Release: preprod → main

eslint.config.js

@@ -30,6 +30,23 @@ export default [
       },
     },
     rules: {
+      // Guardrail: never pull `wallet` out of @meshsdk/react 2.0's useWallet().
+      // That object is a low-level CIP-30 wallet whose signData(address, payload)
+      // / signTx(tx, partialSign) signatures differ from the @meshsdk/core 1.9
+      // IWallet the app is built on — a wrong-order call compiles but signs the
+      // wrong bytes (caused VESPR CIP-30 InternalError -2 and ballot witness
+      // divergence). Use useMeshWallet()/useActiveWallet() for any wallet ops;
+      // useWallet() is fine for connection state only (name/connected/connect/
+      // disconnect).
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector:
+            "VariableDeclarator[init.callee.name='useWallet'] > ObjectPattern > Property[key.name='wallet']",
+          message:
+            "Don't destructure `wallet` from @meshsdk/react useWallet() — its signData/signTx args differ from core 1.9 and silently sign wrong bytes. Use useMeshWallet()/useActiveWallet() instead.",
+        },
+      ],
       "@typescript-eslint/array-type": "off",
       "@typescript-eslint/consistent-type-definitions": "off",
       "@typescript-eslint/consistent-type-imports": [

src/__tests__/addressCompatibility.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect } from '@jest/globals';
+import { normalizeAddressToBech32 } from '../utils/addressCompatibility';
+
+describe('normalizeAddressToBech32', () => {
+  // 57-byte mainnet base address as returned hex-encoded by some CIP-30
+  // wallets (mobile in-app browsers) from getChangeAddress/getUsedAddresses.
+  const mainnetBaseHex =
+    '01188691447471593ad888086cd3cffcb93833f38225ebd56bb1986476b59d6e7bd1e5ae3ae5ffe52dada5528d868ef67b738687543193df8d';
+  const mainnetBaseBech32 =
+    'addr1qyvgdy2yw3c4jwkc3qyxe570ljunsvlnsgj7h4ttkxvxga44n4h8h5094cawtll99kk6255ds680v7mns6r4gvvnm7xscrhvw9';
+
+  it('converts hex-encoded mainnet base address bytes to bech32', () => {
+    expect(normalizeAddressToBech32(mainnetBaseHex)).toBe(mainnetBaseBech32);
+  });
+
+  it('converts hex-encoded testnet base address bytes to addr_test', () => {
+    const testnetHex = '00' + mainnetBaseHex.slice(2);
+    expect(normalizeAddressToBech32(testnetHex)).toMatch(/^addr_test1/);
+  });
+
+  it('converts hex-encoded reward address bytes to stake bech32', () => {
+    const rewardHex = 'e1ad675b9ef479ae3ae5ffe52dada5528d868ef67b738687543193df8d';
+    expect(normalizeAddressToBech32(rewardHex)).toBe(
+      'stake1uxkkwku773u6uwh9lljjmtd922xcdrhk0decdp65xxfalrgc9mvct',
+    );
+  });
+
+  it('returns bech32 addresses unchanged', () => {
+    expect(normalizeAddressToBech32(mainnetBaseBech32)).toBe(mainnetBaseBech32);
+    const stake = 'stake1uxkkwku773u6uwh9lljjmtd922xcdrhk0decdp65xxfalrgc9mvct';
+    expect(normalizeAddressToBech32(stake)).toBe(stake);
+  });
+
+  it('returns non-address input unchanged', () => {
+    expect(normalizeAddressToBech32('deadbeef')).toBe('deadbeef');
+    expect(normalizeAddressToBech32('not-an-address')).toBe('not-an-address');
+    expect(normalizeAddressToBech32('')).toBe('');
+  });
+});

