fix: use derive_safe_wallet instead of derive_proxy_wallet for default proxy derivation

[pck101001]

Summary

• Replace derive_proxy_wallet (EIP-1167) with derive_safe_wallet (Gnosis Safe) as the default proxy wallet derivation
• Change DEFAULT_SIGNATURE_TYPE from "proxy" to "gnosis-safe"
• Users can still pass --signature-type proxy for Magic Link accounts

Problem

The CLI derives the proxy wallet address using derive_proxy_wallet() (EIP-1167 minimal proxy, factory 0xaB45...), but Polymarket deploys Gnosis Safe wallets (factory 0xaacF...) for browser wallet users. The two derivation methods use different salt encoding, factory addresses, and init code hashes, producing completely different addresses for the same EOA.

This causes:

• wallet show displaying the wrong proxy address
• clob balance returning 0 (querying wrong address)
• approve set approving the wrong address
• setup wizard directing users to deposit to the wrong address

Changes

File	Change
src/config.rs	DEFAULT_SIGNATURE_TYPE: "proxy" → "gnosis-safe"
src/commands/wallet.rs	derive_proxy_wallet → derive_safe_wallet; default --signature-type → "gnosis-safe"
src/commands/setup.rs	derive_proxy_wallet → derive_safe_wallet
src/auth.rs	Decouple parse_signature_type from DEFAULT_SIGNATURE_TYPE constant to prevent incorrect mapping

Verification

# After the fix, the derived proxy address matches the API:
polymarket wallet show -o json        # proxy_address field
polymarket profiles get <eoa> -o json # proxyWallet field
# These two now return the same address.

Test plan

• cargo test — all 143 tests pass (94 unit + 49 integration)
• polymarket wallet show displays the correct Gnosis Safe proxy address
• polymarket clob balance returns the actual balance
• --signature-type proxy still works for Magic Link accounts

Fixes #14

---

Note

Medium Risk
Medium risk because it changes the default signature type and proxy-address derivation used for deposits/approvals and balance lookups, which could alter user-visible addresses for existing setups if they relied on the prior default.

Overview
Updates the CLI to derive and display proxy wallet addresses using derive_safe_wallet (Gnosis Safe) instead of derive_proxy_wallet, including in the setup wizard and wallet commands.

Changes the default signature type from proxy to gnosis-safe (CLI defaults and DEFAULT_SIGNATURE_TYPE), and adjusts signature-type parsing to map the literal "proxy" string rather than tying behavior to the default constant.

^{Written by Cursor Bugbot for commit 0c55155. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable autofix in the Cursor dashboard.}

[cursor]

Proxy mode derivation is ignored

Medium Severity

derive_safe_wallet is now used unconditionally in wallet and setup, so derived proxy output no longer follows the configured signature_type. When users intentionally use proxy (Magic Link), proxy_address and deposit guidance can point to the wrong derived wallet despite --signature-type proxy being set.

Additional Locations (2)

• src/commands/wallet.rs#L105-L106
• src/commands/setup.rs#L158-L159