@coordination-network/contracts 0.0.1 → 0.0.2

package/ApprovedIssuerSet.sol

@@ -96,9 +96,9 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
     uint256 public rootDuration;
 
     /// @notice The instant at or before which no superseded root is ever acceptable again.
-    /// @dev Bumped by {retireAllIssuerKeys} on every removal of a member that ever held a key, so
-    /// removing one member closes off every root superseded in the window before removal, not just the
-    /// one root the removal directly replaces.
+    /// @dev Bumped by {retireIssuerKeyImmediately}, and by {retireAllIssuerKeys} on every removal of a
+    /// member that ever held a key, so either closes off every root superseded in the window before it,
+    /// not just the one root it directly replaces.
     uint256 public rootsInvalidatedAt;
 
     /// @dev Whether a member has ever published a live key. Set once, never cleared, so
@@ -257,7 +257,7 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
     /// @param memberNetworkId The member the key belongs to.
     /// @param leaf The commitment to retire.
     function retireIssuerKey(bytes32 memberNetworkId, uint256 leaf)
-        external
+        public
         onlyAuthAddressOrGovernance(memberNetworkId)
     {
         _detachFromMember(memberNetworkId, leaf);
@@ -279,6 +279,16 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
         emit IssuerKeyRetired(memberNetworkId, leaf, newRoot);
     }
 
+    /// @notice Retires a signing key immediately and stops every superseded root being accepted at once.
+    /// @dev Useful in cases of key theft so prevents attack using key during grace window. In-flight
+    /// proofs against old root must be rebuilt.
+    /// @param memberNetworkId The network member the key belongs to.
+    /// @param leaf The commitment to retire.
+    function retireIssuerKeyImmediately(bytes32 memberNetworkId, uint256 leaf) external {
+        rootsInvalidatedAt = block.timestamp;
+        retireIssuerKey(memberNetworkId, leaf);
+    }
+
     /// @inheritdoc IApprovedIssuerSet
     /// @dev Callable only by the registry, which invokes it while removing a member so that removal
     /// and the loss of signing power are one transaction. Two transactions would leave a window in
@@ -594,7 +604,7 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
         }
     }
 
-    /// @dev Rejects a public key that is not a Baby Jubjub point of full order.
+    /// @dev Rejects a public key that is outside the field, off the curve, or of low order.
     ///
     /// The tree would accept any field element as a leaf, so without the curve check the set could
     /// hold a commitment to a point that does not exist.
@@ -607,6 +617,12 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
     /// verify as issued by an approved member, and issuer anonymity means no verifier could say whose
     /// key to retire.
     ///
+    /// It does not reject a mixed-order key, a prime-order point plus a nonzero torsion point. The
+    /// circuit's EdDSA (noir-lang/eddsa 7e206c95) multiplies the key by 8 before verifying, so only the
+    /// holder of its prime-order part's secret can sign under such a key. The only effect is that one
+    /// secret can take several leaves, at most eight live ones, one per torsion point, possibly under
+    /// different members. The TypeScript `issuer-set` refuses to publish them.
+    ///
     /// @param publicKeyX The x coordinate.
     /// @param publicKeyY The y coordinate.
     function _assertOnCurve(uint256 publicKeyX, uint256 publicKeyY) private pure {

package/SemaphorePaymaster.sol

@@ -3,10 +3,9 @@ pragma solidity ^0.8.34;
 
 import { IEntryPoint } from "@account-abstraction/contracts/interfaces/IEntryPoint.sol";
 import { BasePaymaster } from "@account-abstraction/contracts/core/BasePaymaster.sol";
-import { IPaymaster } from "@account-abstraction/contracts/interfaces/IPaymaster.sol";
 import { PackedUserOperation } from "@account-abstraction/contracts/interfaces/PackedUserOperation.sol";
 import { _packValidationData } from "@account-abstraction/contracts/core/Helpers.sol";
-import { UserOperationLib } from "@account-abstraction/contracts/core/UserOperationLib.sol";
+import { SafeCast } from "@openzeppelin/contracts/utils/math/SafeCast.sol";
 import { Semaphore } from "@semaphore-protocol/contracts/Semaphore.sol";
 import { ISemaphore } from "@semaphore-protocol/contracts/interfaces/ISemaphore.sol";
 import { ISemaphoreVerifier } from "@semaphore-protocol/contracts/interfaces/ISemaphoreVerifier.sol";
@@ -17,8 +16,6 @@ import { MIN_DEPTH, MAX_DEPTH } from "@semaphore-protocol/contracts/base/Constan
  * @notice A paymaster that validates user operations in a privacy preserving way using a single semaphore group
  */
 contract SemaphorePaymaster is BasePaymaster, Semaphore {
-    using UserOperationLib for PackedUserOperation;
-
     /**
      * The paymaster uses a single Semaphore group
      */
@@ -30,46 +27,17 @@ contract SemaphorePaymaster is BasePaymaster, Semaphore {
     uint256 private constant ENCODED_PROOF_LENGTH = 13 * 32;
 
     /**
-     * Sponsorship stops for the rest of the epoch once spend reaches this cap, bounding what a
-     * stolen identity can drain before the owner can revoke or withdraw
-     */
-    uint256 public immutable SPEND_CAP_PER_EPOCH;
-    uint256 public immutable EPOCH_DURATION;
-
-    /**
-     * Smaller than epoch cap, so exhausting the cap takes many userOps rather than one.
      * `preVerificationGas` is self declared and never refunded, so `maxCost` can be used to drain the paymaster
      */
     uint256 public immutable MAX_COST_PER_OP;
 
