@trustvc/eip7702 1.1.0-beta.4 → 1.1.0-beta.6

package/README.md

@@ -41,7 +41,7 @@ Per-platform ERC-4337 paymaster cloned from a shared implementation.
 | `tdocDeployer` | TDocDeployer contract that mints registry clones |
 | `authorizedRegistries` | Registries whose calls this paymaster will sponsor |
 | `authorizedTitleEscrows` | Title escrows whose calls this paymaster will sponsor |
-| `authorizedCallers` | Addresses (beneficiary/holder) allowed on Path A |
+| `authorizedCallers` | Owner-managed addresses allowed to call authorized registries |
 | `userWhitelist` | Deployment credits per user (max 3) |
 | `documentsMinted` | Count of documents minted per caller |
 | `dailyLimit` | Max ETH sponsored per user per day |
@@ -50,11 +50,11 @@ Per-platform ERC-4337 paymaster cloned from a shared implementation.
 
 - `initialize(owner, dailyLimit, tdocDeployer)` — called once by the factory after clone; guarded by `owner() == address(0)`
 - `deployRegistry(impl, name, symbol)` — deploys a TradeTrust registry, consumes one credit, auto-authorizes it
-- `mintDocument(registry, beneficiary, holder, tokenId, remark)` — mints a document, auto-authorizes beneficiary + holder + title escrow
+- `mintDocument(registry, beneficiary, holder, tokenId, remark)` — mints a document, auto-authorizes the title escrow. Escrow calls are sponsored only for the escrow's current holder/beneficiary (read live at validation) or the platform owner, so sponsorship follows the document across transfers
 - `setUserWhitelist / removeUserFromWhitelist` — manage deployment credits (`onlyOwner`)
 - `addRegistry / removeRegistry` — manage authorized registries (`onlyOwner`)
 - `addTitleEscrow / removeTitleEscrow` — manage authorized title escrows (`onlyOwner`)
-- `addAuthorizedCaller / removeAuthorizedCaller` — manage Path A callers (`onlyOwner`)
+- `addAuthorizedCaller / removeAuthorizedCaller` — manage extra registry callers; registry role holders (admin/minter/restorer/accepter) are sponsored without this (`onlyOwner`)
 - `setDailyLimit` — update daily spend cap (`onlyOwner`)
 - `getUserDailySpend(user)` — returns `(spent, limit, resetsAt)`
 

package/contracts/EIP7702Implementation.sol

@@ -7,6 +7,7 @@ import {SignerEIP7702} from "@openzeppelin/contracts/utils/cryptography/signers/
 import {EIP7702Utils} from "@openzeppelin/contracts/account/utils/EIP7702Utils.sol";
 import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
 import {IEntryPoint} from "@openzeppelin/contracts/interfaces/draft-IERC4337.sol";
+import {IERC7821} from "@openzeppelin/contracts/interfaces/draft-IERC7821.sol";
 
 /**
  * EIP-7702 smart account implementation using OpenZeppelin base contracts.
@@ -76,11 +77,11 @@ contract EIP7702Implementation is Account, SignerEIP7702, ERC7821, ERC165 {
 
     /**
      * @dev Advertise ERC-7821 (batch executor) and ERC-165 support.
-     * The ERC-7821 interface ID 0x4e49c5c7 is the XOR of:
+     * The ERC-7821 interface ID (0x39922547) is derived from the imported interface:
      *   execute(bytes32,bytes).selector ^ supportsExecutionMode(bytes32).selector
      */
     function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
-        return interfaceId == 0x4e49c5c7 // ERC-7821 batch executor
+        return interfaceId == type(IERC7821).interfaceId // ERC-7821 batch executor
             || super.supportsInterface(interfaceId); // covers 0x01ffc9a7 (ERC-165)
     }
 

package/contracts/Factory.sol

@@ -8,6 +8,7 @@ import {Clones} from "@openzeppelin/contracts/proxy/Clones.sol";
 contract PlatformAccountFactory is Ownable {
     address public tdocDeployer;
     address public paymasterImplementation;
+    mapping(address => address) public attachedPaymaster;
 
     event PlatformOnboarded(
         address indexed platformAddress,
@@ -54,9 +55,17 @@ contract PlatformAccountFactory is Ownable {
             dailyLimit,
             tdocDeployer
         );
+        attachedPaymaster[platformAddress] = paymaster;
         emit PlatformOnboarded(platformAddress, paymaster);
     }
 
+    // Returns the paymaster currently attached to a platform (address(0) if none).
+    function getAttachedPaymaster(
+        address platformAddress
+    ) external view returns (address) {
+        return attachedPaymaster[platformAddress];
+    }
+
     // Predict the clone address for a specific deployer and platform.
     // `deployer` must be the account that will call deployPlatformPaymaster.
     function computePaymasterAddress(

package/contracts/PlatformPaymaster.sol

@@ -26,19 +26,26 @@ interface IAccessControl {
     function hasRole(bytes32 role, address account) external view returns (bool);
 }
 
