[WIP] feat(m14): @aastar/react hooks + @aastar/xiaoheishu component library

[jhfnetboy]

Summary

• M14-A — @aastar/react: React hooks wrapping @aastar/messaging SporeAgent
• M14-B — @aastar/xiaoheishu: Component library for 小黑书 (decentralized lifestyle community)

M14-A — @aastar/react

Hook / Component	Description
SporeProvider	Context provider — initialises SporeAgent, manages lifecycle (stop on unmount)
useDm	NIP-17 E2E DM thread: history load + live streamAllMessages
useGroup	Group chat: sendText / addMember / removeMember
useConversations	Inbox listing via listConversations
useIdentity	NIP-01 profile publish, linkDevice / unlinkDevice
usePayment	X402 USDC tip via agent.sendDm encoded payload
useGatewayStream	SSE EventSource hook for M10 HTTP gateway push events

M14-B — @aastar/xiaoheishu

Component	Description
NoteCard	AT Protocol app.xiaohei.note card with tip button
FeedList	Paginated feed with onLoadMore
CreateNoteForm	Note creation: title / body / tags / price
DmThread	E2E encrypted DM thread (uses useDm)
PaymentModal	USDC tip modal: preset + custom amounts, gasless via SuperPaymaster
ProfileCard	Author profile with SBT tier badge

Security fixes (post-review)

• useGatewayStream: validate URL protocol (http/https only) before new EventSource()
• usePayment: cap message at 280 chars, guard amount <= 0n
• PaymentModal: parseAtomicUsdc() guards NaN/Infinity/negative before BigInt()

Tests

• @aastar/react: 39 tests (vitest + @testing-library/react@16, jsdom)
• @aastar/xiaoheishu: 46 tests
• Total monorepo: 390 tests passing

Test plan

• pnpm --filter @aastar/react test
• pnpm --filter @aastar/xiaoheishu test
• Manual: render <SporeProvider> + <DmThread> in a dev app, verify E2E DM round-trip
• Manual: open <PaymentModal>, enter custom amount, verify tip() encodes correctly

[clestons]

Code Review — #15

[WIP] feat(m14): messaging + payment protocol (Spore Protocol, NIP-44, EIP-3009)

Verdict: REQUEST_CHANGES | 4-round PK (DeepSeek R1 → Sonnet R2 → Codex R3 → Opus)
Early security review — WIP, fix before merge.

---

🔴 Blocking Issues

[Medium] packages/messaging/src/payment/X402Bridge.ts — nonceKey missing payer address (cross-payer nonce burning)

// CURRENT — vulnerable:
const nonceKey = `${chainId}:${nonce}`;

// FIX:
const nonceKey = `${chainId}:${from.toLowerCase()}:${nonce}`;

EIP-3009 nonces are scoped per payer address on-chain — from=Alice:nonce=X and from=Bob:nonce=X are different slots on the USDC contract. But the relay nonce store uses only ${chainId}:${nonce}, collapsing the payer dimension. An attacker can:

1. Observe Alice's pending payment event (chainId=1, nonce=X)
2. Send their own event with the same nonce (invalid signature, different from) to the relay
3. X402Bridge claims 1:X in the nonce store, attempts on-chain settlement (fails — invalid sig)
4. Alice's real event arrives → nonce_already_used — relay never processes her payment

Fix: include from in the nonce key. This also means the offline sig check (see below) should come BEFORE the nonce claim.

---

[Medium] packages/messaging/src/payment/X402Bridge.ts — no offline EIP-3009 signature verification before settlement

// Step 3: Atomic nonce claim
if (!(await this.nonceStore.claim(nonceKey))) { return { error: 'nonce_already_used' }; }
// Step 4: Settle on-chain — sig passed WITHOUT offline verification
const { txHash } = await this.config.x402Client.settlePayment({ ..., sig });

Invalid signatures are passed directly to the on-chain settlement client. The on-chain contract will reject them, but:

• The relay operator's EOA pays gas for each rejected call
• An attacker can spam invalid-sig events (consuming nonce slots) to drain the operator's gas balance

PaymentValidator in message-relay correctly does offline EIP-3009 verification before accepting payment events. X402Bridge should do the same.

Fix: add offline sig verification before nonceStore.claim():

// Verify offline before claiming nonce or calling chain
const sigValid = this.verifyEip3009Sig({ from, to, amount, nonce, validBefore, tokenAddress, chainId, sig });
if (!sigValid) return { success: false, error: 'invalid_signature' };
if (!(await this.nonceStore.claim(nonceKey))) { return { success: false, error: 'nonce_already_used' }; }

Consider extracting PaymentValidator.verifyEip3009Sig into a shared utility so both code paths stay in sync.

