Skip to content

feat(chains): add Robinhood Chain (EVM 4663) as second-class chain - #12497

Merged
kaladinlight merged 6 commits into
shapeshift:developfrom
swdiscordia:swdiscostu/ss-5715-robinhood-chain
Aug 6, 2026
Merged

feat(chains): add Robinhood Chain (EVM 4663) as second-class chain#12497
kaladinlight merged 6 commits into
shapeshift:developfrom
swdiscordia:swdiscostu/ss-5715-robinhood-chain

Conversation

@swdiscordia

@swdiscordia swdiscordia commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Description

Adds Robinhood Chain (EVM chain id 4663, an Arbitrum Orbit rollup settling on Ethereum L1, launched 2026-07-01) as a second-class EVM chain, following .claude/contracts/second-class-evm-chain.md.

Wires up the six swappers whose providers route this chain live in production:

  • Relay (cross-chain in/out of Robinhood Chain, and same-chain swaps)
  • 0x (same-chain swaps only, matching 0x's existing architecture)
  • Across (cross-chain bridging; inbound ETH + USDG exits only, no ETH exits, per Across's own route asymmetry)
  • deBridge (cross-chain via DLN; chain 4663 confirmed against the DLN supported-chains API with a live quote)
  • ButterSwap (cross-chain; chain 4663 confirmed in Butter's supported-chain list with a live route)
  • Bebop (same-chain PMM RFQ only — JAM does not serve this chain; token set is WETH/USDG/VIRTUAL, confirmed with a live quote)

Includes the full second-class chain checklist: CAIP constants, KnownChainIds entry, chain adapter (packages/chain-adapters/src/evm/robinhood/), HDWallet support across all wallet packages — enabled where the wallet actually supports the chain: native, Ledger, Trezor, MetaMask multichain, WalletConnect V2, and Phantom (which added official Robinhood Chain support 2026-07-23); disabled for Coinbase, KeepKey, GridPlus and Vultisig, which don't list the chain — viem client wiring (viem is bumped to 2.55.11, which ships the robinhood chain definition including Multicall3 at the canonical address, so it's imported from viem/chains directly; the swap-widget intentionally stays on viem 2.46.3 to remain aligned with the version AppKit resolves), plugin registration (src/plugins/robinhood/), CSP headers, and generated asset data (283 assets, no native/ERC20 duplicate).

New feature flag VITE_FEATURE_ROBINHOOD: false in .env (off in production), true in .env.development.

Known non-blocking follow-ups, left for a separate PR:

  • Portals, Zerion, Yield.xyz, and WalletConnect V2 support for chain 4663 is unconfirmed (no API key access available to verify against those providers) — WalletConnect V2 itself is wired, just its actual protocol-level support for this chain isn't independently confirmed
  • Canonical USDC/USDT/DAI addresses are not wired for this chain; Robinhood Chain's flagship stablecoin is USDG (Paxos-issued), not canonical USDC, so this was intentionally left out of scope here

Issue (if applicable)

Traces back to Linear SS-5715 (engineering) / BIZ-34 (business). No corresponding GitHub issue to close.

Risk

High risk — this PR should carry the "high risk" label and requires 2 approvals before merge.

This introduces a brand new on-chain transaction type: a new chain means new send and swap transaction paths (build/sign/broadcast) that did not exist before, exercised through the chain adapter and all HDWallet implementations.

Protocols, transaction types, wallets, and contract interactions affected:

  • Swappers: Relay (cross-chain in/out + same-chain), 0x (same-chain), Across (cross-chain), deBridge (cross-chain), ButterSwap (cross-chain), Bebop (same-chain) — new quote/trade/execution paths for chain 4663
  • Transaction types: native ETH sends and swaps, and ERC-20 token swaps, on Robinhood Chain (new chain adapter, new build/sign/broadcast flow)
  • Wallets: every HDWallet implementation now advertises supportsRobinhood() / _supportsRobinhood — all wallet types are technically touched by the interface change even though only EVM-capable wallets will actually sign on this chain
  • Contracts: Relay's Depository contract (native deposit/withdraw bridging flow between Robinhood Chain and mainnet), Multicall3 (token balance batching)

No existing chain's send/swap/bridge logic is modified; all changes are additive (new chain id branch in each integration point).

Testing

Engineering

  • pnpm run build:packages — 0 TS errors
  • pnpm run lint --fix — 0 errors
  • pnpm run type-check — 0 errors
  • pnpm run generate:chain eip155:4663 — 283 assets generated, no native/ERC20 duplicate (chain is standard ETH-native)
  • pnpm exec vitest on the CoinGecko adapter + market-service test suites — all green after regenerating the packages/caip CoinGecko adapter data for this chain

Real, live end-to-end testing was performed with a funded test wallet (not just unit tests, not just trusting the app's own UI — every transaction was independently verified on-chain):

  • Mainnet ETH → Robinhood ETH via Relay: 0.0004 ETH in, 0.000388022917956240 ETH received. Tx confirmed successful on Blockscout: 0x6b63fe6e5fc40e0bb80532160bb2f045c76da9538a9a76018095d8165ac73fdd
  • Robinhood ETH → mainnet ETH via Relay: 0.0003 ETH in, ~0.000283 ETH received on mainnet. Verified via the depositNative call to Relay's Depository contract on Robinhood Chain, plus an independent mainnet balance check (before/after) via public RPC — not just the app's success toast
  • Same-chain ETH → USDG (an ERC-20 token) via Relay, executed for real: 0.00003 ETH in, 57219 raw units (0.057219 USDG) received. Tx confirmed on Blockscout: 0x9a536c13073f83ec5c0ba86ac6878914b6d84f4db538667a5658ce91f12ed088 (WETH wrap → Uniswap V3 → USDG, token transfer log confirms the exact amount). The wallet's own balance display picked it up correctly afterward (Balance: 0.057219 USDG), confirming ERC-20 token balance tracking works on this chain, not just the native asset.
  • While verifying the token balance path, found that Multicall3 (deployed at the canonical address on this chain, confirmed via eth_getCode) wasn't wired into the local viem chain definition, so every token balance read was silently falling back to one RPC call per token against a rate-limited public endpoint (logged as "[Robinhood] Multicall failed, falling back to individual calls"). Fixed by declaring contracts.multicall3 in the chain definition — verified live that the warning is now gone and the same real USDG balance still displays correctly.
  • 0x: request wiring verified structurally correct — chain 4663 passes through ShapeShift's 0x proxy identically to how mainnet requests are shaped. A full live quote couldn't be obtained in local dev testing because of a swapFeeRecipient config gap in the 0x price request — reproduced this exact same error on mainnet (chain 1) with an equivalent manually-constructed request, confirming it's a pre-existing, chain-agnostic local dev environment limitation, not a Robinhood-specific regression
  • Across correctly did not quote the reverse (Robinhood → mainnet ETH) direction, matching Across's documented route asymmetry (no ETH exits from Robinhood, only USDG → USDC)

Audit follow-up verification (post-review commit):

  • Enabled wallets (_supportsRobinhood = true): native, Ledger, Trezor, MetaMask multichain, WalletConnect V2, Phantom. Phantom's support externally confirmed (officially added 2026-07-23). Disabled, matching each wallet's own chain support: Coinbase, KeepKey, GridPlus, Vultisig.
  • Enabled swappers: Relay, 0x, Across (as above), plus deBridge, ButterSwap and Bebop — each newly wired after confirming provider-side support for chain 4663 with a live request:
    • deBridge DLN quote: 1 ETH (Robinhood) → 0.99111 ETH (Base)
    • ButterSwap route: 0.1 ETH (Robinhood) → 0.09959 ETH (Base)
    • Bebop PMM quote: 0.1 WETH → 189.30 USDG (same-chain; PMM-only, JAM returns 404 for this chain, which the swapper tolerates since it races both endpoints)
  • Swappers whose providers do not serve chain 4663 and are correctly left off: CoW, NearIntents, Portals (network set is majors-only), plus all non-EVM swappers
  • Both public RPC endpoints (rpc.mainnet.chain.robinhood.com, robinhood-rpc.publicnode.com) verified live with eth_chainId0x1237 (4663)
  • viem 2.55.11's robinhood definition verified to match the previous local defineChain (same RPC, Blockscout explorer, Multicall3 at the canonical address), so the token-balance batching fix is preserved after dropping the local definition

Operations

  • 🏁 My feature is behind a flag and doesn't require operations testing (yet)

VITE_FEATURE_ROBINHOOD is false in production and only true in dev. To manually verify in a preview environment: flip the flag, confirm Robinhood Chain appears in the network/chain selector, confirm ETH balance loads for a Robinhood Chain account, and run a small test swap in each direction (mainnet ETH ↔ Robinhood ETH) via Relay, checking the resulting tx on https://robinhoodchain.blockscout.com.

