@kohaku-eth/tornado-cash 0.0.2-alpha.15 → 0.0.2-alpha.17

package/dist/index.d.ts

@@ -33,6 +33,15 @@ type DeriveDepositSecretParams = BaseDeriveSecretParams & {
 interface ISecretManager {
     getDepositSecrets: (params: DeriveDepositSecretParams) => Promise<Secret>;
     deriveEphemeralSigner: (params: DeriveDepositSecretParams) => Promise<`0x${string}`>;
+    /**
+     * Derives a delegator key from a classical wallet BIP-32 `path`, WITHOUT the
+     * `coalesceSecret` privacy transform, so it resolves to a recoverable,
+     * classical Ethereum address. Used for the tail-call batch delegator when the
+     * integrator supplies a wallet path (see `paymasterWithdrawThunk`).
+     */
+    deriveDelegatorSigner: (params: {
+        path: string;
+    }) => Promise<`0x${string}`>;
 }
 interface SecretManagerParams {
     host: Pick<Host, 'keystore'>;
@@ -352,6 +361,24 @@ declare enum DepositStrategy {
     MinFee = 1
 }
 
+/**
+ * How the batch delegator for a tail-call paymaster withdrawal is produced.
+ * Only honored when `tailCalls` are present (see `paymasterWithdrawThunk`).
+ *
+ * - `deterministic` (default): recoverable. With `path`, the delegator is a
+ *   classical wallet-path address; without `path`, an ephemeral address keyed by
+ *   the batch's first deposit.
+ * - `random`: a throwaway, unrecoverable EOA — an explicit opt-out of
+ *   recoverability. Never the default, because in the tail-call path the
+ *   delegator holds the withdrawn funds.
+ */
+type DelegationConfig = {
+    mode: 'deterministic';
+    path?: string;
+} | {
+    mode: 'random';
+};
+
 interface SerializedAuth {
     address: Address$1;
     chainId: Hex;
@@ -410,12 +437,6 @@ interface IPaymasterBroadcasterClient {
     broadcast(withdrawals: IPaymasterWithdrawalPayload[]): Promise<PaymasterBroadcastResult[]>;
 }
 
-type DelegationConfig = {
-    mode: 'deterministic';
-    path?: string;
-} | {
-    mode: 'random';
-};
 type StringAddress = `0x${string}`;
 interface IPaymasterConfig {
     paymasterAddress: StringAddress;

package/dist/index.js

@@ -764,9 +764,13 @@ async function SecretManager({
     const coalesced = coalesceSecret({ secret: raw, chainId, poolAddress });
     return `0x${coalesced.toString(16).padStart(64, "0")}`;
   };
+  const deriveDelegatorSigner = async ({ path }) => {
+    return Promise.resolve(keystore.deriveAt(path));
+  };
   return {
     getDepositSecrets: (params) => deriveSecrets(params),
-    deriveEphemeralSigner
+    deriveEphemeralSigner,
+    deriveDelegatorSigner
   };
 }
 function tcPath({ accountIndex, secretType, depositIndex }) {

package/dist/state-manager.worker.js

@@ -17281,9 +17281,13 @@ async function SecretManager({
     const coalesced = coalesceSecret({ secret: raw, chainId, poolAddress });
     return `0x${coalesced.toString(16).padStart(64, "0")}`;
   };
+  const deriveDelegatorSigner = async ({ path }) => {
+    return Promise.resolve(keystore.deriveAt(path));
+  };
   return {
     getDepositSecrets: (params) => deriveSecrets(params),
-    deriveEphemeralSigner
+    deriveEphemeralSigner,
+    deriveDelegatorSigner
   };
 }
 function tcPath({ accountIndex, secretType, depositIndex }) {
@@ -22190,6 +22194,15 @@ var withdrawThunk = createAsyncThunk("withdraw/executeWithdrawals", async ({
   return getWithdrawalsProofs();
 });
 
+// ../provider/dist/index.js
+var createTx = (address, payload, value = BigInt(0)) => {
+  return {
+    to: address,
+    data: payload,
+    value
+  };
+};
+
 // ../../node_modules/.pnpm/viem@2.48.4_typescript@5.9.3_zod@4.4.3/node_modules/viem/_esm/index.js
 init_exports();
 init_encodeAbiParameters2();
@@ -22364,8 +22377,14 @@ function privateKeyToAccount(privateKey, options = {}) {
   };
 }
 
