@fhevm/sdk 1.0.0-alpha.1 → 1.0.0-alpha.3

package/core/clients/decorators/decrypt.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/unified-signatures */
 import type { Fhevm, FhevmBase, FhevmExtension, OptionalNativeClient } from '../../types/coreFhevmClient.js';
 import type { FhevmRuntime, WithDecrypt } from '../../types/coreFhevmRuntime.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
@@ -8,38 +7,29 @@ import { asFhevmClientWith, assertIsFhevmClientWith } from '../../runtime/CoreFh
 import { generateTransportKeypair } from '../../kms/TransportKeypair-p.js';
 import {
   decryptValue,
-  type DecryptSelfValueParameters,
-  type DecryptDelegatedValueParameters,
+  type DecryptValueParameters,
   type DecryptValueReturnType,
 } from '../../actions/decrypt/decryptValue.js';
 import {
   decryptValues,
-  type DecryptDelegatedValuesParameters,
-  type DecryptSelfValuesParameters,
+  type DecryptValuesParameters,
   type DecryptValuesReturnType,
 } from '../../actions/decrypt/decryptValues.js';
 import {
   decryptValuesFromPairs,
-  type DecryptSelfValuesFromPairsParameters,
-  type DecryptDelegatedValuesFromPairsParameters,
+  type DecryptValuesFromPairsParameters,
   type DecryptValuesFromPairsReturnType,
 } from '../../actions/decrypt/decryptValuesFromPairs.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
 export type DecryptActions = {
-  readonly decryptValue: {
-    (parameters: DecryptSelfValueParameters): Promise<DecryptValueReturnType>;
-    (parameters: DecryptDelegatedValueParameters): Promise<DecryptValueReturnType>;
-  };
-  readonly decryptValues: {
-    (parameters: DecryptSelfValuesParameters): Promise<DecryptValuesReturnType>;
-    (parameters: DecryptDelegatedValuesParameters): Promise<DecryptValuesReturnType>;
-  };
-  readonly decryptValuesFromPairs: {
-    (parameters: DecryptSelfValuesFromPairsParameters): Promise<DecryptValuesFromPairsReturnType>;
-    (parameters: DecryptDelegatedValuesFromPairsParameters): Promise<DecryptValuesFromPairsReturnType>;
-  };
+  readonly decryptValue: (parameters: DecryptValueParameters) => Promise<DecryptValueReturnType>;
+  readonly decryptValues: (parameters: DecryptValuesParameters) => Promise<DecryptValuesReturnType>;
+
+  readonly decryptValuesFromPairs: (
+    parameters: DecryptValuesFromPairsParameters,
+  ) => Promise<DecryptValuesFromPairsReturnType>;
   readonly generateTransportKeypair: () => Promise<GenerateTransportKeypairReturnType>;
 };
 
@@ -49,15 +39,9 @@ function _decryptActions(fhevm: Fhevm<FhevmChain, WithDecrypt>): DecryptActions
   // Preserve the original action overloads on the decorated client API.
   // Runtime behavior is unchanged: this is a direct pass-through wrapper.
   return {
-    decryptValue: ((parameters) =>
-      decryptValue(fhevm, parameters as DecryptSelfValueParameters)) as DecryptActions['decryptValue'],
-    decryptValues: ((parameters) =>
-      decryptValues(fhevm, parameters as DecryptSelfValuesParameters)) as DecryptActions['decryptValues'],
-    decryptValuesFromPairs: ((parameters) =>
-      decryptValuesFromPairs(
-        fhevm,
-        parameters as DecryptSelfValuesFromPairsParameters,
-      )) as DecryptActions['decryptValuesFromPairs'],
+    decryptValue: (parameters) => decryptValue(fhevm, parameters),
+    decryptValues: (parameters) => decryptValues(fhevm, parameters),
+    decryptValuesFromPairs: (parameters) => decryptValuesFromPairs(fhevm, parameters),
     generateTransportKeypair: () => generateTransportKeypair(fhevm),
   };
 }

