From 16392ee73c79dea311b5c98881f883c2176dd833 Mon Sep 17 00:00:00 2001
From: Kamlesh Mugdiya <kamleshmugdiya@bitgo.com>
Date: Thu, 18 Jun 2026 14:49:30 +0530
Subject: [PATCH] fix(abstract-eth): allow defi TSS tx verification

verifyTssTransaction rejected DeFi vault deposit intents with "missing
txParams" because defiApprove/defiDeposit were missing from the allowlist
of recipient-less transaction types. These are intent-based txs whose
recipient and calldata are built server-side from defiParams, so they
carry no client recipients, like bridgeFunds and tokenApproval.

Add both types to the allowlist and cover them with TSS verification tests.

CGD-1815

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../src/abstractEthLikeNewCoins.ts            |  2 +
 modules/sdk-coin-eth/test/unit/eth.ts         | 70 +++++++++++++++++++
 2 files changed, 72 insertions(+)

diff --git a/modules/abstract-eth/src/abstractEthLikeNewCoins.ts b/modules/abstract-eth/src/abstractEthLikeNewCoins.ts
index 89e3bd9482..612d9f9c84 100644
--- a/modules/abstract-eth/src/abstractEthLikeNewCoins.ts
+++ b/modules/abstract-eth/src/abstractEthLikeNewCoins.ts
@@ -3158,6 +3158,8 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
             'consolidate',
             'bridgeFunds',
             'enabletoken',
+            'defiApprove',
+            'defiDeposit',
           ].includes(txParams.type))
       )
     ) {
diff --git a/modules/sdk-coin-eth/test/unit/eth.ts b/modules/sdk-coin-eth/test/unit/eth.ts
index 8534388aa4..6f8cba0844 100644
--- a/modules/sdk-coin-eth/test/unit/eth.ts
+++ b/modules/sdk-coin-eth/test/unit/eth.ts
@@ -867,6 +867,76 @@ describe('ETH:', function () {
       isTransactionVerified.should.equal(true);
     });
 
+    it('should verify TSS transaction with defiApprove type', async function () {
+      const coin = bitgo.coin('hteth') as Hteth;
+      const baseAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
+      const wallet = new Wallet(bitgo, coin, {
+        coinSpecific: {
+          baseAddress: baseAddress,
+        },
+      });
+
+      // DeFi deposit flow is intent-based: recipients/calldata are built server-side
+      // from defiParams, so txParams has no recipients (see CGD-1815).
+      const txParams = {
+        type: 'defiApprove',
+        defiParams: { vaultId: 'hteth-usdc-test', amount: '10' },
+        wallet: wallet,
+        walletPassphrase: 'fakeWalletPassphrase',
+      };
+
+      const txPrebuild = {
+        txHex: '0x',
+        coin: 'hteth',
+        walletId: 'fakeWalletId',
+      };
+
+      const verification = {};
+
+      const isTransactionVerified = await coin.verifyTransaction({
+        txParams: txParams as any,
+        txPrebuild: txPrebuild as any,
+        wallet,
+        verification,
+        walletType: 'tss',
+      });
+      isTransactionVerified.should.equal(true);
+    });
+
+    it('should verify TSS transaction with defiDeposit type', async function () {
+      const coin = bitgo.coin('hteth') as Hteth;
+      const baseAddress = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be';
+      const wallet = new Wallet(bitgo, coin, {
+        coinSpecific: {
+          baseAddress: baseAddress,
+        },
+      });
+
+      const txParams = {
+        type: 'defiDeposit',
+        defiParams: { vaultId: 'hteth-usdc-test', amount: '10', operationId: 'fakeOperationId' },
+        wallet: wallet,
+        walletPassphrase: 'fakeWalletPassphrase',
+      };
+
+      const txPrebuild = {
+        txHex: '0x',
+        coin: 'hteth',
+        walletId: 'fakeWalletId',
+      };
+
+      const verification = {};
+
+      const isTransactionVerified = await coin.verifyTransaction({
+        txParams: txParams as any,
+        txPrebuild: txPrebuild as any,
+        wallet,
+        verification,
+        walletType: 'tss',
+      });
+      isTransactionVerified.should.equal(true);
+    });
+
     describe('consolidationToBaseAddress verification', function () {
       it('should verify consolidation when recipient matches base address', async function () {
         const coin = bitgo.coin('hteth') as Hteth;