+// src/state/thunks/paymasterWithdrawThunk.ts
+init_esm();
+
 // src/paymaster/fee.ts
 var ERC20_TRANSFER_GAS = 100000n;
+var PER_DIRECT_WITHDRAW_GAS = 400000n;
+var PER_DIRECT_WITHDRAW_GAS_ERC20 = 500000n;
+var FORWARD_GAS = 60000n;
 var baseGasUnits = {
   preVerificationGas: 80000n,
   verificationGasLimit: 50000n,
@@ -22380,6 +22399,15 @@ function reasonableGasUnits(isERC20) {
     paymasterVerificationGasLimit: baseGasUnits.paymasterVerificationGasLimit + ERC20_TRANSFER_GAS
   };
 }
+function reasonableGasUnitsForBatch(isERC20, extraWithdrawals, hasUserTailCalls) {
+  const base = reasonableGasUnits(isERC20);
+  const perWithdraw = isERC20 ? PER_DIRECT_WITHDRAW_GAS_ERC20 : PER_DIRECT_WITHDRAW_GAS;
+  const executionTail = hasUserTailCalls ? base.callGasLimit : FORWARD_GAS;
+  return {
+    ...base,
+    callGasLimit: BigInt(extraWithdrawals) * perWithdraw + executionTail
+  };
+}
 function computeMinimumViableFee(reasonableGasUnits2, maxFeePerGas) {
   const baseFeeMultiplier = 1.2;
   const decimals = baseFeeMultiplier.toString().split(".")[1]?.length ?? 0;
@@ -22387,10 +22415,6 @@ function computeMinimumViableFee(reasonableGasUnits2, maxFeePerGas) {
   const multiply = (base) => base * BigInt(Math.ceil(baseFeeMultiplier * denominator)) / BigInt(denominator);
   const requiredGas = reasonableGasUnits2.verificationGasLimit + reasonableGasUnits2.callGasLimit + reasonableGasUnits2.paymasterVerificationGasLimit + reasonableGasUnits2.preVerificationGas + reasonableGasUnits2.paymasterPostOpGasLimit;
   const requiredPrefund = requiredGas * maxFeePerGas;
-  console.log("totalGasUnits", requiredGas);
-  console.log("maxFeePerGas", maxFeePerGas);
-  console.log("requiredPrefund", requiredPrefund);
-  console.log("multiply", 1.2);
   return multiply(requiredPrefund);
 }
 
@@ -24087,11 +24111,21 @@ async function getUserOperationGasPrice(client) {
     fast: parse(result.fast)
   };
 }
-function ephemeralSenderAddress(privateKey) {
-  return privateKeyToAccount(privateKey).address;
+async function estimateUserOperationGas2(client, op, entryPoint) {
+  const result = await client.request({
+    method: "eth_estimateUserOperationGas",
+    params: [op, entryPoint]
+  });
+  return {
+    callGasLimit: BigInt(result.callGasLimit),
+    verificationGasLimit: BigInt(result.verificationGasLimit),
+    preVerificationGas: BigInt(result.preVerificationGas),
+    paymasterVerificationGasLimit: BigInt(result.paymasterVerificationGasLimit ?? 0),
+    paymasterPostOpGasLimit: BigInt(result.paymasterPostOpGasLimit ?? 0)
+  };
 }
 async function buildSignedTornadoUserOp({
-  privateKey,
+  signer,
   chainId,
   paymasterAddress,
   paymasterData,
@@ -24101,7 +24135,7 @@ async function buildSignedTornadoUserOp({
   tailCalls = async () => [],
   nonce = 0n
 }) {
-  const owner = privateKeyToAccount(privateKey);
+  const owner = signer;
   const calls = await tailCalls(owner.address);
   let callData = "0x";
   if (calls.length === 1) {
@@ -24174,6 +24208,12 @@ function serializeAuth(auth) {
 }
 
