Consumer Wallet Security

import { ThreatClient, Chain } from '@webacy-xyz/sdk';

const client = new ThreatClient({
  apiKey: process.env.WEBACY_API_KEY,
  defaultChain: Chain.ETH,
});

// Send flow protection
async function validateSendAddress(address: string, chain: Chain) {
  // 1. Address poisoning (most critical)
  const poisoning = await client.addresses.checkPoisoning(address, { chain });
  if (poisoning.is_poisoned) {
    return {
      allowed: false,
      severity: 'critical',
      reason: 'Address poisoning attack detected',
      details: 'This address looks similar to legitimate addresses and may be part of a scam.'
    };
  }

  // 2. Sanctions check (compliance)
  const sanctions = await client.addresses.checkSanctioned(address, { chain });
  if (sanctions.is_sanctioned) {
    return {
      allowed: false,
      severity: 'critical',
      reason: 'Sanctioned address',
      details: 'This address is on the OFAC sanctions list.'
    };
  }

  // 3. Quick profile (risk assessment)
  const profile = await client.addresses.getQuickProfile(address, { chain });

  if (profile.riskLevel === 'critical') {
    return {
      allowed: false,
      severity: 'critical',
      reason: 'Extremely high risk address',
      riskScore: profile.riskScore
    };
  }

  if (profile.riskLevel === 'high') {
    return {
      allowed: true,
      severity: 'high',
      requireConfirmation: true,
      reason: 'High risk address detected',
      riskScore: profile.riskScore
    };
  }

  return {
    allowed: true,
    severity: profile.riskLevel,
    riskScore: profile.riskScore
  };
}

// Transaction preview
async function previewTransaction(
  userAddress: string,
  txData: { to: string; data: string; value: string },
  chain: number,
  dappDomain?: string
) {
  const simulation = await client.scan.scanTransaction(userAddress, {
    tx: {
      from: userAddress,
      to: txData.to,
      data: txData.data,
      value: txData.value,
    },
    chain,
    domain: dappDomain,
  });

  return {
    riskLevel: simulation.riskLevel,
    warnings: simulation.warnings,
    assetChanges: simulation.assetChanges,
    shouldBlock: simulation.riskLevel === 'critical',
    requiresExtraConfirmation: simulation.riskLevel === 'high',
  };
}

// Signature analysis
async function analyzeSignature(
  userAddress: string,
  typedData: object,
  dappDomain: string
) {
  const result = await client.scan.scanEip712(userAddress, {
    msg: {
      from: userAddress,
      data: typedData,
    },
    domain: dappDomain,
  });

  return {
    riskLevel: result.riskLevel,
    messageType: result.messageType,
    shouldBlock: result.riskLevel === 'critical',
    isPermit: result.messageType?.toLowerCase().includes('permit'),
  };
}

// URL screening for dApp browser
async function checkDappUrl(url: string) {
  const result = await client.url.check(url);

  return {
    safe: !result.isPhishing && !result.isMalware,
    isPhishing: result.isPhishing,
    isMalware: result.isMalware,
    riskScore: result.riskScore,
    categories: result.categories,
  };
}