---

[Medium] packages/messaging/src/payment/ChannelBridge.ts — skipVoucherSigVerification is a config flag, not a runtime guard

The ChannelBridgeConfig type requires either verifyVoucherSig or skipVoucherSigVerification: true. The MainnetChecklist (SEC-4) catches missing verification at audit time, but it's not enforced at runtime — a production deployment using skipVoucherSigVerification: true would silently bypass voucher authentication.

Without voucher sig verification, any attacker who knows a channelId can force costly on-chain submitVoucher() calls that burn gas.

Fix: enforce voucher sig verification as a runtime guard: if !config.skipVoucherSigVerification && !config.verifyVoucherSig, throw at construction time. Additionally, fail-hard if skipVoucherSigVerification: true is used on mainnet chain IDs.

---

🟡 Confirmed (Fix Before Merge)

[Low] PaymentValidator.ts — validAfter hardcoded to 0n without assertion

The struct hash encodes validAfter=0n regardless of the incoming commitment. If the signer used validAfter != 0, the signature check would fail (correct behavior), but there's no explicit guard rejecting commitments with non-zero validAfter. Make the protocol invariant explicit:

if (c.validAfter !== 0n) return false; // Spore commitments always use validAfter=0

[Low] SqliteEventStore.ts / event parsing — JSON.parse on untrusted tag data without try-catch

Malformed tags cause an uncaught exception, crashing the event processing goroutine. Wrap in try/catch and reject the event cleanly.

---

✅ Security Controls Verified

EIP-712 digest construction (PaymentValidator) — CORRECT:

// Raw concat is mandatory — encodeAbiParameters would right-pad \x19\x01 to 32 bytes
const combined = new Uint8Array(66);
combined[0] = 0x19; combined[1] = 0x01;
combined.set(hexToBytes(domainSeparator), 2);
combined.set(hexToBytes(structHash), 34);
const digest = keccak256(combined);

The code even has a comment explaining why encodeAbiParameters cannot be used here. ✓

PaymentValidator offline sig verification — ecrecover matches commitment .from. ✓
Nonce replay protection — nonceStore.claim() atomic operation. ✓ (but nonceKey scope — see above)
MainnetChecklist.ts — runMainnetChecklist covers 8 security checks including ChannelBridge sig verifier (SEC-4) and X402Bridge window (SEC-7). ✓

---

❌ Rejected

• F1 (EIP-712 raw concat wrong) — Rejected. Raw \x19\x01 || domainSeparator || structHash IS the correct EIP-712 spec. encodeAbiParameters would right-pad to 32 bytes and produce the wrong digest. The code has an explicit comment documenting this.

---

💡 Suggestions

• Centralize EIP-3009 sig verification in a shared utility so X402Bridge and PaymentValidator can't drift.
• Add unit tests for the nonce collision case (two payers, same chainId+nonce) and invalid-sig rejection.
• Gate payment bridges behind a testnet-only chainId allowlist until the runtime sig guards land.

---

Reviewed by: 4-round PK — DeepSeek R1 (10 findings, F1 false positive) → Sonnet R2 (rejected F1 with EIP-712 reasoning, confirmed F3+F4 Medium) → Codex R3 (confirmed F3/F4/F5, caught MISSED F9 — cross-payer nonce burning) → Opus REQUEST_CHANGES (3 BLOCKING: F9 payer-scoped nonce key, F3 offline sig verify, F4 runtime guard; EIP-712 false positive correctly rejected).

[jhfnetboy]

🔒 Security fixes pushed (30b9f8c) — messaging payment bridges

Addressed the 3 Medium findings from the review + an adversarial Codex challenge pass. Not self-approving — leaving for human review.

Original findings

• F1 (X402Bridge): nonce dedup key scoped per (chainId, tokenAddress, from, nonce) — matches on-chain authorizationState[authorizer][nonce]. Old chainId:nonce key allowed cross-account/cross-token nonce burning.
• F2 (X402Bridge): now requires an injected offline verifyAuthorization (discriminated-union config XOR skipSignatureVerification), run before nonce claim + settlement → invalid-sig spam can no longer burn nonces or force gas-wasting reverting settlePayment(). Delegated (not inlined) because @aastar/messaging has no chain deps / EIP-712 domain; mirrors the existing verifyVoucherSig pattern.
• F3 (ChannelBridge): added constructor runtime guard so a dynamically-built config can't silently bypass voucher verification.

