@agenticprimitives/contracts 1.0.0-alpha.10 → 1.0.0-alpha.12

package/AUDIT.md

@@ -65,7 +65,8 @@ This package ships the **on-chain enforcement layer** for the agenticprimitives
 
 ### 3.2 `agency/DelegationManager.sol` + `enforcers/*`
 
-- **5 enforcers.** AllowedMethods, AllowedTargets, Timestamp, Value, Quorum. All five are **stateless validators**: `beforeHook` / `afterHook` are pure / view, no SSTORE, no events. Invariant locked in `test/EnforcerPauseInvariantR67.t.sol` (R6.7) — see § 3.3.
+- **5 stateless enforcers.** AllowedMethods, AllowedTargets, Timestamp, Value, Quorum. All five are **stateless validators**: `beforeHook` / `afterHook` are pure / view, no SSTORE, no events — safe to call externally. Invariant locked in `test/EnforcerPauseInvariantR67.t.sol` (R6.7) — see § 3.3.
+- **PaymentEnforcer is the STATEFUL exception (EXT-PMT-1, was C-NEW-1).** It SSTOREs budget/nonce and writes a settlement receipt, so it is explicitly NOT safe to call externally. It is bound to an immutable `delegationManager` at construction and both hooks carry `onlyDelegationManager`; a direct caller reverts `NotDelegationManager` and can neither forge a `PaymentSettled` receipt nor grief the victim's budget/nonce. Fail-closed regression: `test/PaymentEnforcer.t.sol::test_EXTPMT1_*`. (Pre-fix, the unbound `beforeHook` let any EOA forge receipts + burn nonces — see `docs/audits/findings.yaml` EXT-PMT-1.)
 - **EIP-712 Caveat typehash** = `keccak256("Caveat(address enforcer,bytes terms)")` — EXCLUDES `args` (audit F-1 — the inclusion bug caused every caveat-carrying delegation to fail on-chain ERC-1271 redeem AND let a redeemer's chosen args ride inside the delegator's signature). `packages/delegation/src/hash.ts` mirrors this.
 - **Test posture:** DelegationManager 95.8% lines / 88.2% branches (post-R6 aggregator).
 - **QuorumEnforcer:** payload-hash binding closed in H7 (`QuorumEnforcer.sol` checks `keccak256(args) == decoded_payload_hash`). R6.9 aggregator confirms 95.5% lines / 100% branches.

package/deployments-base-sepolia.json

@@ -29,8 +29,8 @@
   "timestampEnforcer": "0x7c452434314A5bf2048f9263aeCd0cC20Fa07965",
   "universalSignatureValidator": "0xe8F3e531429F44D77dC3A331C18032bfa1550D84",
   "valueEnforcer": "0x7c4533e0A9fB0B1cb5aa70327b222a80d72d52db",
-  "paymentEnforcer": "0xAF48273e11435cC2D56f4AFBfD091Abb162458E9",
-  "paymentReceiptRegistry": "0x366616E265cd3cDE0F042A592C17838fe210D1d4",
+  "paymentEnforcer": "0xCB5D2dbfc11e146d568764471516C9DB734D2c60",
+  "paymentReceiptRegistry": "0x391Ed4D7538f80a221F910539005bB00b996Ff9F",
   "mockUsdc": "0x8fb56ff3C13347DFC4E1287aE83E88deE5a7211C",
-  "paymentEscrow": "0x954Ba6B3A02E02c5a3Fcd570943126633071cbdD"
+  "paymentEscrow": "0xC85EB1831e9180F5e2cA7854f362f6C9a6D727EA"
 }

package/dist/abi/PaymentEnforcer.json

@@ -2,6 +2,11 @@
   {
     "type": "constructor",
     "inputs": [
+      {
+        "name": "delegationManager_",
+        "type": "address",
+        "internalType": "address"
+      },
       {
         "name": "receiptRegistry_",
         "type": "address",
@@ -56,7 +61,7 @@
       }
     ],
     "outputs": [],
-    "stateMutability": "pure"
+    "stateMutability": "view"
   },
   {
     "type": "function",
@@ -106,6 +111,19 @@
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "function",
+    "name": "delegationManager",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "encodeTerms",
@@ -378,6 +396,17 @@
       }
     ]
   },
+  {
+    "type": "error",
+    "name": "NotDelegationManager",
+    "inputs": [
+      {
+        "name": "caller",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "NotTransferCall",

