feat(server::evm): more criterion types

mise.lock

@@ -55,6 +55,15 @@ backend = "aqua:protocolbuffers/protobuf/protoc"
 "platforms.macos-x64" = { checksum = "sha256:312f04713946921cc0187ef34df80241ddca1bab6f564c636885fd2cc90d3f88", url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-x86_64.zip"}
 "platforms.windows-x64" = { checksum = "sha256:1ebd7c87baffb9f1c47169b640872bf5fb1e4408079c691af527be9561d8f6f7", url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-win64.zip"}
 
+[[tools.python]]
+version = "3.14.3"
+backend = "core:python"
+"platforms.linux-arm64" = { checksum = "sha256:be0f4dc2932f762292b27d46ea7d3e8e66ddf3969a5eb0254a229015ed402625", url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"}
+"platforms.linux-x64" = { checksum = "sha256:0a73413f89efd417871876c9accaab28a9d1e3cd6358fbfff171a38ec99302f0", url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"}
+"platforms.macos-arm64" = { checksum = "sha256:4703cdf18b26798fde7b49b6b66149674c25f97127be6a10dbcf29309bdcdcdb", url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-aarch64-apple-darwin-install_only_stripped.tar.gz"}
+"platforms.macos-x64" = { checksum = "sha256:76f1cc26e3d262eae8ca546a93e8bded10cf0323613f7e246fea2e10a8115eb7", url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-x86_64-apple-darwin-install_only_stripped.tar.gz"}
+"platforms.windows-x64" = { checksum = "sha256:950c5f21a015c1bdd1337f233456df2470fab71e4d794407d27a84cb8b9909a0", url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260303/cpython-3.14.3+20260303-x86_64-pc-windows-msvc-install_only_stripped.tar.gz"}
+
 [[tools.rust]]
 version = "1.93.0"
 backend = "core:rust"

mise.toml

@@ -9,3 +9,4 @@ protoc = "29.6"
 "cargo:cargo-nextest" = "0.9.126"
 "cargo:cargo-shear" = "latest"
 "cargo:cargo-insta" = "1.46.3"
+python = "3.14.3"

scripts/gen_erc20_registry.py

@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+"""
+Fetch the Uniswap default token list and emit Rust `TokenInfo` statics.
+
+Usage:
+    python3 gen_erc20_registry.py                       # fetch from IPFS
+    python3 gen_erc20_registry.py tokens.json           # local file
+    python3 gen_erc20_registry.py tokens.json out.rs    # custom output file
+"""
+
+import json
+import re
+import sys
+import unicodedata
+import urllib.request
+
+UNISWAP_URL = "https://ipfs.io/ipns/tokens.uniswap.org"
+
+SOLANA_CHAIN_ID = 501000101
+IDENTIFIER_RE = re.compile(r"[^A-Za-z0-9]+")
+
+
+def load_tokens(source=None):
+    if source:
+        with open(source) as f:
+            return json.load(f)
+    req = urllib.request.Request(
+        UNISWAP_URL,
+        headers={"Accept": "application/json", "User-Agent": "gen_tokens/1.0"},
+    )
+    with urllib.request.urlopen(req, timeout=60) as resp:
+        return json.loads(resp.read())
+
+
+def escape(s: str) -> str:
+    return s.replace("\\", "\\\\").replace('"', '\\"')
+
+
+def to_screaming_case(name: str) -> str:
+    normalized = unicodedata.normalize("NFKD", name or "")
+    ascii_name = normalized.encode("ascii", "ignore").decode("ascii")
+    snake = IDENTIFIER_RE.sub("_", ascii_name).strip("_").upper()
+    if not snake:
+        snake = "TOKEN"
+    if snake[0].isdigit():
+        snake = f"TOKEN_{snake}"
+    return snake
+
+
+def static_name_for_token(token: dict, used_names: set[str]) -> str:
+    base = to_screaming_case(token.get("name", ""))
+    if base not in used_names:
+        used_names.add(base)
+        return base
+
+    address = token["address"]
+    suffix = f"{token['chainId']}_{address[2:].upper()[-8:]}"
+    candidate = f"{base}_{suffix}"
+
+    i = 2
+    while candidate in used_names:
+        candidate = f"{base}_{suffix}_{i}"
+        i += 1
+
+    used_names.add(candidate)
+    return candidate
+
+
+def main():
+    source = sys.argv[1] if len(sys.argv) > 1 else None
+    output = sys.argv[2] if len(sys.argv) > 2 else "generated_tokens.rs"
+    data = load_tokens(source)
+    tokens = data["tokens"]
+
+    # Deduplicate by (chainId, address)
+    seen = set()
+    unique = []
+    for t in tokens:
+        key = (t["chainId"], t["address"].lower())
+        if key not in seen:
+            seen.add(key)
+            unique.append(t)
+
+    unique.sort(key=lambda t: (t["chainId"], t.get("symbol", "").upper()))
+    evm_tokens = [t for t in unique if t["chainId"] != SOLANA_CHAIN_ID]
+
+    ver = data["version"]
+    lines = []
+    w = lines.append
+
+    w(
+        f"// Auto-generated from Uniswap token list v{ver['major']}.{ver['minor']}.{ver['patch']}"
+    )
+    w(f"// {len(evm_tokens)} tokens")
+    w("// DO NOT EDIT - regenerate with gen_erc20_registry.py")
+    w("")
+
+    used_static_names = set()
+    token_statics = []
+    for t in evm_tokens:
+        static_name = static_name_for_token(t, used_static_names)
+        token_statics.append((static_name, t))
+
+    for static_name, t in token_statics:
+        addr = t["address"]
+        name = escape(t.get("name", ""))
+        symbol = escape(t.get("symbol", ""))
+        decimals = t.get("decimals", 18)
+        logo = t.get("logoURI")
+        chain = t["chainId"]
+
+        logo_val = f'Some("{escape(logo)}")' if logo else "None"
+
+        w(f"pub static {static_name}: TokenInfo = TokenInfo {{")
+        w(f'    name: "{name}",')
+        w(f'    symbol: "{symbol}",')
+        w(f"    decimals: {decimals},")
+        w(f'    contract: address!("{addr}"),')
+        w(f"    chain: {chain},")
+        w(f"    logo_uri: {logo_val},")
+        w("};")
+        w("")
+
+    w("pub static TOKENS: &[&TokenInfo] = &[")
+    for static_name, _ in token_statics:
+        w(f"    &{static_name},")
+    w("];")
+    w("")
+    w("pub fn get_token(")
+    w("    chain_id: alloy::primitives::ChainId,")
+    w("    address: alloy::primitives::Address,")
+    w(") -> Option<&'static TokenInfo> {")
+    w("    match (chain_id, address) {")
+    for static_name, t in token_statics:
+        w(
+            f'        ({t["chainId"]}, addr) if addr == address!("{t["address"]}") => Some(&{static_name}),'
+        )
+    w("        _ => None,")
+    w("    }")
+    w("}")
+    w("")
+
+    with open(output, "w") as f:
+        f.write("\n".join(lines))
+
+    print(f"Wrote {len(token_statics)} tokens to {output}")
+
+
+if __name__ == "__main__":
+    main()

server/Cargo.lock

@@ -710,6 +710,7 @@ version = "0.1.0"
 dependencies = [
  "alloy",
  "arbiter-proto",
+ "arbiter-tokens-registry",
  "argon2",
  "async-trait",
  "chacha20poly1305",
@@ -744,6 +745,13 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "arbiter-tokens-registry"
+version = "0.1.0"
+dependencies = [
+ "alloy",
+]
+
 [[package]]
 name = "arbiter-useragent"
 version = "0.1.0"

server/Cargo.toml

@@ -1,9 +1,6 @@
 [workspace]
 members = [
-    "crates/arbiter-client",
+    "crates/*",
-    "crates/arbiter-proto",
-    "crates/arbiter-server",
-    "crates/arbiter-useragent",
 ]
 resolver = "3"
 

server/crates/arbiter-server/Cargo.toml

@@ -44,6 +44,7 @@ strum = { version = "0.27.2", features = ["derive"] }
 pem = "3.0.6"
 k256 = "0.13.4"
 alloy.workspace = true
+arbiter-tokens-registry.path = "../arbiter-tokens-registry"
 
 [dev-dependencies]
 insta = "1.46.3"

server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql

@@ -68,6 +68,12 @@ create table if not exists evm_wallet (
 create unique index if not exists uniq_evm_wallet_address on evm_wallet (address);
 create unique index if not exists uniq_evm_wallet_aead on evm_wallet (aead_encrypted_id);
 
+create table if not exists evm_ether_transfer_limit (
+    id integer not null primary key,
+    window_secs integer not null,           -- window duration in seconds
+    max_volume blob not null                -- big-endian 32-byte U256
+) STRICT;
+
 -- Shared grant properties: client scope, timeframe, fee caps, and rate limit
 create table if not exists evm_basic_grant (
     id integer not null primary key,
@@ -84,24 +90,29 @@ create table if not exists evm_basic_grant (
     created_at integer not null default(unixepoch('now'))
 ) STRICT;
 
+-- Shared transaction log for all EVM grants, used for rate limit tracking and auditing
+create table if not exists evm_transaction_log (
+    id integer not null primary key,
+    grant_id integer not null references evm_basic_grant(id) on delete restrict,
+    client_id integer not null references program_client(id) on delete restrict,
+    wallet_id integer not null references evm_wallet(id) on delete restrict,
+    chain_id integer not null,
+    eth_value blob not null,     -- always present on any EVM tx
+    signed_at integer not null default(unixepoch('now'))
+) STRICT;
+
 create index if not exists idx_evm_basic_grant_wallet_chain on evm_basic_grant(client_id, wallet_id, chain_id);
 
+-- ===============================
 -- ERC20 token transfer grant
+-- ===============================
 create table if not exists evm_token_transfer_grant (
     id integer not null primary key,
     basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade,
-    token_contract blob not null            -- 20-byte ERC20 contract address
+    token_contract blob not null,            -- 20-byte ERC20 contract address
+    receiver blob                            -- 20-byte recipient address or null if every recipient allowed
 ) STRICT;
 
--- Specific recipient addresses for a token transfer grant (only used when target_all = 0)
-create table if not exists evm_token_transfer_grant_target (
-    id integer not null primary key,
-    grant_id integer not null references evm_token_transfer_grant(id) on delete cascade,
-    address blob not null                   -- 20-byte recipient address
-) STRICT;
-
-create unique index if not exists uniq_token_transfer_target on evm_token_transfer_grant_target(grant_id, address);
-
 -- Per-window volume limits for token transfer grants
 create table if not exists evm_token_transfer_volume_limit (
     id integer not null primary key,
@@ -110,76 +121,11 @@ create table if not exists evm_token_transfer_volume_limit (
     max_volume blob not null                -- big-endian 32-byte U256
 ) STRICT;
 
--- ERC20 token approval grant
-create table if not exists evm_token_approval_grant (
-    id integer not null primary key,
-    basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade,
-    token_contract blob not null,           -- 20-byte ERC20 contract address
-    max_total_approval blob not null        -- big-endian 32-byte U256; max cumulative approval value
-) STRICT;
-
--- Specific spender addresses for a token approval grant (only used when target_all = 0)
-create table if not exists evm_token_approval_grant_target (
-    id integer not null primary key,
-    grant_id integer not null references evm_token_approval_grant(id) on delete cascade,
-    address blob not null                   -- 20-byte spender address
-) STRICT;
-
-create unique index if not exists uniq_token_approval_target on evm_token_approval_grant_target(grant_id, address);
-
--- Plain ether transfer grant
-create table if not exists evm_ether_transfer_grant (
-    id integer not null primary key,
-    basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade
-) STRICT;
-
--- Specific recipient addresses for an ether transfer grant (only used when target_all = 0)
-create table if not exists evm_ether_transfer_grant_target (
-    id integer not null primary key,
-    grant_id integer not null references evm_ether_transfer_grant(id) on delete cascade,
-    address blob not null                   -- 20-byte recipient address
-) STRICT;
-
-create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target(grant_id, address);
-
--- Per-window volume limits for ether transfer grants
-create table if not exists evm_ether_transfer_volume_limit (
-    id integer not null primary key,
-    grant_id integer not null references evm_ether_transfer_grant(id) on delete cascade,
-    window_secs integer not null,
-    max_volume blob not null                -- big-endian 32-byte U256
-) STRICT;
-
--- Unknown / opaque contract call grant
-create table if not exists evm_unknown_call_grant (
-    id integer not null primary key,
-    basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade,
-    contract blob not null,                 -- 20-byte target contract address
-    selector blob                           -- 4-byte function selector, null = allow any selector
-) STRICT;
-
--- Log table for ether transfer grant usage
-create table if not exists evm_ether_transfer_log (
-    id integer not null primary key,
-    grant_id integer not null references evm_ether_transfer_grant(id) on delete restrict,
-    client_id integer not null references program_client(id) on delete restrict,
-    wallet_id integer not null references evm_wallet(id) on delete restrict,
-    chain_id integer not null,              -- EIP-155 chain ID
-    recipient_address blob not null,        -- 20-byte recipient address
-    value blob not null,                    -- big-endian 32-byte U256
-    created_at integer not null default(unixepoch('now'))
-) STRICT;
-
-create index if not exists idx_ether_transfer_log_grant on evm_ether_transfer_log(grant_id);
-create index if not exists idx_ether_transfer_log_client on evm_ether_transfer_log(client_id);
-create index if not exists idx_ether_transfer_log_wallet on evm_ether_transfer_log(wallet_id);
-
 -- Log table for token transfer grant usage
 create table if not exists evm_token_transfer_log (
     id integer not null primary key,
     grant_id integer not null references evm_token_transfer_grant(id) on delete restrict,
-    client_id integer not null references program_client(id) on delete restrict,
+    log_id integer not null references evm_transaction_log(id) on delete restrict,
-    wallet_id integer not null references evm_wallet(id) on delete restrict,
     chain_id integer not null,              -- EIP-155 chain ID
     token_contract blob not null,           -- 20-byte ERC20 contract address
     recipient_address blob not null,        -- 20-byte recipient address
@@ -188,39 +134,25 @@ create table if not exists evm_token_transfer_log (
 ) STRICT;
 
 create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log(grant_id);
-create index if not exists idx_token_transfer_log_client on evm_token_transfer_log(client_id);
+create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log(log_id);
-create index if not exists idx_token_transfer_log_wallet on evm_token_transfer_log(wallet_id);
+create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log(chain_id);
 
--- Log table for token approval grant usage
+
-create table if not exists evm_token_approval_log (
+-- ===============================
+-- Ether transfer grant (uses base log)
+-- ===============================
+create table if not exists evm_ether_transfer_grant (
     id integer not null primary key,
-    grant_id integer not null references evm_token_approval_grant(id) on delete restrict,
+    basic_grant_id integer not null unique references evm_basic_grant(id) on delete cascade,
-    client_id integer not null references program_client(id) on delete restrict,
+    limit_id integer not null references evm_ether_transfer_limit(id) on delete restrict
-    wallet_id integer not null references evm_wallet(id) on delete restrict,
-    chain_id integer not null,              -- EIP-155 chain ID
-    token_contract blob not null,           -- 20-byte ERC20 contract address
-    spender_address blob not null,          -- 20-byte spender address
-    value blob not null,                    -- big-endian 32-byte U256
-    created_at integer not null default(unixepoch('now'))
 ) STRICT;
 
-create index if not exists idx_token_approval_log_grant on evm_token_approval_log(grant_id);
+-- Specific recipient addresses for an ether transfer grant
-create index if not exists idx_token_approval_log_client on evm_token_approval_log(client_id);
+create table if not exists evm_ether_transfer_grant_target (
-create index if not exists idx_token_approval_log_wallet on evm_token_approval_log(wallet_id);
-
--- Log table for unknown contract call grant usage
-create table if not exists evm_unknown_call_log (
     id integer not null primary key,
-    grant_id integer not null references evm_unknown_call_grant(id) on delete restrict,
+    grant_id integer not null references evm_ether_transfer_grant(id) on delete cascade,
-    client_id integer not null references program_client(id) on delete restrict,
+    address blob not null                   -- 20-byte recipient address
-    wallet_id integer not null references evm_wallet(id) on delete restrict,
-    chain_id integer not null,              -- EIP-155 chain ID
-    contract blob not null,                 -- 20-byte target contract address
-    selector blob,                          -- 4-byte function selector, null if none
-    call_data blob,                         -- full call data, null if not stored
-    created_at integer not null default(unixepoch('now'))
 ) STRICT;
 