package/core/coprocessor/InputProof-p.ts

@@ -208,9 +208,9 @@ export function createInputProofFromInputHandles({
   // Proof format :
   // ==============
   //
-  // <len(handles)><len(signatures)><concat(handles)><concat(signatures)>
+  // <len(handles)><len(signatures)><concat(handles)><concat(signatures)><extraData>
   //
-  // size: Byte1 + Byte1 + len(handles)*Bytes32 + len(signatures)*Bytes65
+  // size: Byte1 + Byte1 + len(handles)*Bytes32 + len(signatures)*Bytes65 + BytesN(extraData)
   //
 
   let proof: string = '';

package/core/coprocessor/ZkProof-p.ts

@@ -7,6 +7,7 @@ import type {
   Uint64,
   Bytes21Hex,
   Uint8Number,
+  BytesHex,
 } from '../types/primitives.js';
 import type { ZkProofLike, ZkProof } from '../types/zkProof-p.js';
 import type { ErrorMetadataParams } from '../base/errors/ErrorBase.js';
@@ -49,27 +50,32 @@ class ZkProofImpl implements ZkProof {
   readonly #fheTypeIds: readonly FheTypeId[]; // Can be empty
   #inputHandles: InputHandle[] | undefined;
 
+  // In theory, 'extraData' is not part of the ZkProof
+  readonly #extraData: BytesHex;
+
   constructor(
     privateToken: symbol,
-    params: {
+    parameters: {
       readonly chainId: Uint64BigInt;
       readonly aclContractAddress: ChecksummedAddress;
       readonly contractAddress: ChecksummedAddress;
       readonly userAddress: ChecksummedAddress;
       readonly ciphertextWithZkProof: Bytes;
       readonly encryptionBits: readonly EncryptionBits[];
+      readonly extraData: BytesHex;
     },
   ) {
     if (privateToken !== PRIVATE_TOKEN) {
       throw new Error('Unauthorized');
     }
-    this.#chainId = params.chainId;
-    this.#aclContractAddress = params.aclContractAddress;
-    this.#contractAddress = params.contractAddress;
-    this.#userAddress = params.userAddress;
-    this.#ciphertextWithZkProof = params.ciphertextWithZkProof;
-    this.#encryptionBits = Object.freeze([...params.encryptionBits]);
+    this.#chainId = parameters.chainId;
+    this.#aclContractAddress = parameters.aclContractAddress;
+    this.#contractAddress = parameters.contractAddress;
+    this.#userAddress = parameters.userAddress;
+    this.#ciphertextWithZkProof = parameters.ciphertextWithZkProof;
+    this.#encryptionBits = Object.freeze([...parameters.encryptionBits]);
     this.#fheTypeIds = Object.freeze(this.#encryptionBits.map(fheTypeIdFromEncryptionBits));
+    this.#extraData = parameters.extraData;
     Object.freeze(this);
   }
 
@@ -145,6 +151,10 @@ class ZkProofImpl implements ZkProof {
     return this.#inputHandles;
   }
 
+  public getExtraData(): BytesHex {
+    return this.#extraData;
+  }
+
   //////////////////////////////////////////////////////////////////////////////
   // JSON
   //////////////////////////////////////////////////////////////////////////////
@@ -218,6 +228,7 @@ export function assertIsZkProof(
  */
 export async function toZkProof(
   zkProofLike: ZkProofLike,
+  extraData: BytesHex,
   options?: {
     readonly zkProofParser?: ParseTFHEProvenCompactCiphertextListModuleFunction;
     readonly copy?: boolean;
@@ -265,8 +276,9 @@ export async function toZkProof(
     aclContractAddress,
     contractAddress,
     userAddress,
-    ciphertextWithZkProof: ciphertextWithZkProof,
+    ciphertextWithZkProof,
     encryptionBits,
+    extraData,
   });
 }
 
