@trustvc/eip7702 1.1.0-beta.1 → 1.1.0-beta.3

package/README.md

@@ -63,7 +63,7 @@ Per-platform ERC-4337 paymaster cloned from a shared implementation.
 Deploys `PlatformPaymaster` clones deterministically.
 
 - `deployPlatformPaymaster(platformAddress, dailyLimit, salt)` — clones the implementation and calls `initialize`
-- `computePaymasterAddress(salt)` — predict the clone address before deployment
+- `computePaymasterAddress(deployer, platformAddress, salt)` — predict the clone address before deployment. The CREATE2 salt is `keccak256(abi.encode(deployer, platformAddress, salt))`, so another caller cannot take the predicted address.
 - `updateTdocDeployer(addr)` — update TDoc deployer (`onlyOwner`)
 - `updatePaymasterImplementation(addr)` — upgrade the implementation for future clones (`onlyOwner`)
 

package/contracts/Factory.sol

@@ -8,7 +8,6 @@ import {Clones} from "@openzeppelin/contracts/proxy/Clones.sol";
 contract PlatformAccountFactory is Ownable {
     address public tdocDeployer;
     address public paymasterImplementation;
-    mapping(address => address) public attachedPaymaster;
 
     event PlatformOnboarded(
         address indexed platformAddress,
@@ -27,13 +26,6 @@ contract PlatformAccountFactory is Ownable {
         paymasterImplementation = _paymasterImplementation;
     }
 
-    function setAttachedPaymaster(
-        address platformAddress
-    ) external view returns (address) {
-        address paymaster = attachedPaymaster[platformAddress];
-        return paymaster;
-    }
-
     function updateTdocDeployer(address _tdocDeployer) external onlyOwner {
         require(_tdocDeployer != address(0), "Zero address");
         tdocDeployer = _tdocDeployer;
@@ -51,7 +43,12 @@ contract PlatformAccountFactory is Ownable {
         uint256 dailyLimit,
         bytes32 salt
     ) external returns (address paymaster) {
-        paymaster = Clones.cloneDeterministic(paymasterImplementation, salt);
+        // Bind the CREATE2 salt to the caller and platform so a third party who
+        // only knows `salt` cannot deploy at the address this caller would get.
+        paymaster = Clones.cloneDeterministic(
+            paymasterImplementation,
+            _paymasterSalt(msg.sender, platformAddress, salt)
+        );
         PlatformPaymaster(payable(paymaster)).initialize(
             platformAddress,
             dailyLimit,
@@ -60,15 +57,26 @@ contract PlatformAccountFactory is Ownable {
         emit PlatformOnboarded(platformAddress, paymaster);
     }
 
-    // Address is determined solely by implementation + salt (not by constructor args).
+    // Predict the clone address for a specific deployer and platform.
+    // `deployer` must be the account that will call deployPlatformPaymaster.
     function computePaymasterAddress(
+        address deployer,
+        address platformAddress,
         bytes32 salt
     ) external view returns (address) {
         return
             Clones.predictDeterministicAddress(
                 paymasterImplementation,
-                salt,
+                _paymasterSalt(deployer, platformAddress, salt),
                 address(this)
             );
     }
+
+    function _paymasterSalt(
+        address deployer,
+        address platformAddress,
+        bytes32 salt
+    ) internal pure returns (bytes32) {
+        return keccak256(abi.encode(deployer, platformAddress, salt));
+    }
 }

package/contracts/PlatformPaymaster.sol

@@ -36,7 +36,7 @@ interface IAccessControl {
  * Access control is enforced by the Storage contract itself:
  *   require(msg.sender == beneficiary || msg.sender == holder)
  * so non-beneficiary/holder callers are rejected at execution time.
- * If the call reverts, _postOp skips the spend update.
+ * Reverted ops are still charged to dailySpend in _postOp (gas was paid).
  */
 contract PlatformPaymaster is BasePaymaster {
     bytes4 private constant EXECUTE_SEL =
@@ -70,6 +70,10 @@ contract PlatformPaymaster is BasePaymaster {
     mapping(address => uint256) public lastReset;
     uint256 public dailyLimit;
 
