Token Approval and Spending Limits System

[Tybravo]

Closes #99

Description

This PR introduces granular token spending limits to the Veil wallet contract, bringing ERC-20 style approve/allowance functionality to the Soroban authorization flow. Previously, any passkey-authorized transaction could transfer any amount of tokens. This update allows users to approve specific spenders (e.g., a DEX) for a specific token up to a maximum amount, with an optional expiration, removing the need for a passkey signature on every individual transaction.

Key Changes

🧱 Smart Contract (contracts/invisible_wallet)

• Storage: Extended StorageKey with an Allowance { spender, token } variant to securely store allowance state.
• New Methods:
  • approve(spender, token, amount, expiry): Allows the wallet owner to set an allowance. Requires strict passkey authentication.
  • get_allowance(spender, token): Read-only method to query current allowances.
• Authorization Guard (__check_auth): Updated to intercept and authorize spender-initiated transfers. Validates that the allowance exists, is not expired, and has sufficient balance. Safely and atomically deducts the spent amount upon authorization.

🧩 TypeScript SDK (sdk/src/useInvisibleWallet.ts)

• approve() API: Exposed a clean developer API that handles WebAuthn payload generation, passkey signing, and transaction building for setting allowances.
• getAllowance() API: Exposed a read-only method to fetch active limits via simulated RPC calls.

🔐 Security & Validation

• Passkey Enforcement: approve() operations are secured behind the contract's passkey require_auth() flow.
• Deterministic State: Deduction of the allowance is atomic, preventing double-spends and negative balances.
• Test Coverage: Added a complete Soroban test suite verifying:
  • ✅ Standard approve and spend within limit.
  • ❌ Rejection of transactions exceeding the limit.
  • ❌ Rejection of expired allowances.
  • ✅ Exact boundary spending.
  • ✅ Allowance overwrites and updates.

[vercel]

@Tybravo is attempting to deploy a commit to the miracle656's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Tybravo Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits