@trustvc/eip7702 1.1.0-beta.3 → 1.1.0-beta.5

package/README.md

@@ -41,7 +41,7 @@ Per-platform ERC-4337 paymaster cloned from a shared implementation.
 | `tdocDeployer` | TDocDeployer contract that mints registry clones |
 | `authorizedRegistries` | Registries whose calls this paymaster will sponsor |
 | `authorizedTitleEscrows` | Title escrows whose calls this paymaster will sponsor |
-| `authorizedCallers` | Addresses (beneficiary/holder) allowed on Path A |
+| `authorizedCallers` | Owner-managed addresses allowed to call authorized registries |
 | `userWhitelist` | Deployment credits per user (max 3) |
 | `documentsMinted` | Count of documents minted per caller |
 | `dailyLimit` | Max ETH sponsored per user per day |
@@ -50,11 +50,11 @@ Per-platform ERC-4337 paymaster cloned from a shared implementation.
 
 - `initialize(owner, dailyLimit, tdocDeployer)` — called once by the factory after clone; guarded by `owner() == address(0)`
 - `deployRegistry(impl, name, symbol)` — deploys a TradeTrust registry, consumes one credit, auto-authorizes it
-- `mintDocument(registry, beneficiary, holder, tokenId, remark)` — mints a document, auto-authorizes beneficiary + holder + title escrow
+- `mintDocument(registry, beneficiary, holder, tokenId, remark)` — mints a document, auto-authorizes the title escrow. Escrow calls are sponsored only for the escrow's current holder/beneficiary (read live at validation), so sponsorship follows the document across transfers
 - `setUserWhitelist / removeUserFromWhitelist` — manage deployment credits (`onlyOwner`)
 - `addRegistry / removeRegistry` — manage authorized registries (`onlyOwner`)
 - `addTitleEscrow / removeTitleEscrow` — manage authorized title escrows (`onlyOwner`)
-- `addAuthorizedCaller / removeAuthorizedCaller` — manage Path A callers (`onlyOwner`)
+- `addAuthorizedCaller / removeAuthorizedCaller` — manage extra registry callers; registry role holders (admin/minter/restorer/accepter) are sponsored without this (`onlyOwner`)
 - `setDailyLimit` — update daily spend cap (`onlyOwner`)
 - `getUserDailySpend(user)` — returns `(spent, limit, resetsAt)`
 

package/contracts/EIP7702Implementation.sol

@@ -7,6 +7,7 @@ import {SignerEIP7702} from "@openzeppelin/contracts/utils/cryptography/signers/
 import {EIP7702Utils} from "@openzeppelin/contracts/account/utils/EIP7702Utils.sol";
 import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
 import {IEntryPoint} from "@openzeppelin/contracts/interfaces/draft-IERC4337.sol";
+import {IERC7821} from "@openzeppelin/contracts/interfaces/draft-IERC7821.sol";
 
 /**
  * EIP-7702 smart account implementation using OpenZeppelin base contracts.
@@ -76,11 +77,11 @@ contract EIP7702Implementation is Account, SignerEIP7702, ERC7821, ERC165 {
 
     /**
      * @dev Advertise ERC-7821 (batch executor) and ERC-165 support.
-     * The ERC-7821 interface ID 0x4e49c5c7 is the XOR of:
+     * The ERC-7821 interface ID (0x39922547) is derived from the imported interface:
      *   execute(bytes32,bytes).selector ^ supportsExecutionMode(bytes32).selector
      */
     function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
-        return interfaceId == 0x4e49c5c7 // ERC-7821 batch executor
+        return interfaceId == type(IERC7821).interfaceId // ERC-7821 batch executor
             || super.supportsInterface(interfaceId); // covers 0x01ffc9a7 (ERC-165)
     }
 

package/contracts/Factory.sol

@@ -8,6 +8,7 @@ import {Clones} from "@openzeppelin/contracts/proxy/Clones.sol";
 contract PlatformAccountFactory is Ownable {
     address public tdocDeployer;
     address public paymasterImplementation;
+    mapping(address => address) public attachedPaymaster;
 
     event PlatformOnboarded(
         address indexed platformAddress,
@@ -54,9 +55,17 @@ contract PlatformAccountFactory is Ownable {
             dailyLimit,
             tdocDeployer
         );
+        attachedPaymaster[platformAddress] = paymaster;
         emit PlatformOnboarded(platformAddress, paymaster);
     }
 
+    // Returns the paymaster currently attached to a platform (address(0) if none).
+    function getAttachedPaymaster(
+        address platformAddress
+    ) external view returns (address) {
+        return attachedPaymaster[platformAddress];
+    }
+
     // Predict the clone address for a specific deployer and platform.
     // `deployer` must be the account that will call deployPlatformPaymaster.
     function computePaymasterAddress(

package/contracts/PlatformPaymaster.sol

@@ -23,19 +23,29 @@ interface ITradeTrustToken {
 interface IAccessControl {
     function grantRole(bytes32 role, address account) external;
     function renounceRole(bytes32 role, address callerConfirmation) external;
+    function hasRole(bytes32 role, address account) external view returns (bool);
+}
+
+interface ITitleEscrow {
+    function holder() external view returns (address);
+    function beneficiary() external view returns (address);
 }
 
 /**
  * PlatformPaymaster — validates by inspecting the target contract in callData.
  *
- * Validation strategy (no third-party storage reads → bundler compliant):
+ * Validation strategy (paymaster must be staked → bundler compliant):
  *   1. Decode userOp.callData → must be execute(address to, uint256, bytes)
- *   2. Check `to` is in authorizedRegistries (paymaster's own storage)
- *   3. Check daily spend (paymaster's own storage — always allowed)
+ *   2. Check `to` is in authorizedRegistries / authorizedTitleEscrows (paymaster's own storage)
+ *   3. Title escrow: sender is the escrow's *current* holder or beneficiary
+ *      (read live from the escrow — requires the paymaster to be staked, ERC-7562 STO-033)
+ *   4. Registry: sender holds any registry role (admin/minter/restorer/accepter) or is an
+ *      owner-added authorizedCaller (registry storage associated with sender)
+ *   5. mintDocument only: sender holds MINTER_ROLE on the registry
+ *   6. Check daily spend (paymaster's own storage)
  *
- * Access control is enforced by the Storage contract itself:
- *   require(msg.sender == beneficiary || msg.sender == holder)
- * so non-beneficiary/holder callers are rejected at execution time.
+ * Escrow sponsorship follows the document: after a holder/beneficiary transfer the
+ * previous party is no longer sponsored and the new one is, with no owner action.
  * Reverted ops are still charged to dailySpend in _postOp (gas was paid).
  */
 contract PlatformPaymaster is BasePaymaster {
@@ -60,7 +70,7 @@ contract PlatformPaymaster is BasePaymaster {
     mapping(address => bool) public authorizedTitleEscrows;
     // remaining deployment credits per user; max 3 per user
     mapping(address => uint256) public userWhitelist;
-    // Addresses permitted to call title escrow functions via this paymaster
+    // Owner-managed addresses permitted to call authorized registries via this paymaster
     mapping(address => bool) public authorizedCallers;
     // Count of documents minted per user
     mapping(address => uint256) public documentsMinted;
@@ -167,8 +177,10 @@ contract PlatformPaymaster is BasePaymaster {
     }
 
     // Mints a TradeTrust document, captures the TitleEscrow, and auto-authorizes it.
-    // Paymaster must hold MINTER_ROLE on the registry.
-    // Callable gaslessly by userWhitelist users (credits not consumed — only deployRegistry uses credits).
+    // Paymaster must hold MINTER_ROLE on the registry, and so must the caller
+    // (the deployer, or whoever they granted it to).
+    // Beneficiary/holder are not granted anything here: escrow sponsorship is checked
+    // against the escrow's live holder/beneficiary at validation time.
     function mintDocument(
         address registry,
         address beneficiary,
@@ -177,12 +189,13 @@ contract PlatformPaymaster is BasePaymaster {
         bytes calldata remark
     ) external returns (address titleEscrow) {
         require(authorizedRegistries[registry], "registry not authorized");
+        // The registry only sees the paymaster as minter, so check the real caller here
         require(
-            authorizedCallers[msg.sender] ||
-                userWhitelist[msg.sender] > 0 ||
-                msg.sender == owner(),
-            "caller not authorized"
+            IAccessControl(registry).hasRole(MINTER_ROLE, msg.sender),
+            "not registry minter"
         );
+        require(beneficiary != address(0), "invalid beneficiary");
+        require(holder != address(0), "invalid holder");
 
         titleEscrow = ITradeTrustToken(registry).mint(
             beneficiary,
@@ -190,10 +203,8 @@ contract PlatformPaymaster is BasePaymaster {
             tokenId,
             remark
         );
-
-        // Auto-authorize beneficiary and holder to call title escrow functions
-        authorizedCallers[beneficiary] = true;
-        authorizedCallers[holder] = true;
+        // Don't rely on the registry: only authorize a deployed escrow (also rules out address(0))
+        require(titleEscrow.code.length > 0, "invalid title escrow");
 
         authorizedTitleEscrows[titleEscrow] = true;
         documentsMinted[msg.sender]++;
@@ -264,21 +275,29 @@ contract PlatformPaymaster is BasePaymaster {
             (address, uint256, bytes)
         );
 
-        // Path A — calling an authorized registry or title escrow (regular sponsored op)
-        // Only authorizedCallers or the platform owner may be sponsored here.
-        if (authorizedRegistries[target] || authorizedTitleEscrows[target]) {
-            if (!authorizedCallers[sender] && sender != owner()) {
-                emit UserOpRejected(sender, "caller not authorized");
+        // Path A1 — calling an authorized title escrow.
+        // Only its current holder/beneficiary (or the platform owner) is sponsored,
+        // so a party that has transferred the document away can't keep using it.
+        if (authorizedTitleEscrows[target]) {
+            if (sender != owner() && !_isEscrowParty(target, sender)) {
+                emit UserOpRejected(sender, "not escrow holder/beneficiary");
                 return ("", _packValidationData(true, 0, 0));
             }
-            if (dailyLimit > 0 && dailySpend[sender] + maxCost > dailyLimit) {
-                emit UserOpRejected(sender, "daily limit exceeded");
+            return _sponsorWithinDailyLimit(sender, maxCost);
+        }
+
+        // Path A2 — calling an authorized registry.
+        // Any registry role holder, owner-added callers, or the platform owner.
+        if (authorizedRegistries[target]) {
+            if (
+                sender != owner() &&
+                !authorizedCallers[sender] &&
+                !_hasRegistryRole(target, sender)
+            ) {
+                emit UserOpRejected(sender, "caller not authorized");
                 return ("", _packValidationData(true, 0, 0));
             }
-            return (
-                abi.encode(sender, maxCost, false),
-                _packValidationData(false, 0, 0)
-            );
+            return _sponsorWithinDailyLimit(sender, maxCost);
         }
 
         // Path B — gasless paymaster call (deployRegistry or mintDocument)
@@ -316,22 +335,34 @@ contract PlatformPaymaster is BasePaymaster {
             }
 
             if (innerSel == MINT_DOCUMENT_SEL) {
-                if (
-                    !authorizedCallers[sender] &&
-                    userWhitelist[sender] == 0 &&
-                    sender != owner()
-                ) {
-                    emit UserOpRejected(sender, "caller not authorized");
+                // Mirror mintDocument's checks so non-minters can't get failing ops sponsored.
+                // hasRole reads _roles[role][sender] — storage associated with sender (ERC-7562).
+                // selector + registry + beneficiary + holder
+                if (innerData.length < 100) {
+                    emit UserOpRejected(sender, "mint calldata too short");
                     return ("", _packValidationData(true, 0, 0));
                 }
-                if (dailyLimit > 0 && dailySpend[sender] + maxCost > dailyLimit) {
-                    emit UserOpRejected(sender, "daily limit exceeded");
+                address registry;
+                address beneficiary;
+                address holder;
+                assembly {
+                    registry := mload(add(innerData, 36))
+                    beneficiary := mload(add(innerData, 68))
+                    holder := mload(add(innerData, 100))
+                }
+                if (beneficiary == address(0) || holder == address(0)) {
+                    emit UserOpRejected(sender, "invalid beneficiary/holder");
                     return ("", _packValidationData(true, 0, 0));
                 }
-                return (
-                    abi.encode(sender, maxCost, false),
-                    _packValidationData(false, 0, 0)
-                );
+                if (!authorizedRegistries[registry]) {
+                    emit UserOpRejected(sender, "registry not authorized");
+                    return ("", _packValidationData(true, 0, 0));
+                }
+                if (!IAccessControl(registry).hasRole(MINTER_ROLE, sender)) {
+                    emit UserOpRejected(sender, "not registry minter");
+                    return ("", _packValidationData(true, 0, 0));
+                }
+                return _sponsorWithinDailyLimit(sender, maxCost);
             }
 
             emit UserOpRejected(sender, "unauthorized paymaster call");
@@ -342,6 +373,33 @@ contract PlatformPaymaster is BasePaymaster {
         return ("", _packValidationData(true, 0, 0));
     }
 
+    // Approves a daily-limit-tracked op. If the sender is over today's limit, the op
+    // is approved with validAfter = window end, so it only runs after the window rolls
+    // over and _postOp resets the counter. block.timestamp is banned in validation
+    // (ERC-7562), so the EntryPoint enforces the time via validAfter.
+    function _sponsorWithinDailyLimit(
+        address sender,
+        uint256 maxCost
+    ) internal returns (bytes memory context, uint256 validationData) {
+        context = abi.encode(sender, maxCost, false);
+
+        if (dailyLimit > 0 && dailySpend[sender] + maxCost > dailyLimit) {
+            // Even a fresh window can't fit this op
+            if (maxCost > dailyLimit) {
+                emit UserOpRejected(sender, "maxCost exceeds daily limit");
+                return ("", _packValidationData(true, 0, 0));
+            }
+            // EntryPoint runs the op only when block.timestamp > validAfter, which is
+            // exactly when _postOp's reset condition becomes true
+            return (
+                context,
+                _packValidationData(false, 0, uint48(lastReset[sender] + 1 days))
+            );
+        }
+
+        return (context, _packValidationData(false, 0, 0));
+    }
+
     function _postOp(
         PostOpMode mode,
         bytes calldata context,
@@ -377,6 +435,42 @@ contract PlatformPaymaster is BasePaymaster {
         emit UserOpSponsored(sender, actualGasCost);
     }
 
+    // True if `account` is the escrow's current holder or beneficiary.
+    // An escrow that doesn't answer (e.g. a bad owner-added address) is treated as no match.
+    function _isEscrowParty(
+        address escrow,
+        address account
+    ) private view returns (bool) {
+        return
+            _readAddress(escrow, ITitleEscrow.holder.selector) == account ||
+            _readAddress(escrow, ITitleEscrow.beneficiary.selector) == account;
+    }
+
+    // Low-level so a target without code (or a reverting one) returns address(0)
+    // instead of reverting on ABI decode, which try/catch can't intercept.
+    function _readAddress(
+        address target,
+        bytes4 selector
+    ) private view returns (address result) {
+        (bool ok, bytes memory ret) = target.staticcall(
+            abi.encodeWithSelector(selector)
+        );
+        if (ok && ret.length >= 32) result = abi.decode(ret, (address));
+    }
+
+    // hasRole reads _roles[role][account] — storage associated with the sender (ERC-7562).
+    function _hasRegistryRole(
+        address registry,
+        address account
+    ) private view returns (bool) {
+        IAccessControl r = IAccessControl(registry);
+        return
+            r.hasRole(DEFAULT_ADMIN_ROLE, account) ||
+            r.hasRole(MINTER_ROLE, account) ||
+            r.hasRole(RESTORER_ROLE, account) ||
+            r.hasRole(ACCEPTER_ROLE, account);
+    }
+
     // Strips the 4-byte selector and ABI-decodes deployRegistry's arguments.
     function _decodeDeployArgs(bytes memory innerData) private pure {
         uint256 argsLength = innerData.length - 4;

package/dist/index.d.mts

@@ -320,6 +320,20 @@ declare const platformAccountFactoryAbi: readonly [{
     }];
     readonly name: "TdocDeployerUpdated";
     readonly type: "event";
+}, {
+    readonly inputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly name: "attachedPaymaster";
+    readonly outputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
 }, {
     readonly inputs: readonly [{
         readonly internalType: "address";
@@ -364,6 +378,20 @@ declare const platformAccountFactoryAbi: readonly [{
     }];
     readonly stateMutability: "nonpayable";
     readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "platformAddress";
+        readonly type: "address";
+    }];
+    readonly name: "getAttachedPaymaster";
+    readonly outputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
 }, {
     readonly inputs: readonly [];
     readonly name: "owner";

package/dist/index.d.ts

@@ -320,6 +320,20 @@ declare const platformAccountFactoryAbi: readonly [{
     }];
     readonly name: "TdocDeployerUpdated";
     readonly type: "event";
+}, {
+    readonly inputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly name: "attachedPaymaster";
+    readonly outputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
 }, {
     readonly inputs: readonly [{
         readonly internalType: "address";
@@ -364,6 +378,20 @@ declare const platformAccountFactoryAbi: readonly [{
     }];
     readonly stateMutability: "nonpayable";
     readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "platformAddress";
+        readonly type: "address";
+    }];
+    readonly name: "getAttachedPaymaster";
+    readonly outputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
 }, {
     readonly inputs: readonly [];
     readonly name: "owner";

package/dist/index.js

@@ -438,6 +438,25 @@ var platformAccountFactoryAbi = [
     "name": "TdocDeployerUpdated",
     "type": "event"
   },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "name": "attachedPaymaster",
+    "outputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
   {
     "inputs": [
       {
@@ -496,6 +515,25 @@ var platformAccountFactoryAbi = [
     "stateMutability": "nonpayable",
     "type": "function"
   },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "platformAddress",
+        "type": "address"
+      }
+    ],
+    "name": "getAttachedPaymaster",
+    "outputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
   {
     "inputs": [],
     "name": "owner",

package/dist/index.mjs

@@ -436,6 +436,25 @@ var platformAccountFactoryAbi = [
     "name": "TdocDeployerUpdated",
     "type": "event"
   },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "name": "attachedPaymaster",
+    "outputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
   {
     "inputs": [
       {
@@ -494,6 +513,25 @@ var platformAccountFactoryAbi = [
     "stateMutability": "nonpayable",
     "type": "function"
   },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "platformAddress",
+        "type": "address"
+      }
+    ],
+    "name": "getAttachedPaymaster",
+    "outputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
   {
     "inputs": [],
     "name": "owner",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trustvc/eip7702",
-  "version": "1.1.0-beta.3",
+  "version": "1.1.0-beta.5",
   "description": "EIP-7702 smart account, platform paymaster, and factory contracts for TrustVC",
   "author": "DexTech",
   "license": "MIT",