@kohaku-eth/tornado-cash 0.0.2-alpha.16 → 0.0.2-alpha.18

package/dist/index.d.ts

@@ -502,6 +502,12 @@ interface IPaymasterWithdrawParams extends IWithdrawBaseParams {
     mode: 'paymaster';
     delegation?: DelegationConfig;
     tailCalls?: (address: AccountId) => Promise<TxData[]>;
+    /**
+     * Optional baseline for the execution-phase gas of user `tailCalls` (not
+     * including per-note direct withdraws). Used when bundler estimation fails;
+     * when estimation succeeds the bundler estimate still wins.
+     */
+    tailCallsGasEstimate?: bigint;
 }
 type IWithdrawapOperationParams = IRelayerWithdrawParams | IPaymasterWithdrawParams;
 interface IGetNotesParams extends IBaseOperationParams {
@@ -567,6 +573,13 @@ interface TCRelayerUnshieldOptions extends UnshieldOptions {
 interface TCPaymasterUnshieldOptions extends UnshieldOptions {
     mode: 'paymaster';
     delegation?: DelegationConfig;
+    /**
+     * Optional baseline for the execution-phase gas of user `tailCalls` (not
+     * including per-note direct withdraws). Used as the batch execution-tail
+     * baseline when bundler estimation fails; when estimation succeeds the
+     * bundler estimate still wins. Defaults to the SDK's static callGasLimit.
+     */
+    tailCallsGasEstimate?: bigint;
 }
 type TCPrepareUnshieldOptions = TCRelayerUnshieldOptions | TCPaymasterUnshieldOptions;
 interface TCPrepareShieldOptions {

package/dist/index.js

@@ -592,7 +592,8 @@ var TornadoCashProtocol = class {
         ...baseParams,
         mode: "paymaster",
         delegation: options.delegation,
-        tailCalls: options.tailCalls
+        tailCalls: options.tailCalls,
+        tailCallsGasEstimate: options.tailCallsGasEstimate
       });
     } else {
       withdrawals = await stateManager.getWithdrawalPayloads({

package/dist/state-manager.worker.js

@@ -22194,6 +22194,15 @@ var withdrawThunk = createAsyncThunk("withdraw/executeWithdrawals", async ({
   return getWithdrawalsProofs();
 });
 
+// ../provider/dist/index.js
+var createTx = (address, payload, value = BigInt(0)) => {
+  return {
+    to: address,
+    data: payload,
+    value
+  };
+};
+
 // ../../node_modules/.pnpm/viem@2.48.4_typescript@5.9.3_zod@4.4.3/node_modules/viem/_esm/index.js
 init_exports();
 init_encodeAbiParameters2();
@@ -22368,14 +22377,20 @@ function privateKeyToAccount(privateKey, options = {}) {
   };
 }
 
+// src/state/thunks/paymasterWithdrawThunk.ts
+init_esm();
+
 // src/paymaster/fee.ts
 var ERC20_TRANSFER_GAS = 100000n;
+var PER_DIRECT_WITHDRAW_GAS = 400000n;
+var PER_DIRECT_WITHDRAW_GAS_ERC20 = 500000n;
+var FORWARD_GAS = 60000n;
 var baseGasUnits = {
-  preVerificationGas: 80000n,
+  preVerificationGas: 85000n,
   verificationGasLimit: 50000n,
   callGasLimit: 300000n,
   paymasterVerificationGasLimit: 350000n,
-  paymasterPostOpGasLimit: 10000n
+  paymasterPostOpGasLimit: 50000n
 };
 function reasonableGasUnits(isERC20) {
   if (!isERC20) return baseGasUnits;
@@ -22384,6 +22399,15 @@ function reasonableGasUnits(isERC20) {
     paymasterVerificationGasLimit: baseGasUnits.paymasterVerificationGasLimit + ERC20_TRANSFER_GAS
   };
 }
+function reasonableGasUnitsForBatch(isERC20, extraWithdrawals, hasUserTailCalls, tailCallsGasEstimate) {
+  const base = reasonableGasUnits(isERC20);
+  const perWithdraw = isERC20 ? PER_DIRECT_WITHDRAW_GAS_ERC20 : PER_DIRECT_WITHDRAW_GAS;
+  const executionTail = hasUserTailCalls ? tailCallsGasEstimate ?? base.callGasLimit : FORWARD_GAS;
+  return {
+    ...base,
+    callGasLimit: BigInt(extraWithdrawals) * perWithdraw + executionTail
+  };
+}
 function computeMinimumViableFee(reasonableGasUnits2, maxFeePerGas) {
   const baseFeeMultiplier = 1.2;
   const decimals = baseFeeMultiplier.toString().split(".")[1]?.length ?? 0;
@@ -22391,10 +22415,6 @@ function computeMinimumViableFee(reasonableGasUnits2, maxFeePerGas) {
   const multiply = (base) => base * BigInt(Math.ceil(baseFeeMultiplier * denominator)) / BigInt(denominator);
   const requiredGas = reasonableGasUnits2.verificationGasLimit + reasonableGasUnits2.callGasLimit + reasonableGasUnits2.paymasterVerificationGasLimit + reasonableGasUnits2.preVerificationGas + reasonableGasUnits2.paymasterPostOpGasLimit;
   const requiredPrefund = requiredGas * maxFeePerGas;
-  console.log("totalGasUnits", requiredGas);
-  console.log("maxFeePerGas", maxFeePerGas);
-  console.log("requiredPrefund", requiredPrefund);
-  console.log("multiply", 1.2);
   return multiply(requiredPrefund);
 }
 
@@ -24091,6 +24111,19 @@ async function getUserOperationGasPrice(client) {
     fast: parse(result.fast)
   };
 }
+async function estimateUserOperationGas2(client, op, entryPoint) {
+  const result = await client.request({
+    method: "eth_estimateUserOperationGas",
+    params: [op, entryPoint]
+  });
+  return {
+    callGasLimit: BigInt(result.callGasLimit),
+    verificationGasLimit: BigInt(result.verificationGasLimit),
+    preVerificationGas: BigInt(result.preVerificationGas),
+    paymasterVerificationGasLimit: BigInt(result.paymasterVerificationGasLimit ?? 0),
+    paymasterPostOpGasLimit: BigInt(result.paymasterPostOpGasLimit ?? 0)
+  };
+}
 async function buildSignedTornadoUserOp({
   signer,
   chainId,
@@ -24191,6 +24224,7 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
   },
   secretManager,
   tailCalls,
+  tailCallsGasEstimate,
   ...rest
 }, { getState, dispatch }) => {
   const state = getState();
@@ -24221,12 +24255,32 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
   );
   const bundlerClient = createPaymasterBundlerClient(bundlerUrl);
   const { standard: { maxFeePerGas, maxPriorityFeePerGas } } = await getUserOperationGasPrice(bundlerClient);
-  const gasUnits = reasonableGasUnits(poolInfo.isERC20);
-  const ethFee = computeMinimumViableFee(gasUnits, maxFeePerGas);
-  const fee = poolInfo.isERC20 ? await dataService.quoteWeiInToken(BigInt(paymasterAddress), poolInfo.asset, ethFee) : ethFee;
   const relayerAddress = BigInt(paymasterAddress);
   const bigintChainId = await dataService.getChainId();
   const { recipient: originalRecipient, ...restWithoutRecipient } = rest;
+  const quoteFee = async (ethFee) => poolInfo.isERC20 ? dataService.quoteWeiInToken(BigInt(paymasterAddress), poolInfo.asset, ethFee) : ethFee;
+  const prove = async (deposit, recipient, relayer, depositFee) => unwrapResult(await dispatch(withdrawalsProofThunk({
+    ...restWithoutRecipient,
+    recipient,
+    deposit,
+    relayerAddress: relayer,
+    fee: depositFee
+  })));
+  const buildPaymasterData = (poolAddress, proof) => {
+    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proof.args;
+    return encodePaymasterData(
+      poolAcountsMap.get(poolAddress),
+      encodeTornadoAdapterData(
+        proof.proof,
+        root,
+        nullifierHash,
+        proofRecipient,
+        relayerArg,
+        BigInt(feeArg),
+        BigInt(refundArg)
+      )
+    );
+  };
   const ephemeralSigner = async (deposit) => privateKeyToAccount(await secretManager.deriveEphemeralSigner({
     depositIndex: deposit.index,
     chainId: bigintChainId,
@@ -24241,78 +24295,120 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
     return ephemeralSigner(deposits[0]);
   };
   const resolveIndependentSigner = (deposit) => delegation?.mode === "deterministic" ? ephemeralSigner(deposit) : Promise.resolve(privateKeyToAccount(generatePrivateKey()));
-  const sharedDelegator = tailCalls ? await resolveBatchDelegator() : null;
-  const proofOutputs = [];
-  const userOperations = [];
-  for (let i = 0; i < deposits.length; i++) {
-    const deposit = deposits[i];
-    const isLast = i === deposits.length - 1;
-    const signer = sharedDelegator ?? await resolveIndependentSigner(deposit);
-    const recipient = sharedDelegator ? BigInt(signer.address) : originalRecipient;
-    const effectiveTailCalls = isLast ? tailCalls : void 0;
-    const gas = { ...gasUnits, callGasLimit: effectiveTailCalls ? gasUnits.callGasLimit : 0n };
-    const withdrawResultAction = await dispatch(
-      withdrawalsProofThunk({
-        ...restWithoutRecipient,
-        recipient,
-        deposit,
-        relayerAddress,
-        fee
-      })
-    );
-    const proof = { ...unwrapResult(withdrawResultAction), poolAddress: deposit.pool };
-    proofOutputs.push(proof);
-    const { poolAddress, ...proofArgs } = proof;
-    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proofArgs.args;
-    const paymasterData = encodePaymasterData(
-      poolAcountsMap.get(poolAddress),
-      encodeTornadoAdapterData(
-        proofArgs.proof,
-        root,
-        nullifierHash,
-        proofRecipient,
-        relayerArg,
-        BigInt(feeArg),
-        BigInt(refundArg)
-      )
-    );
-    userOperations.push(
-      await buildSignedTornadoUserOp({
-        signer,
-        chainId,
-        paymasterAddress,
-        paymasterData,
-        gas,
-        maxFeePerGas,
-        maxPriorityFeePerGas,
-        tailCalls: effectiveTailCalls,
-        // When sharing one delegator across multiple deposits each userOp needs
-        // a distinct nonce (0, 1, 2 …) on the shared sender.