Screenshots (if applicable)

Robinhood Chain selected, native ETH balance loading correctly
Robinhood selected in chain picker

Live quote, mainnet ETH → Robinhood ETH via Relay
Quote mainnet to Robinhood

Two independent live quotes for the same trade (Relay + Across)
Available quotes Relay and Across

Swap complete — real transaction, confirmed by the app and independently on Blockscout
Swap complete toast

Reverse direction confirm screen, Robinhood ETH → mainnet ETH via Relay
Reverse confirm details

Final state: both balances correctly updated after both real swaps
Final balances updated

Real ERC-20 token balance (USDG) correctly displayed after a real same-chain swap
USDG token balance confirmed

Summary by CodeRabbit

  • New Features

    • Added Robinhood Mainnet support, including network visibility, wallet connections, account handling, assets, and configuration.
    • Enabled Robinhood token discovery and market data integration.
    • Added swap support through Across, Relay, 0x, Bebop, ButterSwap, and deBridge.
    • Added support for compatible Ledger, Trezor, MetaMask, Native, and WalletConnect wallets.
    • Added a feature flag for selectively enabling Robinhood.
  • Bug Fixes

    • Improved Robinhood asset, fee, transaction, explorer, and native-asset mappings.

Robinhood Chain launched its public mainnet 2026-07-01 with Relay, 0x,
and Across already routing it live in production. Wires it in as a
second-class EVM chain per .claude/contracts/second-class-evm-chain.md,
feature-flagged off in production (VITE_FEATURE_ROBINHOOD).

Live-tested with a real test wallet: real swaps executed and
independently verified on-chain in both directions via Relay
(mainnet ETH <-> Robinhood ETH).
@swdiscordia
swdiscordia requested a review from a team as a code owner July 21, 2026 15:06
@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

This PR adds feature-gated Robinhood mainnet support across CAIP identifiers, assets, RPC clients, chain adapters, wallet capabilities, swappers, plugins, market data, and application state.

Changes

Robinhood chain integration

Layer / File(s) Summary
Chain identifiers and asset generation
chains/robinhood.json, packages/caip/..., packages/types/..., packages/utils/..., scripts/generateAssetData/...
Adds Robinhood identifiers, metadata, CoinGecko mappings, assets, token generation, and related-asset mappings.
RPC clients and chain adapter wiring
headers/csps/..., packages/contracts/..., packages/chain-adapters/..., src/context/WalletProvider/...
Adds RPC resolution, CSP sources, Viem clients, adapter mappings, wrapped-native handling, chain switching metadata, and the Robinhood adapter.
Wallet capability support flags
packages/hdwallet-*/...
Adds _supportsRobinhood flags and the supportsRobinhood type guard.
Swapper platform mappings
packages/swapper/src/swappers/...
Adds Robinhood support for Across, Relay, Bebop, ButterSwap, Debridge, and 0x.
Feature gating and application integration
.env*, src/config.ts, src/plugins/..., src/lib/..., src/state/..., src/pages/...
Adds feature flags, plugin registration, wallet and portfolio checks, market integration, asset filtering, and state updates.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related issues

Possibly related PRs

Suggested reviewers: kaladinlight, gomesalexandre

Poem

A rabbit maps a chain tonight,
Robinhood paths now shine bright.
Wallets signal what they know,
RPC requests flow.
Feature flags guide the way.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the primary change: adding Robinhood Chain as a second-class EVM chain.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
packages/hdwallet-core/src/wallet.ts (1)

280-282: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Avoid any in the new type guard.

Use a typed property check and return an explicit boolean instead of (wallet as any).

