Coinbase and EVM Payment Integration

const coinbase = require('coinbase-commerce-node');
const Client = coinbase.Client;
const Charge = coinbase.resources.Charge;
const Checkout = coinbase.resources.Checkout;

Client.init(process.env.COINBASE_COMMERCE_API_KEY);

const COMMERCE_BASE = 'https://api.commerce.coinbase.com';

async function commerceRequest(method, path, body = null) {
  const res = await fetch(`${COMMERCE_BASE}${path}`, {
    method,
    headers: {
      'Content-Type': 'application/json',
      'X-CC-Api-Key': process.env.COINBASE_COMMERCE_API_KEY,
      'X-CC-Version': '2018-03-22',
    },
    body: body ? JSON.stringify(body) : undefined,
  });
  if (!res.ok) throw new Error(`Commerce API ${res.status}: ${await res.text()}`);
  return res.json();
}

const charge = await Charge.create({
  name: 'Premium Hoodie',
  description: 'Worldwide shipping included',
  local_price: {
    amount: '75.00',
    currency: 'USD',
  },
  pricing_type: 'fixed_price',  // or 'no_price' for donations
  metadata: {
    order_id: 'order_abc123',
    customer_email: '[email protected]',
  },
  redirect_url: 'https://store.example.com/thank-you',
  cancel_url: 'https://store.example.com/cart',
});

// charge.hosted_url → https://commerce.coinbase.com/charges/XXXXXXXX
// charge.addresses  → { bitcoin: '3J98...', ethereum: '0xabc...', ... }
// charge.pricing    → { bitcoin: { amount: '0.00352', currency: 'BTC' }, ... }

const express = require('express');
const crypto = require('crypto');
const { Webhook } = require('coinbase-commerce-node');

const app = express();

// CRITICAL: Use express.raw() for the webhook route, NOT express.json()
// The signature is computed against the exact bytes Coinbase sent.
app.post(
  '/api/webhooks/coinbase',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-cc-webhook-signature'];

    if (!signature) {
      return res.status(400).json({ error: 'Missing signature header' });
    }

    try {
      // Using the SDK's built-in verification
      const event = Webhook.verifyEventBody(
        req.body,   // This is a Buffer because of express.raw()
        signature,
        process.env.COINBASE_WEBHOOK_SECRET
      );

      // Idempotency: deduplicate by event.id
      // If you've already processed this event, return 200 and move on.
      // Coinbase retries with exponential backoff for up to 3 days.
      const eventId = event.id;

      console.log(`[webhook] ${event.type} | event=${eventId}`);

      switch (event.type) {
        case 'charge:confirmed':
          handlePaymentConfirmed(event.data);
          break;

        case 'charge:pending':
          handlePaymentPending(event.data);
          break;

        case 'charge:failed':
          handlePaymentFailed(event.data);
          break;

        case 'charge:delayed':
          handlePaymentDelayed(event.data);
          break;

        default:
          console.log(`[webhook] Unhandled type: ${event.type}`);
      }

      // Always respond 200 immediately. Process async.
      // If you respond with anything else, Coinbase retries.
      res.status(200).send('OK');
    } catch (error) {
      console.error('[webhook] Signature verification failed:', error.message);
      res.status(400).json({ error: 'Invalid signature' });
    }
  }
);

function verifyWebhookSignature(rawBody, signature, secret) {
  const computed = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  // Use timingSafeEqual to prevent timing attacks.
  // Yes, this matters. No, it's not paranoia.
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'utf8'),
    Buffer.from(computed, 'utf8')
  );
}

# Terminal 1: Your Express server
node server.js  # Listening on port 3000

# Terminal 2: ngrok tunnel
ngrok http 3000
# Gives you https://abc123.ngrok.io
# Set this as your webhook URL in Commerce dashboard:
# https://abc123.ngrok.io/api/webhooks/coinbase

import CoinbaseWalletSDK from '@coinbase/wallet-sdk';
import { ethers } from 'ethers';

const coinbaseWallet = new CoinbaseWalletSDK({
  appName: 'My Payment App',
  appLogoUrl: 'https://myapp.com/logo.png',
  darkMode: false,
});

