fix(sdk-core): add EVM staking types to TSS signing bypass list

BNB/BSC hot staking breaks after WAL-375 fix because the staking wallet
calls signTransaction without txParams, leaving effectiveTxParams.type
undefined. resolveEffectiveTxParams then falls through to the guard and
throws InvalidTransactionError for all staking operations.

Fix:
- Add EVM staking intent types (stakingVote, stakingLock, stakingActivate,
  stakingUnvote, stakingUnlock, stakingWithdraw, stakingDeactivate) to
  NO_RECIPIENT_TX_TYPES in recipientUtils.ts
- Fall back to intent.intentType when txParams.type is absent, and
  propagate the resolved type into effectiveTxParams so downstream
  verifyTssTransaction callers can use it
- Mirror staking types in abstractEthLikeNewCoins.ts verifyTssTransaction
  bypass list
- Remove stale verifyTssTransaction override from bsc.ts (was missing
  consolidate, bridgeFunds, enableToken, customTx vs parent, and all
  staking types); parent now handles BSC correctly

Refs: WAL-756

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

TICKET: WAL-756

Author: mrdanish26

modules/abstract-eth/src/abstractEthLikeNewCoins.ts

@@ -3118,6 +3118,14 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
             'bridgeFunds',
             'enableToken',
             'customTx',
+            // EVM staking (BSC/BNB, ETH, CELO) — mirrors NO_RECIPIENT_TX_TYPES in recipientUtils.ts
+            'stakingLock',
+            'stakingVote',
+            'stakingActivate',
+            'stakingUnvote',
+            'stakingUnlock',
+            'stakingWithdraw',
+            'stakingDeactivate',
           ].includes(txParams.type))
       )
     ) {

modules/sdk-coin-bsc/src/bsc.ts

@@ -1,10 +1,6 @@
 import { BaseCoin, BitGoBase, common, MPCAlgorithm, MultisigType, multisigTypes } from '@bitgo/sdk-core';
 import { BaseCoin as StaticsBaseCoin, coins } from '@bitgo/statics';
-import {
-  AbstractEthLikeNewCoins,
-  recoveryBlockchainExplorerQuery,
-  VerifyEthTransactionOptions,
-} from '@bitgo/abstract-eth';
+import { AbstractEthLikeNewCoins, recoveryBlockchainExplorerQuery } from '@bitgo/abstract-eth';
 import { TransactionBuilder } from './lib';
 
 export class Bsc extends AbstractEthLikeNewCoins {
@@ -54,34 +50,4 @@ export class Bsc extends AbstractEthLikeNewCoins {
     const explorerUrl = common.Environments[this.bitgo.getEnv()].bscscanBaseUrl;
     return await recoveryBlockchainExplorerQuery(query, explorerUrl as string, apiToken);
   }
-
-  /**
-   * Verify if a tss transaction is valid
-   *
-   * @param {VerifyEthTransactionOptions} params
-   * @param {TransactionParams} params.txParams - params object passed to send
-   * @param {TransactionPrebuild} params.txPrebuild - prebuild object returned by server
-   * @param {Wallet} params.wallet - Wallet object to obtain keys to verify against
-   * @returns {boolean}
-   */
-  async verifyTssTransaction(params: VerifyEthTransactionOptions): Promise<boolean> {
-    const { txParams, txPrebuild, wallet } = params;
-    if (
-      !txParams?.recipients &&
-      !(
-        txParams.prebuildTx?.consolidateId ||
-        (txParams.type && ['acceleration', 'fillNonce', 'transferToken', 'tokenApproval'].includes(txParams.type))
-      )
-    ) {
-      throw new Error(`missing txParams`);
-    }
-    if (!wallet || !txPrebuild) {
-      throw new Error(`missing params`);
-    }
-    if (txParams.hop && txParams.recipients && txParams.recipients.length > 1) {
-      throw new Error(`tx cannot be both a batch and hop transaction`);
-    }
-
-    return true;
-  }
 }

modules/sdk-core/src/bitgo/utils/tss/recipientUtils.ts

@@ -6,16 +6,31 @@ import { PopulatedIntent, TxRequest } from './baseTypes';
  * Transaction types that legitimately carry no explicit recipients.
  * verifyTransaction handles no-recipient validation for these internally.
  * Mirrors the bypass list in abstractEthLikeNewCoins.ts verifyTssTransaction.
+ *
+ * ECDSA types: acceleration, fillNonce, transferToken, tokenApproval, consolidate,
+ *              bridgeFunds, enableToken, customTx
+ * EVM staking (BSC/BNB, ETH, CELO): stakingLock, stakingVote, stakingActivate,
+ *              stakingUnvote, stakingUnlock, stakingWithdraw, stakingDeactivate
  */
 export const NO_RECIPIENT_TX_TYPES = new Set([
+  // ECDSA types
   'acceleration',
   'fillNonce',
   'transferToken',
   'tokenApproval',
   'consolidate',
   'bridgeFunds',
   'enableToken',
-  'customTx', // DeFi/WalletConnect smart contract interactions have no traditional recipients
+  'customTx',
+
+  // EVM staking (BSC/BNB, ETH, CELO) — contract calls with no traditional txParams recipients
+  'stakingLock',
+  'stakingVote',
+  'stakingActivate',
+  'stakingUnvote',
+  'stakingUnlock',
+  'stakingWithdraw',
+  'stakingDeactivate',
 ]);
 
