fix(bsc): remove ethereumjs-util import, add WalletConnect test coverage

Replace the ethereumjs-util addHexPrefix import (not in sdk-coin-bsc
deps) with an inline helper. ethereumjs-util is a transitive dep of
abstract-eth, not a direct dep of sdk-coin-bsc, so relying on it was
fragile.

Add two tests for the WalletConnect recipients[0].data flow in
verifyTssTransaction:
- BEP-20 with matching recipients[0].data passes
- BEP-20 with tampered txHex calldata but correct recipients[0].data
  throws (tampered-recipient rejection)

Ticket: WCI-1169
Session-Id: 4ade7ff7-085e-476d-b280-f4d3dd01c105
Task-Id: 9e3fa483-2a00-47db-aa04-c64b6f003a77

Author: Marzooqa

modules/sdk-coin-bsc/src/bsc.ts

@@ -17,9 +17,10 @@ import {
   recoveryBlockchainExplorerQuery,
   VerifyEthTransactionOptions,
 } from '@bitgo/abstract-eth';
-import { addHexPrefix } from 'ethereumjs-util';
 import { TransactionBuilder } from './lib';
 
+const addHexPrefix = (hex: string): string => (hex.startsWith('0x') ? hex : `0x${hex}`);
+
 export class Bsc extends AbstractEthLikeNewCoins {
   protected constructor(bitgo: BitGoBase, staticsCoin?: Readonly<StaticsBaseCoin>) {
     super(bitgo, staticsCoin);

modules/sdk-coin-bsc/src/bscToken.ts

@@ -19,9 +19,10 @@ import {
   getRawDecoded,
   VerifyEthTransactionOptions,
 } from '@bitgo/abstract-eth';
-import { addHexPrefix } from 'ethereumjs-util';
 import { TransactionBuilder } from './lib';
 
+const addHexPrefix = (hex: string): string => (hex.startsWith('0x') ? hex : `0x${hex}`);
+
 export { EthLikeTokenConfig };
 
 export class BscToken extends EthLikeToken {

modules/sdk-coin-bsc/test/unit/bsc.ts

@@ -159,5 +159,71 @@ describe('Native BNB', function () {
         })
         .should.be.rejectedWith('destination address does not match with the recipient address');
     });
+
+    it('should accept a BEP-20 token transfer using WalletConnect recipients[0].data flow', async function () {
+      const coin = bitgo.coin('tbsc') as Tbsc;
+
+      // txHex sends to recipientAddress; recipients[0].data encodes the same intent
+      const methodId = EthereumAbi.methodID('transfer', ['address', 'uint256']);
+      const encodedParams = EthereumAbi.rawEncode(['address', 'uint256'], [recipientAddress, '10000000']);
+      const erc20TransferData = '0x' + Buffer.concat([methodId, encodedParams]).toString('hex');
+
+      const txBuilder = getBuilder('tbsc') as TransactionBuilder;
+      txBuilder.type(TransactionType.ContractCall);
+      txBuilder.fee({ fee: '10', gasLimit: '60000' });
+      txBuilder.counter(1);
+      txBuilder.contract(tokenContractAddress);
+      txBuilder.data(erc20TransferData);
+      const tx = await txBuilder.build();
+      const txHex = tx.toBroadcastFormat();
+
+      const wallet = new Wallet(bitgo, coin, { coinSpecific: { baseAddress: recipientAddress } });
+
+      const result = await coin.verifyTssTransaction({
+        txParams: {
+          type: 'transfer',
+          // WalletConnect passes the intended calldata in recipients[0].data
+          recipients: [{ address: tokenContractAddress, amount: '0', data: erc20TransferData }],
+        } as any,
+        txPrebuild: { txHex, coin: 'tbsc', walletId: 'fakeWalletId' } as any,
+        wallet,
+      });
+      result.should.equal(true);
+    });
+
+    it('should reject a BEP-20 token transfer using WalletConnect flow when calldata recipient is tampered', async function () {
+      const coin = bitgo.coin('tbsc') as Tbsc;
+
+      // txHex sends to wrongAddress (tampered)
+      const methodId = EthereumAbi.methodID('transfer', ['address', 'uint256']);
+      const tamperedParams = EthereumAbi.rawEncode(['address', 'uint256'], [wrongAddress, '10000000']);
+      const tamperedData = '0x' + Buffer.concat([methodId, tamperedParams]).toString('hex');
+
+      const txBuilder = getBuilder('tbsc') as TransactionBuilder;
+      txBuilder.type(TransactionType.ContractCall);
+      txBuilder.fee({ fee: '10', gasLimit: '60000' });
+      txBuilder.counter(1);
+      txBuilder.contract(tokenContractAddress);
+      txBuilder.data(tamperedData);
+      const tx = await txBuilder.build();
+      const txHex = tx.toBroadcastFormat();
+
+      // recipients[0].data declares the correct recipient (recipientAddress)
+      const correctParams = EthereumAbi.rawEncode(['address', 'uint256'], [recipientAddress, '10000000']);
+      const correctData = '0x' + Buffer.concat([methodId, correctParams]).toString('hex');
+
+      const wallet = new Wallet(bitgo, coin, { coinSpecific: { baseAddress: recipientAddress } });
+
+      await coin
+        .verifyTssTransaction({
+          txParams: {
+            type: 'transfer',
+            recipients: [{ address: tokenContractAddress, amount: '0', data: correctData }],
+          } as any,
+          txPrebuild: { txHex, coin: 'tbsc', walletId: 'fakeWalletId' } as any,
+          wallet,
+        })
+        .should.be.rejectedWith('destination address does not match with the recipient address');
+    });
   });
 });