// The first argument is a fallback JSON-RPC URL.
// Coinbase Wallet mobile uses its own RPC for supported networks,
// but falls back to this for unsupported ones or when needed.
const coinbaseProvider = coinbaseWallet.makeWeb3Provider(
  `https://mainnet.infura.io/v3/${process.env.INFURA_KEY}`,
  1 // chainId - 1 for Ethereum mainnet
);

// Wrap in ethers.js v5 Web3Provider for the API we all know
const provider = new ethers.providers.Web3Provider(coinbaseProvider);

function getProvider(walletType) {
  if (!window.ethereum) {
    throw new Error('No wallet detected');
  }

  // Multiple wallet extensions installed
  if (window.ethereum.providers?.length) {
    const found = window.ethereum.providers.find((p) => {
      if (walletType === 'metamask') return p.isMetaMask;
      if (walletType === 'coinbase') return p.isCoinbaseWallet;
      return false;
    });
    if (!found) throw new Error(`${walletType} not found in providers`);
    return new ethers.providers.Web3Provider(found);
  }

  // Single wallet extension
  return new ethers.providers.Web3Provider(window.ethereum);
}

import { useState, useCallback, useEffect } from 'react';
import { ethers } from 'ethers';

function useWallet() {
  const [account, setAccount] = useState(null);
  const [provider, setProvider] = useState(null);
  const [signer, setSigner] = useState(null);
  const [chainId, setChainId] = useState(null);
  const [error, setError] = useState(null);

  const connect = useCallback(async () => {
    try {
      if (!window.ethereum) {
        throw new Error('No Ethereum provider detected. Install MetaMask or Coinbase Wallet.');
      }

      const web3Provider = new ethers.providers.Web3Provider(window.ethereum);

      // This triggers the wallet popup
      await web3Provider.send('eth_requestAccounts', []);

      const web3Signer = web3Provider.getSigner();
      const address = await web3Signer.getAddress();
      const network = await web3Provider.getNetwork();

      setProvider(web3Provider);
      setSigner(web3Signer);
      setAccount(address);
      setChainId(network.chainId);
      setError(null);
    } catch (err) {
      setError(err.message);
    }
  }, []);

  // Listen for account and chain changes
  useEffect(() => {
    if (!window.ethereum) return;

    const handleAccountsChanged = (accounts) => {
      if (accounts.length === 0) {
        setAccount(null);
        setSigner(null);
      } else {
        // Re-derive signer from new account
        connect();
      }
    };

    const handleChainChanged = (_chainId) => {
      // ethers.js recommends full page reload on chain change
      window.location.reload();
    };

    window.ethereum.on('accountsChanged', handleAccountsChanged);
    window.ethereum.on('chainChanged', handleChainChanged);

    return () => {
      window.ethereum.removeListener('accountsChanged', handleAccountsChanged);
      window.ethereum.removeListener('chainChanged', handleChainChanged);
    };
  }, [connect]);

  return { account, provider, signer, chainId, error, connect };
}

// Usage in a component
function PaymentPage() {
  const { account, signer, chainId, error, connect } = useWallet();

  return (
    <div>
      {!account ? (
        <button onClick={connect}>Connect Wallet</button>
      ) : (
        <div>
          <p>Connected: {account}</p>
          <p>Chain: {chainId}</p>
          {/* Payment UI goes here */}
        </div>
      )}
      {error && <p className="error">{error}</p>}
    </div>
  );
}

async function sendEthPayment(signer, recipientAddress, amountInEth) {
  const tx = await signer.sendTransaction({
    to: recipientAddress,
    value: ethers.utils.parseEther(amountInEth),
    // EIP-1559 gas params are auto-populated by ethers.js
    // but we'll discuss manual estimation later
  });

  console.log(`Transaction hash: ${tx.hash}`);