 /**
@@ -43,7 +58,16 @@ export function resolveEffectiveTxParams(
     recipients: txParams?.recipients?.length ? txParams.recipients : intentRecipients,
   };
 
-  if (!effectiveTxParams.recipients?.length && !NO_RECIPIENT_TX_TYPES.has(effectiveTxParams.type ?? '')) {
+  // Fall back to intent.intentType when txParams.type is not explicitly set.
+  // Staking wallets call signTransaction without txParams, so the type lives only in the intent.
+  const txType = effectiveTxParams.type ?? (txRequest.intent as PopulatedIntent)?.intentType ?? '';
+
+  // Propagate the resolved type so downstream callers (e.g. verifyTssTransaction) can use it.
+  if (!effectiveTxParams.type && txType) {
+    effectiveTxParams.type = txType;
+  }
+
+  if (!effectiveTxParams.recipients?.length && !NO_RECIPIENT_TX_TYPES.has(txType)) {
     throw new InvalidTransactionError(
       'Recipient details are required to verify this transaction before signing. Pass txParams with at least one recipient.'
     );

modules/sdk-core/test/unit/bitgo/utils/tss/recipientUtils.ts

@@ -5,11 +5,12 @@ import * as assert from 'assert';
 const getModule = () => require('../../../../../src/bitgo/utils/tss/recipientUtils');
 
 function makeTxRequest(
-  intentRecipients?: { address: { address: string }; amount: { value: string }; data?: string }[]
+  intentRecipients?: { address: { address: string }; amount: { value: string }; data?: string }[],
+  intentType = 'payment'
 ): any {
   return {
     txRequestId: 'test-req-id',
-    intent: intentRecipients ? { intentType: 'contractCall', recipients: intentRecipients } : { intentType: 'payment' },
+    intent: intentRecipients ? { intentType: 'contractCall', recipients: intentRecipients } : { intentType },
     transactions: [],
     unsignedTxs: [],
     state: 'pendingUserSignature',
@@ -23,9 +24,10 @@ function makeTxRequest(
 
 describe('recipientUtils', function () {
   describe('NO_RECIPIENT_TX_TYPES', function () {
-    it('contains exactly the 8 expected exempted types', function () {
+    it('contains all expected exempted types', function () {
       const { NO_RECIPIENT_TX_TYPES } = getModule();
       const expected = [
+        // ECDSA
         'acceleration',
         'fillNonce',
         'transferToken',
@@ -34,6 +36,14 @@ describe('recipientUtils', function () {
         'bridgeFunds',
         'enableToken',
         'customTx',
+        // EVM staking
+        'stakingLock',
+        'stakingVote',
+        'stakingActivate',
+        'stakingUnvote',
+        'stakingUnlock',
+        'stakingWithdraw',
+        'stakingDeactivate',
       ];
       expected.forEach((t) => assert.ok(NO_RECIPIENT_TX_TYPES.has(t), `${t} should be in NO_RECIPIENT_TX_TYPES`));
       assert.strictEqual(NO_RECIPIENT_TX_TYPES.size, expected.length);
@@ -105,8 +115,15 @@ describe('recipientUtils', function () {
       'tokenApproval',
       'consolidate',
       'bridgeFunds',
-      'enableToken', // TSS wallets do not populate recipients for token enablement
-      'customTx', // DeFi/WalletConnect smart contract interactions have no traditional recipients
+      'enableToken',
+      'customTx',
+      'stakingLock',
+      'stakingVote',
+      'stakingActivate',
+      'stakingUnvote',
+      'stakingUnlock',
+      'stakingWithdraw',
+      'stakingDeactivate',
     ];
 
     NO_RECIPIENT_TYPES.forEach((type) => {
@@ -117,5 +134,27 @@ describe('recipientUtils', function () {
         result.type.should.equal(type);
       });
     });
+
+    it('allows empty recipients when intent.intentType is a staking type (no txParams passed)', function () {
+      const { resolveEffectiveTxParams } = getModule();
+      const txRequest = makeTxRequest(undefined, 'stakingVote');
+      // Simulate staking wallet: signTransaction called with no txParams
+      const result = resolveEffectiveTxParams(txRequest, undefined);
+      result.type.should.equal('stakingVote');
+    });
+
+    it('propagates intent.intentType into effectiveTxParams.type when txParams.type is absent', function () {
+      const { resolveEffectiveTxParams } = getModule();
+      const txRequest = makeTxRequest(undefined, 'stakingLock');
+      const result = resolveEffectiveTxParams(txRequest, {});
+      result.type.should.equal('stakingLock');
+    });
+
+    it('does not override txParams.type when already set', function () {
+      const { resolveEffectiveTxParams } = getModule();
+      const txRequest = makeTxRequest(undefined, 'stakingVote');
+      const result = resolveEffectiveTxParams(txRequest, { type: 'acceleration' });
+      result.type.should.equal('acceleration');
+    });
   });
 });