Coinbase SDK’s USDC shortcut works only on Base networks

An audit conducted on Oct. 11 reviewed Coinbase’s Node and TypeScript CDP SDK version 1.58.0, which was published on Oct. 6. The package creates and manages Coinbase Developer Platform Server Wallets, including externally owned accounts and ERC-4337 Smart Accounts.

The review examined the transfer code, network settings, token decimals, return values and policy controls. It found that developers can call account.transfer with token set to usdc on Base and Base Sepolia. The amount must be supplied as a bigint in the token’s smallest units.

USDC uses six decimal places. A transfer of 25.50 USDC therefore requires 25,500,000 atomic units, which can be generated with viem’s parseUnits function and a precision of six. The parseEther function uses 18 decimal places and would create an amount one trillion times larger.

The SDK’s address map includes Circle’s USDC contracts on Base and Base Sepolia. On Ethereum, Arbitrum, Optimism and Polygon, the same usdc value returned the literal string usdc instead of a contract address during the local test. Developers using those networks must provide the relevant USDC contract address as a hexadecimal address.

The transfer response depends on the wallet type. An externally owned account returns a transaction hash and must hold the network’s native asset to pay gas. A Smart Account returns a user operation hash. Developers must pass that hash to waitForUserOperation before treating the transfer as complete. A user operation hash should not be presented as a blockchain transaction hash.

The SDK expects lowercase network strings, including base and base-sepolia, rather than viem chain objects. Its transaction operations list several other EVM networks. The audit found differences between network validation in the code and Smart Account support described in Coinbase’s documentation, and recommended checking current support before using Smart Accounts outside Base.

No live USDC transfers were completed because CDP API credentials and wallet funds were unavailable. The review instead inspected the published package, its address map, transfer strategies and TypeScript types. Coinbase’s faucet and broadcast procedures were not tested, and no transaction hashes were generated.

The review also examined policy controls for agent-managed wallets. These include recipient allowlists, restrictions on permitted contract addresses and limits on the net change in a wallet’s USDC balance. Smart Account owners, which sign user operations, can be kept separate from an agent’s runtime.

The CDP SDK is separate from Coinbase’s AgentKit, Agentic Wallet, MCP and CLI products. The Node package is intended for backend applications that create Coinbase-managed wallets and call functions such as transfers, swaps and policy management. Coinbase also offers Python and React tools, but the audit covered the server-side TypeScript package.