-        nonce: sharedDelegator ? BigInt(i) : 0n
-      })
-    );
+  const needsConsolidation = deposits.length > 1 || tailCalls != null;
+  if (!needsConsolidation) {
+    const deposit = deposits[0];
+    const signer2 = await resolveIndependentSigner(deposit);
+    const gasUnits = reasonableGasUnits(poolInfo.isERC20);
+    const fee2 = await quoteFee(computeMinimumViableFee(gasUnits, maxFeePerGas));
+    const proof = await prove(deposit, originalRecipient, relayerAddress, fee2);
+    const userOperation2 = await buildSignedTornadoUserOp({
+      signer: signer2,
+      chainId,
+      paymasterAddress,
+      paymasterData: buildPaymasterData(deposit.pool, proof),
+      gas: { ...gasUnits, callGasLimit: 0n },
+      maxFeePerGas,
+      maxPriorityFeePerGas,
+      nonce: 0n
+    });
+    return [{
+      mode: "paymaster",
+      proof,
+      poolAddress: deposit.pool,
+      isERC20: poolInfo.isERC20,
+      paymasterAddress,
+      entryPointAddress,
+      bundlerUrl,
+      userOperation: userOperation2
+    }];
+  }
+  const signer = await resolveBatchDelegator();
+  const senderAddress = BigInt(signer.address);
+  const sponsoringDeposit = deposits[0];
+  const directDeposits = deposits.slice(1);
+  const ZERO_ADDRESS = 0n;
+  const directWithdrawCalls = [];
+  for (const deposit of directDeposits) {
+    const proof = await prove(deposit, senderAddress, ZERO_ADDRESS, 0n);
+    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proof.args;
+    const data = encodeFunctionData({
+      abi: poolAbi,
+      functionName: "withdraw",
+      args: [proof.proof, root, nullifierHash, proofRecipient, relayerArg, BigInt(feeArg), BigInt(refundArg)]
+    });
+    directWithdrawCalls.push(createTx(addressToHex(deposit.pool), data, 0n));
   }
-  return proofOutputs.map(({ poolAddress, ...proof }, i) => ({
+  const totalDenomination = deposits.reduce(
+    (sum, d) => sum + pools.get(d.pool).denomination,
+    0n
+  );
+  const forwardCalls = (fee2) => {
+    const amount2 = totalDenomination - fee2;
+    if (poolInfo.isERC20) {
+      const data = encodeFunctionData({
+        abi: erc20Abi,
+        functionName: "transfer",
+        args: [addressToHex(originalRecipient), amount2]
+      });
+      return [createTx(addressToHex(poolInfo.asset), data, 0n)];
+    }
+    return [createTx(addressToHex(originalRecipient), "0x", amount2)];
+  };
+  const composeTailCalls = (fee2) => async (addr) => [
+    ...directWithdrawCalls,
+    ...tailCalls ? await tailCalls(addr) : forwardCalls(fee2)
+  ];
+  const buildOp = (gas2, fee2, paymasterData) => buildSignedTornadoUserOp({
+    signer,
+    chainId,
+    paymasterAddress,
+    paymasterData,
+    gas: gas2,
+    maxFeePerGas,
+    maxPriorityFeePerGas,
+    tailCalls: composeTailCalls(fee2),
+    nonce: 0n
+  });
+  const baselineGas = reasonableGasUnitsForBatch(
+    poolInfo.isERC20,
+    directDeposits.length,
+    tailCalls != null,
+    tailCallsGasEstimate
+  );
+  let fee = await quoteFee(computeMinimumViableFee(baselineGas, maxFeePerGas));
+  let gas = baselineGas;
+  let sponsoringProof = await prove(sponsoringDeposit, senderAddress, relayerAddress, fee);
+  let userOperation = await buildOp(gas, fee, buildPaymasterData(sponsoringDeposit.pool, sponsoringProof));
+  try {
+    const estimated = await estimateUserOperationGas2(bundlerClient, userOperation, entryPointAddress);
+    const buffer2 = (x) => x * 12n / 10n;
+    const orBaseline = (e, b) => e > 0n ? buffer2(e) : b;
+    const refinedGas = {
+      callGasLimit: orBaseline(estimated.callGasLimit, baselineGas.callGasLimit),
+      verificationGasLimit: orBaseline(estimated.verificationGasLimit, baselineGas.verificationGasLimit),
+      preVerificationGas: orBaseline(estimated.preVerificationGas, baselineGas.preVerificationGas),
+      paymasterVerificationGasLimit: orBaseline(estimated.paymasterVerificationGasLimit, baselineGas.paymasterVerificationGasLimit),
+      paymasterPostOpGasLimit: orBaseline(estimated.paymasterPostOpGasLimit, baselineGas.paymasterPostOpGasLimit)
+    };
+    fee = await quoteFee(computeMinimumViableFee(refinedGas, maxFeePerGas));
+    gas = refinedGas;
+    sponsoringProof = await prove(sponsoringDeposit, senderAddress, relayerAddress, fee);
+    userOperation = await buildOp(gas, fee, buildPaymasterData(sponsoringDeposit.pool, sponsoringProof));
+  } catch {
+  }
+  return [{
     mode: "paymaster",
-    proof,
-    poolAddress,
+    proof: sponsoringProof,
+    poolAddress: sponsoringDeposit.pool,
     isERC20: poolInfo.isERC20,
     paymasterAddress,
     entryPointAddress,
     bundlerUrl,
-    userOperation: userOperations[i]
-  }));
+    userOperation
+  }];
 });
 