  // Wait for 1 confirmation
  const receipt = await tx.wait(1);
  console.log(`Confirmed in block ${receipt.blockNumber}`);
  console.log(`Gas used: ${receipt.gasUsed.toString()}`);

  return receipt;
}

const ERC20_ABI = [
  'function transfer(address to, uint256 amount) returns (bool)',
  'function transferFrom(address from, address to, uint256 amount) returns (bool)',
  'function approve(address spender, uint256 amount) returns (bool)',
  'function allowance(address owner, address spender) view returns (uint256)',
  'function balanceOf(address owner) view returns (uint256)',
  'function decimals() view returns (uint8)',
  'function symbol() view returns (string)',
  'event Transfer(address indexed from, address indexed to, uint256 amount)',
  'event Approval(address indexed owner, address indexed spender, uint256 amount)',
];

const USDC_ADDRESS = '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48';

async function sendUsdcPayment(signer, recipient, amountInUsdc) {
  const usdc = new ethers.Contract(USDC_ADDRESS, ERC20_ABI, signer);

  // USDC has 6 decimals, NOT 18. This mistake will cost someone money.
  const amount = ethers.utils.parseUnits(amountInUsdc, 6);

  // Check balance first - better UX than a reverted transaction
  const balance = await usdc.balanceOf(await signer.getAddress());
  if (balance.lt(amount)) {
    throw new Error(
      `Insufficient USDC. Have: ${ethers.utils.formatUnits(balance, 6)}, Need: ${amountInUsdc}`
    );
  }

  const tx = await usdc.transfer(recipient, amount);
  console.log(`USDC transfer tx: ${tx.hash}`);

  const receipt = await tx.wait(1);
  return receipt;
}

// Step 1: User approves your contract to spend their USDC
const approveTx = await usdc.approve(YOUR_CONTRACT_ADDRESS, amount);
await approveTx.wait(1);

// Step 2: Your contract calls transferFrom (triggered by a contract method)
const contract = new ethers.Contract(YOUR_CONTRACT_ADDRESS, YOUR_ABI, signer);
const payTx = await contract.payWithToken(USDC_ADDRESS, amount);
await payTx.wait(1);

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;

import "@openzeppelin/contracts/finance/PaymentSplitter.sol";

// Inherits everything. Payees call release() to withdraw their share.
// Supports both ETH and ERC-20 via release(IERC20, account).
// Shares are immutable after deployment - set them right.
contract TeamRevenue is PaymentSplitter {
    constructor(
        address[] memory payees,
        uint256[] memory shares_
    ) PaymentSplitter(payees, shares_) {}
}

// Deploy with:
// payees:  [founderAddr, devAddr, treasuryAddr]
// shares:  [50, 30, 20]
// → founder gets 50%, dev gets 30%, treasury gets 20%

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/utils/Address.sol";

contract PaymentReceiver is Ownable, ReentrancyGuard {
    using SafeERC20 for IERC20;
    using Address for address payable;

    // Events are your backend's best friend.
    // Monitor these via ethers.js WebSocket filters.
    event EthPaymentReceived(
        address indexed from,
        uint256 amount,
        bytes32 indexed orderId
    );

    event TokenPaymentReceived(
        address indexed token,
        address indexed from,
        uint256 amount,
        bytes32 indexed orderId
    );

    event FundsWithdrawn(
        address indexed to,
        uint256 amount
    );

    // Accept ETH with an order reference
    function payWithEth(bytes32 orderId) external payable {
        require(msg.value > 0, "Zero payment");
        emit EthPaymentReceived(msg.sender, msg.value, orderId);
    }

    // Accept ERC-20 with an order reference
    // User must approve() this contract first
    function payWithToken(
        IERC20 token,
        uint256 amount,
        bytes32 orderId
    ) external {
        require(amount > 0, "Zero payment");
        token.safeTransferFrom(msg.sender, address(this), amount);
        emit TokenPaymentReceived(address(token), msg.sender, amount, orderId);
    }

    // Owner withdrawal - ETH
    function withdraw(address payable to, uint256 amount)
        external
        onlyOwner
        nonReentrant
    {
        require(address(this).balance >= amount, "Insufficient ETH");
        to.sendValue(amount); // OZ Address.sendValue, not .transfer()
        emit FundsWithdrawn(to, amount);
    }

    // Owner withdrawal - ERC-20
    function withdrawToken(IERC20 token, address to, uint256 amount)
        external
        onlyOwner
    {
        token.safeTransfer(to, amount);
    }