src/components/common/cardano-objects/connect-wallet.tsx

@@ -16,14 +16,8 @@ import React from "react";
 import useUser from "@/hooks/useUser";
 import { useUserStore } from "@/lib/zustand/user";
 import { getProvider } from "@/utils/get-provider";
-import {
-  Asset,
-  deserializeAddress,
-  pubKeyAddress,
-  scriptAddress,
-  serializeAddressObj,
-  serializeRewardAddress,
-} from "@meshsdk/core";
+import { Asset } from "@meshsdk/core";
+import { normalizeAddressToBech32 } from "@/utils/addressCompatibility";
 import useUTXOS from "@/hooks/useUTXOS";
 import { api } from "@/utils/api";
 import { useWalletContext, WalletState } from "@/hooks/useWalletContext";
@@ -405,23 +399,7 @@ function ConnectWalletContent({
         }
 
         // Normalize possible hex-encoded CIP-30 address bytes to bech32 (addr/addr_test)
-        try {
-          if (!address.startsWith("addr1") && !address.startsWith("addr_test1")) {
-            const d = deserializeAddress(address);
-            const stakeCredential = d.stakeCredentialHash || d.stakeScriptCredentialHash || "";
-            const rebuilt =
-              d.pubKeyHash
-                ? pubKeyAddress(d.pubKeyHash, stakeCredential, !!d.stakeScriptCredentialHash)
-                : d.scriptHash
-                  ? scriptAddress(d.scriptHash, stakeCredential, !!d.stakeScriptCredentialHash)
-                  : null;
-            if (rebuilt) {
-              address = serializeAddressObj(rebuilt, netId);
-            }
-          }
-        } catch {
-          // If normalization fails, keep original (better than dropping the address)
-        }
+        address = normalizeAddressToBech32(address);
 
         setUserAddress(address);
 
@@ -430,24 +408,8 @@ function ConnectWalletContent({
         let stakeAddress = stakeAddresses[0];
 
         // Normalize possible hex-encoded reward address bytes to bech32 (stake/stake_test)
-        try {
-          if (
-            stakeAddress &&
-            !stakeAddress.startsWith("stake1") &&
-            !stakeAddress.startsWith("stake_test1")
-          ) {
-            const d = deserializeAddress(stakeAddress);
-            const stakeHash = d.stakeCredentialHash || d.stakeScriptCredentialHash;
-            if (stakeHash) {
-              stakeAddress = serializeRewardAddress(
-                stakeHash,
-                !!d.stakeScriptCredentialHash,
-                netId,
-              );
-            }
-          }
-        } catch {
-          // ignore
+        if (stakeAddress) {
+          stakeAddress = normalizeAddressToBech32(stakeAddress);
         }
 
         if (!stakeAddress || !address) {
@@ -483,7 +445,7 @@ function ConnectWalletContent({
         utxosInitializedRef.current = false;
       }
     })();
-  }, [isUtxosEnabled, utxosWallet, isUserLoading, createUser, setUserAddress, netId]);
+  }, [isUtxosEnabled, utxosWallet, isUserLoading, createUser, setUserAddress]);
 
   // Handle UTXOS wallet assets and network
   useEffect(() => {

src/components/common/modals/WalletAuthModal.tsx

@@ -1,11 +1,10 @@
 import { useState, useEffect, useCallback } from "react";
-import { useWallet } from "@meshsdk/react";
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "@/components/ui/dialog";
 import { Button } from "@/components/ui/button";
 import { useToast } from "@/hooks/use-toast";
 import useUTXOS from "@/hooks/useUTXOS";
-import { useSiteStore } from "@/lib/zustand/site";
-import { deserializeAddress, pubKeyAddress, scriptAddress, serializeAddressObj } from "@meshsdk/core";
+import useMeshWallet from "@/hooks/useMeshWallet";
+import { normalizeAddressToBech32 } from "@/utils/addressCompatibility";
 
 interface WalletAuthModalProps {
   address: string; // display label; actual signing address is derived from wallet.getUsedAddresses()
@@ -16,9 +15,16 @@ interface WalletAuthModalProps {
 }
 