Proposed fix
 export function supportsRobinhood(wallet: HDWallet): wallet is ETHWallet {
-  return isObject(wallet) && (wallet as any)._supportsRobinhood
+  return isObject(wallet) && '_supportsRobinhood' in wallet && wallet._supportsRobinhood === true
 }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/hdwallet-core/src/wallet.ts` around lines 280 - 282, Update
supportsRobinhood to avoid the any cast by using a typed property check for
_supportsRobinhood, and return an explicit boolean while preserving the existing
ETHWallet type-guard behavior.

Source: Coding guidelines

packages/chain-adapters/src/evm/robinhood/RobinhoodChainAdapter.ts (1)

40-46: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Add explicit return types.

To comply with coding guidelines, please add explicit return types to these methods.

♻️ Proposed refactor
-  getDisplayName() {
+  getDisplayName(): string {
     return ChainAdapterDisplayName.Robinhood
   }
 
-  getName() {
+  getName(): string {
     return 'Robinhood'
   }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/chain-adapters/src/evm/robinhood/RobinhoodChainAdapter.ts` around
lines 40 - 46, Add explicit return type annotations to the RobinhoodChainAdapter
methods getDisplayName and getName, using the types corresponding to their
returned enum value and string while preserving the existing return values.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/hdwallet-metamask-multichain/src/native-multichain.ts`:
- Line 307: Update ethSupportsNetwork in
packages/hdwallet-metamask-multichain/src/native-multichain.ts and
packages/hdwallet-metamask-multichain/src/shapeshift-multichain.ts to allow
chain ID 4663 alongside 1, keeping both MetaMask variants’ Robinhood support
declarations synchronized with their network allowlists.

---

Nitpick comments:
In `@packages/chain-adapters/src/evm/robinhood/RobinhoodChainAdapter.ts`:
- Around line 40-46: Add explicit return type annotations to the
RobinhoodChainAdapter methods getDisplayName and getName, using the types
corresponding to their returned enum value and string while preserving the
existing return values.

In `@packages/hdwallet-core/src/wallet.ts`:
- Around line 280-282: Update supportsRobinhood to avoid the any cast by using a
typed property check for _supportsRobinhood, and return an explicit boolean
while preserving the existing ETHWallet type-guard behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 81b00475-3b70-4ab6-851a-dd219d4f3488

📥 Commits

Reviewing files that changed from the base of the PR and between 0b8eb75 and c2b3357.