    // Allow plain ETH transfers (no order reference)
    receive() external payable {
        emit EthPaymentReceived(msg.sender, msg.value, bytes32(0));
    }
}

mkdir payment-contracts && cd payment-contracts
npm init -y
npm install --save-dev hardhat @nomiclabs/hardhat-ethers \
  @nomiclabs/hardhat-waffle @nomiclabs/hardhat-etherscan \
  ethereum-waffle chai ethers
npm install @openzeppelin/contracts
npx hardhat init
# Select "Create a JavaScript project"

require('@nomiclabs/hardhat-ethers');
require('@nomiclabs/hardhat-waffle');
require('@nomiclabs/hardhat-etherscan');
require('dotenv').config();

module.exports = {
  solidity: {
    version: '0.8.17',
    settings: {
      optimizer: {
        enabled: true,
        runs: 200,
      },
    },
  },
  networks: {
    goerli: {
      url: `https://eth-goerli.g.alchemy.com/v2/${process.env.ALCHEMY_GOERLI_KEY}`,
      accounts: [process.env.DEPLOYER_PRIVATE_KEY],
    },
    mainnet: {
      url: `https://eth-mainnet.g.alchemy.com/v2/${process.env.ALCHEMY_MAINNET_KEY}`,
      accounts: [process.env.DEPLOYER_PRIVATE_KEY],
    },
  },
  etherscan: {
    apiKey: process.env.ETHERSCAN_API_KEY,
  },
};

const hre = require('hardhat');

async function main() {
  const [deployer] = await hre.ethers.getSigners();
  console.log('Deploying with:', deployer.address);
  console.log('Balance:', hre.ethers.utils.formatEther(
    await deployer.getBalance()
  ));

  const PaymentReceiver = await hre.ethers.getContractFactory('PaymentReceiver');
  const receiver = await PaymentReceiver.deploy();
  await receiver.deployed();

  console.log('PaymentReceiver deployed to:', receiver.address);

  // Wait for 5 confirmations before verifying
  console.log('Waiting for confirmations...');
  await receiver.deployTransaction.wait(5);

  // Verify on Etherscan
  console.log('Verifying on Etherscan...');
  await hre.run('verify:verify', {
    address: receiver.address,
    constructorArguments: [],
  });

  console.log('Verified.');
}

main().catch((error) => {
  console.error(error);
  process.exit(1);
});

# Deploy to Goerli testnet first. Always.
npx hardhat run scripts/deploy.js --network goerli

# When you're confident:
npx hardhat run scripts/deploy.js --network mainnet

maxFeePerGas = (baseFee * 2) + maxPriorityFeePerGas

async function getGasEstimate(provider) {
  const feeData = await provider.getFeeData();

  // ethers default - works most of the time
  console.log('ethers defaults:', {
    maxFeePerGas: ethers.utils.formatUnits(feeData.maxFeePerGas, 'gwei'),
    maxPriorityFeePerGas: ethers.utils.formatUnits(feeData.maxPriorityFeePerGas, 'gwei'),
  });

  // Better: query the node directly for current priority fee
  const priorityFeeHex = await provider.send('eth_maxPriorityFeePerGas', []);
  const priorityFee = ethers.BigNumber.from(priorityFeeHex);

  // And get the latest baseFee from the pending block
  const latestBlock = await provider.getBlock('latest');
  const baseFee = latestBlock.baseFeePerGas;

  // Apply the 2x buffer
  const maxFee = baseFee.mul(2).add(priorityFee);

  return {
    maxFeePerGas: maxFee,
    maxPriorityFeePerGas: priorityFee,
  };
}

// Use in a transaction:
const gasParams = await getGasEstimate(provider);
const tx = await signer.sendTransaction({
  to: recipient,
  value: ethers.utils.parseEther('0.1'),
  ...gasParams,
});

const { ethers } = require('ethers');

// WebSocket provider - persistent connection, real-time events
const wsProvider = new ethers.providers.WebSocketProvider(
  `wss://eth-mainnet.g.alchemy.com/v2/${process.env.ALCHEMY_KEY}`
);

const PAYMENT_CONTRACT = '0xYourContractAddress';
const USDC_ADDRESS = '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48';