 export function WalletAuthModal({ address, open, onClose, onAuthorized, autoAuthorize = false }: WalletAuthModalProps) {
-  const { wallet, connected } = useWallet();
-  const network = useSiteStore((state) => state.network);
-  const netId = (network === 1 ? 1 : 0) as 0 | 1;
+  // Use the Mesh 1.9 BrowserWallet (via useMeshWallet), NOT react-2.0's
+  // useWallet().wallet. The latter is a low-level CIP-30 wallet whose
+  // signData(address, payload) argument order is SWAPPED relative to 1.9's
+  // signData(payload, address). Calling it with our (nonce, address) order
+  // made wallets (e.g. VESPR) sign with the nonce as the address and throw
+  // CIP-30 InternalError (-2). The 1.9 wallet matches the (payload, address)
+  // order used everywhere else in the app, and the UTXOS MeshWallet below is
+  // also payload-first — so a single signData(nonce, address) call is correct
+  // for both.
+  const { wallet: meshWallet, connected } = useMeshWallet();
   const { wallet: utxosWallet, isEnabled: isUtxosEnabled } = useUTXOS();
   const { toast } = useToast();
   const [submitting, setSubmitting] = useState(false);
@@ -27,22 +33,7 @@ export function WalletAuthModal({ address, open, onClose, onAuthorized, autoAuth
   const signingWallet =
     isUtxosEnabled && utxosWallet?.cardano
       ? utxosWallet.cardano
-      : (wallet && connected ? wallet : null);
-
-  const normalizePaymentAddress = useCallback((maybeHexOrBech: string): string => {
-    if (maybeHexOrBech.startsWith("addr1") || maybeHexOrBech.startsWith("addr_test1")) {
-      return maybeHexOrBech;
-    }
-    const d = deserializeAddress(maybeHexOrBech);
-    const stakeCredential = d.stakeCredentialHash || d.stakeScriptCredentialHash || "";
-    const rebuilt =
-      d.pubKeyHash
-        ? pubKeyAddress(d.pubKeyHash, stakeCredential, !!d.stakeScriptCredentialHash)
-        : d.scriptHash
-          ? scriptAddress(d.scriptHash, stakeCredential, !!d.stakeScriptCredentialHash)
-          : null;
-    return rebuilt ? serializeAddressObj(rebuilt, netId) : maybeHexOrBech;
-  }, [netId]);
+      : (meshWallet && connected ? meshWallet : null);
 
   const handleAuthorize = useCallback(async () => {
     if (!signingWallet) {
@@ -95,7 +86,10 @@ export function WalletAuthModal({ address, open, onClose, onAuthorized, autoAuth
       if (!signingAddress) {
         throw new Error("No addresses found for wallet");
       }
-      signingAddress = normalizePaymentAddress(signingAddress);
+      signingAddress = normalizeAddressToBech32(signingAddress);
+      if (!signingAddress.startsWith("addr1") && !signingAddress.startsWith("addr_test1")) {
+        throw new Error("Could not read a valid payment address from this wallet.");
+      }
 
       // 1) Get nonce from existing endpoint
       const nonceRes = await fetch(`/api/v1/getNonce?address=${encodeURIComponent(signingAddress)}`);
@@ -113,26 +107,31 @@ export function WalletAuthModal({ address, open, onClose, onAuthorized, autoAuth
 
