SVM Server-Controlled Sponsorship

import { DynamicSvmWalletClient } from '@dynamic-labs-wallet/node-svm';
import { VersionedTransaction } from '@solana/web3.js';

const client = new DynamicSvmWalletClient({
  environmentId: process.env.DYNAMIC_ENVIRONMENT_ID,
});
await client.authenticateApiToken(process.env.DYNAMIC_API_TOKEN);

// Mainnet token addresses: USDC, and LI.FI's address for native SOL.
const USDC_MINT = 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v';
const SOL_NATIVE = '11111111111111111111111111111111';

const buildSwapTransaction = async ({ sponsorAddress, walletAddress }) => {
  const params = new URLSearchParams({
    fromChain: 'SOL',
    toChain: 'SOL',
    fromToken: SOL_NATIVE,
    toToken: USDC_MINT,
    fromAmount: '50000000', // 0.05 SOL, which has 9 decimals
    fromAddress: walletAddress,
    allowExchanges: 'jupiter',
    svmSponsor: sponsorAddress, // names the sponsor as fee payer in the quote
  });

  const response = await fetch(`https://li.quest/v1/quote?${params}`, {
    headers: process.env.LIFI_API_KEY
      ? { 'x-lifi-api-key': process.env.LIFI_API_KEY }
      : {},
  });
  if (!response.ok) throw new Error(`LI.FI quote failed: ${response.status}`);

  const quote = await response.json();
  return VersionedTransaction.deserialize(
    Buffer.from(quote.transactionRequest.data, 'base64'),
  );
};

// Application-supplied: the programs your policy allows, for example the
// programs of the swap routes you accept.
const ALLOWED_PROGRAM_IDS = new Set(process.env.ALLOWED_PROGRAM_IDS.split(','));

const isUserEligible = async (userId) => {
  // Add your own checks for the authenticated user here
  // (KYC status, per-user rate limit or budget, region, fraud flags, ...).
  return true;
};

// Reject if ANY instruction falls outside policy.
const isTransactionSponsorable = ({ transaction, sponsorAddress, walletAddress }) => {
  const { message } = transaction;
  const [feePayer] = message.staticAccountKeys;

  // The sponsor must be the fee payer, and the user's wallet must sign.
  if (feePayer.toBase58() !== sponsorAddress) return false;
  const signers = message.staticAccountKeys
    .slice(0, message.header.numRequiredSignatures)
    .map((key) => key.toBase58());
  if (!signers.includes(walletAddress)) return false;

  // Program ids are always static account keys, so no lookup table
  // resolution is needed for this check.
  return message.compiledInstructions.every((instruction) =>
    ALLOWED_PROGRAM_IDS.has(
      message.staticAccountKeys[instruction.programIdIndex].toBase58(),
    ),
  );
};

app.post('/api/sponsored-swap', async (req, res) => {
  // Application-supplied: verify the caller and look up their Dynamic user id
  // and Solana wallet address. Never trust identifiers sent in the request body.
  const { userId, walletAddress } = await getAuthenticatedUser(req);

  if (!(await isUserEligible(userId))) {
    return res.status(403).json({ error: 'Not eligible for sponsorship' });
  }

  const sponsorAddress = await client.getSponsorAddress();
  const transaction = await buildSwapTransaction({ sponsorAddress, walletAddress });

  if (!isTransactionSponsorable({ transaction, sponsorAddress, walletAddress })) {
    return res.status(403).json({ error: 'Not eligible for sponsorship' });
  }

  const sponsored = await client.sponsorTransaction({ transaction, userId });

  return res.json({
    transaction: Buffer.from(sponsored.serialize()).toString('base64'),
  });
});

import { getActiveNetworkData } from '@dynamic-labs-sdk/client';
import { getSolanaConnection, signTransaction } from '@dynamic-labs-sdk/solana';
import { VersionedTransaction } from '@solana/web3.js';

// `walletAccount` is the user's Solana embedded wallet
const sendSponsoredSwap = async (walletAccount) => {
  // Send your own authentication with this request.
  const response = await fetch('/api/sponsored-swap', { method: 'POST' });
  const { transaction } = await response.json();

  const sponsored = VersionedTransaction.deserialize(
    Uint8Array.from(atob(transaction), (char) => char.charCodeAt(0)),
  );

  // The sponsor has already signed, so this adds only the user's signature.
  const { signedTransaction } = await signTransaction({
    transaction: sponsored,
    walletAccount,
  });

  const { networkData } = await getActiveNetworkData({ walletAccount });
  const connection = getSolanaConnection({ networkData });

  return connection.sendRawTransaction(signedTransaction.serialize());
};