// ──────────────────────────────────────────────────
// Monitor: ERC-20 payments TO our contract
// ──────────────────────────────────────────────────
const usdc = new ethers.Contract(USDC_ADDRESS, ERC20_ABI, wsProvider);
const usdcFilter = usdc.filters.Transfer(null, PAYMENT_CONTRACT);

usdc.on(usdcFilter, (from, to, amount, event) => {
  console.log(`[USDC] ${ethers.utils.formatUnits(amount, 6)} from ${from}`);
  console.log(`  tx: ${event.transactionHash}`);
  console.log(`  block: ${event.blockNumber}`);
  // → match to order, update database, notify user
});

// ──────────────────────────────────────────────────
// Monitor: ETH payments TO our contract
// (No Transfer event for native ETH - scan blocks)
// ──────────────────────────────────────────────────
wsProvider.on('block', async (blockNumber) => {
  try {
    const block = await wsProvider.getBlockWithTransactions(blockNumber);
    for (const tx of block.transactions) {
      if (
        tx.to?.toLowerCase() === PAYMENT_CONTRACT.toLowerCase() &&
        tx.value.gt(0)
      ) {
        console.log(`[ETH] ${ethers.utils.formatEther(tx.value)} from ${tx.from}`);
        console.log(`  tx: ${tx.hash}`);
        // → match to order, update database, notify user
      }
    }
  } catch (err) {
    console.error(`Block scan error at ${blockNumber}:`, err.message);
  }
});

// ──────────────────────────────────────────────────
// Monitor: Custom contract events (PaymentReceived)
// ──────────────────────────────────────────────────
const paymentContract = new ethers.Contract(
  PAYMENT_CONTRACT,
  [
    'event EthPaymentReceived(address indexed from, uint256 amount, bytes32 indexed orderId)',
    'event TokenPaymentReceived(address indexed token, address indexed from, uint256 amount, bytes32 indexed orderId)',
  ],
  wsProvider
);

paymentContract.on('EthPaymentReceived', (from, amount, orderId, event) => {
  console.log(`[Contract ETH] Order ${orderId}: ${ethers.utils.formatEther(amount)}`);
});

paymentContract.on('TokenPaymentReceived', (token, from, amount, orderId, event) => {
  console.log(`[Contract Token] Order ${orderId}: token=${token}, amount=${amount}`);
});

// ──────────────────────────────────────────────────
// Handle WebSocket disconnections
// ──────────────────────────────────────────────────
wsProvider._websocket.on('close', () => {
  console.error('WebSocket disconnected. Reconnecting...');
  // Implement reconnection logic with exponential backoff
  // In production, use a process manager (PM2) or container restart policy
});

# Railway deployment is absurdly simple
npm install -g @railway/cli
railway login
railway init
railway up
# That's it. Set env vars in the Railway dashboard.

// pages/api/webhooks/coinbase.js

export const config = {
  api: {
    bodyParser: false, // We need the raw body for signature verification
  },
};

export default async function handler(req, res) {
  if (req.method !== 'POST') {
    return res.status(405).end();
  }

  // Read raw body manually
  const chunks = [];
  for await (const chunk of req) {
    chunks.push(chunk);
  }
  const rawBody = Buffer.concat(chunks);

  // Verify signature against rawBody
  // ... (same verification logic as before)
}

// BAD - vulnerable to phishing
require(tx.origin == owner, "Not owner");

// GOOD - use Ownable or check msg.sender directly
require(msg.sender == owner, "Not owner");
// Or just: onlyOwner modifier from Ownable

const rateLimit = require('express-rate-limit');
const cors = require('cors');
const helmet = require('helmet');

const app = express();

// Rate limiting - protect webhook and API endpoints
app.use('/api/', rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  message: 'Too many requests',
}));

// CORS - restrict to your frontend domain, not '*'
app.use(cors({
  origin: process.env.FRONTEND_URL, // e.g., 'https://myapp.com'
  methods: ['GET', 'POST'],
}));

// Helmet - security headers
app.use(helmet());