package/dist/abi/PaymentEscrow.json

@@ -46,6 +46,11 @@
     "type": "function",
     "name": "getHold",
     "inputs": [
+      {
+        "name": "payer",
+        "type": "address",
+        "internalType": "address"
+      },
       {
         "name": "orderHash",
         "type": "bytes32",
@@ -120,6 +125,11 @@
     "type": "function",
     "name": "refund",
     "inputs": [
+      {
+        "name": "payer",
+        "type": "address",
+        "internalType": "address"
+      },
       {
         "name": "orderHash",
         "type": "bytes32",
@@ -133,6 +143,11 @@
     "type": "function",
     "name": "release",
     "inputs": [
+      {
+        "name": "payer",
+        "type": "address",
+        "internalType": "address"
+      },
       {
         "name": "orderHash",
         "type": "bytes32",
@@ -146,6 +161,11 @@
     "type": "function",
     "name": "statusOf",
     "inputs": [
+      {
+        "name": "payer",
+        "type": "address",
+        "internalType": "address"
+      },
       {
         "name": "orderHash",
         "type": "bytes32",
@@ -240,6 +260,11 @@
     "name": "BadExpiry",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "Expired",
+    "inputs": []
+  },
   {
     "type": "error",
     "name": "FailedInnerCall",

package/dist/deployments/base-sepolia.js

@@ -31,9 +31,9 @@ export const CONTRACTS = {
   "timestampEnforcer": "0x7c452434314A5bf2048f9263aeCd0cC20Fa07965",
   "universalSignatureValidator": "0xe8F3e531429F44D77dC3A331C18032bfa1550D84",
   "valueEnforcer": "0x7c4533e0A9fB0B1cb5aa70327b222a80d72d52db",
-  "paymentEnforcer": "0xAF48273e11435cC2D56f4AFBfD091Abb162458E9",
-  "paymentReceiptRegistry": "0x366616E265cd3cDE0F042A592C17838fe210D1d4",
+  "paymentEnforcer": "0xCB5D2dbfc11e146d568764471516C9DB734D2c60",
+  "paymentReceiptRegistry": "0x391Ed4D7538f80a221F910539005bB00b996Ff9F",
   "mockUsdc": "0x8fb56ff3C13347DFC4E1287aE83E88deE5a7211C",
-  "paymentEscrow": "0x954Ba6B3A02E02c5a3Fcd570943126633071cbdD"
+  "paymentEscrow": "0xC85EB1831e9180F5e2cA7854f362f6C9a6D727EA"
 };
 export default CONTRACTS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.10",
+  "version": "1.0.0-alpha.12",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
   "license": "MIT",
   "repository": {

package/src/enforcers/PaymentEnforcer.sol

@@ -58,6 +58,14 @@ contract PaymentEnforcer is ICaveatEnforcer {
     /// delegator => delegationHash => nonce => consumed (on-chain replay guard)
     mapping(address => mapping(bytes32 => mapping(bytes32 => bool))) private _nonceUsed;
 
+    /// @notice The ONLY authorized caller of the hooks (EXT-PMT-1 / C-NEW-1). Unlike the stateless
+    ///         enforcers (timestamp/value/targets/methods), this enforcer MUTATES state (budget, nonce)
+    ///         and writes a settlement receipt — so it is NOT safe to call externally. A direct caller
+    ///         that is not the DelegationManager could otherwise forge a `PaymentSettled` receipt and
+    ///         grief the victim's budget/nonce with no actual transfer. Bound immutably at deploy; the
+    ///         hooks revert `NotDelegationManager` for any other `msg.sender`.
+    address public immutable delegationManager;
+
     /// @notice Trustless receipt sink (PAY-CON-4). Immutable; `address(0)` disables registry receipts
     ///         (the `PaymentCharged` event below is always the primary on-chain receipt).
     IPaymentReceiptRegistry public immutable receiptRegistry;
@@ -84,8 +92,21 @@ contract PaymentEnforcer is ICaveatEnforcer {
     error AggregateExceeded(uint256 spent, uint256 maxAggregate, uint256 amount);
     error FrequencyExceeded(uint32 callsInWindow, uint32 maxRedemptionsPerWindow);
     error NonceReused(bytes32 nonce);
+    error NotDelegationManager(address caller);
+
+    /// @dev The hooks are state-mutating + receipt-emitting, so ONLY the DelegationManager may invoke
+    ///      them (EXT-PMT-1). `_runBeforeHooks`/`_runAfterHooks` call the enforcer directly, so during a
+    ///      real `redeemDelegation` msg.sender IS the DelegationManager. The `verifyAuthorization` view
+    ///      path staticcalls the hook from the same DelegationManager and still reverts on the SSTORE
+    ///      under staticcall (yields `false`), exactly as before — the modifier does not change that.
+    modifier onlyDelegationManager() {
+        if (msg.sender != delegationManager) revert NotDelegationManager(msg.sender);
+        _;
+    }
 
-    constructor(address receiptRegistry_) {
+    constructor(address delegationManager_, address receiptRegistry_) {
+        require(delegationManager_ != address(0), "PaymentEnforcer: zero DelegationManager");
+        delegationManager = delegationManager_;
         receiptRegistry = IPaymentReceiptRegistry(receiptRegistry_);
     }
 
@@ -98,7 +119,7 @@ contract PaymentEnforcer is ICaveatEnforcer {
         address target,
         uint256 value,
         bytes calldata callData
-    ) external override {
+    ) external override onlyDelegationManager {
         // ── terms (immutable, set at delegation creation) ──
         if (terms.length != 192) revert InvalidTerms();
         (
@@ -161,8 +182,9 @@ contract PaymentEnforcer is ICaveatEnforcer {
 
     function afterHook(bytes calldata, bytes calldata, bytes32, address, address, address, uint256, bytes calldata)
         external
-        pure
+        view
         override
+        onlyDelegationManager
     {}
 
     // ── views (off-chain budget display + idempotency checks) ──

package/src/payments/PaymentEscrow.sol

@@ -42,7 +42,10 @@ contract PaymentEscrow is ReentrancyGuard {
         Status status;
     }
 
-    mapping(bytes32 orderHash => Hold) private _holds;
+    // EXT-PMT-3: holds are keyed by (payer, orderHash), NOT orderHash alone — so a stranger cannot
+    // squat a predictable orderHash to block the real payer's deposit (HoldExists griefing). Each payer
+    // has an independent namespace for any given orderHash.
+    mapping(bytes32 holdKey => Hold) private _holds;
 
     event EscrowDeposited(bytes32 indexed orderHash);
     event EscrowReleased(bytes32 indexed orderHash);
@@ -57,6 +60,13 @@ contract PaymentEscrow is ReentrancyGuard {
     error BadExpiry();
     error NotAuthorized();
     error NotYetExpired();
+    error Expired();
+
+    /// @dev The (payer, orderHash) namespace key. Terminal calls by the payee/releaser pass `payer`;
+    ///      the payer's own `reclaim`/`deposit` derive it from `msg.sender`.
+    function _key(address payer, bytes32 orderHash) private pure returns (bytes32) {
+        return keccak256(abi.encode(payer, orderHash));
+    }
 
     /**
      * @notice Fund a hold for `orderHash`. Pulls `amount` of `asset` from the caller (the payer).
@@ -72,15 +82,30 @@ contract PaymentEscrow is ReentrancyGuard {
         address releaser,
         uint64 expiry
     ) external nonReentrant {
-        if (_holds[orderHash].status != Status.None) revert HoldExists();
+        bytes32 key = _key(msg.sender, orderHash);
+        if (_holds[key].status != Status.None) revert HoldExists();
         if (amount == 0) revert ZeroAmount();
         if (asset == address(0) || payee == address(0)) revert ZeroAddress();
         if (expiry <= block.timestamp) revert BadExpiry();
 
-        _holds[orderHash] = Hold({
+        // EXT-PMT-3: credit the REALIZED amount received (balance delta), not the requested `amount`. A
+        // fee-on-transfer / rebasing asset delivers less than `amount`, which would otherwise over-credit
+        // the hold and let it draw from other holds' funds in the shared pool (cross-hold drain). The
+        // external transfer happens before the storage write, but nonReentrant + the status check above
+        // keep it safe (a reentrant deposit is blocked; a duplicate (payer,orderHash) reverts HoldExists).
+        uint256 beforeBal = IERC20(asset).balanceOf(address(this));
+        // Triaged false positive: `deposit` is `nonReentrant`, so the balanceOf delta cannot be
+        // manipulated by re-entering between the two reads — the guard blocks any callback. The
+        // before/after balance read is the EXT-PMT-3 realized-amount fix for fee-on-transfer assets.
+        // slither-disable-next-line reentrancy-balance
+        IERC20(asset).safeTransferFrom(msg.sender, address(this), amount);
+        uint256 received = IERC20(asset).balanceOf(address(this)) - beforeBal;
+        if (received == 0) revert ZeroAmount();
+
+        _holds[key] = Hold({
             payer: msg.sender,
             asset: asset,
-            amount: amount,
+            amount: received,
             payee: payee,
             refundTo: refundTo == address(0) ? msg.sender : refundTo,
             releaser: releaser,
@@ -88,49 +113,51 @@ contract PaymentEscrow is ReentrancyGuard {
             status: Status.Held
         });
         emit EscrowDeposited(orderHash);
-        IERC20(asset).safeTransferFrom(msg.sender, address(this), amount);
     }
 
     /// @notice Capture a held order to the payee. Authorized: the payee, or the configured releaser.
-    function release(bytes32 orderHash) external nonReentrant {
-        Hold storage h = _held(orderHash);
+    ///         `payer` namespaces the hold (EXT-PMT-3). Cannot release at/after expiry — that window is
+    ///         the payer's `reclaim` (removes the prior release/reclaim race; spec 243 §reclaim intent).
+    function release(address payer, bytes32 orderHash) external nonReentrant {
+        Hold storage h = _held(_key(payer, orderHash));
         if (msg.sender != h.payee && (h.releaser == address(0) || msg.sender != h.releaser)) revert NotAuthorized();
+        if (block.timestamp >= h.expiry) revert Expired();
         h.status = Status.Captured;
         emit EscrowReleased(orderHash);
         IERC20(h.asset).safeTransfer(h.payee, h.amount);
     }
 
-    /// @notice Payee-consented refund of a held order to the payer (before capture).
-    function refund(bytes32 orderHash) external nonReentrant {
-        Hold storage h = _held(orderHash);
+    /// @notice Payee-consented refund of a held order to the payer (before capture). `payer` namespaces.
+    function refund(address payer, bytes32 orderHash) external nonReentrant {
+        Hold storage h = _held(_key(payer, orderHash));
         if (msg.sender != h.payee) revert NotAuthorized();
         h.status = Status.Refunded;
         emit EscrowRefunded(orderHash);
         IERC20(h.asset).safeTransfer(h.refundTo, h.amount);
     }
 
-    /// @notice Payer reclaims a held order after expiry (never released).
+    /// @notice Payer reclaims a held order after expiry (never released). Payer-initiated → the hold is
+    ///         derived from `msg.sender`, so only the payer can reach their own hold.
     function reclaim(bytes32 orderHash) external nonReentrant {
-        Hold storage h = _held(orderHash);
-        if (msg.sender != h.payer) revert NotAuthorized();
+        Hold storage h = _held(_key(msg.sender, orderHash));
         if (block.timestamp < h.expiry) revert NotYetExpired();
         h.status = Status.Reclaimed;
         emit EscrowReclaimed(orderHash);
         IERC20(h.asset).safeTransfer(h.refundTo, h.amount);
     }
 
-    /// @notice Full hold record (app reads via this view, not log scans — ADR-0012).
-    function getHold(bytes32 orderHash) external view returns (Hold memory) {
-        return _holds[orderHash];
+    /// @notice Full hold record for (payer, orderHash) — app reads via this view, not log scans (ADR-0012).
+    function getHold(address payer, bytes32 orderHash) external view returns (Hold memory) {
+        return _holds[_key(payer, orderHash)];
     }
 
-    function statusOf(bytes32 orderHash) external view returns (Status) {
-        return _holds[orderHash].status;
+    function statusOf(address payer, bytes32 orderHash) external view returns (Status) {
+        return _holds[_key(payer, orderHash)].status;
     }
 
     /// @dev Load a hold that MUST be in `Held` (fail-closed): missing → NoHold; terminal → NotHeld.
-    function _held(bytes32 orderHash) private view returns (Hold storage h) {
-        h = _holds[orderHash];
+    function _held(bytes32 key) private view returns (Hold storage h) {
+        h = _holds[key];
         if (h.status == Status.None) revert NoHold();
         if (h.status != Status.Held) revert NotHeld();
     }