feat(svm): add program allowlist for smart wallet Path 2

Operator-configurable allowlist gates which programs can reach
simulation-based verification. Prevents custom malicious programs
from exploiting the simulation path entirely.

Default: Squads Multisig v4, Squads Smart Account, Swig, SPL Governance.
Override via smartWalletAllowedPrograms in ExactSvmSchemeOptions.
Unknown programs rejected with smart_wallet_program_not_allowed.

Made-with: Cursor

Author: BranchManager69

typescript/packages/http/paywall/src/evm/gen/template.ts

@@ -35,6 +35,18 @@ import type { ExactSvmPayloadV2 } from "../../types";
 import { decodeTransactionFromPayload, getTokenPayerFromTransaction } from "../../utils";
 import { verifySmartWalletTransaction, verifyPostSettlement } from "./smartWalletVerification";
 
+/**
+ * Default allowed smart wallet program addresses.
+ * Only these programs can reach Path 2 (simulation-based verification).
+ * Operators can override via smartWalletAllowedPrograms in options.
+ */
+const DEFAULT_SMART_WALLET_ALLOWED_PROGRAMS = [
+  "SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf", // Squads Multisig v4
+  "SMRTzfY6DfH5ik3TKiyLFfXexV8uSG3d2UksSCYdunG", // Squads Smart Account
+  "SWiGmQedKzMz1tiTqoJCWeGDnGXfNBp2PkXLkpCAtQo", // Swig
+  "GovER5Lthms3bLBqWub97yVrMmEogzX7xNjdXpPPCVZw", // SPL Governance
+];
+
 /**
  * Configuration options for ExactSvmScheme.
  */
@@ -66,6 +78,16 @@ export type ExactSvmSchemeOptions = {
    * Default: 50,000
    */
   smartWalletMaxPriorityFeeMicroLamports?: number;
+
+  /**
+   * Allowed smart wallet program addresses for Path 2 verification.
+   * Only transactions whose top-level non-ComputeBudget instruction invokes
+   * a program in this list will be accepted through the simulation path.
+   * Prevents unknown/malicious programs from reaching CPI verification.
+   *
+   * Default: Squads Multisig v4, Squads Smart Account, Swig, SPL Governance
+   */
+  smartWalletAllowedPrograms?: string[];
 };
 
 /**
@@ -224,10 +246,29 @@ export class ExactSvmScheme implements SchemeNetworkFacilitator {
 
     // ─── Path 2: Simulation-based verification (smart wallets) ──────────
     // If static validation failed and smart wallet verification is enabled,
-    // try simulation-based outcome verification. This handles any wallet
-    // program (Squads, Swig, SPL Governance, etc.) that executes
-    // TransferChecked via CPI.
+    // try simulation-based outcome verification for allowed wallet programs.
     if (this.options?.enableSmartWalletVerification) {
+      // Program allowlist: only known, audited smart wallet programs can reach Path 2.
+      // This prevents custom malicious programs from exploiting the simulation path.
+      const allowedPrograms = new Set(
+        this.options.smartWalletAllowedPrograms ?? DEFAULT_SMART_WALLET_ALLOWED_PROGRAMS,
+      );
+
+      const compiled = getCompiledTransactionMessageDecoder().decode(transaction.messageBytes);
+      const decompiledForCheck = decompileTransactionMessage(compiled);
+      const topLevelPrograms = (decompiledForCheck.instructions ?? [])
+        .map(ix => ix.programAddress.toString())
+        .filter(addr => addr !== COMPUTE_BUDGET_PROGRAM_ADDRESS.toString());
+
+      const disallowedProgram = topLevelPrograms.find(addr => !allowedPrograms.has(addr));
+      if (disallowedProgram) {
+        return {
+          isValid: false,
+          invalidReason: `smart_wallet_program_not_allowed: ${disallowedProgram}`,
+          payer: "",
+        };
+      }
+
       const feePayer = requirements.extra.feePayer;
       return verifySmartWalletTransaction(
         exactSvmPayload.transaction,

typescript/packages/http/paywall/src/svm/gen/template.ts

@@ -465,10 +465,23 @@ export async function verifyPostSettlement(
   const requiredAmount = BigInt(requirements.amount);
 