 // src/state/thunks/paymasterWithdrawThunk.ts
+var BIP32_PATH = /^m(\/\d+'?)+$/;
+function assertValidDelegatorPath(path) {
+  if (!BIP32_PATH.test(path)) {
+    throw new Error(`Invalid delegation path "${path}": expected a BIP-32 path like m/44'/60'/0'/0/0`);
+  }
+}
 var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdrawals", async ({
   dataService,
   assetAddress,
@@ -24214,43 +24254,23 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
   );
   const bundlerClient = createPaymasterBundlerClient(bundlerUrl);
   const { standard: { maxFeePerGas, maxPriorityFeePerGas } } = await getUserOperationGasPrice(bundlerClient);
-  const gasUnits = reasonableGasUnits(poolInfo.isERC20);
-  const ethFee = computeMinimumViableFee(gasUnits, maxFeePerGas);
-  const fee = poolInfo.isERC20 ? await dataService.quoteWeiInToken(BigInt(paymasterAddress), poolInfo.asset, ethFee) : ethFee;
   const relayerAddress = BigInt(paymasterAddress);
   const bigintChainId = await dataService.getChainId();
   const { recipient: originalRecipient, ...restWithoutRecipient } = rest;
-  const sharedPrivateKey = tailCalls ? generatePrivateKey() : null;
-  const proofOutputs = [];
-  const userOperations = [];
-  for (let i = 0; i < deposits.length; i++) {
-    const deposit = deposits[i];
-    const isLast = i === deposits.length - 1;
-    const privateKey = sharedPrivateKey ?? (delegation?.mode === "deterministic" ? await secretManager.deriveEphemeralSigner({
-      depositIndex: deposit.index,
-      chainId: bigintChainId,
-      poolAddress: deposit.pool
-    }) : generatePrivateKey());
-    const recipient = sharedPrivateKey ? BigInt(ephemeralSenderAddress(privateKey)) : originalRecipient;
-    const effectiveTailCalls = isLast ? tailCalls : void 0;
-    const gas = { ...gasUnits, callGasLimit: effectiveTailCalls ? gasUnits.callGasLimit : 0n };
-    const withdrawResultAction = await dispatch(
-      withdrawalsProofThunk({
-        ...restWithoutRecipient,
-        recipient,
-        deposit,
-        relayerAddress,
-        fee
-      })
-    );
-    const proof = { ...unwrapResult(withdrawResultAction), poolAddress: deposit.pool };
-    proofOutputs.push(proof);
-    const { poolAddress, ...proofArgs } = proof;
-    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proofArgs.args;
-    const paymasterData = encodePaymasterData(
+  const quoteFee = async (ethFee) => poolInfo.isERC20 ? dataService.quoteWeiInToken(BigInt(paymasterAddress), poolInfo.asset, ethFee) : ethFee;
+  const prove = async (deposit, recipient, relayer, depositFee) => unwrapResult(await dispatch(withdrawalsProofThunk({
+    ...restWithoutRecipient,
+    recipient,
+    deposit,
+    relayerAddress: relayer,
+    fee: depositFee
+  })));
+  const buildPaymasterData = (poolAddress, proof) => {
+    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proof.args;
+    return encodePaymasterData(
       poolAcountsMap.get(poolAddress),
       encodeTornadoAdapterData(
-        proofArgs.proof,
+        proof.proof,
         root,
         nullifierHash,
         proofRecipient,
@@ -24259,43 +24279,130 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
         BigInt(refundArg)
       )
     );
-    userOperations.push(
-      await buildSignedTornadoUserOp({
-        privateKey,
-        chainId,
-        paymasterAddress,
-        paymasterData,
-        gas,
-        maxFeePerGas,
-        maxPriorityFeePerGas,
-        tailCalls: effectiveTailCalls,
-        // When sharing one ephemeral key across multiple deposits each userOp
-        // needs a distinct nonce (0, 1, 2 …) on the shared sender.
-        nonce: sharedPrivateKey ? BigInt(i) : 0n
-      })
-    );
+  };
+  const ephemeralSigner = async (deposit) => privateKeyToAccount(await secretManager.deriveEphemeralSigner({
+    depositIndex: deposit.index,
+    chainId: bigintChainId,
+    poolAddress: deposit.pool
+  }));
+  const resolveBatchDelegator = async () => {
+    if (delegation?.mode === "random") return privateKeyToAccount(generatePrivateKey());
+    if (delegation?.mode === "deterministic" && delegation.path) {
+      assertValidDelegatorPath(delegation.path);
+      return privateKeyToAccount(await secretManager.deriveDelegatorSigner({ path: delegation.path }));
+    }
+    return ephemeralSigner(deposits[0]);
+  };
+  const resolveIndependentSigner = (deposit) => delegation?.mode === "deterministic" ? ephemeralSigner(deposit) : Promise.resolve(privateKeyToAccount(generatePrivateKey()));
+  const needsConsolidation = deposits.length > 1 || tailCalls != null;
+  if (!needsConsolidation) {
+    const deposit = deposits[0];
+    const signer2 = await resolveIndependentSigner(deposit);
+    const gasUnits = reasonableGasUnits(poolInfo.isERC20);
+    const fee2 = await quoteFee(computeMinimumViableFee(gasUnits, maxFeePerGas));
+    const proof = await prove(deposit, originalRecipient, relayerAddress, fee2);
+    const userOperation2 = await buildSignedTornadoUserOp({
+      signer: signer2,
+      chainId,
+      paymasterAddress,
+      paymasterData: buildPaymasterData(deposit.pool, proof),
+      gas: { ...gasUnits, callGasLimit: 0n },
+      maxFeePerGas,
+      maxPriorityFeePerGas,
+      nonce: 0n
+    });
+    return [{
+      mode: "paymaster",
+      proof,
+      poolAddress: deposit.pool,
+      isERC20: poolInfo.isERC20,
+      paymasterAddress,
+      entryPointAddress,
+      bundlerUrl,
+      userOperation: userOperation2
+    }];
+  }
+  const signer = await resolveBatchDelegator();
+  const senderAddress = BigInt(signer.address);
+  const sponsoringDeposit = deposits[0];
+  const directDeposits = deposits.slice(1);
+  const ZERO_ADDRESS = 0n;
+  const directWithdrawCalls = [];
+  for (const deposit of directDeposits) {
+    const proof = await prove(deposit, senderAddress, ZERO_ADDRESS, 0n);
+    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proof.args;
+    const data = encodeFunctionData({
+      abi: poolAbi,
+      functionName: "withdraw",
+      args: [proof.proof, root, nullifierHash, proofRecipient, relayerArg, BigInt(feeArg), BigInt(refundArg)]
+    });
+    directWithdrawCalls.push(createTx(addressToHex(deposit.pool), data, 0n));
   }
-  return proofOutputs.map(({ poolAddress, ...proof }, i) => ({
+  const totalDenomination = deposits.reduce(
+    (sum, d) => sum + pools.get(d.pool).denomination,
+    0n
+  );
+  const forwardCalls = (fee2) => {
+    const amount2 = totalDenomination - fee2;
+    if (poolInfo.isERC20) {
+      const data = encodeFunctionData({
+        abi: erc20Abi,
+        functionName: "transfer",
+        args: [addressToHex(originalRecipient), amount2]
+      });
+      return [createTx(addressToHex(poolInfo.asset), data, 0n)];
+    }
+    return [createTx(addressToHex(originalRecipient), "0x", amount2)];
+  };
+  const composeTailCalls = (fee2) => async (addr) => [
+    ...directWithdrawCalls,
+    ...tailCalls ? await tailCalls(addr) : forwardCalls(fee2)
+  ];
+  const buildOp = (gas2, fee2, paymasterData) => buildSignedTornadoUserOp({
+    signer,
+    chainId,
+    paymasterAddress,
+    paymasterData,
+    gas: gas2,
+    maxFeePerGas,
+    maxPriorityFeePerGas,
+    tailCalls: composeTailCalls(fee2),
+    nonce: 0n
+  });
+  const baselineGas = reasonableGasUnitsForBatch(poolInfo.isERC20, directDeposits.length, tailCalls != null);
+  let fee = await quoteFee(computeMinimumViableFee(baselineGas, maxFeePerGas));
+  let gas = baselineGas;
+  let sponsoringProof = await prove(sponsoringDeposit, senderAddress, relayerAddress, fee);
+  let userOperation = await buildOp(gas, fee, buildPaymasterData(sponsoringDeposit.pool, sponsoringProof));
+  try {
+    const estimated = await estimateUserOperationGas2(bundlerClient, userOperation, entryPointAddress);
+    const buffer2 = (x) => x * 12n / 10n;
+    const orBaseline = (e, b) => e > 0n ? buffer2(e) : b;
+    const refinedGas = {
+      callGasLimit: orBaseline(estimated.callGasLimit, baselineGas.callGasLimit),
+      verificationGasLimit: orBaseline(estimated.verificationGasLimit, baselineGas.verificationGasLimit),
+      preVerificationGas: orBaseline(estimated.preVerificationGas, baselineGas.preVerificationGas),
+      paymasterVerificationGasLimit: orBaseline(estimated.paymasterVerificationGasLimit, baselineGas.paymasterVerificationGasLimit),
+      paymasterPostOpGasLimit: orBaseline(estimated.paymasterPostOpGasLimit, baselineGas.paymasterPostOpGasLimit)
+    };
+    fee = await quoteFee(computeMinimumViableFee(refinedGas, maxFeePerGas));
+    gas = refinedGas;
+    sponsoringProof = await prove(sponsoringDeposit, senderAddress, relayerAddress, fee);
+    userOperation = await buildOp(gas, fee, buildPaymasterData(sponsoringDeposit.pool, sponsoringProof));
+  } catch {
+  }
+  return [{
     mode: "paymaster",
-    proof,
-    poolAddress,
+    proof: sponsoringProof,
+    poolAddress: sponsoringDeposit.pool,
     isERC20: poolInfo.isERC20,
     paymasterAddress,
     entryPointAddress,
     bundlerUrl,
-    userOperation: userOperations[i]
-  }));
+    userOperation
+  }];
 });
 