-create index if not exists idx_unknown_call_log_grant on evm_unknown_call_log(grant_id);
+create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target(grant_id, address);
-create index if not exists idx_unknown_call_log_client on evm_unknown_call_log(client_id);
+
-create index if not exists idx_unknown_call_log_wallet on evm_unknown_call_log(wallet_id);

server/crates/arbiter-server/src/actors/keyholder/mod.rs

@@ -1,3 +1,4 @@
+use chrono::Utc;
 use diesel::{
     ExpressionMethods as _, OptionalExtension, QueryDsl, SelectableHelper,
     dsl::{insert_into, update},
@@ -312,7 +313,7 @@ impl KeyHolder {
                 current_nonce: nonce.to_vec(),
                 schema_version: 1,
                 associated_root_key_id: *root_key_history_id,
-                created_at: chrono::Utc::now().timestamp() as i32,
+                created_at: Utc::now().into()
             })
             .returning(schema::aead_encrypted::id)
             .get_result(&mut conn)

server/crates/arbiter-server/src/db/models.rs

@@ -2,12 +2,7 @@
 #![allow(clippy::all)]
 
 use crate::db::schema::{
-    self, aead_encrypted, arbiter_settings, evm_basic_grant, evm_ether_transfer_grant,
+    self, aead_encrypted, arbiter_settings, evm_basic_grant, evm_ether_transfer_grant, evm_ether_transfer_grant_target, evm_ether_transfer_limit, evm_token_transfer_grant, evm_token_transfer_log, evm_token_transfer_volume_limit, evm_transaction_log, evm_wallet, root_key_history, tls_history
-    evm_ether_transfer_grant_target, evm_ether_transfer_log, evm_ether_transfer_volume_limit,
-    evm_token_approval_grant, evm_token_approval_grant_target,
-    evm_token_approval_log, evm_token_transfer_grant, evm_token_transfer_grant_target,
-    evm_token_transfer_log, evm_token_transfer_volume_limit, evm_unknown_call_grant,
-    evm_unknown_call_log, evm_wallet, root_key_history, tls_history,
 };
 use chrono::{DateTime, Utc};
 use diesel::{prelude::*, sqlite::Sqlite};
@@ -29,6 +24,22 @@ pub mod types {
     #[sql_type = "Integer"]
     #[repr(transparent)] // hint compiler to optimize the wrapper struct away
     pub struct SqliteTimestamp(pub DateTime<Utc>);
+    impl SqliteTimestamp {
+        pub fn now() -> Self {
+            SqliteTimestamp(Utc::now())
+        }
+    }
+
+    impl From<chrono::DateTime<Utc>> for SqliteTimestamp {
+        fn from(dt: chrono::DateTime<Utc>) -> Self {
+            SqliteTimestamp(dt)
+        }
+    }
+    impl Into<chrono::DateTime<Utc>> for SqliteTimestamp {
+        fn into(self) -> chrono::DateTime<Utc> {
+            self.0
+        }
+    }
 
     impl ToSql<Integer, Sqlite> for SqliteTimestamp {
         fn to_sql<'b>(
@@ -78,7 +89,7 @@ pub struct AeadEncrypted {
     pub current_nonce: Vec<u8>,
     pub schema_version: i32,
     pub associated_root_key_id: i32, // references root_key_history.id
-    pub created_at: i32,
+    pub created_at: SqliteTimestamp,
 }
 
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
@@ -143,8 +154,8 @@ pub struct EvmWallet {
 #[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
 pub struct ProgramClient {
     pub id: i32,
-    pub public_key: Vec<u8>,
     pub nonce: i32,
+    pub public_key: Vec<u8>,
     pub created_at: SqliteTimestamp,
     pub updated_at: SqliteTimestamp,
 }
@@ -153,12 +164,26 @@ pub struct ProgramClient {
 #[diesel(table_name = schema::useragent_client, check_for_backend(Sqlite))]
 pub struct UseragentClient {
     pub id: i32,
-    pub public_key: Vec<u8>,
     pub nonce: i32,
+    pub public_key: Vec<u8>,
     pub created_at: SqliteTimestamp,
     pub updated_at: SqliteTimestamp,
 }
 
+#[derive(Models, Queryable, Debug, Insertable, Selectable)]
+#[diesel(table_name = evm_ether_transfer_limit, check_for_backend(Sqlite))]
+#[view(
+    NewEvmEtherTransferLimit,
+    derive(Insertable),
+    omit(id, created_at),
+    attributes_with = "deriveless"
+)]
+pub struct EvmEtherTransferLimit {
+    pub id: i32,
+    pub window_secs: i32,
+    pub max_volume: Vec<u8>,
+}
+
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_basic_grant, check_for_backend(Sqlite))]
 #[view(
@@ -182,6 +207,24 @@ pub struct EvmBasicGrant {
     pub created_at: SqliteTimestamp,
 }
 
+#[derive(Models, Queryable, Debug, Insertable, Selectable)]
+#[diesel(table_name = evm_transaction_log, check_for_backend(Sqlite))]
+#[view(
+    NewEvmTransactionLog,
+    derive(Insertable),
+    omit(id),
+    attributes_with = "deriveless"
+)]
+pub struct EvmTransactionLog {
+    pub id: i32,
+    pub grant_id: i32,
+    pub client_id: i32,
+    pub wallet_id: i32,
+    pub chain_id: i32,
+    pub eth_value: Vec<u8>,
+    pub signed_at: SqliteTimestamp,
+}
+
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_ether_transfer_grant, check_for_backend(Sqlite))]
 #[view(
@@ -193,6 +236,7 @@ pub struct EvmBasicGrant {
 pub struct EvmEtherTransferGrant {
     pub id: i32,
     pub basic_grant_id: i32,
+    pub limit_id: i32, // references evm_ether_transfer_limit.id
 }
 
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
@@ -209,49 +253,6 @@ pub struct EvmEtherTransferGrantTarget {
     pub address: Vec<u8>,
 }
 
-#[derive(Models, Queryable, Debug, Insertable, Selectable)]
-#[diesel(table_name = evm_ether_transfer_volume_limit, check_for_backend(Sqlite))]
-#[view(
-    NewEvmEtherTransferVolumeLimit,
-    derive(Insertable),
-    omit(id),
-    attributes_with = "deriveless"
-)]
-pub struct EvmEtherTransferVolumeLimit {
-    pub id: i32,
-    pub grant_id: i32,
-    pub window_secs: i32,
-    pub max_volume: Vec<u8>,
-}
-
-#[derive(Models, Queryable, Debug, Insertable, Selectable)]
-#[diesel(table_name = evm_token_approval_grant, check_for_backend(Sqlite))]
-#[view(
-    NewEvmTokenApprovalGrant,
-    derive(Insertable),
-    omit(id),
-    attributes_with = "deriveless"
-)]
-pub struct EvmTokenApprovalGrant {
-    pub id: i32,
-    pub basic_grant_id: i32,
-    pub token_contract: Vec<u8>,
-    pub max_total_approval: Vec<u8>,
-}
-
-#[derive(Models, Queryable, Debug, Insertable, Selectable)]
-#[diesel(table_name = evm_token_approval_grant_target, check_for_backend(Sqlite))]
-#[view(
-    NewEvmTokenApprovalGrantTarget,
-    derive(Insertable),
-    omit(id),
-    attributes_with = "deriveless"
-)]
-pub struct EvmTokenApprovalGrantTarget {
-    pub id: i32,
-    pub grant_id: i32,
-    pub address: Vec<u8>,
-}
 
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_token_transfer_grant, check_for_backend(Sqlite))]
@@ -265,20 +266,7 @@ pub struct EvmTokenTransferGrant {
     pub id: i32,
     pub basic_grant_id: i32,
     pub token_contract: Vec<u8>,
-}
+    pub receiver: Option<Vec<u8>>,
-
-#[derive(Models, Queryable, Debug, Insertable, Selectable)]
-#[diesel(table_name = evm_token_transfer_grant_target, check_for_backend(Sqlite))]
-#[view(
-    NewEvmTokenTransferGrantTarget,
-    derive(Insertable),
-    omit(id),
-    attributes_with = "deriveless"
-)]
-pub struct EvmTokenTransferGrantTarget {
-    pub id: i32,
-    pub grant_id: i32,
-    pub address: Vec<u8>,
 }
 
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
@@ -296,40 +284,6 @@ pub struct EvmTokenTransferVolumeLimit {
     pub max_volume: Vec<u8>,
 }
 