@@ -440,7 +452,7 @@ async function _getOrParseEncryptionBits(
  * assert_eq!(handle.len(), 32);
  * ```
  *
- * @see https://github.com/zama-ai/fhevm/blob/8ffbd5906ab3d57af178e049930e3fc065c9d4b3/coprocessor/fhevm-engine/zkproof-worker/src/verifier.rs#L431
+ * @see https://github.com/zama-ai/fhevm/blob/322748569f0b5eb100b8cc1a58f691cfe88d17c4/coprocessor/fhevm-engine/zkproof-worker/src/verifier.rs#L538
  * @internal
  */
 function _computeInputHash21(

package/core/coprocessor/ZkProofBuilder-p.ts

@@ -1,4 +1,4 @@
-import type { Bytes20, Bytes32, ChecksummedAddress, UintNumber } from '../types/primitives.js';
+import type { Bytes20, Bytes32, BytesHex, ChecksummedAddress, UintNumber } from '../types/primitives.js';
 import type { ZkProof } from '../types/zkProof-p.js';
 import type { EncryptionBits, FheType } from '../types/fheType.js';
 import type { ZkProofBuilder } from '../types/zkProofBuilder.js';
@@ -18,7 +18,7 @@ import type {
 import { assert } from '../base/errors/InternalError.js';
 import { isUint64, uint256ToBytes32 } from '../base/uint.js';
 import { isAddress } from '../base/address.js';
-import { hexToBytes20 } from '../base/bytes.js';
+import { asBytesHex, hexToBytes20 } from '../base/bytes.js';
 import { ZkProofError } from '../errors/ZkProofError.js';
 import { createTypedValue, TypedValueArrayBuilder } from '../base/typedValue.js';
 import { toZkProof } from './ZkProof-p.js';
@@ -142,9 +142,11 @@ class ZkProofBuilderImpl implements ZkProofBuilder {
     {
       contractAddress,
       userAddress,
+      extraData,
     }: {
       readonly contractAddress: string;
       readonly userAddress: string;
+      readonly extraData: string;
     },
   ): Promise<ZkProof> {
     // Fetch the FheEncryptionKey (in wasm format) from the global cache.
@@ -211,11 +213,13 @@ class ZkProofBuilderImpl implements ZkProofBuilder {
 
     assert(metaData.length - chainIdBytes32.length === 60);
 
-    const ciphertextWithZKProofBytes: Uint8Array = await context.runtime.encrypt.buildWithProofPacked({
-      typedValues: [...this.#builder.build()],
-      fheEncryptionKey: fheEncryptionKeyWasm,
-      metaData,
-    });
+    const { ciphertextWithZKProofBytes, extraData: finalExtraData } =
+      await context.runtime.encrypt.buildWithProofPacked({
+        typedValues: [...this.#builder.build()],
+        fheEncryptionKey: fheEncryptionKeyWasm,
+        metaData,
+        extraData: asBytesHex(extraData),
+      });
 
     return toZkProof(
       {
@@ -226,6 +230,7 @@ class ZkProofBuilderImpl implements ZkProofBuilder {
         ciphertextWithZkProof: ciphertextWithZKProofBytes,
         encryptionBits: this.#bits,
       },
+      finalExtraData,
       { copy: false }, // Take ownership
     );
   }
@@ -273,9 +278,10 @@ export async function createZkProof(
     readonly values: readonly TypedValue[];
     readonly contractAddress: ChecksummedAddress;
     readonly userAddress: ChecksummedAddress;
+    readonly extraData: BytesHex;
   },
 ): Promise<ZkProof> {
-  const { contractAddress, userAddress, values } = parameters;
+  const { contractAddress, userAddress, values, extraData } = parameters;
 
   const builder = new ZkProofBuilderImpl(PRIVATE_TOKEN, {
     ciphertextCapacity: TFHE_ZKPROOF_CIPHERTEXT_CAPACITY,
@@ -289,6 +295,7 @@ export async function createZkProof(
   const zkProof = await builder.build(context, {
     contractAddress,
     userAddress,
+    extraData,
   });
 
   return zkProof;

package/core/coprocessor/encrypt.ts

@@ -3,7 +3,6 @@ import type { FhevmChain } from '../types/fhevmChain.js';
 import type { BytesHex, ChecksummedAddress, TypedValue } from '../types/primitives.js';
 import type { RelayerInputProofOptions } from '../types/relayer.js';
 import type { InputHandle } from '../types/encryptedTypes-p.js';
-import { asBytesHex } from '../base/bytes.js';
 import { fetchVerifiedInputProof } from './fetchVerifiedInputProof.js';
 import { createZkProof } from './ZkProofBuilder-p.js';
 
@@ -33,11 +32,10 @@ type ReturnType = {
 export async function encrypt(context: Context, parameters: Parameters): Promise<ReturnType> {
   const hardCodedExtraData = '0x00' as BytesHex;
 
-  const zkProof = await createZkProof(context, parameters);
+  const zkProof = await createZkProof(context, { ...parameters, extraData: hardCodedExtraData });
 
   const inputProof = await fetchVerifiedInputProof(context, {
     zkProof,
-    extraData: asBytesHex(hardCodedExtraData),
     options: parameters.options,
   });
 

package/core/coprocessor/fetchVerifiedInputProof.ts

@@ -1,7 +1,6 @@
 import type { RelayerInputProofOptions } from '../types/relayer.js';
 import type { FhevmChain } from '../types/fhevmChain.js';
 import type { VerifiedInputProof } from '../types/inputProof.js';
-import type { BytesHex } from '../types/primitives.js';
 import type { ZkProof } from '../types/zkProof-p.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
 import type { InputHandle } from '../types/encryptedTypes-p.js';
@@ -22,7 +21,6 @@ type Context = {
 
 type Parameters = {
   readonly zkProof: ZkProof;
-  readonly extraData: BytesHex;
   readonly options?: RelayerInputProofOptions | undefined;
 };
 
@@ -31,7 +29,7 @@ type ReturnType = VerifiedInputProof;
 ////////////////////////////////////////////////////////////////////////////////
 
 export async function fetchVerifiedInputProof(context: Context, parameters: Parameters): Promise<ReturnType> {
-  const { zkProof, extraData, options } = parameters;
+  const { zkProof, options } = parameters;
 
   assertIsZkProof(zkProof, {});
 
@@ -52,16 +50,12 @@ export async function fetchVerifiedInputProof(context: Context, parameters: Para
 
   // 2. Request coprocessor signatures from the relayer for the given ZK proof
   const { handles: coprocessorSignedHandles, coprocessorEip712Signatures: coprocessorSignatures } =
-    await context.runtime.relayer.fetchCoprocessorSignatures(
-      { relayerUrl: context.chain.fhevm.relayerUrl, chainId: context.chain.id },
-      {
-        payload: {
-          zkProof,
-          extraData,
-        },
-        options: relayerOptions,
+    await context.runtime.relayer.fetchCoprocessorSignatures(context, {
+      payload: {
+        zkProof,
       },
-    );
+      options: relayerOptions,
+    });
 
   // 3. Check that the handles and the one in the fetch result
   // Note: this check is theoretically unnecessary
@@ -73,7 +67,7 @@ export async function fetchVerifiedInputProof(context: Context, parameters: Para
   const inputProof = createInputProofFromInputHandles({
     coprocessorEip712Signatures: coprocessorSignatures,
     inputHandles,
-    extraData,
+    extraData: zkProof.getExtraData(),
     signedHandleAccess: {
       userAddress: zkProof.userAddress,
       contractAddress: zkProof.contractAddress,

package/core/handle/FheType.ts

@@ -418,8 +418,7 @@ function _assertMinimumEncryptionBitWidth(bw: number): void {
   );
 }
 
-export function bytesToClearValueType<etype extends FheType>(fheType: etype, bytes: Bytes): ClearValueType<etype> {
-  const bn = bytesToBigInt(bytes);
+export function bigintToClearValueType<etype extends FheType>(fheType: etype, bn: bigint): ClearValueType<etype> {
   // needed to type narrowing
   const ft: FheType = fheType;
 
@@ -455,6 +454,10 @@ export function bytesToClearValueType<etype extends FheType>(fheType: etype, byt
   }
 }
 
+export function bytesToClearValueType<etype extends FheType>(fheType: etype, bytes: Bytes): ClearValueType<etype> {
+  return bigintToClearValueType(fheType, bytesToBigInt(bytes));
+}
+
 /**
  * Asserts that `value` is already the correct JS type for the given `fheTypeName`
  * and returns it narrowed. No conversion is performed.

package/core/host-contracts/KmsSignersContext-p.ts

@@ -70,7 +70,7 @@ class KmsSignersContextImpl implements KmsSignersContext {
   }
 
   public has(signer: string): boolean {
-    return this.#kmsSignersSet.has(signer);
+    return this.#kmsSignersSet.has(signer.toLowerCase());
   }
 
   public static [VERIFY_FUNC](instance: unknown, owner: FhevmRuntime): void {

package/core/host-contracts/checkDelegation.ts

@@ -0,0 +1,114 @@
+import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import type { Handle } from '../types/encryptedTypes-p.js';
+import type { ChecksummedAddress } from '../types/primitives.js';