   // Primary path: fetch confirmed transaction and inspect inner instructions.
+  // Retry with backoff to handle RPC indexing lag (transaction confirmed but
+  // not yet indexed). Same polling pattern as confirmTransaction in the SVM signer.
   if (typeof signer.getConfirmedTransactionInnerInstructions === "function") {
-    try {
-      const confirmed = await signer.getConfirmedTransactionInnerInstructions(signature, network);
+    let confirmed: SmartWalletSimulationResult | null = null;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        confirmed = await signer.getConfirmedTransactionInnerInstructions(signature, network);
+        if (confirmed?.innerInstructions) break;
+      } catch {
+        // RPC error — retry
+      }
+      if (attempt < 2) {
+        await new Promise(resolve => setTimeout(resolve, 100 * (attempt + 1)));
+      }
+    }
 
+    try {
       if (confirmed?.innerInstructions) {
         // Reuse the same extraction logic used for simulation results.
         // We pass an empty accountKeys array because the confirmed transaction's

typescript/packages/mechanisms/svm/src/exact/facilitator/scheme.ts

@@ -143,6 +143,7 @@ describe("ExactSvmScheme smart wallet fallback path", () => {
 
     const scheme = new ExactSvmScheme(mockSigner as never, undefined, {
       enableSmartWalletVerification: true,
+      smartWalletAllowedPrograms: [unknownProgram.address],
     });
 
     const result = await scheme.verify(
@@ -228,6 +229,7 @@ describe("ExactSvmScheme smart wallet fallback path", () => {
 
     const scheme = new ExactSvmScheme(mockSigner as never, undefined, {
       enableSmartWalletVerification: true,
+      smartWalletAllowedPrograms: [unknownProgram.address],
     });
 
     const result = await scheme.verify(
@@ -307,6 +309,7 @@ describe("ExactSvmScheme smart wallet fallback path", () => {
 
     const scheme = new ExactSvmScheme(mockSigner as never, undefined, {
       enableSmartWalletVerification: true,
+      smartWalletAllowedPrograms: [unknownProgram.address],
     });
 
     const result = await scheme.verify(
@@ -340,4 +343,65 @@ describe("ExactSvmScheme smart wallet fallback path", () => {
       "invalid_exact_svm_payload_transaction_fee_payer_transferring_funds",
     );
   });
+
+  it("verify rejects smart wallet transaction when program is not in allowlist", async () => {
+    const { ExactSvmScheme } = await import("../../src/exact/facilitator/scheme");
+
+    const feePayer = await generateKeyPairSigner();
+    const unknownProgram = await generateKeyPairSigner();
+    const payTo = await generateKeyPairSigner();
+    const payer = await generateKeyPairSigner();
+
+    const txBase64 = await buildSmartWalletPayload(
+      feePayer.address,
+      unknownProgram.address,
+      payer.address,
+    );
+
+    const mockSigner = {
+      getAddresses: vi.fn().mockReturnValue([feePayer.address]),
+      signTransaction: vi.fn().mockResolvedValue(txBase64),
+      simulateTransaction: vi.fn().mockResolvedValue(undefined),
+      sendTransaction: vi.fn(),
+      confirmTransaction: vi.fn(),
+      simulateTransactionWithInnerInstructions: vi.fn().mockResolvedValue({
+        innerInstructions: [],
+      }),
+      getConfirmedTransactionInnerInstructions: vi.fn().mockResolvedValue(null),
+      getTokenAccountBalance: vi.fn().mockResolvedValue(null),
+    };
+
+    // Allowlist does NOT include unknownProgram
+    const scheme = new ExactSvmScheme(mockSigner as never, undefined, {
+      enableSmartWalletVerification: true,
+      smartWalletAllowedPrograms: ["SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf"],
+    });
+
+    const result = await scheme.verify(
+      {
+        x402Version: 2,
+        accepted: {
+          scheme: "exact",
+          network: SOLANA_DEVNET_CAIP2,
+          asset: USDC_DEVNET_ADDRESS,
+          amount: "100000",
+          payTo: payTo.address,
+          extra: { feePayer: feePayer.address },
+        },
+        payload: { transaction: txBase64 },
+      } as never,
+      {
+        scheme: "exact",
+        network: SOLANA_DEVNET_CAIP2,
+        asset: USDC_DEVNET_ADDRESS,
+        amount: "100000",
+        payTo: payTo.address,
+        maxTimeoutSeconds: 3600,
+        extra: { feePayer: feePayer.address },
+      } as never,
+    );
+
+    expect(result.isValid).toBe(false);
+    expect(result.invalidReason).toContain("smart_wallet_program_not_allowed");
+  });
 });