Implement onchain attribution for embed partners using ERC-8021 format - #661
Merged
Dprof-in-tech merged 6 commits intoAug 24, 2026
Conversation
- Introduced deterministic embed code generation based on partner origin, enabling transaction volume tracking without middleware reliance. - Extended core attribution logic with new functions for computing and appending embed codes. - Updated transaction paths to incorporate embed codes in various transaction scenarios. - Added comprehensive tests for embed code generation and attribution suffix handling. - Enhanced documentation to explain the new onchain attribution mechanism and its implications for partners.
Dprof-in-tech
requested review from
5ran6,
chibie,
onahprosper and
sundayonah
as code owners
August 5, 2026 06:23
Contributor
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour. 📝 WalkthroughWalkthroughThe PR adds deterministic origin-based embed codes, validates and encodes them as ERC-8021 attribution suffixes, and propagates them through wallet, bridge, smart-wallet, and sponsored transaction flows. It also updates quote handling, refund-account validation, tests, and widget documentation. ChangesEmbed attribution
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to This PR adds deterministic onchain attribution for embed partners across transaction flows, with corresponding tests and documentation; no actionable merge-blocking risk remains. Sequence Diagram(s)sequenceDiagram
participant EmbedContext
participant TransactionPreview
participant useBridgeExecute
participant executeSponsored
participant appendAttributionSuffix
EmbedContext->>TransactionPreview: provide embedCode
EmbedContext->>useBridgeExecute: provide embedCode
TransactionPreview->>appendAttributionSuffix: append attribution to calldata
useBridgeExecute->>appendAttributionSuffix: append attribution to bridge calls
TransactionPreview->>executeSponsored: send embedCode
executeSponsored->>appendAttributionSuffix: append attribution to sponsored calldata
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
- Simplified the hash generation process by removing the fallback for older Node versions, ensuring consistent use of the Web Crypto API for SHA-256 hashing. - Updated the computeEmbedCode function to directly utilize crypto.subtle.digest, enhancing code clarity and maintainability.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (1)
docs/embed-widget.md (1)
319-321: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a language tag to the fenced example.
markdownlint-cli2reports MD040 for Line 319. Mark this pseudo-code block astext.Proposed fix
-``` +```text embedCode = "e_" + first 8 hex chars of sha256(normalizedOrigin) -``` +```🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/embed-widget.md` around lines 319 - 321, Add the text language tag to the fenced pseudo-code block containing the embedCode example in the documentation, changing its opening fence to ```text while preserving the example content and closing fence.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app/context/EmbedContext.tsx`:
- Around line 284-290: Update the EmbedProvider effect around parentOrigin and
computeEmbedCode so that when isEmbed becomes false, both parentOrigin and
embedCode are cleared or exposed as null. Include isEmbed in the relevant
dependency handling, and ensure later transactions cannot reuse attribution from
the previous embed partner.
In `@app/hooks/bridge.ts`:
- Around line 331-336: Update the sponsored bridge execution flows in
evmBatchExecute and LI.FI executeBatchCalls to accept and forward
embedCodeRef.current through their helper APIs, then include it in the
sponsored-execution payload consumed by executeSponsored so attribution suffixes
are appended.
In `@app/lib/baseBuilderCode.ts`:
- Around line 13-15: Update the marker-count comment in baseBuilderCode.ts to
state that 0x8021 repeats eight times, matching the suffix literal and
ERC8021_MARKER definition. Do not change the implementation.
- Around line 95-116: Validate body.embedCode at the sponsored-route boundary
before passing it to executeSponsored: require the e_ prefix followed by exactly
eight hexadecimal characters, then verify it against the allowlisted origin
using the existing validation mechanism. Reject invalid or unauthorized codes
and only forward validated values into appendAttributionSuffix.
In `@docs/embed-widget.md`:
- Around line 310-312: Update the attribution statement in the widget
documentation to limit the guarantee to supported EVM contract transactions with
calldata, rather than every transaction. Replace “onchain” with “on-chain” and
preserve the explanation that the attribution code identifies embedding partners
for Paycrest volume and activity tracking.
- Around line 342-344: Update the Privacy statement in the embed widget
documentation to accurately describe the unsalted 32-bit SHA-256 prefix: state
that it does not directly encode the origin but can be matched when a candidate
origin is known or guessed, while retaining the existing reproducibility
qualification.
In `@EMBED_ATTRIBUTION_IMPLEMENTATION.md`:
- Around line 91-112: Update the “Onchain Calldata Format” and “Aggregator
Parser Requirements” sections to document the rebuilt suffix schema: ASCII-hex
encoded codes, followed by a length byte, 00 schema byte, and 8021 marker
repeated eight times. Specify that Base uses codes “bc_julg9gbq,<embedCode>”
while other chains use only “<embedCode>”, and revise parser guidance to decode
and validate this complete layout instead of stripping or appending to
BASE_BUILDER_CODE_SUFFIX.
---
Nitpick comments:
In `@docs/embed-widget.md`:
- Around line 319-321: Add the text language tag to the fenced pseudo-code block
containing the embedCode example in the documentation, changing its opening
fence to ```text while preserving the example content and closing fence.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c453a035-66f2-49c1-93ae-e0b431cd5734
📒 Files selected for processing (11)
EMBED_ATTRIBUTION_IMPLEMENTATION.md__tests__/attributionSuffix.test.ts__tests__/embedCode.test.tsapp/api/bundler/execute-sponsored/route.tsapp/context/EmbedContext.tsxapp/hooks/bridge.tsapp/lib/baseBuilderCode.tsapp/lib/bundler/executeSponsored.tsapp/lib/embedCode.tsapp/pages/TransactionPreview.tsxdocs/embed-widget.md
- Introduced `isValidEmbedCode` function to validate the shape of embed codes, ensuring only correctly formatted codes are accepted in transaction requests. - Updated the bundler's sponsored execution route to reject invalid embed codes and provide clear error messages. - Revised documentation to clarify the on-chain attribution process and the structure of embed codes. - Improved the embed code generation logic to ensure consistency across different transaction scenarios.
…via-erc-8021-parent-origin-code
sundayonah
previously approved these changes
Aug 17, 2026
…e aggregator reference The bc_julg9gbq builder code was reverted out of the aggregator, so the 'must match aggregator/services/builder_code.go' note no longer points at anything. Replaced with what the code actually is. - merge app/lib/embedCode.ts into app/lib/baseBuilderCode.ts - embedCodeToHex now delegates to the existing stringToHex helper - consolidate the three attribution test files into baseBuilderCode.test.ts - remove EMBED_ATTRIBUTION_IMPLEMENTATION.md, superseded by docs/embed-widget.md; its warning about rebuilding multi-code suffixes moved into a code comment
…via-erc-8021-parent-origin-code
Dprof-in-tech
deleted the
KAN-723-feat-onchain-embed-host-attribution-via-erc-8021-parent-origin-code
branch
August 24, 2026 04:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
References
Testing
Checklist
mainBy submitting a PR, I agree to Paycrest's Contributor Code of Conduct and Contribution Guide.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation