Channel Creation depositAndCreate Transaction Fails with Signature Validation

[bertankofon]

After receiving create_channel response from Clearnode with signed channel state, the depositAndCreate blockchain transaction should succeed when submitted with the provided signatures.

The depositAndCreate transaction fails with MetaMask showing "This transaction is likely to fail" warning. However, the exact same flow works successfully on apps.yellow.com without any warnings.

I'm submitting tx through apps.yellow.com and reject the tx to see the logs below:

Request Arguments:
  from:   0xa79D7454d39bF42e7E1Ed54ea1Ca496152f0A39E
  to:     0x490fb189DdE3a01B00be9BA5F41e3447FbC838b6
  value:  0 ETH
  data:   0x00e2bb2c000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300000000000000000000000000000000000000000000000000000000000027100000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000016000000000000000000000000000000000000000000000000000000000000000800000000000000000000000007de4a0736cf5740fd3ca2f2e9cc85c9ac223ef0c0000000000000000000000000000000000000000000000000000000000000e1000000000000000000000000000000000000000000000000000000199be5bb2860000000000000000000000000000000000000000000000000000000000000002000000000000000000000000fd2459abbc7bc942e6de6b48104d6ad1bb1641a3000000000000000000000000435d4b6b68e1083cc0835d1f971c4739204c1d2a0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000001a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000a79d7454d39bf42e7e1ed54ea1ca496152f0a39e000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda029130000000000000000000000000000000000000000000000000000000000002710000000000000000000000000435d4b6b68e1083cc0835d1f971c4739204c1d2a000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000c00000000000000000000000000000000000000000000000000000000000000041087c324ed7c1cf92bb0509f7fe16f32f392308b6b2569182b7b38f76d620449b305efcb98105a343f6a21b4e1c39e3c037f2b8ceb42b70f1628774d7df76a9fe1b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000417e3fa8d4922d093f7daa32fa5bb59a6ac9390750e4f3a27980b7be68f282db586f7e0883358389ac72b6eeaae965656c7a43cdd5571a72bf92ab1e7e175d35eb1b00000000000000000000000000000000000000000000000000000000000000

Contract Call:
  address:   0x490fb189DdE3a01B00be9BA5F41e3447FbC838b6
  function:  depositAndCreate(address token, uint256 amount, (address[] participants, address adjudicator, uint64 challenge, uint64 nonce), (uint8 intent, uint256 version, bytes data, (address destination, address token, uint256 amount)[], bytes[] sigs))
  args:                      (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, 10000, {"participants":["0xfd2459aBBc7bc942E6De6b48104D6aD1bB1641A3","0x435d4B6b68e1083Cc0835D1F971C4739204C1d2a"],"adjudicator":"0x7de4A0736Cf5740fD3Ca2F2e9cc85c9AC223eF0C","challenge":"3600","nonce":"1759835304582"}, {"intent":1,"version":"0","data":"0x","allocations":[{"destination":"0xa79D7454d39bF42e7E1Ed54ea1Ca496152f0A39E","token":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"10000"},{"destination":"0x435d4B6b68e1083Cc0835D1F971C4739204C1d2a","token":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"0"}],"sigs":["0x087c324ed7c1cf92bb0509f7fe16f32f392308b6b2569182b7b38f76d620449b305efcb98105a343f6a21b4e1c39e3c037f2b8ceb42b70f1628774d7df76a9fe1b","0x7e3fa8d4922d093f7daa32fa5bb59a6ac9390750e4f3a27980b7be68f282db586f7e0883358389ac72b6eeaae965656c7a43cdd5571a72bf92ab1e7e175d35eb1b"]})
  sender:    0xa79D7454d39bF42e7E1Ed54ea1Ca496152f0A39E

Then here's my app's log:

