spec: use canonical base/commerce-payments addresses#43
Merged
Conversation
…deployment Replace the CREATE2 redeploy addresses (`0xF821…`, `0x7561DC…`, `0xD8490609…`) with the canonical, audited live deployment listed in the upstream `base/commerce-payments` README: - AuthCaptureEscrow: 0xBdEA0D1bcC5966192B070Fdf62aB4EF5b4420cff - ERC3009PaymentCollector: 0x0E3dF9510de65469C4518D7843919c0b8C7A7757 - Permit2PaymentCollector: 0x992476B9Ee81d52a5BdA0622C333938D0Af0aB26 Drop the salt-scheme block and "any first-mover deployer can land at the same address" framing; the spec now defers to whatever Base ships as the authoritative deployment, which is the contract that will be replicated at the same address on additional EVM chains. Spec-only change. The `@x402r/evm` constants will follow in a separate commit once the broader chain rollout lands. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ot "Base" "Base" was ambiguous (Base is also a chain). Refer to the contract maintainers instead so it's clear who owns deployment to additional EVM chains. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop the "maintainers deploy to" / "extends coverage" framing in all three sites; the deployer is implied. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3 tasks
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The v1.0.0 release notes are where the deployment addresses are explicitly listed, so it's a more durable pin than the repo root. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Just drop "via deterministic CREATE2"; keep "Universal contract addresses (same on every supported EVM chain):". Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Restore the > **Requirement**: blockquote framing; drop only the CREATE2-specific clauses (deterministic-CREATE2, bytecode-identical, first-mover deployer) and the Salt-scheme paragraph + Salt-label table column, since the canonical addresses don't follow them. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop the address table in the PaymentRequirements section (it duplicated the one in the Canonical Addresses annex). Drop the table in the annex itself and link to the upstream sources instead — base/commerce-payments release notes for AuthCaptureEscrow + collectors, and the Uniswap Permit2 repo. Matches scheme_exact_evm.md's "Canonical Permit2" annex pattern. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mirrors scheme_exact_evm.md's third-party "Canonical Permit2" annex (plain one-line pointer to upstream, no Requirement blockquote). The deterministic-address claim isn't the spec's to make for third-party contracts; the upstream link carries it implicitly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Use docs.uniswap.org/contracts/v4/deployments (the deployments page) instead of the github.com/Uniswap/permit2 repo, matching the link target used by scheme_exact_evm.md's Canonical Permit2 annex. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Both lines now read "resolve to the canonical [project](URL)" — same shape. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Match the proper-noun style of the Permit2 line ("Uniswap Permit2 contract").
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
vraspar
approved these changes
May 9, 2026
A1igator
deleted the
A1igator/use-canonical-base-commerce-payments-addresses
branch
A1igator
added a commit
that referenced
this pull request
May 9, 2026
## Summary - Switch the SDK's AuthCaptureEscrow + token-collector constants from the CREATE2 redeploy to the audited, live [`base/commerce-payments`](https://github.com/base/commerce-payments) deployment listed in the upstream README. - Update the header comment in `constants.ts` to reflect actual deployment coverage instead of the broader chain list that applied to the CREATE2 redeploys. - Companion to the spec-side change in #43. | Constant | Old (CREATE2 redeploy) | New (canonical `base/commerce-payments`) | | :-------------------------------- | :------------------------------------------- | :------------------------------------------- | | `AUTH_CAPTURE_ESCROW_ADDRESS` | `0xF8211868187974a7Fb9d99b8fFB171AD70665Dc6` | `0xBdEA0D1bcC5966192B070Fdf62aB4EF5b4420cff` | | `EIP3009_TOKEN_COLLECTOR_ADDRESS` | `0x7561DC178D9aD5bc5fb103C01f448A510d2A36D0` | `0x0E3dF9510de65469C4518D7843919c0b8C7A7757` | | `PERMIT2_TOKEN_COLLECTOR_ADDRESS` | `0xD8490609d2da0ee626b0e676941b225cbc1A8C08` | `0x992476B9Ee81d52a5BdA0622C333938D0Af0aB26` | ## Deployment status Verified via `eth_getCode` against public RPCs: | Chain | `0xBdEA0D…` (canonical) | `0xF821…` (old CREATE2) | | :--------------------- | :---------------------- | :---------------------- | | Base mainnet (8453) | ✅ deployed | ✅ deployed | | Base Sepolia (84532) | ✅ deployed | ✅ deployed | | Ethereum (1) | ❌ | (n/a) | | Optimism (10) | ❌ | (n/a) | | Arbitrum One (42161) | ❌ | (n/a) | | Polygon (137) | ❌ | (n/a) | | BSC (56) | ❌ | (n/a) | | Avalanche (43114) | ❌ | (n/a) | | Celo (42220) | ❌ | (n/a) | | Linea (59144) | ❌ | (n/a) | | Ethereum Sepolia | ❌ | (n/a) | | Arbitrum Sepolia | ❌ | (n/a) | So today this PR effectively scopes the SDK to **Base mainnet + Base Sepolia**. Additional EVMs are expected to land at the same canonical addresses as the upstream extends coverage; we'll widen the supported-chain comment as those deployments ship. ## Test plan - [x] `pnpm test` — 122/122 unit tests pass - [x] `pnpm build` — clean - [ ] Fork tests against Base Sepolia have a pre-existing failure mode unrelated to this swap (`eth_call` defaults `from = 0`, so simulation hits `onlySender(operator)` on `authorize` / `charge`). Same failure on `main` with the CREATE2 addresses, so this PR is not the cause. Tracked as a separate fix. ## Notes - This is a breaking change for anyone running the SDK against a non-Base chain — the previous CREATE2 redeploys were live on more chains than `0xBdEA0D…` is today. That's the intended direction (single audited deployment as source of truth) and matches the spec change in #43. - No version bump in this PR; expect to bundle one in once the spec PR also merges so consumers see a single coordinated cut. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0xF821…,0x7561DC…,0xD8490609…) inspecs/schemes/authCapture/scheme_authCapture_evm.mdwith the canonical, audited live deployment listed in the upstreambase/commerce-paymentsREADME.base/commerce-payments)AUTH_CAPTURE_ESCROW_ADDRESS0xF8211868187974a7Fb9d99b8fFB171AD70665Dc60xBdEA0D1bcC5966192B070Fdf62aB4EF5b4420cffEIP3009_TOKEN_COLLECTOR_ADDRESS0x7561DC178D9aD5bc5fb103C01f448A510d2A36D00x0E3dF9510de65469C4518D7843919c0b8C7A7757PERMIT2_TOKEN_COLLECTOR_ADDRESS0xD8490609d2da0ee626b0e676941b225cbc1A8C080x992476B9Ee81d52a5BdA0622C333938D0Af0aB26Spec-only change. The
@x402r/evmpackage constants are intentionally left on this branch and will be flipped in a follow-up once the broader chain rollout lands and we can re-run the fork tests against the canonical deploy.Test plan
specs/schemes/authCapture/scheme_authCapture_evm.mdcommerce-payments::v1::*salt labels or0xF821…/0x7561DC…/0xD8490609…remain in the spec🤖 Generated with Claude Code