-#[derive(Models, Queryable, Debug, Insertable, Selectable)]
-#[diesel(table_name = evm_unknown_call_grant, check_for_backend(Sqlite))]
-#[view(
-    NewEvmUnknownCallGrant,
-    derive(Insertable),
-    omit(id),
-    attributes_with = "deriveless"
-)]
-pub struct EvmUnknownCallGrant {
-    pub id: i32,
-    pub basic_grant_id: i32,
-    pub contract: Vec<u8>,
-    pub selector: Option<Vec<u8>>,
-}
-
-#[derive(Models, Queryable, Debug, Insertable, Selectable)]
-#[diesel(table_name = evm_ether_transfer_log, check_for_backend(Sqlite))]
-#[view(
-    NewEvmEtherTransferLog,
-    derive(Insertable),
-    omit(id, created_at),
-    attributes_with = "deriveless"
-)]
-pub struct EvmEtherTransferLog {
-    pub id: i32,
-    pub grant_id: i32,
-    pub client_id: i32,
-    pub wallet_id: i32,
-    pub chain_id: i32,
-    pub recipient_address: Vec<u8>,
-    pub value: Vec<u8>,
-    pub created_at: SqliteTimestamp,
-}
-
 #[derive(Models, Queryable, Debug, Insertable, Selectable)]
 #[diesel(table_name = evm_token_transfer_log, check_for_backend(Sqlite))]
 #[view(
@@ -341,51 +295,10 @@ pub struct EvmEtherTransferLog {
 pub struct EvmTokenTransferLog {
     pub id: i32,
     pub grant_id: i32,
-    pub client_id: i32,
+    pub log_id: i32,
-    pub wallet_id: i32,
     pub chain_id: i32,
     pub token_contract: Vec<u8>,
     pub recipient_address: Vec<u8>,
     pub value: Vec<u8>,
     pub created_at: SqliteTimestamp,
 }
-
-#[derive(Models, Queryable, Debug, Insertable, Selectable)]
-#[diesel(table_name = evm_token_approval_log, check_for_backend(Sqlite))]
-#[view(
-    NewEvmTokenApprovalLog,
-    derive(Insertable),
-    omit(id, created_at),
-    attributes_with = "deriveless"
-)]
-pub struct EvmTokenApprovalLog {
-    pub id: i32,
-    pub grant_id: i32,
-    pub client_id: i32,
-    pub wallet_id: i32,
-    pub chain_id: i32,
-    pub token_contract: Vec<u8>,
-    pub spender_address: Vec<u8>,
-    pub value: Vec<u8>,
-    pub created_at: SqliteTimestamp,
-}
-
-#[derive(Models, Queryable, Debug, Insertable, Selectable)]
-#[diesel(table_name = evm_unknown_call_log, check_for_backend(Sqlite))]
-#[view(
-    NewEvmUnknownCallLog,
-    derive(Insertable),
-    omit(id, created_at),
-    attributes_with = "deriveless"
-)]
-pub struct EvmUnknownCallLog {
-    pub id: i32,
-    pub grant_id: i32,
-    pub client_id: i32,
-    pub wallet_id: i32,
-    pub chain_id: i32,
-    pub contract: Vec<u8>,
-    pub selector: Option<Vec<u8>>,
-    pub call_data: Option<Vec<u8>>,
-    pub created_at: SqliteTimestamp,
-}

server/crates/arbiter-server/src/db/schema.rs

@@ -41,6 +41,7 @@ diesel::table! {
     evm_ether_transfer_grant (id) {
         id -> Integer,
         basic_grant_id -> Integer,
+        limit_id -> Integer,
     }
 }
 
@@ -53,71 +54,19 @@ diesel::table! {
 }
 
 diesel::table! {
-    evm_ether_transfer_log (id) {
+    evm_ether_transfer_limit (id) {
         id -> Integer,
-        grant_id -> Integer,
-        client_id -> Integer,
-        wallet_id -> Integer,
-        chain_id -> Integer,
-        recipient_address -> Binary,
-        value -> Binary,
-        created_at -> Integer,
-    }
-}
-
-diesel::table! {
-    evm_ether_transfer_volume_limit (id) {
-        id -> Integer,
-        grant_id -> Integer,
         window_secs -> Integer,
         max_volume -> Binary,
     }
 }
 
-diesel::table! {
-    evm_token_approval_grant (id) {
-        id -> Integer,
-        basic_grant_id -> Integer,
-        token_contract -> Binary,
-        max_total_approval -> Binary,
-    }
-}
-
-diesel::table! {
-    evm_token_approval_grant_target (id) {
-        id -> Integer,
-        grant_id -> Integer,
-        address -> Binary,
-    }
-}
-
-diesel::table! {
-    evm_token_approval_log (id) {
-        id -> Integer,
-        grant_id -> Integer,
-        client_id -> Integer,
-        wallet_id -> Integer,
-        chain_id -> Integer,
-        token_contract -> Binary,
-        spender_address -> Binary,
-        value -> Binary,
-        created_at -> Integer,
-    }
-}
-
 diesel::table! {
     evm_token_transfer_grant (id) {
         id -> Integer,
         basic_grant_id -> Integer,
         token_contract -> Binary,
-    }
+        receiver -> Nullable<Binary>,
-}
-
-diesel::table! {
-    evm_token_transfer_grant_target (id) {
-        id -> Integer,
-        grant_id -> Integer,
-        address -> Binary,
     }
 }
 
@@ -125,8 +74,7 @@ diesel::table! {
     evm_token_transfer_log (id) {
         id -> Integer,
         grant_id -> Integer,
-        client_id -> Integer,
+        log_id -> Integer,
-        wallet_id -> Integer,
         chain_id -> Integer,
         token_contract -> Binary,
         recipient_address -> Binary,
@@ -145,25 +93,14 @@ diesel::table! {
 }
 
 diesel::table! {
-    evm_unknown_call_grant (id) {
+    evm_transaction_log (id) {
-        id -> Integer,
-        basic_grant_id -> Integer,
-        contract -> Binary,
-        selector -> Nullable<Binary>,
-    }
-}
-
-diesel::table! {
-    evm_unknown_call_log (id) {
         id -> Integer,
         grant_id -> Integer,
         client_id -> Integer,
         wallet_id -> Integer,
         chain_id -> Integer,
-        contract -> Binary,
+        eth_value -> Binary,
-        selector -> Nullable<Binary>,
+        signed_at -> Integer,
-        call_data -> Nullable<Binary>,
-        created_at -> Integer,
     }
 }
 
@@ -225,26 +162,12 @@ diesel::joinable!(arbiter_settings -> tls_history (tls_id));
 diesel::joinable!(evm_basic_grant -> evm_wallet (wallet_id));
 diesel::joinable!(evm_basic_grant -> program_client (client_id));
 diesel::joinable!(evm_ether_transfer_grant -> evm_basic_grant (basic_grant_id));
+diesel::joinable!(evm_ether_transfer_grant -> evm_ether_transfer_limit (limit_id));
 diesel::joinable!(evm_ether_transfer_grant_target -> evm_ether_transfer_grant (grant_id));
-diesel::joinable!(evm_ether_transfer_log -> evm_ether_transfer_grant (grant_id));
-diesel::joinable!(evm_ether_transfer_log -> evm_wallet (wallet_id));
-diesel::joinable!(evm_ether_transfer_log -> program_client (client_id));
-diesel::joinable!(evm_ether_transfer_volume_limit -> evm_ether_transfer_grant (grant_id));
-diesel::joinable!(evm_token_approval_grant -> evm_basic_grant (basic_grant_id));
-diesel::joinable!(evm_token_approval_grant_target -> evm_token_approval_grant (grant_id));
-diesel::joinable!(evm_token_approval_log -> evm_token_approval_grant (grant_id));
-diesel::joinable!(evm_token_approval_log -> evm_wallet (wallet_id));
-diesel::joinable!(evm_token_approval_log -> program_client (client_id));
 diesel::joinable!(evm_token_transfer_grant -> evm_basic_grant (basic_grant_id));
-diesel::joinable!(evm_token_transfer_grant_target -> evm_token_transfer_grant (grant_id));
 diesel::joinable!(evm_token_transfer_log -> evm_token_transfer_grant (grant_id));
-diesel::joinable!(evm_token_transfer_log -> evm_wallet (wallet_id));
+diesel::joinable!(evm_token_transfer_log -> evm_transaction_log (log_id));
-diesel::joinable!(evm_token_transfer_log -> program_client (client_id));
 diesel::joinable!(evm_token_transfer_volume_limit -> evm_token_transfer_grant (grant_id));
-diesel::joinable!(evm_unknown_call_grant -> evm_basic_grant (basic_grant_id));
-diesel::joinable!(evm_unknown_call_log -> evm_unknown_call_grant (grant_id));
-diesel::joinable!(evm_unknown_call_log -> evm_wallet (wallet_id));
-diesel::joinable!(evm_unknown_call_log -> program_client (client_id));
 diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
 
 diesel::allow_tables_to_appear_in_same_query!(
@@ -253,17 +176,11 @@ diesel::allow_tables_to_appear_in_same_query!(
     evm_basic_grant,
     evm_ether_transfer_grant,
     evm_ether_transfer_grant_target,
-    evm_ether_transfer_log,
+    evm_ether_transfer_limit,
-    evm_ether_transfer_volume_limit,
-    evm_token_approval_grant,
-    evm_token_approval_grant_target,
-    evm_token_approval_log,
     evm_token_transfer_grant,
-    evm_token_transfer_grant_target,
     evm_token_transfer_log,
     evm_token_transfer_volume_limit,
-    evm_unknown_call_grant,
+    evm_transaction_log,
-    evm_unknown_call_log,
     evm_wallet,
     program_client,
     root_key_history,

server/crates/arbiter-server/src/evm/abi.rs

@@ -0,0 +1,84 @@
+use alloy::sol;
+
+sol! {
+    interface IERC20 {
+        event Transfer(address indexed from, address indexed to, uint256 value);
+        event Approval(address indexed owner, address indexed spender, uint256 value);
+
+        function totalSupply() external view returns (uint256);
+        function balanceOf(address account) external view returns (uint256);
+        function transfer(address to, uint256 value) external returns (bool);
+        function allowance(address owner, address spender) external view returns (uint256);
+        function approve(address spender, uint256 value) external returns (bool);
+        function transferFrom(address from, address to, uint256 value) external returns (bool);
+    }
+}
+
+sol! {
+    /// ERC-721: Non-Fungible Token Standard.
+    #[derive(Debug)]
+    interface IERC721 {
+        event Transfer(address indexed from, address indexed to, uint256 indexed tokenId);
+        event Approval(address indexed owner, address indexed approved, uint256 indexed tokenId);
+        event ApprovalForAll(address indexed owner, address indexed operator, bool approved);
+
+        function balanceOf(address owner) external view returns (uint256 balance);
+        function ownerOf(uint256 tokenId) external view returns (address owner);
+        function safeTransferFrom(address from, address to, uint256 tokenId) external;
+        function safeTransferFrom(address from, address to, uint256 tokenId, bytes calldata data) external;
+        function transferFrom(address from, address to, uint256 tokenId) external;
+        function approve(address to, uint256 tokenId) external;
+        function setApprovalForAll(address operator, bool approved) external;
+        function getApproved(uint256 tokenId) external view returns (address operator);
+        function isApprovedForAll(address owner, address operator) external view returns (bool);
+    }
+}
+
+sol! {
+    /// Wrapped Ether — the only functions beyond ERC-20 that matter.
+    #[derive(Debug)]
+    interface IWETH {
+        function deposit() external payable;
+        function withdraw(uint256 wad) external;
+    }
+}
+
+sol! {
+    /// Permit2 — Uniswap's canonical token approval manager.
+    /// Replaces per-contract ERC-20 approve() with a single approval hub.
+    #[derive(Debug)]
+    interface IPermit2 {
+        struct TokenPermissions {
+            address token;
+            uint256 amount;
+        }
+
+        struct PermitSingle {
+            TokenPermissions details;
+            address spender;
+            uint256 sigDeadline;
+        }
+
+        struct PermitBatch {
+            TokenPermissions[] details;
+            address spender;
+            uint256 sigDeadline;
+        }
+
+        struct AllowanceTransferDetails {
+            address from;
+            address to;
+            uint160 amount;
+            address token;
+        }
+
+        function approve(address token, address spender, uint160 amount, uint48 expiration) external;
+        function permit(address owner, PermitSingle calldata permitSingle, bytes calldata signature) external;
+        function permit(address owner, PermitBatch calldata permitBatch, bytes calldata signature) external;
+        function transferFrom(address from, address to, uint160 amount, address token) external;
+        function transferFrom(AllowanceTransferDetails[] calldata transferDetails) external;
+
+        function allowance(address user, address token, address spender)
+            external view returns (uint160 amount, uint48 expiration, uint48 nonce);
+    }
+}

server/crates/arbiter-server/src/evm/mod.rs

@@ -1,4 +1,5 @@
 pub mod safe_signer;
+pub mod abi;
 
 use alloy::{
     consensus::TxEip1559,
@@ -55,7 +56,7 @@ impl Engine {
     pub async fn create_grant<P: Policy>(
         &self,
         client_id: i32,
-        full_grant: FullGrant<P::Grant>,
+        full_grant: FullGrant<P::Settings>,
     ) -> Result<i32, CreationError> {
         let mut conn = self.db.get().await?;
 

server/crates/arbiter-server/src/evm/policies.rs

@@ -2,14 +2,21 @@ use std::fmt::Display;
 
 use alloy::primitives::{Address, Bytes, ChainId, U256};
 use chrono::{DateTime, Duration, Utc};
-use diesel::{result::QueryResult, sqlite::Sqlite};
+use diesel::{
-use diesel_async::AsyncConnection;
+    ExpressionMethods as _, QueryDsl, SelectableHelper, result::QueryResult,
+    sqlite::Sqlite,
+};
+use diesel_async::{AsyncConnection, RunQueryDsl};
 use miette::Diagnostic;
 use thiserror::Error;
 
-use crate::db::models;
+use crate::{
+    db::models::{self, EvmBasicGrant},
+    evm::utils,
+};
 
 pub mod ether_transfer;
+pub mod token_transfers;
 
 pub struct EvalContext {
     // Which wallet is this transaction for
@@ -47,17 +54,23 @@ pub enum EvalViolation {
     #[error("Transaction is outside of the grant's validity period")]
     #[diagnostic(code(arbiter_server::evm::eval_violation::invalid_time))]
     InvalidTime,
+
+    #[error("Transaction type is not allowed by this grant")]
+    #[diagnostic(code(arbiter_server::evm::eval_violation::invalid_transaction_type))]
+    InvalidTransactionType,
 }
 
 pub type DatabaseID = i32;
 
-pub struct GrantMetadata {
+pub struct Grant<PolicySettings> {
-    pub basic_grant_id: DatabaseID,
+    pub id: DatabaseID,
-    pub policy_grant_id: DatabaseID,
+    pub shared_grant_id: DatabaseID, // ID of the basic grant for shared-logic checks like rate limits and validity periods
+    pub shared: SharedGrantSettings,
+    pub settings: PolicySettings,
 }
 
 pub trait Policy: Sized {
-    type Grant: Send + 'static + Into<SpecificGrant>;
+    type Settings: Send + 'static + Into<SpecificGrant>;
     type Meaning: Display + Send + 'static + Into<SpecificMeaning>;
 
     fn analyze(context: &EvalContext) -> Option<Self::Meaning>;
@@ -65,16 +78,16 @@ pub trait Policy: Sized {
     // Evaluate whether a transaction with the given meaning complies with the provided grant, and return any violations if not
     // Empty vector means transaction is compliant with the grant
     fn evaluate(
+        context: &EvalContext,
         meaning: &Self::Meaning,
-        grant: &Self::Grant,
+        grant: &Grant<Self::Settings>,
-        meta: &GrantMetadata,
         db: &mut impl AsyncConnection<Backend = Sqlite>,
     ) -> impl Future<Output = QueryResult<Vec<EvalViolation>>> + Send;
 
     // Create a new grant in the database based on the provided grant details, and return its ID
     fn create_grant(
         basic: &models::EvmBasicGrant,
-        grant: &Self::Grant,
+        grant: &Self::Settings,
         conn: &mut impl AsyncConnection<Backend = Sqlite>,
     ) -> impl std::future::Future<Output = QueryResult<DatabaseID>> + Send;
 
@@ -83,20 +96,28 @@ pub trait Policy: Sized {
     fn try_find_grant(
         context: &EvalContext,
         conn: &mut impl AsyncConnection<Backend = Sqlite>,
-    ) -> impl Future<Output = QueryResult<Option<(Self::Grant, GrantMetadata)>>>;
+    ) -> impl Future<Output = QueryResult<Option<Grant<Self::Settings>>>> + Send;
 
     // Records, updates or deletes rate limits
     // In other words, records grant-specific things after transaction is executed
     fn record_transaction(
         context: &EvalContext,
-        grant: &GrantMetadata,
+        meaning: &Self::Meaning,
+        log_id: i32,
+        grant: &Grant<Self::Settings>,
         conn: &mut impl AsyncConnection<Backend = Sqlite>,
     ) -> impl Future<Output = QueryResult<()>>;
 }
 
+pub enum ReceiverTarget {
+    Specific(Vec<Address>), // only allow transfers to these addresses
+    Any,                    // allow transfers to any address
+}
+
 // Classification of what transaction does
 pub enum SpecificMeaning {
     EtherTransfer(ether_transfer::Meaning),
+    TokenTransfer(token_transfers::Meaning),
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
@@ -106,7 +127,13 @@ pub struct TransactionRateLimit {
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
-pub struct BasicGrant {
+pub struct VolumeRateLimit {
+    pub max_volume: U256,
+    pub window: Duration,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct SharedGrantSettings {
     pub wallet_id: i32,
     pub chain: ChainId,
 
@@ -119,11 +146,53 @@ pub struct BasicGrant {
     pub rate_limit: Option<TransactionRateLimit>,
 }
 
+impl SharedGrantSettings {
+    fn try_from_model(model: EvmBasicGrant) -> QueryResult<Self> {
+        Ok(Self {
+            wallet_id: model.wallet_id,
+            chain: model.chain_id as u64, // safe because chain_id is stored as i32 but is guaranteed to be a valid ChainId by the API when creating grants
+            valid_from: model.valid_from.map(Into::into),
+            valid_until: model.valid_until.map(Into::into),
+            max_gas_fee_per_gas: model
+                .max_gas_fee_per_gas
+                .map(|b| utils::try_bytes_to_u256(&b))
+                .transpose()?,
+            max_priority_fee_per_gas: model
+                .max_priority_fee_per_gas
+                .map(|b| utils::try_bytes_to_u256(&b))
+                .transpose()?,
+            rate_limit: match (model.rate_limit_count, model.rate_limit_window_secs) {
+                (Some(count), Some(window_secs)) => Some(TransactionRateLimit {
+                    count: count as u32,
+                    window: Duration::seconds(window_secs as i64),
+                }),
+                _ => None,
+            },
+        })
+    }
+
+    pub async fn query_by_id(
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+        id: i32,
+    ) -> diesel::result::QueryResult<Self> {
+        use crate::db::schema::evm_basic_grant;
+
+        let basic_grant: EvmBasicGrant = evm_basic_grant::table
+            .select(EvmBasicGrant::as_select())
+            .filter(evm_basic_grant::id.eq(id))
+            .first::<EvmBasicGrant>(conn)
+            .await?;
+
+        Self::try_from_model(basic_grant)
+    }
+}
+
 pub enum SpecificGrant {
-    EtherTransfer(ether_transfer::Grant),
+    EtherTransfer(ether_transfer::Settings),
+    TokenTransfer(token_transfers::Settings),
 }
 
 pub struct FullGrant<PolicyGrant> {
-    pub basic: BasicGrant,
+    pub basic: SharedGrantSettings,
     pub specific: PolicyGrant,
 }

server/crates/arbiter-server/src/evm/policies/ether_transfer.rs

@@ -1,26 +1,24 @@
-use std::{fmt::Display, time::Duration};
+use std::fmt::Display;
 
 use alloy::primitives::{Address, U256};
-use chrono::{DateTime, Utc};
+use chrono::{DateTime, Duration, Utc};
 use diesel::dsl::insert_into;
 use diesel::sqlite::Sqlite;
 use diesel::{ExpressionMethods, JoinOnDsl, prelude::*};
 use diesel_async::{AsyncConnection, RunQueryDsl};
 
 use crate::db::models::{
-    EvmEtherTransferGrant, EvmEtherTransferGrantTarget, EvmEtherTransferVolumeLimit, SqliteTimestamp,
+    EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget, EvmEtherTransferLimit,
+    NewEvmEtherTransferLimit, SqliteTimestamp,
+};
+use crate::db::schema::{evm_ether_transfer_limit, evm_transaction_log};
+use crate::evm::policies::{
+    Grant, SharedGrantSettings, SpecificGrant, SpecificMeaning, VolumeRateLimit,
 };
-use crate::evm::policies::{GrantMetadata, SpecificGrant, SpecificMeaning};
 use crate::{
     db::{
-        models::{
+        models::{self, NewEvmEtherTransferGrant, NewEvmEtherTransferGrantTarget},
-            self, NewEvmEtherTransferGrant, NewEvmEtherTransferGrantTarget,
+        schema::{evm_ether_transfer_grant, evm_ether_transfer_grant_target},
-            NewEvmEtherTransferVolumeLimit,
-        },
-        schema::{
-            evm_ether_transfer_grant, evm_ether_transfer_grant_target,
-            evm_ether_transfer_volume_limit,
-        },
     },
     evm::{policies::Policy, utils},
 };
@@ -49,19 +47,13 @@ impl Into<SpecificMeaning> for Meaning {
     }
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Hash)]
-pub struct VolumeLimit {
-    window: Duration,
-    max_volume: U256,
-}
-
 // A grant for ether transfers, which can be scoped to specific target addresses and volume limits
-pub struct Grant {
+pub struct Settings {
     target: Vec<Address>,
-    limits: Vec<VolumeLimit>,
+    limit: VolumeRateLimit,
 }
 
-impl Into<SpecificGrant> for Grant {
+impl Into<SpecificGrant> for Settings {
     fn into(self) -> SpecificGrant {
         SpecificGrant::EtherTransfer(self)
     }
@@ -72,20 +64,17 @@ async fn query_relevant_past_transaction(
     longest_window: Duration,
     db: &mut impl AsyncConnection<Backend = Sqlite>,
 ) -> QueryResult<Vec<(U256, DateTime<Utc>)>> {
-    use crate::db::schema::evm_ether_transfer_log;
+    let past_transactions: Vec<(Vec<u8>, SqliteTimestamp)> = evm_transaction_log::table
-    let past_transactions: Vec<(Vec<u8>, SqliteTimestamp)> =
+        .filter(evm_transaction_log::grant_id.eq(grant_id))
-        evm_ether_transfer_log::table
+        .filter(
-            .filter(evm_ether_transfer_log::grant_id.eq(grant_id))
+            evm_transaction_log::signed_at.ge(SqliteTimestamp(chrono::Utc::now() - longest_window)),
-            .filter(
+        )
-                evm_ether_transfer_log::created_at
+        .select((
-                    .ge(SqliteTimestamp(chrono::Utc::now() - longest_window)),
+            evm_transaction_log::eth_value,
-            )
+            evm_transaction_log::signed_at,
-            .select((
+        ))
-                evm_ether_transfer_log::value,
+        .load(db)
-                evm_ether_transfer_log::created_at,
+        .await?;
-            ))
-            .load(db)
-            .await?;
     let past_transaction: Vec<(U256, DateTime<Utc>)> = past_transactions
         .into_iter()
         .filter_map(|(value_bytes, timestamp)| {
@@ -97,30 +86,22 @@ async fn query_relevant_past_transaction(
 }
 
 async fn check_rate_limits(
-    grant: &Grant,
+    grant: &Grant<Settings>,
-    meta: &GrantMetadata,
     db: &mut impl AsyncConnection<Backend = Sqlite>,
 ) -> QueryResult<Vec<EvalViolation>> {
     let mut violations = Vec::new();
-    // This has double meaning: checks for limit presence, and finds biggest window
+    let window = grant.settings.limit.window;
-    // to extract all needed historical transactions in one go later
-    let longest_window = grant.limits.iter().map(|limit| limit.window).max();
 
-    if let Some(longest_window) = longest_window {
+    let past_transaction = query_relevant_past_transaction(grant.id, window, db).await?;
-        let _past_transaction = query_relevant_past_transaction(meta.policy_grant_id, longest_window, db).await?;
 
-        for limit in &grant.limits {
+    let window_start = chrono::Utc::now() - grant.settings.limit.window;
-            let window_start = chrono::Utc::now() - limit.window;
+    let cumulative_volume: U256 = past_transaction
-            let cumulative_volume: U256 = _past_transaction
+        .iter()
-                .iter()
+        .filter(|(_, timestamp)| timestamp >= &window_start)
-                .filter(|(_, timestamp)| timestamp >= &window_start)
+        .fold(U256::default(), |acc, (value, _)| acc + *value);
-                .fold(U256::default(), |acc, (value, _)| acc + *value);
 
-            if cumulative_volume > limit.max_volume {
+    if cumulative_volume > grant.settings.limit.max_volume {
-                violations.push(EvalViolation::VolumetricLimitExceeded);
+        violations.push(EvalViolation::VolumetricLimitExceeded);
-            }
-        }
-        // TODO: Implement actual rate limit checking logic
     }
 
     Ok(violations)
@@ -128,7 +109,7 @@ async fn check_rate_limits(
 
 pub struct EtherTransfer;
 impl Policy for EtherTransfer {
-    type Grant = Grant;
+    type Settings = Settings;
 
     type Meaning = Meaning;
 
@@ -144,19 +125,19 @@ impl Policy for EtherTransfer {
     }
 
     async fn evaluate(
+        _: &EvalContext,
         meaning: &Self::Meaning,
-        grant: &Self::Grant,
+        grant: &Grant<Self::Settings>,
-        meta: &GrantMetadata,
         db: &mut impl AsyncConnection<Backend = Sqlite>,
     ) -> QueryResult<Vec<EvalViolation>> {
         let mut violations = Vec::new();
 
         // Check if the target address is within the grant's allowed targets
-        if !grant.target.contains(&meaning.to) {
+        if !grant.settings.target.contains(&meaning.to) {
             violations.push(EvalViolation::InvalidTarget { target: meaning.to });
         }
 
-        let rate_violations = check_rate_limits(grant, meta, db).await?;
+        let rate_violations = check_rate_limits(grant, db).await?;
         violations.extend(rate_violations);
 
         Ok(violations)
@@ -164,12 +145,22 @@ impl Policy for EtherTransfer {
 
     async fn create_grant(
         basic: &models::EvmBasicGrant,
-        grant: &Self::Grant,
+        grant: &Self::Settings,
         conn: &mut impl AsyncConnection<Backend = Sqlite>,
     ) -> diesel::result::QueryResult<DatabaseID> {
+        let limit_id: i32 = insert_into(evm_ether_transfer_limit::table)
+            .values(NewEvmEtherTransferLimit {
+                window_secs: grant.limit.window.num_seconds() as i32,
+                max_volume: utils::u256_to_bytes(grant.limit.max_volume).to_vec(),
+            })
+            .returning(evm_ether_transfer_limit::id)
+            .get_result(conn)
+            .await?;
+
         let grant_id: i32 = insert_into(evm_ether_transfer_grant::table)
             .values(&NewEvmEtherTransferGrant {
                 basic_grant_id: basic.id,
+                limit_id,
             })
             .returning(evm_ether_transfer_grant::id)
             .get_result(conn)
@@ -185,24 +176,13 @@ impl Policy for EtherTransfer {
                 .await?;
         }
 
