From 19ec2897d172cce7afba29171b7afc46e28b517d Mon Sep 17 00:00:00 2001
From: Sasha Mitchell <sash.t.mitchell@gmail.com>
Date: Sat, 8 Aug 2026 09:46:06 +0700
Subject: [PATCH] fix(enso): cap route slippage to 0-10000 bps

Prevent agents from requesting unbounded Enso slippage via schema validation.
Matches Jupiter (#1393) and 0x provider caps.
---
 .../src/action-providers/enso/README.md       |  2 +-
 .../enso/ensoActionProvider.test.ts           | 62 +++++++++++++++++++
 .../src/action-providers/enso/schemas.ts      | 10 ++-
 3 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/typescript/agentkit/src/action-providers/enso/README.md b/typescript/agentkit/src/action-providers/enso/README.md
index 0629e9705..75fda0d4e 100644
--- a/typescript/agentkit/src/action-providers/enso/README.md
+++ b/typescript/agentkit/src/action-providers/enso/README.md
@@ -25,7 +25,7 @@ enso/
 - `tokenIn`: Address of the token to swap from (for ETH, use `0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`)
 - `tokenOut`: Address of the token to swap to (for ETH, use `0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`)
 - `amountIn`: Amount of tokenIn to swap in whole units (e.g., "100 USDC")
-- `slippage`: Optional slippage tolerance in basis points (1/10000). Default is 50 (0.5%)
+- `slippage`: Optional slippage tolerance in basis points (0-10000). Default is 50 (0.5%). Values above 10000 are rejected.
 
 ## Network Support
 
diff --git a/typescript/agentkit/src/action-providers/enso/ensoActionProvider.test.ts b/typescript/agentkit/src/action-providers/enso/ensoActionProvider.test.ts
index 6d0d07f82..1eb9d4d9c 100644
--- a/typescript/agentkit/src/action-providers/enso/ensoActionProvider.test.ts
+++ b/typescript/agentkit/src/action-providers/enso/ensoActionProvider.test.ts
@@ -46,6 +46,68 @@ describe("Enso Route Schema", () => {
 
     expect(result.success).toBe(false);
   });
+
+  it("should accept null slippage (API/default path)", () => {
+    const result = EnsoRouteSchema.safeParse({
+      tokenIn: USDC,
+      tokenOut: WETH,
+      amountIn: "100",
+      slippage: null,
+    });
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.slippage).toBeNull();
+    }
+  });
+
+  it("should accept boundary slippage 0 and 10000", () => {
+    for (const slippage of [0, 10000]) {
+      const result = EnsoRouteSchema.safeParse({
+        tokenIn: USDC,
+        tokenOut: WETH,
+        amountIn: "100",
+        slippage,
+      });
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.data.slippage).toBe(slippage);
+      }
+    }
+  });
+
+  it("should reject slippage above 10000 bps", () => {
+    const result = EnsoRouteSchema.safeParse({
+      tokenIn: USDC,
+      tokenOut: WETH,
+      amountIn: "100",
+      slippage: 10001,
+    });
+
+    expect(result.success).toBe(false);
+  });
+
+  it("should reject negative slippage", () => {
+    const result = EnsoRouteSchema.safeParse({
+      tokenIn: USDC,
+      tokenOut: WETH,
+      amountIn: "100",
+      slippage: -1,
+    });
+
+    expect(result.success).toBe(false);
+  });
+
+  it("should reject non-integer slippage", () => {
+    const result = EnsoRouteSchema.safeParse({
+      tokenIn: USDC,
+      tokenOut: WETH,
+      amountIn: "100",
+      slippage: 50.5,
+    });
+
+    expect(result.success).toBe(false);
+  });
 });
 
 describe("Enso Route Action", () => {
diff --git a/typescript/agentkit/src/action-providers/enso/schemas.ts b/typescript/agentkit/src/action-providers/enso/schemas.ts
index ccbcdb034..89dbc75fb 100644
--- a/typescript/agentkit/src/action-providers/enso/schemas.ts
+++ b/typescript/agentkit/src/action-providers/enso/schemas.ts
@@ -22,6 +22,14 @@ export const EnsoRouteSchema = z
         "Address of the token to swap to, For ETH, use 0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
       ),
     amountIn: z.string().describe("Amount of tokenIn to swap in whole units (e.g. 100 USDC)"),
-    slippage: z.number().nullable().describe("Slippage in basis points (1/10000). Default - 50"),
+    slippage: z
+      .number()
+      .int()
+      .min(0)
+      .max(10000)
+      .nullable()
+      .describe(
+        "Slippage in basis points (0-10000, 1/10000 units). Default 50 (0.5%). Caps match Jupiter/0x.",
+      ),
   })
   .describe("Instructions for routing through Enso API");