⛔ Files ignored due to path filters (11)
  • packages/caip/src/adapters/coingecko/generated/eip155_4663/adapter.json is excluded by !**/generated/**
  • packages/caip/src/adapters/coingecko/generated/index.ts is excluded by !**/generated/**
  • public/generated/asset-manifest.json is excluded by !**/generated/**
  • public/generated/asset-manifest.json.br is excluded by !**/generated/**
  • public/generated/asset-manifest.json.gz is excluded by !**/*.gz, !**/generated/**
  • public/generated/generatedAssetData.json is excluded by !**/generated/**
  • public/generated/generatedAssetData.json.br is excluded by !**/generated/**
  • public/generated/generatedAssetData.json.gz is excluded by !**/*.gz, !**/generated/**
  • public/generated/relatedAssetIndex.json is excluded by !**/generated/**
  • public/generated/relatedAssetIndex.json.br is excluded by !**/generated/**
  • public/generated/relatedAssetIndex.json.gz is excluded by !**/*.gz, !**/generated/**
📒 Files selected for processing (69)
  • .env
  • .env.development
  • chains/robinhood.json
  • headers/csps/chains/robinhood.ts
  • headers/csps/index.ts
  • packages/caip/src/adapters/coingecko/index.test.ts
  • packages/caip/src/adapters/coingecko/index.ts
  • packages/caip/src/adapters/coingecko/utils.test.ts
  • packages/caip/src/adapters/coingecko/utils.ts
  • packages/caip/src/constants.ts
  • packages/chain-adapters/src/evm/EvmBaseAdapter.ts
  • packages/chain-adapters/src/evm/SecondClassEvmAdapter.ts
  • packages/chain-adapters/src/evm/index.ts
  • packages/chain-adapters/src/evm/robinhood/RobinhoodChainAdapter.ts
  • packages/chain-adapters/src/evm/robinhood/index.ts
  • packages/chain-adapters/src/types.ts
  • packages/contracts/src/ethersProviderSingleton.ts
  • packages/contracts/src/publicRpcUrls.ts
  • packages/contracts/src/viemClient.ts
  • packages/hdwallet-coinbase/src/coinbase.ts
  • packages/hdwallet-core/src/ethereum.ts
  • packages/hdwallet-core/src/wallet.ts
  • packages/hdwallet-gridplus/src/gridplus.ts
  • packages/hdwallet-keepkey/src/keepkey.ts
  • packages/hdwallet-ledger/src/ledger.ts
  • packages/hdwallet-metamask-multichain/src/native-multichain.ts
  • packages/hdwallet-metamask-multichain/src/shapeshift-multichain.ts
  • packages/hdwallet-native/src/ethereum.ts
  • packages/hdwallet-phantom/src/phantom.ts
  • packages/hdwallet-trezor/src/trezor.ts
  • packages/hdwallet-vultisig/src/vultisig.ts
  • packages/hdwallet-walletconnectv2/src/walletconnectV2.ts
  • packages/swapper/src/swappers/AcrossSwapper/constant.ts
  • packages/swapper/src/swappers/RelaySwapper/constant.ts
  • packages/swapper/src/swappers/RelaySwapper/utils/relayTokenToAssetId.ts
  • packages/swapper/src/swappers/ZrxSwapper/types.ts
  • packages/swapper/src/swappers/ZrxSwapper/utils/constants.ts
  • packages/swapper/src/swappers/ZrxSwapper/utils/helpers/helpers.ts
  • packages/types/src/base.ts
  • packages/utils/src/assetData/baseAssets.ts
  • packages/utils/src/assetData/getBaseAsset.ts
  • packages/utils/src/chainIdToFeeAssetId.ts
  • packages/utils/src/getAssetNamespaceFromChainId.ts
  • packages/utils/src/getChainShortName.ts
  • packages/utils/src/getNativeFeeAssetReference.ts
  • scripts/generateAssetData/coingecko.ts
  • scripts/generateAssetData/generateAssetData.ts
  • scripts/generateAssetData/generateRelatedAssetIndex/generateChainRelatedAssetIndex.ts
  • scripts/generateAssetData/generateRelatedAssetIndex/generateRelatedAssetIndex.ts
  • scripts/generateAssetData/robinhood/index.ts
  • src/components/TradeAssetSearch/hooks/useGetPopularAssetsQuery.tsx
  • src/config.ts
  • src/constants/chains.ts
  • src/context/PluginProvider/PluginProvider.tsx
  • src/context/WalletProvider/WalletConnectV2/config.ts
  • src/hooks/useWalletSupportsChain/useWalletSupportsChain.ts
  • src/lib/account/evm.ts
  • src/lib/asset-service/service/AssetService.ts
  • src/lib/coingecko/utils.ts
  • src/lib/market-service/coingecko/coingecko.test.ts
  • src/pages/Markets/components/MarketsRow.tsx
  • src/plugins/activePlugins.ts
  • src/plugins/robinhood/index.tsx
  • src/state/migrations/index.ts
  • src/state/slices/opportunitiesSlice/mappings.ts
  • src/state/slices/portfolioSlice/utils/index.ts
  • src/state/slices/preferencesSlice/preferencesSlice.ts
  • src/test/mocks/store.ts
  • src/vite-env.d.ts

Comment thread packages/hdwallet-metamask-multichain/src/native-multichain.ts
@swdiscordia

Copy link
Copy Markdown
Contributor Author

Checked the two nitpick suggestions against existing precedent before deciding whether to apply them:

  • supportsRobinhood's (wallet as any)._supportsRobinhood cast: identical to every other supports<Chain> function in this file (supportsLinea, supportsScroll, supportsCronos, supportsUnichain, supportsSoneium, etc. all use the same pattern). Not changing it in isolation - that would make Robinhood's version inconsistent with its ~30 siblings for no functional benefit.
  • RobinhoodChainAdapter's getDisplayName()/getName() missing explicit return types: same as AbstractChainAdapter and PlasmaChainAdapter (the two most recently added reference chains) - neither has explicit return types either. Matching existing convention rather than diverging from the pattern this PR is modeled on.

