> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chipipay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# v14.17.0: SHHH V8.5, and Bramble as co-owner or guardian

> What v14.17.0 adds: new SHHH wallets deploy V8.5, which enforces the threshold for single signers; Bramble, Braavos, Ready and other Chipi wallets can co-own or guard a Chipi wallet (STARK_SNIP12); and Connect with Chipi 0.5.0 sits quietly next to Bramble.

<Info>
  v14.17.0 creates new SHHH wallets on **V8.5**, which fixes a threshold bypass in V8.4 (no mainnet wallet was affected). It also lets a user's own Starknet wallet (Bramble, Braavos, Ready, or another Chipi wallet) become a **co-owner** or a **recovery guardian** of their Chipi wallet. The wallet keeps its key and approves with `wallet_signTypedData`; Chipi relays gaslessly. It also fixes threshold signatures and Argent-shaped signatures. One behavior is stricter: a Chipi wallet object now refuses typed data with no `chainId` (see the table).
</Info>

## TL;DR: does this affect me?

| Your setup | Action |
| - | - |
| You create SHHH wallets (the default) | **None.** New wallets deploy V8.5 at a V8.5 address. Existing V8.4 wallets keep working at threshold 1. |
| You run, or plan, an N-of-M wallet or treasury | New wallets get the on-chain N-of-M. A V8.4 wallet can't: its threshold stays at 1 (see [SHHH V8.5](#shhh-v85)). |
| You don't use external Starknet wallets | **None.** |
| You want Bramble to approve sessions or recover a Chipi wallet | Follow [Trusted wallets](/sdk/guides/trusted-wallets). The `STARK_SNIP12` verifier class is declared on mainnet. |
| You use Sign in with Starknet | **None.** A domain `chainId` written as hex (`0x534e5f4d41494e`) is now accepted too. |
| Your dApp offers Connect with Chipi next to Bramble | Upgrade `@chipi-stack/starknet-connector` to `^0.5.0` (a caret on `0.4` does not reach it). |
| You host a wallet with `useChipiWalletObject` / `createChipiWindowObject` | `wallet_signTypedData` with no domain `chainId` is refused (`114`), as Bramble does. `wallet_deploymentData` answers `116` unless you pass `isDeployed: true`. |
| You build threshold signatures (`buildThresholdEnvelope`, `useThresholdSign`) | Upgrade. Earlier versions produced envelopes the wallet contract rejected (`THRESH: bad owner_id`). No code change on your side. |
| You use `sendSponsored()` or x402 with a Ready / Argent account | Upgrade. Its `["1", "0", publicKey, r, s]` signature was read as `r = 1, s = 0`. |

## SHHH V8.5

Through V8.4 the SHHH account checked the threshold only on threshold envelopes (`V2_THRESHOLD`). Its single-owner envelope (`V2_SNIP12`) never read it, so on an N-of-M wallet one owner signing alone could execute. V8.5 requires that owner's weight to meet the threshold, except for one call: an owner cancelling a recovery, naming itself. A guardian can still start a recovery alone, as before.

No mainnet wallet was affected: none ever had a threshold above 1. Full record: [`v8-5-audit-entry.md`](https://github.com/haycarlitos/shhh-wallet-cairo/blob/v8-robust/docs/v8-5-audit-entry.md).

| | Class hash | Declared |
| - | - | - |
| V8.5 (`WALLET_CLASS_HASHES.SHHH`) | `0x067828c8b82ac723b4adb141f9aa8975e296d8c11179d22bb8d7203b32abd96a` | 2026-10-14, block 16375744 |
| V8.4 (now in `LEGACY_SHHH_CLASS_HASHES`) | `0x075dfb396145926bffa6beb659897f46cc082a50b211d80871cff7f1038fa58a` | 2026-05-15 |

What changes for you:

* **`createWallet` (TS and Python)** computes the address with V8.5 and now names that class in `prepare-creation`. If the API answers with any other class it stops with `Not deploying`, so a wallet can't land at an address the SDK didn't compute. The API keeps V8.4 as its default for older SDKs, which name no class.
* **Existing wallets don't move.** V8.x has no upgrade path, and a V8.4 wallet at threshold 1 (every V8.4 wallet on mainnet) is not affected. `getWalletTypeFromClassHash` still returns `SHHH` for V8.4.
* **N-of-M only on V8.5.** Chipi's API refuses `propose_set_threshold` / `execute_set_threshold` above 1 for wallets on older classes (`422 SHHH_THRESHOLD_UNSUPPORTED`). A V8.4 treasury's `requiredApprovals` are enforced by Chipi's backend only; to get the on-chain N-of-M, move it to a V8.5 wallet. See [Co-signing](/services/gasless/threshold).
* **Same API otherwise.** V8.5 has the same constructor, storage layout and ABI as V8.4: every builder, hook and envelope works unchanged.
* **Migrating CHIPI wallets to SHHH** (`migrateChipiWalletToShhh`) still upgrades them to V8.4, the class Chipi's migration names.