+import type { HandleContractPair } from '../types/other-p.js';
+import { AclUserDecryptionError } from '../errors/AclError.js';
+import { isHandleDelegatedForUserDecryption } from './isHandleDelegatedForUserDecryption-p.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+type Context = {
+  readonly runtime: FhevmRuntime;
+  readonly client: NonNullable<object>;
+  readonly options: { readonly batchRpcCalls: boolean };
+};
+
+type Parameters = {
+  readonly address: ChecksummedAddress;
+  readonly delegator: ChecksummedAddress;
+  readonly delegate: ChecksummedAddress;
+  readonly handleContractPairs: ReadonlyArray<{
+    readonly handle: Handle;
+    readonly contractAddress: ChecksummedAddress;
+  }>;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function checkDelegation(context: Context, parameters: Parameters): Promise<void> {
+  const { address, delegator, delegate, handleContractPairs } = parameters;
+
+  if (handleContractPairs.length === 0) {
+    throw new Error('checkDelegation requires at least one (handle, contractAddress) pair');
+  }
+
+  // runtime defensive check, use lowercase
+  function getKey(addr: string, handleBytes32Hex: string): string {
+    return `${addr}:${handleBytes32Hex}`.toLowerCase();
+  }
+
+  // 1. Verify rule: delegator !== delegate
+  if (delegator.toLowerCase() === delegate.toLowerCase()) {
+    throw new AclUserDecryptionError({
+      contractAddress: address,
+      message: `delegator ${delegator} cannot be equal to delegate`,
+    });
+  }
+
+  // 2. Verify rules: delegator !== contractAddress & delegate !== contractAddress
+  for (const pair of handleContractPairs) {
+    if (delegator.toLowerCase() === pair.contractAddress.toLowerCase()) {
+      throw new AclUserDecryptionError({
+        contractAddress: address,
+        message: `delegator ${delegator} cannot be equal to contractAddress`,
+      });
+    }
+    if (delegate.toLowerCase() === pair.contractAddress.toLowerCase()) {
+      throw new AclUserDecryptionError({
+        contractAddress: address,
+        message: `delegate ${delegate} cannot be equal to contractAddress`,
+      });
+    }
+  }
+
+  // 3. Collect all unique (contractAddress, handle) pairs to avoid duplicate RPC calls
+  const allChecks: HandleContractPair[] = [];
+  const seenKeys = new Set<string>();
+
+  for (const pair of handleContractPairs) {
+    // runtime defensive check, use lowercase
+    const key = getKey(pair.contractAddress, pair.handle.bytes32Hex);
+    if (!seenKeys.has(key)) {
+      seenKeys.add(key);
+      allChecks.push({
+        handle: pair.handle,
+        contractAddress: pair.contractAddress,
+      });
+    }
+  }
+
+  if (allChecks.length === 0) {
+    throw new Error('checkDelegation: no delegation checks to perform (unexpected empty dedup result)');
+  }
+
+  // 4. Single batched RPC call for all unique checks
+  const allResults = await isHandleDelegatedForUserDecryption(context, {
+    address,
+    delegator,
+    delegate,
+    pairs: allChecks,
+  });
+
+  // 5. Build result map for lookup
+  const resultMap = new Map<string, boolean>();
+  for (const [i, check] of allChecks.entries()) {
+    const result = allResults[i];
+    // tsc: noUncheckedIndexedAccess
+    if (result === undefined) {
+      throw new Error(`Missing result at index ${i}`);
+    }
+    const key = getKey(check.contractAddress, check.handle.bytes32Hex);
+    resultMap.set(key, result);
+  }
+
+  // 6. Verify delegation for each requested pair
+  for (const pair of handleContractPairs) {
+    const key = getKey(pair.contractAddress, pair.handle.bytes32Hex);
+    if (resultMap.get(key) !== true) {
+      throw new AclUserDecryptionError({
+        contractAddress: address,
+        message: `Delegate ${delegate} is not delegated by ${delegator} to user decrypt handle ${pair.handle.bytes32Hex} on contract ${pair.contractAddress}!`,
+      });
+    }
+  }
+}

package/core/host-contracts/getUserDecryptionDelegationExpirationDate.ts

@@ -0,0 +1,45 @@
+import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import type { ChecksummedAddress, Uint64BigInt } from '../types/primitives.js';
