any,
+        txPrebuild: txPrebuild as any,
+        wallet,
+        verification,
+        walletType: 'tss',
+      });
+      isTransactionVerified.should.equal(true);
+    });
+
+    it('should reject TSS transaction without recipients, consolidateId, or valid type', async function () {
+      const coin = bitgo.coin('hteth') as Hteth;
+      const baseAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
+      const wallet = new Wallet(bitgo, coin, {
+        coinSpecific: {
+          baseAddress: baseAddress,
+        },
+      });
+
+      const txParams = {
+        wallet: wallet,
+        walletPassphrase: 'fakeWalletPassphrase',
+      };
+
+      const txPrebuild = {
+        txHex: '0x',
+        coin: 'hteth',
+        walletId: 'fakeWalletId',
+      };
+
+      const verification = {};
+
+      await coin
+        .verifyTransaction({
+          txParams: txParams as any,
+          txPrebuild: txPrebuild as any,
+          wallet,
+          verification,
+          walletType: 'tss',
+        })
+        .should.be.rejectedWith('missing txParams');
+    });
+
+    it('should verify TSS transaction with acceleration type', async function () {
+      const coin = bitgo.coin('hteth') as Hteth;
+      const baseAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
+      const wallet = new Wallet(bitgo, coin, {
+        coinSpecific: {
+          baseAddress: baseAddress,
+        },
+      });
+
+      const txParams = {
+        type: 'acceleration',
+        wallet: wallet,
+        walletPassphrase: 'fakeWalletPassphrase',
+      };
+
+      const txPrebuild = {
+        txHex: '0x',
+        coin: 'hteth',
+        walletId: 'fakeWalletId',
+      };
+
+      const verification = {};
+
+      const isTransactionVerified = await coin.verifyTransaction({
+        txParams: txParams as any,
+        txPrebuild: txPrebuild as any,
+        wallet,
+        verification,
+        walletType: 'tss',
+      });
+      isTransactionVerified.should.equal(true);
+    });
+
+    it('should verify TSS transaction with fillNonce type', async function () {
+      const coin = bitgo.coin('hteth') as Hteth;
+      const baseAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
+      const wallet = new Wallet(bitgo, coin, {
+        coinSpecific: {
+          baseAddress: baseAddress,
+        },
+      });
+
+      const txParams = {
+        type: 'fillNonce',
+        wallet: wallet,
+        walletPassphrase: 'fakeWalletPassphrase',
+      };
+
+      const txPrebuild = {
+        txHex: '0x',
+        coin: 'hteth',
+        walletId: 'fakeWalletId',
+      };
+
+      const verification = {};
+
+      const isTransactionVerified = await coin.verifyTransaction({
+        txParams: txParams as any,
+        txPrebuild: txPrebuild as any,
+        wallet,
+        verification,
+        walletType: 'tss',
+      });
+      isTransactionVerified.should.equal(true);
+    });
+  });
+
   describe('Address Verification', function () {
     describe('isWalletAddress', function () {
       it('should verify an address generated using forwarder version 1', async function () {