       let signed: { signature: string; key: string } | undefined;
       try {
-        // Mirror the working Swagger token flow: signData(nonce, address)
+        // Mesh 1.9 / UTXOS order is signData(payload, address).
         signed = (await (signingWallet as any).signData(
           nonce,
           signingAddress,
         )) as { signature: string; key: string };
       } catch (error: any) {
-        if (error instanceof Error) {
-          const msg = error.message.toLowerCase();
-          if (
-            msg.includes("user") ||
-            msg.includes("cancel") ||
-            msg.includes("decline") ||
-            msg.includes("reject")
-          ) {
-            throw new Error(
-              "Signing cancelled. Please try again and approve the signing request.",
-            );
-          }
-        }
-        throw new Error("Failed to sign nonce. Please try again.");
+        const raw =
+          error instanceof Error
+            ? error.message
+            : typeof error === "string"
+              ? error
+              : (() => {
+                  try {
+                    return JSON.stringify(error);
+                  } catch {
+                    return String(error);
+                  }
+                })();
+        // Surface the wallet's real error verbatim — some (e.g. the UTXOS
+        // smart wallet) fail inside signData with a provider-specific
+        // message we otherwise lose. The previous cancel/reject heuristic
+        // false-matched non-cancellation errors that merely contained the
+        // word "user", hiding the true cause, so always show the raw text.
+        console.error("[WalletAuthModal] signData failed:", error);
+        throw new Error(`Failed to sign nonce: ${raw || "unknown wallet error"}`);
       }
 
       if (!signed?.signature || !signed?.key) {
@@ -171,7 +170,7 @@ export function WalletAuthModal({ address, open, onClose, onAuthorized, autoAuth
     } finally {
       setSubmitting(false);
     }
-  }, [signingWallet, toast, onAuthorized, onClose, normalizePaymentAddress]);
+  }, [signingWallet, toast, onAuthorized, onClose]);
 
   // Auto-authorize when modal opens if autoAuthorize is true (only once)
   useEffect(() => {

src/components/common/overall-layout/layout.tsx

@@ -1,7 +1,7 @@
 import React, { useEffect, Component, ReactNode, useMemo, useCallback, useState, useRef } from "react";
 import { useRouter } from "next/router";
 import Link from "next/link";
-import { useWallet, useAddress } from "@meshsdk/react";
+import { useAddress } from "@meshsdk/react";
 import { publicRoutes } from "@/data/public-routes";
 import { api } from "@/utils/api";
 import useUser from "@/hooks/useUser";
@@ -99,7 +99,6 @@ export default function RootLayout({
 }: {
   children: React.ReactNode;
 }) {
-  const { wallet } = useWallet();
   // 1.9 IWallet bridge — used for getDRep(), which the react 2.0 wallet lacks.
   const { wallet: meshWallet } = useMeshWallet();
   const { state: walletState, connectedWalletInstance } = useWalletContext();
@@ -124,9 +123,9 @@ export default function RootLayout({
   const connected = String(walletState) === String(WalletState.CONNECTED);
   const anyWalletConnected = connected || isUtxosEnabled;
   // Use connectedWalletInstance if available, otherwise fall back to wallet
-  const activeWallet = connectedWalletInstance && Object.keys(connectedWalletInstance).length > 0 
-    ? connectedWalletInstance 
-    : wallet;
+  const activeWallet = connectedWalletInstance && Object.keys(connectedWalletInstance).length > 0
+    ? connectedWalletInstance
+    : meshWallet;
 
   // Global error handler for unhandled promise rejections
   useEffect(() => {
@@ -289,8 +288,8 @@ export default function RootLayout({
     }
 
     async function initializeWallet() {
-      if (!walletAddress) return;
-      
+      if (!walletAddress || !activeWallet) return;
+
       try {
         // Get stake address
         const stakeAddresses = await activeWallet.getRewardAddresses();

src/components/common/overall-layout/mobile-wrappers/user-dropdown-wrapper.tsx

@@ -8,6 +8,7 @@ import {
   DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { useWallet } from "@meshsdk/react";
+import useMeshWallet from "@/hooks/useMeshWallet";
 import { useToast } from "@/hooks/use-toast";
 import { useRouter } from "next/router";
 import { useUserStore } from "@/lib/zustand/user";
@@ -24,7 +25,10 @@ export default function UserDropDownWrapper({
   mode, 
   onAction 
 }: UserDropDownWrapperProps) {
-  const { wallet, connected, disconnect } = useWallet();
+  // useWallet only for connection state/control; wallet ops go through the
+  // Mesh 1.9 bridge.
+  const { connected, disconnect } = useWallet();
+  const { wallet } = useMeshWallet();
   const { wallet: utxosWallet, isEnabled: isUtxosEnabled, disable: disableUtxos } = useUTXOS();
   const { toast } = useToast();
   const router = useRouter();