-        for limit in &grant.limits {
-            insert_into(evm_ether_transfer_volume_limit::table)
-                .values(NewEvmEtherTransferVolumeLimit {
-                    grant_id,
-                    window_secs: limit.window.as_secs() as i32,
-                    max_volume: utils::u256_to_bytes(limit.max_volume).to_vec(),
-                })
-                .execute(conn)
-                .await?;
-        }
-
         Ok(grant_id)
     }
 
     async fn try_find_grant(
         context: &EvalContext,
         conn: &mut impl AsyncConnection<Backend = Sqlite>,
-    ) -> diesel::result::QueryResult<Option<(Self::Grant, GrantMetadata)>> {
+    ) -> diesel::result::QueryResult<Option<Grant<Self::Settings>>> {
         use crate::db::schema::{
             evm_basic_grant, evm_ether_transfer_grant, evm_ether_transfer_grant_target,
         };
@@ -212,7 +192,7 @@ impl Policy for EtherTransfer {
         // Find a grant where:
         // 1. The basic grant's wallet_id and client_id match the context
         // 2. Any of the grant's targets match the context's `to` address
-        let grant: Option<EvmEtherTransferGrant> = evm_ether_transfer_grant::table
+        let grant: Option<(EvmBasicGrant, EvmEtherTransferGrant)> = evm_ether_transfer_grant::table
             .inner_join(
                 evm_basic_grant::table
                     .on(evm_ether_transfer_grant::basic_grant_id.eq(evm_basic_grant::id)),
@@ -224,29 +204,28 @@ impl Policy for EtherTransfer {
             .filter(evm_basic_grant::wallet_id.eq(context.wallet_id))
             .filter(evm_basic_grant::client_id.eq(context.client_id))
             .filter(evm_ether_transfer_grant_target::address.eq(&target_bytes))
-            .select(EvmEtherTransferGrant::as_select())
+            .select((
-            .first::<EvmEtherTransferGrant>(conn)
+                EvmBasicGrant::as_select(),
+                EvmEtherTransferGrant::as_select(),
+            ))
+            .first(conn)
             .await
             .optional()?;
 
-        let Some(grant) = grant else {
+        let Some((basic_grant, grant)) = grant else {
             return Ok(None);
         };
 
-        use crate::db::schema::evm_ether_transfer_volume_limit;
-
-        // Load grant targets
         let target_bytes: Vec<EvmEtherTransferGrantTarget> = evm_ether_transfer_grant_target::table
             .select(EvmEtherTransferGrantTarget::as_select())
             .filter(evm_ether_transfer_grant_target::grant_id.eq(grant.id))
             .load(conn)
             .await?;
 
-        // Load volume limits
+        let limit: EvmEtherTransferLimit = evm_ether_transfer_limit::table
-        let limit_rows: Vec<EvmEtherTransferVolumeLimit> = evm_ether_transfer_volume_limit::table
+            .filter(evm_ether_transfer_limit::id.eq(grant.limit_id))
-            .filter(evm_ether_transfer_volume_limit::grant_id.eq(grant.id))
+            .select(EvmEtherTransferLimit::as_select())
-            .select(EvmEtherTransferVolumeLimit::as_select())
+            .first::<EvmEtherTransferLimit>(conn)
-            .load(conn)
             .await?;
 
         // Convert bytes back to Address
@@ -259,51 +238,31 @@ impl Policy for EtherTransfer {
             })
             .collect();
 
-        // Convert database rows to VolumeLimit
+        let settings = Settings {
-        let limits: Vec<VolumeLimit> = limit_rows
-            .into_iter()
-            .filter_map(|limit| {
-                // TODO: Handle invalid volumes more gracefully
-                let max_volume = utils::bytes_to_u256(&limit.max_volume)?;
-                Some(VolumeLimit {
-                    window: Duration::from_secs(limit.window_secs as u64),
-                    max_volume,
-                })
-            })
-            .collect();
-
-        let domain_grant = Grant {
             target: targets,
-            limits,
+            limit: VolumeRateLimit {
+                max_volume: utils::try_bytes_to_u256(&limit.max_volume)
+                    .map_err(|err| diesel::result::Error::DeserializationError(Box::new(err)))?,
+                window: chrono::Duration::seconds(limit.window_secs as i64),
+            },
         };
 
-        Ok(Some((
+        Ok(Some(Grant {
-            domain_grant,
+            id: grant.id,
-            GrantMetadata {
+            shared_grant_id: grant.basic_grant_id,
-                basic_grant_id: grant.basic_grant_id,
+            shared: SharedGrantSettings::try_from_model(basic_grant)?,
-                policy_grant_id: grant.id,
+            settings,
-            },
+        }))
-        )))
     }
 
     async fn record_transaction(
-        context: &EvalContext,
+        _context: &EvalContext,
-        grant: &GrantMetadata,
+        _: &Self::Meaning,
-        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+        _log_id: i32,
+        _grant: &Grant<Self::Settings>,
+        _conn: &mut impl AsyncConnection<Backend = Sqlite>,
     ) -> diesel::result::QueryResult<()> {
-        use crate::db::schema::evm_ether_transfer_log;
+        // Basic log is sufficient
-
-        insert_into(evm_ether_transfer_log::table)
-            .values(models::NewEvmEtherTransferLog {
-                grant_id: grant.policy_grant_id,
-                value: utils::u256_to_bytes(context.value).to_vec(),
-                client_id: context.client_id,
-                wallet_id: context.wallet_id,
-                chain_id: context.chain as i32,
-                recipient_address: context.to.to_vec(),
-            })
-            .execute(conn)
-            .await?;
 
