From cc72590f657e468b336004db8e18ac63666ac7ac Mon Sep 17 00:00:00 2001
From: faisalnugroho <vantjxrg@gmail.com>
Date: Sat, 30 May 2026 12:48:34 +0800
Subject: [PATCH] fix(spend-permission): use wallet-signed data for returned
 permission

When capabilities are provided, the wallet may substitute message.account
via mutableData (e.g., replacing an EOA with a smart-wallet address).
The returned SpendPermission object was using the original pre-substitution
typedData.message for the permission field, while correctly using the
post-substitution data for permissionHash. This created an internally
inconsistent object where permission.account != the address in the hash.

Track the actual signed message and use it consistently in the returned
SpendPermission object.

Fixes #324
---
 .../spend-permission/methods/requestSpendPermission.ts      | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/account-sdk/src/interface/public-utilities/spend-permission/methods/requestSpendPermission.ts b/packages/account-sdk/src/interface/public-utilities/spend-permission/methods/requestSpendPermission.ts
index 850262b3..a29ccf05 100644
--- a/packages/account-sdk/src/interface/public-utilities/spend-permission/methods/requestSpendPermission.ts
+++ b/packages/account-sdk/src/interface/public-utilities/spend-permission/methods/requestSpendPermission.ts
@@ -78,6 +78,7 @@ const requestSpendPermissionFn = async (
   // Check if we should use wallet_sign (when capabilities are provided) or eth_signTypedData_v4
   let signature: string;
   let permissionHash: string;
+  let signedMessage = typedData.message;
 
   if (capabilities) {
     // Use wallet_sign with capabilities
@@ -122,8 +123,9 @@ const requestSpendPermissionFn = async (
     };
 
     signature = signResult.signature;
+    signedMessage = signResult.signedData.message;
     permissionHash = await getHash({
-      permission: signResult.signedData.message,
+      permission: signedMessage,
       chainId,
     });
   } else {
@@ -142,7 +144,7 @@ const requestSpendPermissionFn = async (
     permissionHash,
     signature,
     chainId,
-    permission: typedData.message,
+    permission: signedMessage,
   };
 
   return permission;