+import { isUint64 } from '../base/uint.js';
+import { getUserDecryptionDelegationExpirationDateAbi } from '../host-contracts/abi-fragments/fragments.js';
+import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+type Context = {
+  readonly runtime: FhevmRuntime;
+  readonly client: NonNullable<object>;
+  readonly options: { readonly batchRpcCalls: boolean };
+};
+
+type Parameters = {
+  readonly address: ChecksummedAddress;
+  readonly delegator: ChecksummedAddress;
+  readonly delegate: ChecksummedAddress;
+  readonly contractAddress: ChecksummedAddress;
+};
+
+type ReturnType = Uint64BigInt;
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function getUserDecryptionDelegationExpirationDate(
+  context: Context,
+  parameters: Parameters,
+): Promise<ReturnType> {
+  const trustedClient = getTrustedClient(context);
+  const address = parameters.address;
+
+  const res = await context.runtime.ethereum.readContract(trustedClient, {
+    address: address,
+    abi: getUserDecryptionDelegationExpirationDateAbi,
+    args: [parameters.delegator, parameters.delegate, parameters.contractAddress],
+    functionName: getUserDecryptionDelegationExpirationDateAbi[0].name,
+  });
+
+  if (!isUint64(res)) {
+    throw new Error(`Invalid expiration date.`);
+  }
+
+  return BigInt(res) as Uint64BigInt;
+}

package/core/host-contracts/isHandleDelegatedForUserDecryption-p.ts

@@ -0,0 +1,77 @@
+import type { ChecksummedAddress } from '../types/primitives.js';
+import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import type { Handle } from '../types/encryptedTypes-p.js';
+import type { HandleContractPair } from '../types/other-p.js';
+import { isHandleDelegatedForUserDecryptionAbi } from './abi-fragments/fragments.js';
+import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
+import { executeWithBatching } from '../base/promise.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+type Context = {
+  readonly runtime: FhevmRuntime;
+  readonly client: NonNullable<object>;
+  readonly options: { readonly batchRpcCalls: boolean };
+};
+
+type Parameters = {
+  readonly address: ChecksummedAddress;
+  readonly delegate: ChecksummedAddress;
+  readonly delegator: ChecksummedAddress;
+  readonly pairs: readonly HandleContractPair[];
+};
+
+type ReturnType = boolean[];
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function isHandleDelegatedForUserDecryption(
+  context: Context,
+  parameters: Parameters,
+): Promise<ReturnType> {
+  const { address, delegate, delegator, pairs } = parameters;
+
+  const rpcCalls = pairs.map(
+    (pair) => () =>
+      _isHandleDelegatedForUserDecryption(context, {
+        address,
+        delegate,
+        delegator,
+        handle: pair.handle,
+        contractAddress: pair.contractAddress,
+      }),
+  );
+
+  const results = await executeWithBatching(rpcCalls, context.options.batchRpcCalls);
+
+  return results;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+async function _isHandleDelegatedForUserDecryption(
+  context: Context,
+  parameters: {
+    readonly address: ChecksummedAddress;
+    readonly delegator: ChecksummedAddress;
+    readonly delegate: ChecksummedAddress;
+    readonly contractAddress: ChecksummedAddress;
+    readonly handle: Handle;
+  },
+): Promise<boolean> {
+  const { address, delegator, delegate, contractAddress, handle } = parameters;
+  const trustedClient = getTrustedClient(context);
+
+  const res = await context.runtime.ethereum.readContract(trustedClient, {
+    address: address,
+    abi: isHandleDelegatedForUserDecryptionAbi,
+    args: [delegator, delegate, contractAddress, handle.bytes32Hex],
+    functionName: isHandleDelegatedForUserDecryptionAbi[0].name,
+  });
+
+  if (typeof res !== 'boolean') {
+    throw new Error(`Invalid isHandleDelegatedForUserDecryptionAbi result.`);
+  }
+
+  return res;
+}

package/core/host-contracts/persistAllowed.ts

@@ -61,7 +61,7 @@ async function _persistAllowed(
   });
 
   if (typeof res !== 'boolean') {
-    throw new Error(`Invalid isAllowedForDecryption result.`);
+    throw new Error(`Invalid persistAllowed result.`);
   }
 
   return res;