-// ../provider/dist/index.js
-var createTx = (address, payload, value = BigInt(0)) => {
-  return {
-    to: address,
-    data: payload,
-    value
-  };
-};
-
 // src/account/tx/shield.ts
 init_esm();
 init_esm();

package/dist/state-manager.worker.node.js

@@ -16853,9 +16853,13 @@ async function SecretManager({
     const coalesced = coalesceSecret({ secret: raw, chainId, poolAddress });
     return `0x${coalesced.toString(16).padStart(64, "0")}`;
   };
+  const deriveDelegatorSigner = async ({ path }) => {
+    return Promise.resolve(keystore.deriveAt(path));
+  };
   return {
     getDepositSecrets: (params) => deriveSecrets(params),
-    deriveEphemeralSigner
+    deriveEphemeralSigner,
+    deriveDelegatorSigner
   };
 }
 function tcPath({ accountIndex, secretType, depositIndex }) {
@@ -21416,6 +21420,15 @@ var withdrawThunk = createAsyncThunk("withdraw/executeWithdrawals", async ({
   return getWithdrawalsProofs();
 });
 
+// ../provider/dist/index.js
+var createTx = (address, payload, value = BigInt(0)) => {
+  return {
+    to: address,
+    data: payload,
+    value
+  };
+};
+
 // ../../node_modules/.pnpm/viem@2.48.4_typescript@5.9.3_zod@4.4.3/node_modules/viem/_esm/index.js
 init_exports();
 init_encodeAbiParameters2();
@@ -21590,8 +21603,14 @@ function privateKeyToAccount(privateKey, options = {}) {
   };
 }
 
+// src/state/thunks/paymasterWithdrawThunk.ts
+init_esm();
+
 // src/paymaster/fee.ts
 var ERC20_TRANSFER_GAS = 100000n;
+var PER_DIRECT_WITHDRAW_GAS = 400000n;
+var PER_DIRECT_WITHDRAW_GAS_ERC20 = 500000n;
+var FORWARD_GAS = 60000n;
 var baseGasUnits = {
   preVerificationGas: 80000n,
   verificationGasLimit: 50000n,
@@ -21606,6 +21625,15 @@ function reasonableGasUnits(isERC20) {
     paymasterVerificationGasLimit: baseGasUnits.paymasterVerificationGasLimit + ERC20_TRANSFER_GAS
   };
 }
+function reasonableGasUnitsForBatch(isERC20, extraWithdrawals, hasUserTailCalls) {
+  const base = reasonableGasUnits(isERC20);
+  const perWithdraw = isERC20 ? PER_DIRECT_WITHDRAW_GAS_ERC20 : PER_DIRECT_WITHDRAW_GAS;
+  const executionTail = hasUserTailCalls ? base.callGasLimit : FORWARD_GAS;
+  return {
+    ...base,
+    callGasLimit: BigInt(extraWithdrawals) * perWithdraw + executionTail
+  };
+}
 function computeMinimumViableFee(reasonableGasUnits2, maxFeePerGas) {
   const baseFeeMultiplier = 1.2;
   const decimals = baseFeeMultiplier.toString().split(".")[1]?.length ?? 0;
@@ -21613,10 +21641,6 @@ function computeMinimumViableFee(reasonableGasUnits2, maxFeePerGas) {
   const multiply = (base) => base * BigInt(Math.ceil(baseFeeMultiplier * denominator)) / BigInt(denominator);
   const requiredGas = reasonableGasUnits2.verificationGasLimit + reasonableGasUnits2.callGasLimit + reasonableGasUnits2.paymasterVerificationGasLimit + reasonableGasUnits2.preVerificationGas + reasonableGasUnits2.paymasterPostOpGasLimit;
   const requiredPrefund = requiredGas * maxFeePerGas;
-  console.log("totalGasUnits", requiredGas);
-  console.log("maxFeePerGas", maxFeePerGas);
-  console.log("requiredPrefund", requiredPrefund);
-  console.log("multiply", 1.2);
   return multiply(requiredPrefund);
 }
 
@@ -23313,11 +23337,21 @@ async function getUserOperationGasPrice(client) {
     fast: parse(result.fast)
   };
 }
-function ephemeralSenderAddress(privateKey) {
-  return privateKeyToAccount(privateKey).address;
+async function estimateUserOperationGas2(client, op, entryPoint) {
+  const result = await client.request({
+    method: "eth_estimateUserOperationGas",
+    params: [op, entryPoint]
+  });
+  return {
+    callGasLimit: BigInt(result.callGasLimit),
+    verificationGasLimit: BigInt(result.verificationGasLimit),
+    preVerificationGas: BigInt(result.preVerificationGas),
+    paymasterVerificationGasLimit: BigInt(result.paymasterVerificationGasLimit ?? 0),
+    paymasterPostOpGasLimit: BigInt(result.paymasterPostOpGasLimit ?? 0)
+  };
 }
 async function buildSignedTornadoUserOp({
-  privateKey,
+  signer,
   chainId,
   paymasterAddress,
   paymasterData,
@@ -23327,7 +23361,7 @@ async function buildSignedTornadoUserOp({
   tailCalls = async () => [],
   nonce = 0n
 }) {
-  const owner = privateKeyToAccount(privateKey);
+  const owner = signer;
   const calls = await tailCalls(owner.address);
   let callData = "0x";
   if (calls.length === 1) {
@@ -23400,6 +23434,12 @@ function serializeAuth(auth) {
 }
 