Codex challenge pass — additionally hardened

• ChannelBridge: reject cumulativeAmount > depositedAmount before sig/store/settle (prevents guaranteed-revert gas waste + channel lock).
• ChannelBridge: verifyVoucherSig now fails closed on throw (consistent with X402Bridge).
• Docs: scoped NonceStore key format documented; X402AuthorizationParams exported.

Note on F4/F5 from the plan: PaymentValidator.ts / SqliteEventStore.ts don't exist on this branch; ChannelBridge's JSON.parse already has try/catch. N/A here.

Deferred (not introduced by this fix): claim-before-settle leaves a nonce consumed if settlement fails for transient reasons — a pre-existing anti-double-spend tradeoff. A retry/pending state machine should be a separate issue rather than reintroducing double-settle risk here.

Tests: bridges.test.ts 314 passing; tsc clean.

[clestons]

Review — aastar-sdk#15 (security commits) · messaging bridge 安全加固

4-round PK verdict: APPROVE ✅

本 review 仅针对两个安全修复提交（37fa5d55 + 30b9f8c），不包含 WIP react hooks 部分。

(R2 Sonnet → R3 Codex → Opus；R1 跳过；Codex 零 findings，零 misses)

---

4 个安全修复全部实现正确，314 tests 全覆盖，Opus 无 blocking 项。

---

commit 37fa5d5 — react/xiaoheishu 安全修复

SSRF prevention — useGatewayStream.ts

function isAllowedGatewayUrl(raw: string): boolean {
  try {
    const parsed = new URL(raw);
    return parsed.protocol === 'http:' || parsed.protocol === 'https:';
  } catch { return false; }
}
// 在构建 EventSource URL 前调用，阻断任意协议注入

正确：new URL() 解析失败返回 false（fail-closed），仅放行 http/https ✓

输入验证 — usePayment.ts + PaymentModal.tsx

• amount <= 0n 前置 guard — 在任何状态变更前抛出 ✓
• message.slice(0, 280) 截断（非拒绝） ✓
• parseAtomicUsdc: guards NaN/Infinity/负值/超 1B → 0n；Math.round(num*1e6) 因 cap 保证在 safe integer 范围内，BigInt() 安全 ✓

---

commit 30b9f8c — messaging bridge 安全加固（认真 review）

F1 — Nonce key 范围修复（跨账户 nonce burning 漏洞）

// OLD: const nonceKey = `${chainId}:${nonce}`;
// NEW:
const nonceKey = `${chainId}:${tokenAddress.toLowerCase()}:${from.toLowerCase()}:${nonce}`;

• 与链上 EIP-3009 authorizationState[authorizer][nonce] 语义完全对齐 ✓
• 测试：同 nonce 不同 payer → 两者均 settle（cross-account burning 已修复）✓
• 测试：同 nonce 不同 token → 两者均 settle（cross-token burning 已修复）✓

F2 — EIP-3009 离线签名验证注入（nonce claim 前执行）

// Step 2.5: BEFORE nonce claim
if (this.config.verifyAuthorization) {
  let sigValid = false;
  try { sigValid = await this.config.verifyAuthorization({...}); }
  catch { sigValid = false; }  // fail-closed: verifier 异常 = 无效签名
  if (!sigValid) return { success: false, error: 'invalid_signature' };
}
// Step 3: nonce claim (只有合法签名才烧 nonce)

• 验证在所有状态变更（nonce claim、链上 settle）之前 ✓
• 测试：invalid sig → nonce 未烧，后续合法重试成功 ✓
• TypeScript discriminated union + constructor runtime guard 双层强制 ✓

F3 — ChannelBridge constructor guard + 超额存款早拒

// 构造时强制配置验证器
if (!config.skipVoucherSigVerification && !config.verifyVoucherSig) {
  throw new Error('ChannelBridge: verifyVoucherSig is required...');
}
// 在 sig/store/settle 全部之前检查超额
if (cumulativeAmount > state.depositedAmount) {
  return { success: false, error: 'exceeds_deposit' };
}

• 早拒防止 guaranteed-revert gas 浪费 + channel lock ✓
• verifyVoucherSig 同样 fail-closed（throws → valid=false）✓

---

Opus 建议（非阻断）：

• claim-before-settle 防双花权衡（nonce 被烧后 RPC 瞬断 settle 失败 → 该 nonce 永久 stranded）— 已知设计取舍，建议后续独立 issue 跟踪 retry/pending 状态机
• ChannelBridge over-deposit 在签名前 check — 信息无泄露（depositedAmount 链上公开），建议加一行注释说明是有意的 pre-auth 早拒
• NonceStore key 格式应在测试中有 lint/assertion guard（opaque key 不可随意缩窄）

Verdict: APPROVE.