-    /**
-     * Enough for `_postOp` to record spend. The EntryPoint charges the paymaster even when `postOp`
-     * runs out of gas, so validation requires the limit up front
-     */
-    uint256 public constant MIN_POSTOP_GAS = 40_000;
-
-    /**
-     * Validation cannot read `block.timestamp` (banned by ERC-7562), so the epoch lives in
-     * storage and is advanced by `updateEpoch`
-     */
-    uint256 public currentEpoch;
-
-    mapping(uint256 epoch => uint256 spent) public spentInEpoch;
-
     error ZeroOwner();
 
-    constructor(
-        address _entryPoint,
-        address _verifier,
-        address _owner,
-        uint256 _spendCapPerEpoch,
-        uint256 _epochDuration,
-        uint256 _maxCostPerOp
-    ) BasePaymaster(IEntryPoint(_entryPoint)) Semaphore(ISemaphoreVerifier(_verifier)) {
-        SPEND_CAP_PER_EPOCH = _spendCapPerEpoch;
-        EPOCH_DURATION = _epochDuration;
+    constructor(address _entryPoint, address _verifier, address _owner, uint256 _maxCostPerOp)
+        BasePaymaster(IEntryPoint(_entryPoint))
+        Semaphore(ISemaphoreVerifier(_verifier))
+    {
         MAX_COST_PER_OP = _maxCostPerOp;
-        currentEpoch = block.timestamp / _epochDuration;
 
         // _transferOwnership skips zero-address guard
         if (_owner == address(0)) revert ZeroOwner();
@@ -101,11 +69,7 @@ contract SemaphorePaymaster is BasePaymaster, Semaphore {
         override
         returns (bytes memory context, uint256 validationData)
     {
-        if (maxCost > MAX_COST_PER_OP || spentInEpoch[currentEpoch] + maxCost > SPEND_CAP_PER_EPOCH) {
-            return ("", _packValidationData(true, 0, 0));
-        }
-
-        if (userOp.unpackPostOpGasLimit() < MIN_POSTOP_GAS) {
+        if (maxCost > MAX_COST_PER_OP) {
             return ("", _packValidationData(true, 0, 0));
         }
 
@@ -156,10 +120,7 @@ contract SemaphorePaymaster is BasePaymaster, Semaphore {
                 return ("", _packValidationData(true, 0, 0));
             }
 
-            // merkleRootCreationDate is block.timestamp. Overflow would require owner
-            // setting very high merkleTreeDuration
-            // forge-lint: disable-next-line(unsafe-typecast)
-            validUntil = uint48(merkleRootCreationDate + merkleTreeDuration);
+            validUntil = SafeCast.toUint48(merkleRootCreationDate + merkleTreeDuration);
         }
 
         // Call `verifier.verifyProof` directly. `this.verifyProof` reads `block.timestamp` when the
@@ -175,20 +136,7 @@ contract SemaphorePaymaster is BasePaymaster, Semaphore {
             return ("", _packValidationData(true, 0, 0));
         }
 
-        // a non empty context is what makes the EntryPoint call `postOp`
-        return (hex"01", _packValidationData(false, validUntil, 0));
-    }
-
-    function _postOp(IPaymaster.PostOpMode, bytes calldata, uint256 actualGasCost, uint256) internal override {
-        updateEpoch();
-        spentInEpoch[currentEpoch] += actualGasCost;
-    }
-
-    /**
-     * Advance to the current epoch, freeing the spend cap again.
-     */
-    function updateEpoch() public {
-        currentEpoch = block.timestamp / EPOCH_DURATION;
+        return ("", _packValidationData(false, validUntil, 0));
     }
 
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coordination-network/contracts",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "The coordination network's Solidity contracts: the network member registry and its governance, the identity registry, the approved-issuer set, the revocation registries and the Semaphore paymaster.",
   "license": "MIT",
   "repository": {

package/revocation/README.md

@@ -83,4 +83,5 @@ yarn test:contracts
 - There is deliberately no on-chain Merkle proof verifier. Verifying a plaintext proof would reveal the commitment, and a caller willing to do that can just call `isRevoked`, which is cheaper and answers the same question. The private path is a zero-knowledge proof verified elsewhere, whose root is checked with `isValidRoot`.
 - Registries are isolated. One deployment serves many issuers, and an admin can only write to its own registry.
 - Admin transfers are two-step, so a typo cannot strand a registry.
+- `unrevoke` and `updateRevocationCommitment` are for correcting mistakes, such as a commitment revoked in error or an invalid value written to the tree. Like every write here, they are visible to anyone reading the chain. `unrevoke` shows that a commitment is no longer revoked. `updateRevocationCommitment` shows the old and new commitments together, so an observer can tell one replaced the other. Whether that link reveals anything depends on how the commitments are generated and handled in your use case. If two commitments should not appear related, use `unrevoke` and a separate `revoke` instead, spaced apart in time, since two writes landing back to back can be linked by their timing alone.
 - `test/integration/CrossLanguageRoot.t.sol` pins the contract's roots against the TypeScript package. Any drift in the hashing or the insertion rules fails a test on both sides.