         Ok(())
     }

server/crates/arbiter-server/src/evm/policies/token_transfers.rs

@@ -0,0 +1,291 @@
+use alloy::{
+    primitives::{Address, U256},
+    sol_types::SolCall,
+};
+use arbiter_tokens_registry::evm::nonfungible::{self, TokenInfo};
+use chrono::{DateTime, Duration, Utc};
+use diesel::dsl::insert_into;
+use diesel::sqlite::Sqlite;
+use diesel::{ExpressionMethods, prelude::*};
+use diesel_async::{AsyncConnection, RunQueryDsl};
+
+use crate::db::models::{
+    EvmBasicGrant, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit, NewEvmTokenTransferGrant,
+    NewEvmTokenTransferLog, NewEvmTokenTransferVolumeLimit, SqliteTimestamp,
+};
+use crate::db::schema::{
+    evm_token_transfer_grant, evm_token_transfer_log, evm_token_transfer_volume_limit,
+};
+use crate::evm::{
+    abi::IERC20::transferCall,
+    policies::{Grant, Policy, SharedGrantSettings, SpecificGrant, SpecificMeaning, VolumeRateLimit},
+    utils,
+};
+
+use super::{DatabaseID, EvalContext, EvalViolation};
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct Meaning {
+    token: &'static TokenInfo,
+    to: Address,
+    value: U256,
+}
+impl std::fmt::Display for Meaning {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "Transfer of {} {} to {}",
+            self.value, self.token.symbol, self.to
+        )
+    }
+}
+impl Into<SpecificMeaning> for Meaning {
+    fn into(self) -> SpecificMeaning {
+        SpecificMeaning::TokenTransfer(self)
+    }
+}
+
+// A grant for token transfers, which can be scoped to specific target addresses and volume limits
+pub struct Settings {
+    token_contract: Address,
+    target: Option<Address>,
+    volume_limits: Vec<VolumeRateLimit>,
+}
+impl Into<SpecificGrant> for Settings {
+    fn into(self) -> SpecificGrant {
+        SpecificGrant::TokenTransfer(self)
+    }
+}
+
+async fn query_relevant_past_transfers(
+    grant_id: i32,
+    longest_window: Duration,
+    db: &mut impl AsyncConnection<Backend = Sqlite>,
+) -> QueryResult<Vec<(U256, DateTime<Utc>)>> {
+    let past_logs: Vec<(Vec<u8>, SqliteTimestamp)> = evm_token_transfer_log::table
+        .filter(evm_token_transfer_log::grant_id.eq(grant_id))
+        .filter(
+            evm_token_transfer_log::created_at
+                .ge(SqliteTimestamp(chrono::Utc::now() - longest_window)),
+        )
+        .select((
+            evm_token_transfer_log::value,
+            evm_token_transfer_log::created_at,
+        ))
+        .load(db)
+        .await?;
+
+    let past_transfers: Vec<(U256, DateTime<Utc>)> = past_logs
+        .into_iter()
+        .filter_map(|(value_bytes, timestamp)| {
+            let value = utils::bytes_to_u256(&value_bytes)?;
+            Some((value, timestamp.0))
+        })
+        .collect();
+
+    Ok(past_transfers)
+}
+
+async fn check_volume_rate_limits(
+    grant: &Grant<Settings>,
+    db: &mut impl AsyncConnection<Backend = Sqlite>,
+) -> QueryResult<Vec<EvalViolation>> {
+    let mut violations = Vec::new();
+
+    let Some(longest_window) = grant.settings.volume_limits.iter().map(|l| l.window).max() else {
+        return Ok(violations);
+    };
+
+    let past_transfers = query_relevant_past_transfers(grant.id, longest_window, db).await?;
+
+    for limit in &grant.settings.volume_limits {
+        let window_start = chrono::Utc::now() - limit.window;
+        let cumulative_volume: U256 = past_transfers
+            .iter()
+            .filter(|(_, timestamp)| timestamp >= &window_start)
+            .fold(U256::default(), |acc, (value, _)| acc + *value);
+
+        if cumulative_volume > limit.max_volume {
+            violations.push(EvalViolation::VolumetricLimitExceeded);
+            break;
+        }
+    }
+
+    Ok(violations)
+}
+
+pub struct TokenTransferPolicy;
+impl Policy for TokenTransferPolicy {
+    type Settings = Settings;
+    type Meaning = Meaning;
+
+    fn analyze(context: &EvalContext) -> Option<Self::Meaning> {
+        let token = nonfungible::get_token(context.chain, context.to)?;
+        let decoded = transferCall::abi_decode_raw_validate(&context.calldata).ok()?;
+
+        Some(Meaning {
+            token,
+            to: decoded.to,
+            value: decoded.value,
+        })
+    }
+
+    async fn evaluate(
+        context: &EvalContext,
+        meaning: &Self::Meaning,
+        grant: &Grant<Self::Settings>,
+        db: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> QueryResult<Vec<EvalViolation>> {
+        let mut violations = Vec::new();
+
+        // erc20 transfer shouldn't carry eth value
+        if !context.value.is_zero() {
+            violations.push(EvalViolation::InvalidTransactionType);
+            return Ok(violations);
+        }
+
+        if let Some(allowed) = grant.settings.target {
+            if allowed != meaning.to {
+                violations.push(EvalViolation::InvalidTarget { target: meaning.to });
+            }
+        }
+
+        let rate_violations = check_volume_rate_limits(grant, db).await?;
+        violations.extend(rate_violations);
+
+        Ok(violations)
+    }
+
+    async fn create_grant(
+        basic: &EvmBasicGrant,
+        grant: &Self::Settings,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> QueryResult<DatabaseID> {
+        // Store the specific receiver as bytes (None means any receiver is allowed)
+        let receiver: Option<Vec<u8>> = grant.target.map(|addr| addr.to_vec());
+
+        let grant_id: i32 = insert_into(evm_token_transfer_grant::table)
+            .values(NewEvmTokenTransferGrant {
+                basic_grant_id: basic.id,
+                token_contract: grant.token_contract.to_vec(),
+                receiver,
+            })
+            .returning(evm_token_transfer_grant::id)
+            .get_result(conn)
+            .await?;
+
+        for limit in &grant.volume_limits {
+            insert_into(evm_token_transfer_volume_limit::table)
+                .values(NewEvmTokenTransferVolumeLimit {
+                    grant_id,
+                    window_secs: limit.window.num_seconds() as i32,
+                    max_volume: utils::u256_to_bytes(limit.max_volume).to_vec(),
+                })
+                .execute(conn)
+                .await?;
+        }
+
+        Ok(grant_id)
+    }
+
+    async fn try_find_grant(
+        context: &EvalContext,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> QueryResult<Option<Grant<Self::Settings>>> {
+        use crate::db::schema::{evm_basic_grant, evm_token_transfer_grant};
+
+        let token_contract_bytes = context.to.to_vec();
+
+        let grant: Option<(EvmBasicGrant, EvmTokenTransferGrant)> = evm_token_transfer_grant::table
+            .inner_join(
+                evm_basic_grant::table
+                    .on(evm_token_transfer_grant::basic_grant_id.eq(evm_basic_grant::id)),
+            )
+            .filter(evm_basic_grant::wallet_id.eq(context.wallet_id))
+            .filter(evm_basic_grant::client_id.eq(context.client_id))
+            .filter(evm_token_transfer_grant::token_contract.eq(&token_contract_bytes))
+            .select((
+                EvmBasicGrant::as_select(),
+                EvmTokenTransferGrant::as_select(),
+            ))
+            .first(conn)
+            .await
+            .optional()?;
+
+        let Some((basic_grant, token_grant)) = grant else {
+            return Ok(None);
+        };
+
+        let volume_limits_db: Vec<EvmTokenTransferVolumeLimit> =
+            evm_token_transfer_volume_limit::table
+                .filter(evm_token_transfer_volume_limit::grant_id.eq(token_grant.id))
+                .select(EvmTokenTransferVolumeLimit::as_select())
+                .load(conn)
+                .await?;
+
+        let volume_limits: Vec<VolumeRateLimit> = volume_limits_db
+            .into_iter()
+            .map(|row| {
+                Ok(VolumeRateLimit {
+                    max_volume: utils::try_bytes_to_u256(&row.max_volume).map_err(|err| {
+                        diesel::result::Error::DeserializationError(Box::new(err))
+                    })?,
+                    window: Duration::seconds(row.window_secs as i64),
+                })
+            })
+            .collect::<QueryResult<Vec<_>>>()?;
+
+        let token_contract: [u8; 20] = token_grant.token_contract.try_into().map_err(|_| {
+            diesel::result::Error::DeserializationError(
+                "Invalid token contract address length".into(),
+            )
+        })?;
+
+        let target: Option<Address> = match token_grant.receiver {
+            None => None,
+            Some(bytes) => {
+                let arr: [u8; 20] = bytes.try_into().map_err(|_| {
+                    diesel::result::Error::DeserializationError(
+                        "Invalid receiver address length".into(),
+                    )
+                })?;
+                Some(Address::from(arr))
+            }
+        };
+
+        let settings = Settings {
+            token_contract: Address::from(token_contract),
+            target,
+            volume_limits,
+        };
+
+        Ok(Some(Grant {
+            id: token_grant.id,
+            shared_grant_id: token_grant.basic_grant_id,
+            shared: SharedGrantSettings::try_from_model(basic_grant)?,
+            settings,
+        }))
+    }
+
+    async fn record_transaction(
+        context: &EvalContext,
+        meaning: &Self::Meaning,
+        log_id: i32,
+        grant: &Grant<Self::Settings>,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> QueryResult<()> {
+        insert_into(evm_token_transfer_log::table)
+            .values(NewEvmTokenTransferLog {
+                grant_id: grant.id,
+                log_id,
+                chain_id: context.chain as i32,
+                token_contract: context.to.to_vec(),
+                recipient_address: meaning.to.to_vec(),
+                value: utils::u256_to_bytes(meaning.value).to_vec(),
+            })
+            .execute(conn)
+            .await?;
+
+        Ok(())
+    }
+}

server/crates/arbiter-server/src/evm/utils.rs

@@ -1,5 +1,12 @@
 use alloy::primitives::U256;
 
+#[derive(thiserror::Error, Debug)]
+#[error("Expected {expected} bytes but got {actual} bytes")]
+pub struct LengthError {
+    pub expected: usize,
+    pub actual: usize,
+}
+
 pub fn u256_to_bytes(value: U256) -> [u8; 32] {
     value.to_le_bytes()
 }
@@ -7,3 +14,13 @@ pub fn bytes_to_u256(bytes: &[u8]) -> Option<U256> {
     let bytes: [u8; 32] = bytes.try_into().ok()?;
     Some(U256::from_le_bytes(bytes))
 }
+
+pub fn try_bytes_to_u256(bytes: &[u8]) -> diesel::result::QueryResult<U256> {
+    let bytes: [u8; 32] = bytes.try_into().map_err(|_| {
+        diesel::result::Error::DeserializationError(Box::new(LengthError {
+            expected: 32,
+            actual: bytes.len(),
+        }))
+    })?;
+    Ok(U256::from_le_bytes(bytes))
+}

server/crates/arbiter-tokens-registry/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "arbiter-tokens-registry"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+alloy.workspace = true

server/crates/arbiter-tokens-registry/src/evm/mod.rs

@@ -0,0 +1 @@
+pub mod nonfungible;

server/crates/arbiter-tokens-registry/src/evm/nonfungible.rs

@@ -0,0 +1,13 @@
+use alloy::primitives::{Address, ChainId, address};
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct TokenInfo {
+    pub name: &'static str,
+    pub symbol: &'static str,
+    pub decimals: u32,
+    pub contract: Address,
+    pub chain: ChainId,
+    pub logo_uri: Option<&'static str>,
+}
+
+include!("tokens.rs");

server/crates/arbiter-tokens-registry/src/lib.rs

@@ -0,0 +1 @@
+pub mod evm;