 // src/state/thunks/paymasterWithdrawThunk.ts
+var BIP32_PATH = /^m(\/\d+'?)+$/;
+function assertValidDelegatorPath(path) {
+  if (!BIP32_PATH.test(path)) {
+    throw new Error(`Invalid delegation path "${path}": expected a BIP-32 path like m/44'/60'/0'/0/0`);
+  }
+}
 var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdrawals", async ({
   dataService,
   assetAddress,
@@ -23440,43 +23480,23 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
   );
   const bundlerClient = createPaymasterBundlerClient(bundlerUrl);
   const { standard: { maxFeePerGas, maxPriorityFeePerGas } } = await getUserOperationGasPrice(bundlerClient);
-  const gasUnits = reasonableGasUnits(poolInfo.isERC20);
-  const ethFee = computeMinimumViableFee(gasUnits, maxFeePerGas);
-  const fee = poolInfo.isERC20 ? await dataService.quoteWeiInToken(BigInt(paymasterAddress), poolInfo.asset, ethFee) : ethFee;
   const relayerAddress = BigInt(paymasterAddress);
   const bigintChainId = await dataService.getChainId();
   const { recipient: originalRecipient, ...restWithoutRecipient } = rest;
-  const sharedPrivateKey = tailCalls ? generatePrivateKey() : null;
-  const proofOutputs = [];
-  const userOperations = [];
-  for (let i = 0; i < deposits.length; i++) {
-    const deposit = deposits[i];
-    const isLast = i === deposits.length - 1;
-    const privateKey = sharedPrivateKey ?? (delegation?.mode === "deterministic" ? await secretManager.deriveEphemeralSigner({
-      depositIndex: deposit.index,
-      chainId: bigintChainId,
-      poolAddress: deposit.pool
-    }) : generatePrivateKey());
-    const recipient = sharedPrivateKey ? BigInt(ephemeralSenderAddress(privateKey)) : originalRecipient;
-    const effectiveTailCalls = isLast ? tailCalls : void 0;
-    const gas = { ...gasUnits, callGasLimit: effectiveTailCalls ? gasUnits.callGasLimit : 0n };
-    const withdrawResultAction = await dispatch(
-      withdrawalsProofThunk({
-        ...restWithoutRecipient,
-        recipient,
-        deposit,
-        relayerAddress,
-        fee
-      })
-    );
-    const proof = { ...unwrapResult(withdrawResultAction), poolAddress: deposit.pool };
-    proofOutputs.push(proof);
-    const { poolAddress, ...proofArgs } = proof;
-    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proofArgs.args;
-    const paymasterData = encodePaymasterData(
+  const quoteFee = async (ethFee) => poolInfo.isERC20 ? dataService.quoteWeiInToken(BigInt(paymasterAddress), poolInfo.asset, ethFee) : ethFee;
+  const prove = async (deposit, recipient, relayer, depositFee) => unwrapResult(await dispatch(withdrawalsProofThunk({
+    ...restWithoutRecipient,
+    recipient,
+    deposit,
+    relayerAddress: relayer,
+    fee: depositFee
+  })));
+  const buildPaymasterData = (poolAddress, proof) => {
+    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proof.args;
+    return encodePaymasterData(
       poolAcountsMap.get(poolAddress),
       encodeTornadoAdapterData(
-        proofArgs.proof,
+        proof.proof,
         root,
         nullifierHash,
         proofRecipient,
@@ -23485,43 +23505,130 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
         BigInt(refundArg)
       )
     );
-    userOperations.push(
-      await buildSignedTornadoUserOp({
-        privateKey,
-        chainId,
-        paymasterAddress,
-        paymasterData,
-        gas,
-        maxFeePerGas,
-        maxPriorityFeePerGas,
-        tailCalls: effectiveTailCalls,
-        // When sharing one ephemeral key across multiple deposits each userOp
-        // needs a distinct nonce (0, 1, 2 …) on the shared sender.
-        nonce: sharedPrivateKey ? BigInt(i) : 0n
-      })
-    );
+  };
+  const ephemeralSigner = async (deposit) => privateKeyToAccount(await secretManager.deriveEphemeralSigner({
+    depositIndex: deposit.index,
+    chainId: bigintChainId,
+    poolAddress: deposit.pool
+  }));
+  const resolveBatchDelegator = async () => {
+    if (delegation?.mode === "random") return privateKeyToAccount(generatePrivateKey());
+    if (delegation?.mode === "deterministic" && delegation.path) {
+      assertValidDelegatorPath(delegation.path);
+      return privateKeyToAccount(await secretManager.deriveDelegatorSigner({ path: delegation.path }));
+    }
+    return ephemeralSigner(deposits[0]);
+  };
+  const resolveIndependentSigner = (deposit) => delegation?.mode === "deterministic" ? ephemeralSigner(deposit) : Promise.resolve(privateKeyToAccount(generatePrivateKey()));
+  const needsConsolidation = deposits.length > 1 || tailCalls != null;
