@obolnetwork/obol-sdk 2.1.1 → 2.2.0

package/src/verification/common.ts

@@ -23,7 +23,6 @@ import {
   hashClusterLockV1X7,
   verifyDVV1X7,
 } from './v1.7.0.js';
-import { ethers } from 'ethers';
 import {
   DOMAIN_APPLICATION_BUILDER,
   DOMAIN_DEPOSIT,
@@ -33,7 +32,6 @@ import {
   signEnrPayload,
   signOperatorConfigHashPayload,
 } from '../constants.js';
-import { SignTypedDataVersion, TypedDataUtils } from '@metamask/eth-sig-util';
 import {
   builderRegistrationMessageType,
   depositMessageType,
@@ -48,6 +46,7 @@ import {
   hashClusterLockV1X8,
   verifyDVV1X8,
 } from './v1.8.0.js';
+import { validateAddressSignature } from './signature-validator.js';
 
 // cluster-definition hash
 
@@ -132,82 +131,94 @@ export const clusterLockHash = (clusterLock: ClusterLock): string => {
 
 // cluster-definition signatures verification
 
-const getPOSTConfigHashSigner = (
+const validatePOSTConfigHashSigner = async (
+  address: string,
   signature: string,
   configHash: string,
   chainId: FORK_MAPPING,
-): string => {
+): Promise<boolean> => {
   try {
-    const sig = ethers.Signature.from(signature);
     const data = signCreatorConfigHashPayload(
       { creator_config_hash: configHash },
       chainId,
     );
-    const digest = TypedDataUtils.eip712Hash(data, SignTypedDataVersion.V4);
 
-    return ethers.recoverAddress(digest, sig).toLowerCase();
+    return await validateAddressSignature({
+      address,
+      token: signature,
+      data,
+      chainId,
+    });
   } catch (err) {
     throw err;
   }
 };
 
-const getPUTConfigHashSigner = (
+const validatePUTConfigHashSigner = async (
+  address: string,
   signature: string,
   configHash: string,
   chainId: number,
-): string => {
+): Promise<boolean> => {
   try {
-    const sig = ethers.Signature.from(signature);
     const data = signOperatorConfigHashPayload(
       { operator_config_hash: configHash },
       chainId,
     );
-    const digest = TypedDataUtils.eip712Hash(data, SignTypedDataVersion.V4);
-
-    return ethers.recoverAddress(digest, sig).toLowerCase();
+    return await validateAddressSignature({
+      address,
+      token: signature,
+      data,
+      chainId,
+    });
   } catch (err) {
     throw err;
   }
 };
 
-const getEnrSigner = (
+const validateEnrSigner = async (
+  address: string,
   signature: string,
   payload: string,
   chainId: number,
-): string => {
+): Promise<boolean> => {
   try {
-    const sig = ethers.Signature.from(signature);
-
     const data = signEnrPayload({ enr: payload }, chainId);
-    const digest = TypedDataUtils.eip712Hash(data, SignTypedDataVersion.V4);
 
-    return ethers.recoverAddress(digest, sig).toLowerCase();
+    return await validateAddressSignature({
+      address,
+      token: signature,
+      data,
+      chainId,
+    });
   } catch (err) {
     throw err;
   }
 };
 
-const verifyDefinitionSignatures = (
+const verifyDefinitionSignatures = async (
   clusterDefinition: ClusterDefinition,
   definitionType: DefinitionFlow,
-): boolean => {
+): Promise<boolean> => {
   if (definitionType === DefinitionFlow.Charon) {
     return true;
   } else {
-    const configSigner = getPOSTConfigHashSigner(
+    const isPOSTConfigHashSignerValid = await validatePOSTConfigHashSigner(
+      clusterDefinition.creator.address,
       clusterDefinition.creator.config_signature as string,
       clusterDefinition.config_hash,
       FORK_MAPPING[clusterDefinition.fork_version as keyof typeof FORK_MAPPING],
     );
 
-    if (configSigner !== clusterDefinition.creator.address.toLowerCase()) {
+    if (!isPOSTConfigHashSignerValid) {
       return false;
     }
     if (definitionType === DefinitionFlow.Solo) {
       return true;
     }
-    return clusterDefinition.operators.every(operator => {
-      const configSigner = getPUTConfigHashSigner(
+    return clusterDefinition.operators.every(async operator => {
+      const isPUTConfigHashSignerValid = await validatePUTConfigHashSigner(
+        operator.address,
         operator.config_signature as string,
         clusterDefinition.config_hash,
         FORK_MAPPING[
@@ -215,7 +226,8 @@ const verifyDefinitionSignatures = (
         ],
       );
 
-      const enrSigner = getEnrSigner(
+      const isENRSignerValid = await validateEnrSigner(
+        operator.address,
         operator.enr_signature as string,
         operator.enr as string,
         FORK_MAPPING[
@@ -223,10 +235,7 @@ const verifyDefinitionSignatures = (
         ],
       );
 
-      if (
-        configSigner !== operator.address.toLowerCase() ||
-        enrSigner !== operator.address.toLowerCase()
-      ) {
+      if (!isPUTConfigHashSignerValid || !isENRSignerValid) {
         return false;
       }
       return true;
@@ -444,7 +453,7 @@ export const isValidClusterLock = async (
     if (definitionType == null) {
       return false;
     }
-    const isValidDefinitionData = verifyDefinitionSignatures(
+    const isValidDefinitionData = await verifyDefinitionSignatures(
       clusterLock.cluster_definition,
       definitionType,
     );

package/src/verification/signature-validator.ts

@@ -0,0 +1,96 @@
+/* eslint-disable @typescript-eslint/restrict-template-expressions */
+import { ethers } from 'ethers';
+import {
+  SignTypedDataVersion,
+  TypedDataUtils,
+  type TypedMessage,
+} from '@metamask/eth-sig-util';
+import Safe from '@safe-global/protocol-kit';
+import { PROVIDER_MAP } from '../constants';
+import { hashTypedData } from '@safe-global/protocol-kit/dist/src/utils';
+import { type EIP712TypedData } from '@safe-global/safe-core-sdk-types';
+import { isContractAvailable, getProvider } from '../utils';
+
+export const validateAddressSignature = async ({
+  address,
+  token,
+  data,
+  chainId,
+}: {
+  address: string;
+  token: string;
+  data: TypedMessage<any>;
+  chainId: number;
+}): Promise<boolean> => {
+  try {
+    const provider = getProvider(chainId);
+    if (provider) {
+      const contractAddress = await isContractAvailable(address, provider);
+      if (contractAddress) {
+        return await validateSmartContractSignature({
+          token,
+          data: data as unknown as EIP712TypedData,
+          address,
+          chainId,
+        });
+      }
+    }
+    return validateEOASignature({ token, data, address });
+  } catch (error) {
+    return validateEOASignature({ token, data, address });
+  }
+};
+
+export const validateEOASignature = ({
+  token,
+  data,
+  address,
+}: {
+  token: string;
+  data: TypedMessage<any>;
+  address: string;
+}): boolean => {
+  try {
+    const sig = ethers.Signature.from(token);
+    const digest = TypedDataUtils.eip712Hash(data, SignTypedDataVersion.V4);
+
+    return (
+      ethers.recoverAddress(digest, sig).toLowerCase() ===
+      address.toLocaleLowerCase()
+    );
+  } catch (err) {
+    console.error(`validate EOA Signature error: ${err}`);
+    throw err;
+  }
+};
+
+export const validateSmartContractSignature = async ({
+  token,
+  data,
+  address,
+  chainId,
+}: {
+  token: string;
+  data: EIP712TypedData;
+  address: string;
+  chainId: number;
+}): Promise<boolean> => {
+  try {
+    const provider = PROVIDER_MAP[chainId];
+    const protocolKit = await Safe.init({
+      provider,
+      safeAddress: address,
+    });
+    const messageHash = hashTypedData(data);
+    const isValidSignature = await protocolKit.isValidSignature(
+      messageHash,
+      token,
+    );
+
+    return isValidSignature;
+  } catch (err: any) {
+    throw new Error(
+      `Error validating smart contract signature: ${err.message}`,
+    );
+  }
+};