## Trusted wallets (`@chipi-stack/backend`, `chipi-react`, `nextjs`)

Bramble signs with a STARK key, but only through typed data that includes its own address, so the wallet's `STARK` signer can't check it. The new `STARK_SNIP12` signer kind checks the STARK signature over an `Approval { Wallet, Hash }` typed data instead.

* `starkSnip12ApprovalTypedData`, `resolveStarkSnip12Signer`, `starkSnip12PubkeyFelts`, `buildStarkSnip12Envelope`, `verifyStarkSnip12Approval`, `parseStarknetWalletSignature`.
* `sdk.executeWithExternalSigner` and `useExternalSignerExecute`: run calls approved by the external wallet, relayed gaslessly. Lower level: `prepareExternalOwnerExecution` / `submitExternalOwnerExecution`.
* Governance: `buildProposeAddVerifierClassCall` / `buildExecuteAddVerifierClassCall` (a wallet must register a kind before it can have an owner of that kind), `isShhhVerifierDeclared`.
* Reads: `readShhhOwners`, `readVerifierClass`, `readPendingRecovery`, `parseOpProposedEvents` (op ids come from the propose transaction's events).
* `executeShhhWithStarkKey`: sign as a STARK owner other than owner 0, such as the key a guardian recovery added.

```ts theme={null}
const txHash = await sdk.executeWithExternalSigner({
  params: {
    walletAddress: chipiWallet.publicKey,
    ownerIndex: brambleOwnerId,
    calls,
    signTypedData: async (typedData) =>
      (await bramble.request({ type: "wallet_signTypedData", params: typedData })) as string[],
  },
  bearerToken,
});
```

The verifier (`StarkSnip12Verifier`, class `0x017884125977631bee198b34cd3e3fcf975a543e453c8b996a818910a964b5e`) lands on existing wallets through `propose_add_verifier_class` (48 hours); no wallet redeploys or upgrades. It is declared on mainnet (2026-10-14, block 16377651).

## Connect with Chipi 0.5.0 (`@chipi-stack/starknet-connector`)

Wallet scanners such as get-starknet v4 call `wallet_getPermissions` on every injected wallet at page load, Bramble's and Chipi's alike. Those passive calls no longer try to open the Chipi popup: before the user connects, Chipi answers them locally. The README and [connector docs](/sdk/connector/overview) now show Chipi next to Bramble, Ready and Braavos, and list every error the connector returns.

## Connect with Chipi wallet object (`@chipi-stack/chipi-react`)

`useChipiWalletObject` answered `wallet_deploymentData` with `115` ("already deployed") even for an account that is not deployed. It now answers `116` ("deployment data is not available") unless you pass `isDeployed: true`, which keeps `115`.

## Fixes

* **Threshold envelopes** (`@chipi-stack/backend`, Python SDK): `buildThresholdEnvelope` kept each owner's `V2_SNIP12` tag inside the envelope, and the wallet contract rejected every such envelope with `THRESH: bad owner_id`. It now emits each frame as `[owner_id, kind_tag, ...payload]`, the shape the contract verifies. `useThresholdSign` gets the fix through it; you still pass the per-kind builders' envelopes.
* **Argent signatures**: the paymaster adapter (`sendSponsored()`) and core's x402 client read `["1", "0", publicKey, r, s]` as `r = 1, s = 0`. Both now take `r` and `s` from the end, and refuse shapes they don't know.
* **Sign in with Starknet** accepts the domain `chainId` as `SN_MAIN` or its felt.

## Docs fixes

* [Guardian recovery](/services/gasless/recovery): recovery adds an owner (it never replaces one), `cancel_recovery` takes the cancelling owner's id, guardians cannot cancel, and every `execute_*` call is permissionless. Adding an owner of a new kind needs the verifier class first.
* [Sign in with Starknet](/sdk/guides/sign-in-with-starknet): Bramble end to end, every failure reason, and the wallet error codes.
* [When passkeys fail](/sdk/passkeys/when-passkeys-fail), [threshold](/services/gasless/threshold), [multi-owner governance](/sdk/guides/multisig-governance) and the core signer pages: corrected against the code.

## Related

* [Trusted wallets](/sdk/guides/trusted-wallets)
* [Sign in with Starknet](/sdk/guides/sign-in-with-starknet)
* [Connect with Chipi](/sdk/connector/overview)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.