+  if (!needsConsolidation) {
+    const deposit = deposits[0];
+    const signer2 = await resolveIndependentSigner(deposit);
+    const gasUnits = reasonableGasUnits(poolInfo.isERC20);
+    const fee2 = await quoteFee(computeMinimumViableFee(gasUnits, maxFeePerGas));
+    const proof = await prove(deposit, originalRecipient, relayerAddress, fee2);
+    const userOperation2 = await buildSignedTornadoUserOp({
+      signer: signer2,
+      chainId,
+      paymasterAddress,
+      paymasterData: buildPaymasterData(deposit.pool, proof),
+      gas: { ...gasUnits, callGasLimit: 0n },
+      maxFeePerGas,
+      maxPriorityFeePerGas,
+      nonce: 0n
+    });
+    return [{
+      mode: "paymaster",
+      proof,
+      poolAddress: deposit.pool,
+      isERC20: poolInfo.isERC20,
+      paymasterAddress,
+      entryPointAddress,
+      bundlerUrl,
+      userOperation: userOperation2
+    }];
+  }
+  const signer = await resolveBatchDelegator();
+  const senderAddress = BigInt(signer.address);
+  const sponsoringDeposit = deposits[0];
+  const directDeposits = deposits.slice(1);
+  const ZERO_ADDRESS = 0n;
+  const directWithdrawCalls = [];
+  for (const deposit of directDeposits) {
+    const proof = await prove(deposit, senderAddress, ZERO_ADDRESS, 0n);
+    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proof.args;
+    const data = encodeFunctionData({
+      abi: poolAbi,
+      functionName: "withdraw",
+      args: [proof.proof, root, nullifierHash, proofRecipient, relayerArg, BigInt(feeArg), BigInt(refundArg)]
+    });
+    directWithdrawCalls.push(createTx(addressToHex(deposit.pool), data, 0n));
   }
-  return proofOutputs.map(({ poolAddress, ...proof }, i) => ({
+  const totalDenomination = deposits.reduce(
+    (sum, d) => sum + pools.get(d.pool).denomination,
+    0n
+  );
+  const forwardCalls = (fee2) => {
+    const amount2 = totalDenomination - fee2;
+    if (poolInfo.isERC20) {
+      const data = encodeFunctionData({
+        abi: erc20Abi,
+        functionName: "transfer",
+        args: [addressToHex(originalRecipient), amount2]
+      });
+      return [createTx(addressToHex(poolInfo.asset), data, 0n)];
+    }
+    return [createTx(addressToHex(originalRecipient), "0x", amount2)];
+  };
+  const composeTailCalls = (fee2) => async (addr) => [
+    ...directWithdrawCalls,
+    ...tailCalls ? await tailCalls(addr) : forwardCalls(fee2)
+  ];
+  const buildOp = (gas2, fee2, paymasterData) => buildSignedTornadoUserOp({
+    signer,
+    chainId,
+    paymasterAddress,
+    paymasterData,
+    gas: gas2,
+    maxFeePerGas,
+    maxPriorityFeePerGas,
+    tailCalls: composeTailCalls(fee2),
+    nonce: 0n
+  });
+  const baselineGas = reasonableGasUnitsForBatch(poolInfo.isERC20, directDeposits.length, tailCalls != null);
+  let fee = await quoteFee(computeMinimumViableFee(baselineGas, maxFeePerGas));
+  let gas = baselineGas;
+  let sponsoringProof = await prove(sponsoringDeposit, senderAddress, relayerAddress, fee);
+  let userOperation = await buildOp(gas, fee, buildPaymasterData(sponsoringDeposit.pool, sponsoringProof));
+  try {
+    const estimated = await estimateUserOperationGas2(bundlerClient, userOperation, entryPointAddress);
+    const buffer2 = (x) => x * 12n / 10n;
+    const orBaseline = (e, b) => e > 0n ? buffer2(e) : b;
+    const refinedGas = {
+      callGasLimit: orBaseline(estimated.callGasLimit, baselineGas.callGasLimit),
+      verificationGasLimit: orBaseline(estimated.verificationGasLimit, baselineGas.verificationGasLimit),
+      preVerificationGas: orBaseline(estimated.preVerificationGas, baselineGas.preVerificationGas),
+      paymasterVerificationGasLimit: orBaseline(estimated.paymasterVerificationGasLimit, baselineGas.paymasterVerificationGasLimit),
+      paymasterPostOpGasLimit: orBaseline(estimated.paymasterPostOpGasLimit, baselineGas.paymasterPostOpGasLimit)
+    };
+    fee = await quoteFee(computeMinimumViableFee(refinedGas, maxFeePerGas));
+    gas = refinedGas;
+    sponsoringProof = await prove(sponsoringDeposit, senderAddress, relayerAddress, fee);
+    userOperation = await buildOp(gas, fee, buildPaymasterData(sponsoringDeposit.pool, sponsoringProof));
+  } catch {
+  }
+  return [{
     mode: "paymaster",
-    proof,
-    poolAddress,
+    proof: sponsoringProof,
+    poolAddress: sponsoringDeposit.pool,
     isERC20: poolInfo.isERC20,
     paymasterAddress,
     entryPointAddress,
     bundlerUrl,
-    userOperation: userOperations[i]
-  }));
+    userOperation
+  }];
 });
 
-// ../provider/dist/index.js
-var createTx = (address, payload, value = BigInt(0)) => {
-  return {
-    to: address,
-    data: payload,
-    value
-  };
-};
-
 // src/account/tx/shield.ts
 init_esm();
 init_esm();

package/dist/worker-loader.browser.d.ts

@@ -113,6 +113,24 @@ declare enum DepositStrategy {
     MinFee = 1
 }
 
+/**
+ * How the batch delegator for a tail-call paymaster withdrawal is produced.
+ * Only honored when `tailCalls` are present (see `paymasterWithdrawThunk`).
+ *
+ * - `deterministic` (default): recoverable. With `path`, the delegator is a
+ *   classical wallet-path address; without `path`, an ephemeral address keyed by
+ *   the batch's first deposit.
+ * - `random`: a throwaway, unrecoverable EOA — an explicit opt-out of
+ *   recoverability. Never the default, because in the tail-call path the
+ *   delegator holds the withdrawn funds.
+ */
+type DelegationConfig = {
+    mode: 'deterministic';
+    path?: string;
+} | {
+    mode: 'random';
+};
+
 interface SerializedAuth {
     address: Address$1;
     chainId: Hex;
@@ -154,12 +172,6 @@ interface IGenericPaymasterWithdrawalPayload {
     userOperation: SerializedUserOperation;
 }
 
-type DelegationConfig = {
-    mode: 'deterministic';
-    path?: string;
-} | {
-    mode: 'random';
-};
 type StringAddress = `0x${string}`;
 interface IPaymasterConfig {
     paymasterAddress: StringAddress;

package/dist/worker-loader.node.d.ts

@@ -114,6 +114,24 @@ declare enum DepositStrategy {
     MinFee = 1
 }
 
+/**
+ * How the batch delegator for a tail-call paymaster withdrawal is produced.
+ * Only honored when `tailCalls` are present (see `paymasterWithdrawThunk`).
+ *
+ * - `deterministic` (default): recoverable. With `path`, the delegator is a
+ *   classical wallet-path address; without `path`, an ephemeral address keyed by
+ *   the batch's first deposit.
+ * - `random`: a throwaway, unrecoverable EOA — an explicit opt-out of
+ *   recoverability. Never the default, because in the tail-call path the
+ *   delegator holds the withdrawn funds.
+ */
+type DelegationConfig = {
+    mode: 'deterministic';
+    path?: string;
+} | {
+    mode: 'random';
+};
+
 interface SerializedAuth {
     address: Address$1;
     chainId: Hex;
@@ -155,12 +173,6 @@ interface IGenericPaymasterWithdrawalPayload {
     userOperation: SerializedUserOperation;
 }
 
-type DelegationConfig = {
-    mode: 'deterministic';
-    path?: string;
-} | {
-    mode: 'random';
-};
 type StringAddress = `0x${string}`;
 interface IPaymasterConfig {
     paymasterAddress: StringAddress;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kohaku-eth/tornado-cash",
-  "version": "0.0.2-alpha.15",
+  "version": "0.0.2-alpha.17",
   "description": "Tornado Cash Shielded Pool Kohaku Plugin",
   "type": "module",
   "private": false,
@@ -74,9 +74,9 @@
     "micro-zk-proofs": "0.3.1",
     "ox": "^0.12.0",
     "viem": "^2.51.3",
+    "@kohaku-eth/plugins": "0.0.1-alpha.11",
     "@kohaku-eth/mimc-tree": "0.0.3",
-    "@kohaku-eth/provider": "0.1.0-alpha.8",
-    "@kohaku-eth/plugins": "0.0.1-alpha.11"
+    "@kohaku-eth/provider": "0.1.0-alpha.8"
   },
   "devDependencies": {
     "@types/node": "^24.12.2",