Request Arguments:
  from:  0xa79D7454d39bF42e7E1Ed54ea1Ca496152f0A39E
  to:    0x490fb189DdE3a01B00be9BA5F41e3447FbC838b6
  data:  0x00e2bb2c000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300000000000000000000000000000000000000000000000000000000000027100000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000016000000000000000000000000000000000000000000000000000000000000000800000000000000000000000007de4a0736cf5740fd3ca2f2e9cc85c9ac223ef0c0000000000000000000000000000000000000000000000000000000000000e1000000000000000000000000000000000000000000000000000000199be536faf0000000000000000000000000000000000000000000000000000000000000002000000000000000000000000c4cfada1beb9110a18459077c0dd2f0bcc75c53b000000000000000000000000435d4b6b68e1083cc0835d1f971c4739204c1d2a0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000001a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000a79d7454d39bf42e7e1ed54ea1ca496152f0a39e000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda029130000000000000000000000000000000000000000000000000000000000002710000000000000000000000000435d4b6b68e1083cc0835d1f971c4739204c1d2a000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000000000000000000000000000000000000004177bfff272527e1f580832497511d0f9008efe40ee26071bc801207f217e138547308269321f396d62ffb1030f4055b0e4173634907dfb50ac236739a81dbaab71c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041a34af9e535349e75e6921f092d39de7ed997cf629a1207f5f4358f483eb26bb8761f98be3baa6441d8621d1a1bd62cddada53447ce7b036c9d5d9ed31ca92eb71b00000000000000000000000000000000000000000000000000000000000000

Contract Call:
  address:   0x490fb189DdE3a01B00be9BA5F41e3447FbC838b6
  function:  depositAndCreate(address token, uint256 amount, (address[] participants, address adjudicator, uint64 challenge, uint64 nonce), (uint8 intent, uint256 version, bytes data, (address destination, address token, uint256 amount)[], bytes[] sigs))
  args:                      (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, 10000, {"participants":["0xc4cFAda1Beb9110a18459077c0dD2F0Bcc75c53B","0x435d4B6b68e1083Cc0835D1F971C4739204C1d2a"],"adjudicator":"0x7de4A0736Cf5740fD3Ca2F2e9cc85c9AC223eF0C","challenge":"3600","nonce":"1759834763183"}, {"intent":1,"version":"0","data":"0x","allocations":[{"destination":"0xa79D7454d39bF42e7E1Ed54ea1Ca496152f0A39E","token":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"10000"},{"destination":"0x435d4B6b68e1083Cc0835D1F971C4739204C1d2a","token":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"0"}],"sigs":["0x77bfff272527e1f580832497511d0f9008efe40ee26071bc801207f217e138547308269321f396d62ffb1030f4055b0e4173634907dfb50ac236739a81dbaab71c","0xa34af9e535349e75e6921f092d39de7ed997cf629a1207f5f4358f483eb26bb8761f98be3baa6441d8621d1a1bd62cddada53447ce7b036c9d5d9ed31ca92eb71b"]})
  sender:    0xa79D7454d39bF42e7E1Ed54ea1Ca496152f0A39E

My Implementation

1. Signing create_channel RPC Request

// Using @erc7824/nitrolite SDK
const sessionSigner = createECDSAMessageSigner(sessionKey.privateKey);

const createRequest = {
  chain_id: 8453,
  token: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
  amount: '10000',
  session_key: sessionKey.address,
  participant: account
};

const message = {
  req: [requestId, "create_channel", createRequest, timestamp],
  sig: []
};

// Sign the RPC request
const signature = await sessionSigner(message.req);
message.sig = [signature];

// Store this signature for depositAndCreate
setUserSignature(signature);

2. Using Signatures in depositAndCreate

const stateStruct = {
  intent: state.intent,
  version: BigInt(state.version),
  data: (state.state_data || '0x') as `0x${string}`,
  allocations: state.allocations.map(alloc => ({
    destination: alloc.destination,
    token: alloc.token,
    amount: BigInt(alloc.amount)
  })),
  sigs: [
    userSignature,           // Signature from create_channel RPC request
    response.server_signature // Broker signature from create_channel response
  ]
};

await walletClient.writeContract({
  address: '0x490fb189DdE3a01B00be9BA5F41e3447FbC838b6',
  abi: custodyAbi,
  functionName: 'depositAndCreate',
  args: [
    '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913', // USDC
    10000,
    channelStruct,
    stateStruct
  ],
  account: userAddress
});

Question: Should sigs[0] be the signature of the RPC request or the channel state itself?

[nksazonov]

Hello, @bertankofon !
Thanks for using Yellow SDK!

Question: Should sigs[0] be the signature of the RPC request or the channel state itself?

The state.sigs[0] should be the user signature of the channel state struct (without signatures, obviously).
Please note that it is more convenient to use Yellow SDK NitroliteClient's depositAndCreate method, that basically takes the response from create_channel Clearnode's endpoint as a parameter, performs all the necessary transformations and even submits the transation!

[bertankofon]

Solved! Thanks alot :) @nksazonov