Both are reasonable general code-quality suggestions, just not something this PR should fix in isolation without also touching ~30 other files for consistency - happy to do that as a separate cleanup if the team wants it.

…PC fanout

Multicall3 is deployed at the canonical address on Robinhood Chain
(verified via eth_getCode) but wasn't declared in the local viem
defineChain(), so every token balance read silently fell back to one
RPC call per token against a rate-limited public endpoint. Verified
live: before this fix each account load logged "[Robinhood] Multicall
failed, falling back to individual calls"; after, it doesn't, and the
same real USDG balance still displays correctly.
…15-robinhood-chain

# Conflicts:
#	public/generated/asset-manifest.json
#	public/generated/asset-manifest.json.br
#	public/generated/asset-manifest.json.gz
#	public/generated/generatedAssetData.json
#	public/generated/generatedAssetData.json.br
#	public/generated/generatedAssetData.json.gz
#	public/generated/relatedAssetIndex.json.br
#	public/generated/relatedAssetIndex.json.gz
#	src/state/migrations/index.ts
301 assets now (up from 283), reflects both upstream's asset updates
across the merged 86 commits and Robinhood's own token list refresh.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
.env (1)

236-236: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Rotate/remove the browser-exposed API keys.

VITE_TRON_GRID_API_KEY and VITE_BOB_GATEWAY_API_KEY are committed in .env and forwarded into the client config, so they should be treated as public. Revoke/rotate them and move any sensitive authorization server-side; if these are meant to be public API keys, lock them down with origin/quota limits instead.

  • .env#L236-L236: VITE_TRON_GRID_API_KEY
  • .env#L375-L375: VITE_BOB_GATEWAY_API_KEY
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.env at line 236, Remove the exposed VITE_TRON_GRID_API_KEY at .env:236-236
and VITE_BOB_GATEWAY_API_KEY at .env:375-375, revoke or rotate both credentials,
and move sensitive authorization server-side; if either must remain public,
restrict it with origin and quota limits.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.env:
- Line 236: Remove the exposed VITE_TRON_GRID_API_KEY at .env:236-236 and
VITE_BOB_GATEWAY_API_KEY at .env:375-375, revoke or rotate both credentials, and
move sensitive authorization server-side; if either must remain public, restrict
it with origin and quota limits.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: aed427ff-3595-472b-8a2e-9b1d82f3f79b

📥 Commits

Reviewing files that changed from the base of the PR and between b9e8bfd and 10117cf.

⛔ Files ignored due to path filters (3)
  • public/generated/asset-manifest.json is excluded by !**/generated/**
  • public/generated/asset-manifest.json.br is excluded by !**/generated/**
  • public/generated/asset-manifest.json.gz is excluded by !**/*.gz, !**/generated/**
📒 Files selected for processing (10)
  • .env
  • .env.development
  • headers/csps/index.ts
  • packages/caip/src/adapters/coingecko/index.test.ts
  • packages/caip/src/constants.ts
  • packages/chain-adapters/src/evm/EvmBaseAdapter.ts
  • packages/chain-adapters/src/evm/SecondClassEvmAdapter.ts
  • packages/hdwallet-core/src/ethereum.ts
  • packages/swapper/src/swappers/RelaySwapper/constant.ts
  • packages/utils/src/assetData/baseAssets.ts
🚧 Files skipped from review as they are similar to previous changes (7)
  • headers/csps/index.ts
  • packages/caip/src/adapters/coingecko/index.test.ts
  • packages/swapper/src/swappers/RelaySwapper/constant.ts
  • packages/chain-adapters/src/evm/SecondClassEvmAdapter.ts
  • packages/utils/src/assetData/baseAssets.ts
  • packages/caip/src/constants.ts
  • packages/chain-adapters/src/evm/EvmBaseAdapter.ts

@swdiscordia

Copy link
Copy Markdown
Contributor Author

Checked this before doing anything: both VITE_TRON_GRID_API_KEY (.env:236) and VITE_BOB_GATEWAY_API_KEY (.env:375) are pre-existing on develop itself, added by unrelated PRs (3c3b7f0ad "fix Sun.io Tron swaps", 709f90ceb "enable Bob chain and BobGateway swapper in production") - not introduced by this PR, and only present in this branch's .env because of the merge from upstream/develop needed to resolve a conflict.

