From 8faec26154644a33468d715f6bd3ad365068f11e Mon Sep 17 00:00:00 2001
From: Draco <draco@dracoli.com>
Date: Fri, 7 Feb 2025 15:04:02 -0500
Subject: [PATCH 1/2] export wip address & approval safety check

---
 packages/core-sdk/src/index.ts             | 2 +-
 packages/core-sdk/src/utils/wipFeeUtils.ts | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/core-sdk/src/index.ts b/packages/core-sdk/src/index.ts
index 82f40b95..d98b2461 100644
--- a/packages/core-sdk/src/index.ts
+++ b/packages/core-sdk/src/index.ts
@@ -1,5 +1,5 @@
 export { StoryClient } from "./client";
-export { AddressZero, HashZero } from "./constants/common";
+export { AddressZero, HashZero, WIP_TOKEN_ADDRESS } from "./constants/common";
 export { aeneid, mainnet } from "./utils/chain";
 export { IPAssetClient } from "./resources/ipAsset";
 export { PermissionClient } from "./resources/permission";
diff --git a/packages/core-sdk/src/utils/wipFeeUtils.ts b/packages/core-sdk/src/utils/wipFeeUtils.ts
index 8514e905..298e6e36 100644
--- a/packages/core-sdk/src/utils/wipFeeUtils.ts
+++ b/packages/core-sdk/src/utils/wipFeeUtils.ts
@@ -25,9 +25,14 @@ const approvalAllSpenders = async ({
   owner,
   useMultiCall,
   rpcClient,
+  multicallAddress,
 }: WipApprovalCall) => {
   const approvals = await Promise.all(
     spenders.map(async (spender) => {
+      // make sure we never give approval to the multicall contract
+      if (spender.address === multicallAddress) {
+        return;
+      }
       const spenderAmount = spender.amount || maxUint256;
       const { result: allowance } = await client.allowance({
         owner: owner,
@@ -138,6 +143,7 @@ const multiCallWrapIp = async ({
     const approvalCalls = await approvalAllSpenders({
       spenders: wipSpenders,
       client: wipClient,
+      multicallAddress: multicall3Client.address,
       owner: useMultiCall ? multicall3Client.address : wallet.account!.address,
       rpcClient,
       useMultiCall,
@@ -221,6 +227,7 @@ export const contractCallWithWipFees = async ({
         spenders: wipSpenders,
         client: wipClient,
         owner: sender, // sender owns the wip
+        multicallAddress: multicall3Client.address,
         rpcClient,
         // since sender has all wip, if using multicall, we will also need to transfer
         // sender's wip to multicall, which brings more complexity. So in this case,

From aa57fc8ce9922dce7e06b6ae26dea7ce27692740 Mon Sep 17 00:00:00 2001
From: Draco <draco@dracoli.com>
Date: Fri, 7 Feb 2025 15:10:31 -0500
Subject: [PATCH 2/2] fix test

---
 packages/core-sdk/src/types/utils/wip.ts           | 1 +
 packages/core-sdk/test/integration/ipAsset.test.ts | 1 +
 2 files changed, 2 insertions(+)

diff --git a/packages/core-sdk/src/types/utils/wip.ts b/packages/core-sdk/src/types/utils/wip.ts
index 89ea7fa0..66927d2f 100644
--- a/packages/core-sdk/src/types/utils/wip.ts
+++ b/packages/core-sdk/src/types/utils/wip.ts
@@ -59,6 +59,7 @@ export type WipSpender = {
 export type WipApprovalCall = {
   spenders: WipSpender[];
   client: WrappedIpClient;
+  multicallAddress: Address;
   rpcClient: PublicClient;
   /** owner is the address calling the approval */
   owner: Address;
diff --git a/packages/core-sdk/test/integration/ipAsset.test.ts b/packages/core-sdk/test/integration/ipAsset.test.ts
index 5a5d28eb..bb288cca 100644
--- a/packages/core-sdk/test/integration/ipAsset.test.ts
+++ b/packages/core-sdk/test/integration/ipAsset.test.ts
@@ -17,6 +17,7 @@ import {
   derivativeWorkflowsAddress,
   royaltyTokenDistributionWorkflowsAddress,
   wrappedIpAddress,
+  mockErc20Address,
 } from "../../src/abi/generated";
 import { MAX_ROYALTY_TOKEN, WIP_TOKEN_ADDRESS } from "../../src/constants/common";