Bind Solana swap execution to the persisted request intent - #512

Review Status

✅ Passed

Review effort: 4/5 (Complex)

Details

This PR correctly closes the intent-binding gap for Solana swap signing. The implementation is well-structured and the security properties are sound. No actionable bugs found.

Overall assessment: This is a solid security hardening PR. The three signing paths (local, Privy, WalletConnect) all have assertCompleteSolanaRequestIntent + assertQuoteMatchesRequest inserted at the right point — before any signing call — with explicit fail-closed guards on the wallet address resolution. The --max-input enforcement for Solana exactOut is correctly placed before any API call and the self-referential cap bug mentioned in the PR description was already fixed. Tests are comprehensive: adversarial scenarios cover tampered token pairs, inflated inputs, wrong wallet binding, and missing intent across all three signer paths, plus a regression test confirming benign quotes still complete successfully. The changeset is present with a correct minor bump, and schema.json is updated to match the new behavior.

Note: Claude suggested: APPROVE. Final status determined by severity thresholds.