feat(frontend): send imported EVM balances to the user's own wallet

[sbpublic]

Motivation

PR2 moves the ICP and ICRC balances of an imported wallet. This does the same for Ethereum and the other EVM networks — the first chain where OISY cannot sign for itself.

Those addresses are threshold keys rooted in the source wallet's own helper canister. On the management canister, ecdsa_public_key takes a canister_id argument but sign_with_ecdsa does not — it derives from the caller. So the addresses are readable by anyone (which is how PR1 derives them offline) and signable only by that canister. We ask it for a signature and broadcast the result ourselves.

Stacked on #13649; review that first. This PR targets its branch.

Note

Draft, and this is the first PR in the stack to request a real signature from that canister. eth_address confirmed it accepts outside callers, but no signing method has been exercised. Worth one small real send before this merges — that single test retires the main risk for the BTC and SOL PRs too.

Changes

• Add the EVM send path: fee data, nonce, signature from the helper canister, broadcast through OISY's provider.
• Route EVM rows on the import page to it, with a reason shown when a row cannot move.
• Update PRODUCT.md and the spec; the PR3-approach decision is now marked resolved.
• After a real-wallet test: handle ERC-4626 vault tokens. They were reported showing the account's ETH balance in every vault row (the balance dispatch had no erc4626 branch, so vaults fell through to native, formatted with each vault's own decimals). ERC-4626 is a superset of ERC-20, so the fix treats them alike via one isPlugEvmContractToken predicate — read via balanceOf, send via send_erc20, gate on native gas. getErc20FeeData is widened to accept either shape (it only reads address/symbol/name).

Gas shapes the whole thing. It is paid in the network's native coin out of the imported account:

• A native send can only move balance - gas. Sending the full balance always fails.
• A token send needs native coin sitting in that same account — a common gap for someone who only ever received tokens. The row is blocked with the coin named, not just greyed out.
• Both are enforced in the send path against live fee data, not trusted from the UI, because the fee moves between the moment a row renders and the moment the user confirms.
• An absent fee ceiling stops the send rather than defaulting: signing a transaction whose gas price is unknown risks spending the whole balance on gas.

Reuse over rebuild: fee data comes from getEthFeeDataWithProvider, which already applies the per-chain floors (BSC minimums) — reading getFeeData raw would have silently dropped those. The nonce comes from OISY's own provider rather than the canister's transaction_count, keeping a third party off the path for everything but the signature.

Two bugs the EVM case exposed in the rows PR2 shipped, fixed here:

• A row's identity is network plus symbol. Symbol alone is not unique and neither is the address — the same token enabled on several EVM networks yields rows sharing both. Keying the in-flight send on symbol would have spun two rows at once. There is a regression test for it.
• The confirmation copy was wrong for tokens. It said the fee is deducted "from this token", true for ICRC and native EVM but not for an ERC20, where gas is paid in the native coin. Token transfers now name that coin.

Also: the EVM destination is the user's own OISY EVM address, not their principal — unlike the IC sweep, where the principal is the destination.

Tests

• plug-evm.services.spec.ts (7 cases): gas is reserved out of a native amount; the signed transaction is broadcast and its hash returned; a balance that cannot cover its own gas is refused without signing; an absent fee ceiling refuses without signing; a token sends its full balance; a token with no native coin is refused without signing; and a token never takes the native signing method.
• PlugImportAccount.spec.ts (14 cases, up from 6): native EVM and funded-ERC20 rows offer an action; an ERC20 with no gas is blocked and names the coin; plus the cross-network symbol-collision regression.

The "without signing" assertions are the ones worth having — a refusal that still asked the canister to sign would burn its cycles and could leave a signed transaction in flight.

Local gates, all green:

Gate	Result
npm run format	clean
npm run lint -- --max-warnings 0 (whole repo)	clean
npm run check	5892 files, 0 errors
npm run check:tests	7121 files, 0 errors
targeted vitest	82 passed (whole feature)

Not run locally: the full suite (MenuThemeSelector fails 8 cases on unmodified main — Node's localStorage clobbers jsdom) and test-coverage. compare-sizes will fail as it does across this stack; the increase is known and accepted.

---

🤖 Generated with Claude Code