[sdk-drift] TS: _hostedCancelTypedDataRoute returns Limitless route names absent from SCHEMAS, blocking all Limitless hosted cancels

[realfishsam]

Drift Finding

Category: Model/type drift + runtime blocking bug
Severity: Critical — all Limitless hosted order cancels fail at runtime in the TypeScript SDK
Files: sdks/typescript/pmxt/client.ts, sdks/typescript/pmxt/hosted-typed-data.ts

---

Description

Exchange._hostedCancelTypedDataRoute in the TypeScript SDK generates route name strings for Limitless that do not exist in the SCHEMAS dictionary in hosted-typed-data.ts. This causes validateTypedData to always throw InvalidSignature when a Limitless client tries to cancel a hosted order — the cancel path is completely broken at runtime.

TypeScript — client.ts (lines ~2314–2319)

private _hostedCancelTypedDataRoute(isPull: boolean): string {
    const venue = this.exchangeName;
    if (venue === "polymarket") return "cancel_polymarket";
    if (venue === "limitless") return isPull ? "cancel_limitless_base_pull" : "cancel_limitless_polygon";
    return isPull ? "cancel_opinion_bsc_pull" : "cancel_opinion_polygon";
}

TypeScript — hosted-typed-data.ts SCHEMAS keys (all 11 present)

polymarket_buy
polymarket_sell
limitless_buy
limitless_sell_polygon
limitless_sell_base_pull
opinion_buy
opinion_sell_polygon
opinion_sell_bsc_pull
cancel_polymarket
cancel_opinion_polygon
cancel_opinion_bsc_pull

cancel_limitless_polygon and cancel_limitless_base_pull are absent from SCHEMAS.

Failure path

When a Limitless hosted client calls cancelOrder, the code path is:

1. _hostedCancelTypedDataRoute(isPull) → returns "cancel_limitless_polygon" or "cancel_limitless_base_pull"
2. validateTypedData(typedData, route, ...) → calls schemaFor(route)
3. schemaFor throws InvalidSignature(0, "unknown typed-data route: 'cancel_limitless_polygon'")

Every Limitless hosted cancel operation fails at this step with no fallback.

---

Python comparison

Python _hosted_typeddata.py SCHEMAS also does not include cancel_limitless_polygon or cancel_limitless_base_pull. However, in Python _hostedCancelTypedDataRoute is not present in the same form — the Python SDK's Limitless cancel flow should be investigated separately. The TS bug is independently confirmed by direct code tracing.

---

Expected behavior

Either:

• Add cancel_limitless_polygon and cancel_limitless_base_pull EIP-712 schemas to SCHEMAS in hosted-typed-data.ts (matching the actual Limitless cancel typed-data structures), or
• Remove the Limitless branch from _hostedCancelTypedDataRoute and route Limitless cancels through a non-typed-data path if the chain doesn't require EIP-712 signing for cancels

---

Audit metadata

Detected by automated SDK drift auditor (scheduled routine, 2026-06-17).
Related issues: #1143 (TS validateEconomics skips Limitless routes)