fix(evm-wallet): address code review findings for plugin and scripts

- Validate decimal places in encodeEthToTerms instead of silent truncation
- Add try-catch for getTokenMetadata in swap token resolution
- Recognize native tokens (BNB, MATIC/POL) across supported chains
- Reject zero-value hex amounts in wallet_send

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sirtimid

packages/evm-wallet-experiment/openclaw-plugin/tools/eth.ts

@@ -125,6 +125,9 @@ export function registerEthTools(
         // Convert decimal ETH string to hex wei.
         let hexValue: string;
         if (HEX_VALUE_RE.test(params.value)) {
+          if (BigInt(params.value) <= 0n) {
+            return makeError('Amount must be greater than zero.');
+          }
           hexValue = params.value;
         } else {
           try {

packages/evm-wallet-experiment/openclaw-plugin/tools/swap.ts

@@ -2,6 +2,7 @@ import type { WalletCaller } from '../daemon.ts';
 import type { OpenClawPluginApi } from '../types.ts';
 import {
   NATIVE_ETH,
+  NATIVE_TOKEN_SYMBOLS,
   errorMessage,
   formatTxResult,
   makeError,
@@ -25,8 +26,8 @@ async function resolveSwapToken(
 ): Promise<
   { address: string; decimals: number; symbol: string } | { error: string }
 > {
-  if (token.toUpperCase() === 'ETH' || token === NATIVE_ETH) {
-    return { address: NATIVE_ETH, decimals: 18, symbol: 'ETH' };
+  if (NATIVE_TOKEN_SYMBOLS.has(token.toUpperCase()) || token === NATIVE_ETH) {
+    return { address: NATIVE_ETH, decimals: 18, symbol: token.toUpperCase() };
   }
 
   let resolved: { address: string; symbol?: string };
@@ -36,9 +37,16 @@ async function resolveSwapToken(
     return { error: errorMessage(error) };
   }
 
-  const metadata = (await wallet('getTokenMetadata', [
-    { token: resolved.address },
-  ])) as Record<string, unknown>;
+  let metadata: Record<string, unknown>;
+  try {
+    metadata = (await wallet('getTokenMetadata', [
+      { token: resolved.address },
+    ])) as Record<string, unknown>;
+  } catch (error: unknown) {
+    return {
+      error: `Could not fetch metadata for ${token}: ${errorMessage(error)}`,
+    };
+  }
 
   if (typeof metadata?.decimals !== 'number') {
     return { error: `Could not determine decimals for ${token}.` };

packages/evm-wallet-experiment/openclaw-plugin/utils.ts

@@ -6,6 +6,11 @@ export const ETH_ADDRESS_RE = /^0x[\da-f]{40}$/iu;
 export const HEX_VALUE_RE = /^0x[\da-f]+$/iu;
 export const NATIVE_ETH = '0x0000000000000000000000000000000000000000';
 
+/**
+ * Native token symbols that map to the zero address across supported chains.
+ */
+export const NATIVE_TOKEN_SYMBOLS = new Set(['ETH', 'BNB', 'MATIC', 'POL']);
+
 const BLOCK_EXPLORER_URLS: Record<number, string> = {
   1: 'https://etherscan.io',
   10: 'https://optimistic.etherscan.io',

packages/evm-wallet-experiment/scripts/home-interactive.mjs

@@ -249,7 +249,10 @@ function prompt(question) {
  */
 function encodeEthToTerms(ethAmount) {
   const [whole, frac = ''] = ethAmount.split('.');
-  const fracPadded = frac.padEnd(18, '0').slice(0, 18);
+  if (frac.length > 18) {
+    fail(`Amount "${ethAmount}" has too many decimal places (max 18 for ETH).`);
+  }
+  const fracPadded = frac.padEnd(18, '0');
   const wei = BigInt(whole || '0') * 10n ** 18n + BigInt(fracPadded);
   return `0x${wei.toString(16).padStart(64, '0')}`;
 }