+    // Set once by initialize() (or the constructor for the implementation).
+    // Kept separate from owner() so renounceOwnership() cannot re-open initialize().
+    bool private _initialized;
+
     event RegistryAdded(address indexed registry);
     event RegistryRemoved(address indexed registry);
     event TitleEscrowLinked(
@@ -89,19 +93,22 @@ contract PlatformPaymaster is BasePaymaster {
     event UserOpRejected(address indexed user, string reason);
     event DailyLimitUpdated(uint256 newLimit);
 
-    // Deployed once as the shared implementation; BasePaymaster sets owner = msg.sender.
-    // That non-zero owner prevents initialize() from running on the implementation itself.
-    constructor(IEntryPoint _entryPoint) BasePaymaster(_entryPoint) {}
+    // Deployed once as the shared implementation; lock it so initialize() can never run on it.
+    constructor(IEntryPoint _entryPoint) BasePaymaster(_entryPoint) {
+        _initialized = true;
+    }
 
     // Called by the factory immediately after cloneDeterministic().
-    // A fresh clone has all-zero storage, so owner() == address(0) exactly once.
+    // Initialization state is tracked separately from ownership, so renounceOwnership()
+    // cannot make an initialized clone look fresh and re-open initialize().
     function initialize(
         address _owner,
         uint256 _dailyLimit,
         address _tdocDeployer
     ) external {
-        require(owner() == address(0), "Already initialized");
+        require(!_initialized, "Already initialized");
         require(_owner != address(0), "Zero owner");
+        _initialized = true;
         _transferOwnership(_owner);
         dailyLimit = _dailyLimit;
         tdocDeployer = ITDocDeployer(_tdocDeployer);
@@ -170,6 +177,12 @@ contract PlatformPaymaster is BasePaymaster {
         bytes calldata remark
     ) external returns (address titleEscrow) {
         require(authorizedRegistries[registry], "registry not authorized");
+        require(
+            authorizedCallers[msg.sender] ||
+                userWhitelist[msg.sender] > 0 ||
+                msg.sender == owner(),
+            "caller not authorized"
+        );
 
         titleEscrow = ITradeTrustToken(registry).mint(
             beneficiary,
@@ -272,6 +285,10 @@ contract PlatformPaymaster is BasePaymaster {
         // Double-spend safe: EntryPoint sequential nonces allow only one
         // pending UserOp per sender in the mempool at a time.
         if (target == address(this)) {
+            if (innerData.length < 4) {
+                emit UserOpRejected(sender, "inner callData too short");
+                return ("", _packValidationData(true, 0, 0));
+            }
             bytes4 innerSel;
             assembly {
                 innerSel := mload(add(innerData, 32))
@@ -283,7 +300,15 @@ contract PlatformPaymaster is BasePaymaster {
                     emit UserOpRejected(sender, "not whitelisted");
                     return ("", _packValidationData(true, 0, 0));
                 }
-                // credits consumed inside deployRegistry; flag as deployment to skip daily spend
+                if (address(tdocDeployer) == address(0)) {
+                    emit UserOpRejected(sender, "TdocDeployer not set");
+                    return ("", _packValidationData(true, 0, 0));
+                }
+                // Reverts on malformed ABI args, so only well-formed
+                // deployRegistry(address,string,string) payloads are sponsored.
+                _decodeDeployArgs(innerData);
+                // credits consumed inside deployRegistry; flag as deployment to skip daily spend.
+                // _postOp falls back to normal accounting if execution reverts.
                 return (
                     abi.encode(sender, maxCost, true),
                     _packValidationData(false, 0, 0)
@@ -291,7 +316,18 @@ contract PlatformPaymaster is BasePaymaster {
             }
 
             if (innerSel == MINT_DOCUMENT_SEL) {
-                // mintDocument: registry enforces MINTER_ROLE — no extra whitelist needed
+                if (
+                    !authorizedCallers[sender] &&
+                    userWhitelist[sender] == 0 &&
+                    sender != owner()
+                ) {
+                    emit UserOpRejected(sender, "caller not authorized");
+                    return ("", _packValidationData(true, 0, 0));
+                }
+                if (dailyLimit > 0 && dailySpend[sender] + maxCost > dailyLimit) {
+                    emit UserOpRejected(sender, "daily limit exceeded");
+                    return ("", _packValidationData(true, 0, 0));
+                }
                 return (
                     abi.encode(sender, maxCost, false),
                     _packValidationData(false, 0, 0)
@@ -319,18 +355,38 @@ contract PlatformPaymaster is BasePaymaster {
             (address, uint256, bool)
         );
 
-        // Deployment ops are credit-gated; skip daily spend tracking for them
-        if (!isDeployment) {
+        // Successful deployments are credit-gated; skip daily spend tracking for them.
+        // A reverted deployment rolls back the credit decrement inside deployRegistry,
+        // so charge it like a normal op and burn the credit here instead — otherwise a
+        // sender could replay failing deployments to drain the deposit for free.
+        if (!isDeployment || mode != PostOpMode.opSucceeded) {
             if (block.timestamp > lastReset[sender] + 1 days) {
                 dailySpend[sender] = 0;
                 lastReset[sender] = block.timestamp;
             }
             dailySpend[sender] += actualGasCost;
         }
+        if (isDeployment && mode == PostOpMode.opReverted) {
+            uint256 credits = userWhitelist[sender];
+            if (credits > 0) {
+                userWhitelist[sender] = credits - 1;
+                emit UserWhitelistUpdated(sender, credits - 1);
+            }
+        }
 
         emit UserOpSponsored(sender, actualGasCost);
     }
 
+    // Strips the 4-byte selector and ABI-decodes deployRegistry's arguments.
+    function _decodeDeployArgs(bytes memory innerData) private pure {
+        uint256 argsLength = innerData.length - 4;
+        bytes memory args = new bytes(argsLength);
+        assembly ("memory-safe") {
+            mcopy(add(args, 32), add(innerData, 36), argsLength)
+        }
+        abi.decode(args, (address, string, string));
+    }
+
     // v0.8 contracts on Etherspot EntryPoint — skip interface mismatch check
     function _validateEntryPointInterface(IEntryPoint) internal pure override {}
 

package/dist/index.d.mts

@@ -323,19 +323,13 @@ declare const platformAccountFactoryAbi: readonly [{
 }, {
     readonly inputs: readonly [{
         readonly internalType: "address";
-        readonly name: "";
+        readonly name: "deployer";
         readonly type: "address";
-    }];
-    readonly name: "attachedPaymaster";
-    readonly outputs: readonly [{
+    }, {
         readonly internalType: "address";
-        readonly name: "";
+        readonly name: "platformAddress";
         readonly type: "address";
-    }];
-    readonly stateMutability: "view";
-    readonly type: "function";
-}, {
-    readonly inputs: readonly [{
+    }, {
         readonly internalType: "bytes32";
         readonly name: "salt";
         readonly type: "bytes32";
@@ -396,20 +390,6 @@ declare const platformAccountFactoryAbi: readonly [{
     readonly outputs: readonly [];
     readonly stateMutability: "nonpayable";
     readonly type: "function";
-}, {
-    readonly inputs: readonly [{
-        readonly internalType: "address";
-        readonly name: "platformAddress";
-        readonly type: "address";
-    }];
-    readonly name: "setAttachedPaymaster";
-    readonly outputs: readonly [{
-        readonly internalType: "address";
-        readonly name: "";
-        readonly type: "address";
-    }];
-    readonly stateMutability: "view";
-    readonly type: "function";
 }, {
     readonly inputs: readonly [];
     readonly name: "tdocDeployer";
@@ -1167,11 +1147,17 @@ declare namespace index$1 {
 
 declare const ChainId: {
     readonly Sepolia: 11155111;
+    readonly Amoy: 80002;
 };
 /** Deployed contract addresses indexed by chainId */
 declare const contractAddress: {
+    readonly PaymasterImplementation: {
+        readonly 11155111: "0x5ca5652025ca77d13323ed4887b4cbee6098dd8f";
+        readonly 80002: "0xf47d58D3adc642DaD23966698A7A60b8b34D72f8";
+    };
     readonly PlatformAccountFactory: {
-        readonly 11155111: "0x5dcDf7fA6Ab8323F67FD66E89b6CeD4564f9F4Ff";
+        readonly 11155111: "0x1fe801f6af6e9a6c76431db08b121a7de70bc895";
+        readonly 80002: "0x2762abf6fa22314ebcab41dd4666836038d29341";
     };
 };
 

package/dist/index.d.ts

@@ -323,19 +323,13 @@ declare const platformAccountFactoryAbi: readonly [{
 }, {
     readonly inputs: readonly [{
         readonly internalType: "address";
-        readonly name: "";
+        readonly name: "deployer";
         readonly type: "address";
-    }];
-    readonly name: "attachedPaymaster";
-    readonly outputs: readonly [{
+    }, {
         readonly internalType: "address";
-        readonly name: "";
+        readonly name: "platformAddress";
         readonly type: "address";
-    }];
-    readonly stateMutability: "view";
-    readonly type: "function";
-}, {
-    readonly inputs: readonly [{
+    }, {
         readonly internalType: "bytes32";
         readonly name: "salt";
         readonly type: "bytes32";
@@ -396,20 +390,6 @@ declare const platformAccountFactoryAbi: readonly [{
     readonly outputs: readonly [];
     readonly stateMutability: "nonpayable";
     readonly type: "function";
-}, {
-    readonly inputs: readonly [{
-        readonly internalType: "address";
-        readonly name: "platformAddress";
-        readonly type: "address";
-    }];
-    readonly name: "setAttachedPaymaster";
-    readonly outputs: readonly [{
-        readonly internalType: "address";
-        readonly name: "";
-        readonly type: "address";
-    }];
-    readonly stateMutability: "view";
-    readonly type: "function";
 }, {
     readonly inputs: readonly [];
     readonly name: "tdocDeployer";
@@ -1167,11 +1147,17 @@ declare namespace index$1 {
 
 declare const ChainId: {
     readonly Sepolia: 11155111;
+    readonly Amoy: 80002;
 };
 /** Deployed contract addresses indexed by chainId */
 declare const contractAddress: {
+    readonly PaymasterImplementation: {
+        readonly 11155111: "0x5ca5652025ca77d13323ed4887b4cbee6098dd8f";
+        readonly 80002: "0xf47d58D3adc642DaD23966698A7A60b8b34D72f8";
+    };
     readonly PlatformAccountFactory: {
-        readonly 11155111: "0x5dcDf7fA6Ab8323F67FD66E89b6CeD4564f9F4Ff";
+        readonly 11155111: "0x1fe801f6af6e9a6c76431db08b121a7de70bc895";
+        readonly 80002: "0x2762abf6fa22314ebcab41dd4666836038d29341";
     };
 };
 

package/dist/index.js

@@ -442,23 +442,14 @@ var platformAccountFactoryAbi = [
     "inputs": [
       {
         "internalType": "address",
-        "name": "",
+        "name": "deployer",
         "type": "address"
-      }
-    ],
-    "name": "attachedPaymaster",
-    "outputs": [
+      },
       {
         "internalType": "address",
-        "name": "",
+        "name": "platformAddress",
         "type": "address"
-      }
-    ],
-    "stateMutability": "view",
-    "type": "function"
-  },
-  {
-    "inputs": [
+      },
       {
         "internalType": "bytes32",
         "name": "salt",
@@ -538,25 +529,6 @@ var platformAccountFactoryAbi = [
     "stateMutability": "nonpayable",
     "type": "function"
   },
-  {
-    "inputs": [
-      {
-        "internalType": "address",
-        "name": "platformAddress",
-        "type": "address"
-      }
-    ],
-    "name": "setAttachedPaymaster",
-    "outputs": [
-      {
-        "internalType": "address",
-        "name": "",
-        "type": "address"
-      }
-    ],
-    "stateMutability": "view",
-    "type": "function"
-  },
   {
     "inputs": [],
     "name": "tdocDeployer",
@@ -1529,11 +1501,17 @@ __export(constants_exports, {
   contractAddress: () => contractAddress
 });
 var ChainId = {
-  Sepolia: 11155111
+  Sepolia: 11155111,
+  Amoy: 80002
 };
 var contractAddress = {
+  PaymasterImplementation: {
+    [ChainId.Sepolia]: "0x5ca5652025ca77d13323ed4887b4cbee6098dd8f",
+    [ChainId.Amoy]: "0xf47d58D3adc642DaD23966698A7A60b8b34D72f8"
+  },
   PlatformAccountFactory: {
-    [ChainId.Sepolia]: "0x5dcDf7fA6Ab8323F67FD66E89b6CeD4564f9F4Ff"
+    [ChainId.Sepolia]: "0x1fe801f6af6e9a6c76431db08b121a7de70bc895",
+    [ChainId.Amoy]: "0x2762abf6fa22314ebcab41dd4666836038d29341"
   }
 };
 

package/dist/index.mjs

@@ -440,23 +440,14 @@ var platformAccountFactoryAbi = [
     "inputs": [
       {
         "internalType": "address",
-        "name": "",
+        "name": "deployer",
         "type": "address"
-      }
-    ],
-    "name": "attachedPaymaster",
-    "outputs": [
+      },
       {
         "internalType": "address",
-        "name": "",
+        "name": "platformAddress",
         "type": "address"
-      }
-    ],
-    "stateMutability": "view",
-    "type": "function"
-  },
-  {
-    "inputs": [
+      },
       {
         "internalType": "bytes32",
         "name": "salt",
@@ -536,25 +527,6 @@ var platformAccountFactoryAbi = [
     "stateMutability": "nonpayable",
     "type": "function"
   },
-  {
-    "inputs": [
-      {
-        "internalType": "address",
-        "name": "platformAddress",
-        "type": "address"
-      }
-    ],
-    "name": "setAttachedPaymaster",
-    "outputs": [
-      {
-        "internalType": "address",
-        "name": "",
-        "type": "address"
-      }
-    ],
-    "stateMutability": "view",
-    "type": "function"
-  },
   {
     "inputs": [],
     "name": "tdocDeployer",
@@ -1527,11 +1499,17 @@ __export(constants_exports, {
   contractAddress: () => contractAddress
 });
 var ChainId = {
-  Sepolia: 11155111
+  Sepolia: 11155111,
+  Amoy: 80002
 };
 var contractAddress = {
+  PaymasterImplementation: {
+    [ChainId.Sepolia]: "0x5ca5652025ca77d13323ed4887b4cbee6098dd8f",
+    [ChainId.Amoy]: "0xf47d58D3adc642DaD23966698A7A60b8b34D72f8"
+  },
   PlatformAccountFactory: {
-    [ChainId.Sepolia]: "0x5dcDf7fA6Ab8323F67FD66E89b6CeD4564f9F4Ff"
+    [ChainId.Sepolia]: "0x1fe801f6af6e9a6c76431db08b121a7de70bc895",
+    [ChainId.Amoy]: "0x2762abf6fa22314ebcab41dd4666836038d29341"
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trustvc/eip7702",
-  "version": "1.1.0-beta.1",
+  "version": "1.1.0-beta.3",
   "description": "EIP-7702 smart account, platform paymaster, and factory contracts for TrustVC",
   "author": "DexTech",
   "license": "MIT",