-// ../provider/dist/index.js
-var createTx = (address, payload, value = BigInt(0)) => {
-  return {
-    to: address,
-    data: payload,
-    value
-  };
-};
-
 // src/account/tx/shield.ts
 init_esm();
 init_esm();
@@ -24595,7 +24691,8 @@ var storeStateManager = async ({
                 delegation: params.delegation
               },
               secretManager,
-              tailCalls: params.tailCalls
+              tailCalls: params.tailCalls,
+              tailCallsGasEstimate: params.tailCallsGasEstimate
             })
           )
         );

package/dist/state-manager.worker.node.js

@@ -21420,6 +21420,15 @@ var withdrawThunk = createAsyncThunk("withdraw/executeWithdrawals", async ({
   return getWithdrawalsProofs();
 });
 
+// ../provider/dist/index.js
+var createTx = (address, payload, value = BigInt(0)) => {
+  return {
+    to: address,
+    data: payload,
+    value
+  };
+};
+
 // ../../node_modules/.pnpm/viem@2.48.4_typescript@5.9.3_zod@4.4.3/node_modules/viem/_esm/index.js
 init_exports();
 init_encodeAbiParameters2();
@@ -21594,14 +21603,20 @@ function privateKeyToAccount(privateKey, options = {}) {
   };
 }
 
+// src/state/thunks/paymasterWithdrawThunk.ts
+init_esm();
+
 // src/paymaster/fee.ts
 var ERC20_TRANSFER_GAS = 100000n;
+var PER_DIRECT_WITHDRAW_GAS = 400000n;
+var PER_DIRECT_WITHDRAW_GAS_ERC20 = 500000n;
+var FORWARD_GAS = 60000n;
 var baseGasUnits = {
-  preVerificationGas: 80000n,
+  preVerificationGas: 85000n,
   verificationGasLimit: 50000n,
   callGasLimit: 300000n,
   paymasterVerificationGasLimit: 350000n,
-  paymasterPostOpGasLimit: 10000n
+  paymasterPostOpGasLimit: 50000n
 };
 function reasonableGasUnits(isERC20) {
   if (!isERC20) return baseGasUnits;
@@ -21610,6 +21625,15 @@ function reasonableGasUnits(isERC20) {
     paymasterVerificationGasLimit: baseGasUnits.paymasterVerificationGasLimit + ERC20_TRANSFER_GAS
   };
 }
+function reasonableGasUnitsForBatch(isERC20, extraWithdrawals, hasUserTailCalls, tailCallsGasEstimate) {
+  const base = reasonableGasUnits(isERC20);
+  const perWithdraw = isERC20 ? PER_DIRECT_WITHDRAW_GAS_ERC20 : PER_DIRECT_WITHDRAW_GAS;
+  const executionTail = hasUserTailCalls ? tailCallsGasEstimate ?? base.callGasLimit : FORWARD_GAS;
+  return {
+    ...base,
+    callGasLimit: BigInt(extraWithdrawals) * perWithdraw + executionTail
+  };
+}
 function computeMinimumViableFee(reasonableGasUnits2, maxFeePerGas) {
   const baseFeeMultiplier = 1.2;
   const decimals = baseFeeMultiplier.toString().split(".")[1]?.length ?? 0;
@@ -21617,10 +21641,6 @@ function computeMinimumViableFee(reasonableGasUnits2, maxFeePerGas) {
   const multiply = (base) => base * BigInt(Math.ceil(baseFeeMultiplier * denominator)) / BigInt(denominator);
   const requiredGas = reasonableGasUnits2.verificationGasLimit + reasonableGasUnits2.callGasLimit + reasonableGasUnits2.paymasterVerificationGasLimit + reasonableGasUnits2.preVerificationGas + reasonableGasUnits2.paymasterPostOpGasLimit;
   const requiredPrefund = requiredGas * maxFeePerGas;
-  console.log("totalGasUnits", requiredGas);
-  console.log("maxFeePerGas", maxFeePerGas);
-  console.log("requiredPrefund", requiredPrefund);
-  console.log("multiply", 1.2);
   return multiply(requiredPrefund);
 }
 
@@ -23317,6 +23337,19 @@ async function getUserOperationGasPrice(client) {
     fast: parse(result.fast)
   };
 }
+async function estimateUserOperationGas2(client, op, entryPoint) {
+  const result = await client.request({
+    method: "eth_estimateUserOperationGas",
+    params: [op, entryPoint]
+  });
+  return {
+    callGasLimit: BigInt(result.callGasLimit),
+    verificationGasLimit: BigInt(result.verificationGasLimit),
+    preVerificationGas: BigInt(result.preVerificationGas),
+    paymasterVerificationGasLimit: BigInt(result.paymasterVerificationGasLimit ?? 0),
+    paymasterPostOpGasLimit: BigInt(result.paymasterPostOpGasLimit ?? 0)
+  };
+}
 async function buildSignedTornadoUserOp({
   signer,
   chainId,
@@ -23417,6 +23450,7 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
   },
   secretManager,
   tailCalls,
+  tailCallsGasEstimate,
   ...rest
 }, { getState, dispatch }) => {
   const state = getState();
@@ -23447,12 +23481,32 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
   );
   const bundlerClient = createPaymasterBundlerClient(bundlerUrl);
   const { standard: { maxFeePerGas, maxPriorityFeePerGas } } = await getUserOperationGasPrice(bundlerClient);
-  const gasUnits = reasonableGasUnits(poolInfo.isERC20);
-  const ethFee = computeMinimumViableFee(gasUnits, maxFeePerGas);
-  const fee = poolInfo.isERC20 ? await dataService.quoteWeiInToken(BigInt(paymasterAddress), poolInfo.asset, ethFee) : ethFee;
   const relayerAddress = BigInt(paymasterAddress);
   const bigintChainId = await dataService.getChainId();
   const { recipient: originalRecipient, ...restWithoutRecipient } = rest;
+  const quoteFee = async (ethFee) => poolInfo.isERC20 ? dataService.quoteWeiInToken(BigInt(paymasterAddress), poolInfo.asset, ethFee) : ethFee;
+  const prove = async (deposit, recipient, relayer, depositFee) => unwrapResult(await dispatch(withdrawalsProofThunk({
+    ...restWithoutRecipient,
+    recipient,
+    deposit,
+    relayerAddress: relayer,
+    fee: depositFee
+  })));
+  const buildPaymasterData = (poolAddress, proof) => {
+    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proof.args;
+    return encodePaymasterData(
+      poolAcountsMap.get(poolAddress),
+      encodeTornadoAdapterData(
+        proof.proof,
+        root,
+        nullifierHash,
+        proofRecipient,
+        relayerArg,
+        BigInt(feeArg),
+        BigInt(refundArg)
+      )
+    );
+  };
   const ephemeralSigner = async (deposit) => privateKeyToAccount(await secretManager.deriveEphemeralSigner({
     depositIndex: deposit.index,
     chainId: bigintChainId,
@@ -23467,78 +23521,120 @@ var paymasterWithdrawThunk = createAsyncThunk("withdraw/executePaymasterWithdraw
     return ephemeralSigner(deposits[0]);
   };
   const resolveIndependentSigner = (deposit) => delegation?.mode === "deterministic" ? ephemeralSigner(deposit) : Promise.resolve(privateKeyToAccount(generatePrivateKey()));
-  const sharedDelegator = tailCalls ? await resolveBatchDelegator() : null;
-  const proofOutputs = [];
-  const userOperations = [];
-  for (let i = 0; i < deposits.length; i++) {
-    const deposit = deposits[i];
-    const isLast = i === deposits.length - 1;
-    const signer = sharedDelegator ?? await resolveIndependentSigner(deposit);
-    const recipient = sharedDelegator ? BigInt(signer.address) : originalRecipient;
-    const effectiveTailCalls = isLast ? tailCalls : void 0;
-    const gas = { ...gasUnits, callGasLimit: effectiveTailCalls ? gasUnits.callGasLimit : 0n };
-    const withdrawResultAction = await dispatch(
-      withdrawalsProofThunk({
-        ...restWithoutRecipient,
-        recipient,
-        deposit,
-        relayerAddress,
-        fee
-      })
-    );
-    const proof = { ...unwrapResult(withdrawResultAction), poolAddress: deposit.pool };
-    proofOutputs.push(proof);
-    const { poolAddress, ...proofArgs } = proof;
-    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proofArgs.args;
-    const paymasterData = encodePaymasterData(
-      poolAcountsMap.get(poolAddress),
-      encodeTornadoAdapterData(
-        proofArgs.proof,
-        root,
-        nullifierHash,
-        proofRecipient,
-        relayerArg,
-        BigInt(feeArg),
-        BigInt(refundArg)
-      )
-    );
-    userOperations.push(
-      await buildSignedTornadoUserOp({
-        signer,
-        chainId,
-        paymasterAddress,
-        paymasterData,
-        gas,
-        maxFeePerGas,
-        maxPriorityFeePerGas,
-        tailCalls: effectiveTailCalls,
-        // When sharing one delegator across multiple deposits each userOp needs
-        // a distinct nonce (0, 1, 2 …) on the shared sender.
-        nonce: sharedDelegator ? BigInt(i) : 0n
-      })
-    );
+  const needsConsolidation = deposits.length > 1 || tailCalls != null;
+  if (!needsConsolidation) {
+    const deposit = deposits[0];
+    const signer2 = await resolveIndependentSigner(deposit);
+    const gasUnits = reasonableGasUnits(poolInfo.isERC20);
+    const fee2 = await quoteFee(computeMinimumViableFee(gasUnits, maxFeePerGas));
+    const proof = await prove(deposit, originalRecipient, relayerAddress, fee2);
+    const userOperation2 = await buildSignedTornadoUserOp({
+      signer: signer2,
+      chainId,
+      paymasterAddress,
+      paymasterData: buildPaymasterData(deposit.pool, proof),
+      gas: { ...gasUnits, callGasLimit: 0n },
+      maxFeePerGas,
+      maxPriorityFeePerGas,
+      nonce: 0n
+    });
+    return [{
+      mode: "paymaster",
+      proof,
+      poolAddress: deposit.pool,
+      isERC20: poolInfo.isERC20,
+      paymasterAddress,
+      entryPointAddress,
+      bundlerUrl,
+      userOperation: userOperation2
+    }];
+  }
+  const signer = await resolveBatchDelegator();
+  const senderAddress = BigInt(signer.address);
+  const sponsoringDeposit = deposits[0];
+  const directDeposits = deposits.slice(1);
+  const ZERO_ADDRESS = 0n;
+  const directWithdrawCalls = [];
+  for (const deposit of directDeposits) {
+    const proof = await prove(deposit, senderAddress, ZERO_ADDRESS, 0n);
+    const [root, nullifierHash, proofRecipient, relayerArg, feeArg, refundArg] = proof.args;
+    const data = encodeFunctionData({
+      abi: poolAbi,
+      functionName: "withdraw",
+      args: [proof.proof, root, nullifierHash, proofRecipient, relayerArg, BigInt(feeArg), BigInt(refundArg)]
+    });
+    directWithdrawCalls.push(createTx(addressToHex(deposit.pool), data, 0n));
   }
-  return proofOutputs.map(({ poolAddress, ...proof }, i) => ({
+  const totalDenomination = deposits.reduce(
+    (sum, d) => sum + pools.get(d.pool).denomination,
+    0n
+  );
+  const forwardCalls = (fee2) => {
+    const amount2 = totalDenomination - fee2;
+    if (poolInfo.isERC20) {
+      const data = encodeFunctionData({
+        abi: erc20Abi,
+        functionName: "transfer",
+        args: [addressToHex(originalRecipient), amount2]
+      });
+      return [createTx(addressToHex(poolInfo.asset), data, 0n)];
+    }
+    return [createTx(addressToHex(originalRecipient), "0x", amount2)];
+  };
+  const composeTailCalls = (fee2) => async (addr) => [
+    ...directWithdrawCalls,
+    ...tailCalls ? await tailCalls(addr) : forwardCalls(fee2)
+  ];
+  const buildOp = (gas2, fee2, paymasterData) => buildSignedTornadoUserOp({
+    signer,
+    chainId,
+    paymasterAddress,
+    paymasterData,
+    gas: gas2,
+    maxFeePerGas,
+    maxPriorityFeePerGas,
+    tailCalls: composeTailCalls(fee2),
+    nonce: 0n
+  });
+  const baselineGas = reasonableGasUnitsForBatch(
+    poolInfo.isERC20,
+    directDeposits.length,
+    tailCalls != null,
+    tailCallsGasEstimate
+  );
+  let fee = await quoteFee(computeMinimumViableFee(baselineGas, maxFeePerGas));
+  let gas = baselineGas;
+  let sponsoringProof = await prove(sponsoringDeposit, senderAddress, relayerAddress, fee);
+  let userOperation = await buildOp(gas, fee, buildPaymasterData(sponsoringDeposit.pool, sponsoringProof));
+  try {
+    const estimated = await estimateUserOperationGas2(bundlerClient, userOperation, entryPointAddress);
+    const buffer2 = (x) => x * 12n / 10n;
+    const orBaseline = (e, b) => e > 0n ? buffer2(e) : b;
+    const refinedGas = {
+      callGasLimit: orBaseline(estimated.callGasLimit, baselineGas.callGasLimit),
+      verificationGasLimit: orBaseline(estimated.verificationGasLimit, baselineGas.verificationGasLimit),
+      preVerificationGas: orBaseline(estimated.preVerificationGas, baselineGas.preVerificationGas),
+      paymasterVerificationGasLimit: orBaseline(estimated.paymasterVerificationGasLimit, baselineGas.paymasterVerificationGasLimit),
+      paymasterPostOpGasLimit: orBaseline(estimated.paymasterPostOpGasLimit, baselineGas.paymasterPostOpGasLimit)
+    };
+    fee = await quoteFee(computeMinimumViableFee(refinedGas, maxFeePerGas));
+    gas = refinedGas;
+    sponsoringProof = await prove(sponsoringDeposit, senderAddress, relayerAddress, fee);
+    userOperation = await buildOp(gas, fee, buildPaymasterData(sponsoringDeposit.pool, sponsoringProof));
+  } catch {
+  }
+  return [{
     mode: "paymaster",
-    proof,
-    poolAddress,
+    proof: sponsoringProof,
+    poolAddress: sponsoringDeposit.pool,
     isERC20: poolInfo.isERC20,
     paymasterAddress,
     entryPointAddress,
     bundlerUrl,
-    userOperation: userOperations[i]
-  }));
+    userOperation
+  }];
 });
 
-// ../provider/dist/index.js
-var createTx = (address, payload, value = BigInt(0)) => {
-  return {
-    to: address,
-    data: payload,
-    value
-  };
-};
-
 // src/account/tx/shield.ts
 init_esm();
 init_esm();
@@ -23821,7 +23917,8 @@ var storeStateManager = async ({
                 delegation: params.delegation
               },
               secretManager,
-              tailCalls: params.tailCalls
+              tailCalls: params.tailCalls,
+              tailCallsGasEstimate: params.tailCallsGasEstimate
             })
           )
         );

package/dist/worker-loader.browser.d.ts

@@ -211,6 +211,12 @@ interface IPaymasterWithdrawParams extends IWithdrawBaseParams {
     mode: 'paymaster';
     delegation?: DelegationConfig;
     tailCalls?: (address: AccountId) => Promise<TxData[]>;
+    /**
+     * Optional baseline for the execution-phase gas of user `tailCalls` (not
+     * including per-note direct withdraws). Used when bundler estimation fails;
+     * when estimation succeeds the bundler estimate still wins.
+     */
+    tailCallsGasEstimate?: bigint;
 }
 type IWithdrawapOperationParams = IRelayerWithdrawParams | IPaymasterWithdrawParams;
 interface IGetNotesParams extends IBaseOperationParams {

package/dist/worker-loader.node.d.ts

@@ -212,6 +212,12 @@ interface IPaymasterWithdrawParams extends IWithdrawBaseParams {
     mode: 'paymaster';
     delegation?: DelegationConfig;
     tailCalls?: (address: AccountId) => Promise<TxData[]>;
+    /**
+     * Optional baseline for the execution-phase gas of user `tailCalls` (not
+     * including per-note direct withdraws). Used when bundler estimation fails;
+     * when estimation succeeds the bundler estimate still wins.
+     */
+    tailCallsGasEstimate?: bigint;
 }
 type IWithdrawapOperationParams = IRelayerWithdrawParams | IPaymasterWithdrawParams;
 interface IGetNotesParams extends IBaseOperationParams {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kohaku-eth/tornado-cash",
-  "version": "0.0.2-alpha.16",
+  "version": "0.0.2-alpha.18",
   "description": "Tornado Cash Shielded Pool Kohaku Plugin",
   "type": "module",
   "private": false,
@@ -75,8 +75,8 @@
     "ox": "^0.12.0",
     "viem": "^2.51.3",
     "@kohaku-eth/plugins": "0.0.1-alpha.11",
-    "@kohaku-eth/mimc-tree": "0.0.3",
-    "@kohaku-eth/provider": "0.1.0-alpha.8"
+    "@kohaku-eth/provider": "0.1.0-alpha.8",
+    "@kohaku-eth/mimc-tree": "0.0.3"
   },
   "devDependencies": {
     "@types/node": "^24.12.2",