src/components/common/overall-layout/user-drop-down.tsx

@@ -9,13 +9,17 @@ import {
   DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { useWallet } from "@meshsdk/react";
+import useMeshWallet from "@/hooks/useMeshWallet";
 import { useToast } from "@/hooks/use-toast";
 import { useRouter } from "next/router";
 import { useUserStore } from "@/lib/zustand/user";
 import { api } from "@/utils/api";
 
 export default function UserDropDown() {
-  const { wallet, disconnect } = useWallet();
+  // useWallet only for connection control (disconnect); wallet ops go
+  // through the Mesh 1.9 bridge.
+  const { disconnect } = useWallet();
+  const { wallet } = useMeshWallet();
   const { toast } = useToast();
   const router = useRouter();
   const setPastWallet = useUserStore((state) => state.setPastWallet);
@@ -42,6 +46,7 @@ export default function UserDropDown() {
 
   async function unlinkDiscord(): Promise<void> {
     try {
+      if (!wallet) return;
       const usedAddresses = await wallet.getUsedAddresses();
       const address = usedAddresses[0];
       unlinkDiscordMutation.mutate({ address: address ?? "" });
@@ -84,6 +89,7 @@ export default function UserDropDown() {
         <DropdownMenuItem
           onClick={async () => {
             try {
+              if (!wallet) return;
               let userAddress: string | undefined;
               try {
                 const usedAddresses = await wallet.getUsedAddresses();

src/components/pages/homepage/governance/drep/id/index.tsx

@@ -8,7 +8,7 @@ import { TooltipProvider } from "@/components/ui/tooltip";
 import { Loader } from "lucide-react";
 import ActiveIndicator from "../activeIndicator";
 import ScriptIndicator from "../scriptIndicator";
-import { useWallet } from "@meshsdk/react";
+import useMeshWallet from "@/hooks/useMeshWallet";
 import RowLabelInfo from "@/components/common/row-label-info";
 import { extractJsonLdValue } from "@/utils/jsonLdParser";
 import { Button } from "@/components/ui/button";
@@ -17,7 +17,7 @@ import DelegateButton from "./delegateButton";
 export default function DrepDetailPage() {
   const router = useRouter();
   const { id } = router.query;
-  const { wallet, connected } = useWallet();
+  const { wallet, connected } = useMeshWallet();
   const [drepInfo, setDrepInfo] = useState<BlockfrostDrepInfo | null>(null);
   const [drepMetadata, setDrepMetadata] =
     useState<BlockfrostDrepMetadata | null>(null);

src/components/pages/homepage/governance/drep/index.tsx

@@ -4,7 +4,7 @@ import Pagination from "@/components/common/overall-layout/pagination";
 import { getProvider } from "@/utils/get-provider";
 import { BlockfrostDrepInfo, BlockfrostDrepMetadata } from "@/types/governance";
 import Link from "next/link";
-import { useWallet } from "@meshsdk/react";
+import useMeshWallet from "@/hooks/useMeshWallet";
 import DelegateButton from "./id/delegateButton";
 import RowLabelInfo from "@/components/common/row-label-info";
 import { TooltipProvider } from "@/components/ui/tooltip";
@@ -16,7 +16,7 @@ export default function DrepOverviewPage() {
     Array<{ details: BlockfrostDrepInfo; metadata: BlockfrostDrepMetadata | null }>
   >([]);
   const [loading, setLoading] = useState<boolean>(true);
-  const { wallet, connected } = useWallet();
+  const { wallet, connected } = useMeshWallet();
   const [currentPage, setCurrentPage] = useState<number>(1);
   const [pageSize, setPageSize] = useState<number>(25);
   const [order, setOrder] = useState<"asc" | "desc">("asc");