Not something this PR should touch: rotating/removing third-party API keys is unrelated to a chain integration and outside what I have context or authority to do here. Flagging for the team to triage separately if it's actually a live concern.

@Masha-lla

Copy link
Copy Markdown
Contributor

Hi! I noticed a few remaining actionable review comments around the Robinhood wallet support and type safety. I’d be happy to address them in a small follow-up PR or contribute commits if helpful. Are these items still available to work on?

Resolves conflicts:
- src/state/migrations/index.ts: renumber robinhood clearAssets migration to 353 (develop reached 352)
- public/generated/*: develop's 08/03 regenerated asset data with the 301 robinhood chain assets re-injected, manifest hashes recomputed, br/gz recompressed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

- bump viem to 2.55.11 across web packages (swap-widget stays aligned with
  appkit at 2.46.3); drop local megaeth/robinhood defineChains in favor of
  viem/chains
- make robinhood rpc resolution fallback-only like other second-class chains;
  replace tenderly gateway with official rpc + publicnode
- enable robinhood on Phantom (supported by Phantom since 2026-07-23)
- wire robinhood for Debridge, ButterSwap and Bebop (provider support
  verified with live quotes)
- use viem chain ids in swapper chain maps (relay/across/debridge/butter)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/swapper/src/swappers/BebopSwapper/types.ts`:
- Line 22: Keep the Bebop Robinhood mapping in
packages/swapper/src/swappers/BebopSwapper/types.ts at lines 22 and 120,
including KnownChainIds.RobinhoodMainnet and the 'robinhood' name. Remove or
guard the Butter Router Robinhood mappings in
packages/swapper/src/swappers/ButterSwap/utils/helpers.ts at lines 17 and 35 so
they are used only with provider-backed support, rather than treating Robinhood
as statically supported by Butter.

In `@src/context/WalletProvider/WalletConnectV2/config.ts`:
- Around line 66-69: Update walletConnectV2OptionalChains to add robinhood only
when enabledFlags.Robinhood is true, and ensure walletConnectV2ProviderConfig
continues using the filtered array for optionalChains.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 489e163f-013b-4bdc-9ab9-5fdf32bdfaa0

📥 Commits

Reviewing files that changed from the base of the PR and between 584a93f and 988f7c2.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (22)
  • .env
  • .env.development
  • chains/robinhood.json
  • package.json
  • packages/caip/src/constants.ts
  • packages/chain-adapters/package.json
  • packages/contracts/package.json
  • packages/contracts/src/ethersProviderSingleton.ts
  • packages/contracts/src/publicRpcUrls.ts
  • packages/contracts/src/viemClient.ts
  • packages/hdwallet-phantom/src/phantom.ts
  • packages/public-api/package.json
  • packages/swapper/package.json
  • packages/swapper/src/swappers/AcrossSwapper/constant.ts
  • packages/swapper/src/swappers/BebopSwapper/types.ts
  • packages/swapper/src/swappers/ButterSwap/utils/helpers.ts
  • packages/swapper/src/swappers/DebridgeSwapper/constant.ts
  • packages/swapper/src/swappers/RelaySwapper/constant.ts
  • packages/swapper/src/swappers/RelaySwapper/utils/relayTokenToAssetId.ts
  • packages/types/package.json
  • packages/unchained-client/package.json
  • src/context/WalletProvider/WalletConnectV2/config.ts
💤 Files with no reviewable changes (2)
  • packages/swapper/src/swappers/RelaySwapper/utils/relayTokenToAssetId.ts
  • .env.development
🚧 Files skipped from review as they are similar to previous changes (6)
  • packages/contracts/src/publicRpcUrls.ts
  • chains/robinhood.json
  • packages/contracts/src/ethersProviderSingleton.ts
  • packages/caip/src/constants.ts
  • packages/swapper/src/swappers/AcrossSwapper/constant.ts
  • .env

Comment thread packages/swapper/src/swappers/BebopSwapper/types.ts
Comment thread src/context/WalletProvider/WalletConnectV2/config.ts
@kaladinlight
kaladinlight merged commit 2d0b012 into shapeshift:develop Aug 6, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants