fix: disable gasless voting for smart contract wallets

[JoaquinBattilana]

Summary

Smart contract wallets (e.g. Safe) can't use the gas-sponsored voting path: the relay submits submitVoteBySignature, which verifies the vote with ecrecover, so the signer must be an EOA. A Safe's EIP-1271 signature can't be represented as v, r, s and would never recover to the Safe address.

This gates the relay path on useIsContractAddress(user, votingChainId) — the wallet must already be on the voting chain to sign the typed data, so that's where a contract wallet will have code. Contract wallets go straight to the existing self-paid submitVote flow (no signature prompt, no relay error). The gate fails closed while the lookup resolves.

This mirrors the permit → approve fallback used elsewhere in the app and the behaviour of the Aave governance interface (gelatoNotAvailableGnosis).

Test plan

• EOA with NEXT_PUBLIC_ENABLE_GASLESS_VOTING=true: vote goes through the relay as before
• Safe on the voting chain: vote skips the signature prompt and sends submitVote directly
• NEXT_PUBLIC_ENABLE_GASLESS_VOTING=false: unchanged, self-paid for everyone

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
interface	Ready	Preview	Aug 26, 2026 6:53pm

[odin-by-borg]

Mjolnir Security Review

Verdict	CLEAN · 0 findings
Commit	1253f63 · 53s

No security vulnerabilities identified. The PR improves security posture by correctly disabling gasless (relay-sponsored) voting for smart contract wallets, which cannot produce valid ECDSA signatures for ecrecover-based on-chain verification. The strict === false comparison ensures gasless voting remains disabled during the loading state, defaulting to the safer self-paid path. The on-chain submitVoteBySignature contract provides a robust server-side security boundary regardless of client-side checks.

---

_{13 PRs reviewed}

[github-actions]

• Ipfs hash: bafybeidvfjjnw5w6x2kw4rcb5ypgw7qs3bqbkge4hl6yjruc7vydvk5ps4
• Ipfs preview link: https://bafybeidvfjjnw5w6x2kw4rcb5ypgw7qs3bqbkge4hl6yjruc7vydvk5ps4.ipfs.cf-ipfs.com/

[github-actions]

📦 Next.js Bundle Analysis for aave-ui

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