+interface ITitleEscrow {
+    function holder() external view returns (address);
+    function beneficiary() external view returns (address);
+}
+
 /**
  * PlatformPaymaster — validates by inspecting the target contract in callData.
  *
  * Validation strategy (paymaster must be staked → bundler compliant):
  *   1. Decode userOp.callData → must be execute(address to, uint256, bytes)
- *   2. Check `to` is in authorizedRegistries (paymaster's own storage)
- *   3. mintDocument only: sender holds MINTER_ROLE on the registry
- *      (registry storage associated with sender)
- *   4. Check daily spend (paymaster's own storage)
+ *   2. Check `to` is in authorizedRegistries / authorizedTitleEscrows (paymaster's own storage)
+ *   3. Title escrow: sender is the escrow's *current* holder or beneficiary
+ *      (read live from the escrow — requires the paymaster to be staked, ERC-7562 STO-033)
+ *   4. Registry: sender holds any registry role (admin/minter/restorer/accepter) or is an
+ *      owner-added authorizedCaller (registry storage associated with sender)
+ *   5. mintDocument only: sender holds MINTER_ROLE on the registry
+ *   6. Check daily spend (paymaster's own storage)
  *
- * Access control is enforced by the Storage contract itself:
- *   require(msg.sender == beneficiary || msg.sender == holder)
- * so non-beneficiary/holder callers are rejected at execution time.
+ * Escrow sponsorship follows the document: after a holder/beneficiary transfer the
+ * previous party is no longer sponsored and the new one is, with no owner action.
  * Reverted ops are still charged to dailySpend in _postOp (gas was paid).
  */
 contract PlatformPaymaster is BasePaymaster {
@@ -63,7 +70,7 @@ contract PlatformPaymaster is BasePaymaster {
     mapping(address => bool) public authorizedTitleEscrows;
     // remaining deployment credits per user; max 3 per user
     mapping(address => uint256) public userWhitelist;
-    // Addresses permitted to call title escrow functions via this paymaster
+    // Owner-managed addresses permitted to call authorized registries via this paymaster
     mapping(address => bool) public authorizedCallers;
     // Count of documents minted per user
     mapping(address => uint256) public documentsMinted;
@@ -137,8 +144,10 @@ contract PlatformPaymaster is BasePaymaster {
 
     // Deploys a TDoc clone on behalf of a whitelisted user; consumes one credit.
     // Role setup (atomic, no follow-up txs needed):
-    //   - msg.sender (EOA) gets DEFAULT_ADMIN_ROLE
-    //   - paymaster gets MINTER_ROLE + RESTORER_ROLE + ACCEPTER_ROLE
+    //   - msg.sender (EOA) gets DEFAULT_ADMIN_ROLE + MINTER_ROLE + RESTORER_ROLE + ACCEPTER_ROLE
+    //     (MINTER_ROLE is checked by mintDocument; restore/accept are called on the registry directly)
+    //   - paymaster keeps MINTER_ROLE + RESTORER_ROLE + ACCEPTER_ROLE from initialization
+    //     and renounces DEFAULT_ADMIN_ROLE
     function deployRegistry(
         address implementation,
         string memory name,
@@ -153,6 +162,8 @@ contract PlatformPaymaster is BasePaymaster {
         // Paymaster is temporary admin so it can configure roles after deploy
         bytes memory params = abi.encode(name, symbol, address(this));
         deployed = tdocDeployer.deploy(implementation, params);
+        // Don't rely on the deployer: only configure/authorize a deployed contract (also rules out address(0))
+        require(deployed.code.length > 0, "invalid registry");
 
         IAccessControl(deployed).grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
         IAccessControl(deployed).grantRole(RESTORER_ROLE, msg.sender);
@@ -170,8 +181,10 @@ contract PlatformPaymaster is BasePaymaster {
     }
 
     // Mints a TradeTrust document, captures the TitleEscrow, and auto-authorizes it.
-    // Paymaster must hold MINTER_ROLE on the registry.
-    // Caller must hold MINTER_ROLE on the registry (the deployer, or whoever they granted it to).
+    // Paymaster must hold MINTER_ROLE on the registry, and so must the caller
+    // (the deployer, or whoever they granted it to).
+    // Beneficiary/holder are not granted anything here: escrow sponsorship is checked
+    // against the escrow's live holder/beneficiary at validation time.
     function mintDocument(
         address registry,
         address beneficiary,
@@ -185,6 +198,8 @@ contract PlatformPaymaster is BasePaymaster {
             IAccessControl(registry).hasRole(MINTER_ROLE, msg.sender),
             "not registry minter"
         );
+        require(beneficiary != address(0), "invalid beneficiary");
+        require(holder != address(0), "invalid holder");
 
         titleEscrow = ITradeTrustToken(registry).mint(
             beneficiary,
@@ -192,10 +207,8 @@ contract PlatformPaymaster is BasePaymaster {
             tokenId,
             remark
         );
-
-        // Auto-authorize beneficiary and holder to call title escrow functions
-        authorizedCallers[beneficiary] = true;
-        authorizedCallers[holder] = true;
+        // Don't rely on the registry: only authorize a deployed escrow (also rules out address(0))
+        require(titleEscrow.code.length > 0, "invalid title escrow");
 
         authorizedTitleEscrows[titleEscrow] = true;
         documentsMinted[msg.sender]++;
@@ -266,10 +279,25 @@ contract PlatformPaymaster is BasePaymaster {
             (address, uint256, bytes)
         );
 
-        // Path A — calling an authorized registry or title escrow (regular sponsored op)
-        // Only authorizedCallers or the platform owner may be sponsored here.
-        if (authorizedRegistries[target] || authorizedTitleEscrows[target]) {
-            if (!authorizedCallers[sender] && sender != owner()) {
+        // Path A1 — calling an authorized title escrow.
+        // Only its current holder/beneficiary (or the platform owner) is sponsored,
+        // so a party that has transferred the document away can't keep using it.
+        if (authorizedTitleEscrows[target]) {
+            if (sender != owner() && !_isEscrowParty(target, sender)) {
+                emit UserOpRejected(sender, "not escrow holder/beneficiary");
+                return ("", _packValidationData(true, 0, 0));
+            }
+            return _sponsorWithinDailyLimit(sender, maxCost);
+        }
+
+        // Path A2 — calling an authorized registry.
+        // Any registry role holder, owner-added callers, or the platform owner.
+        if (authorizedRegistries[target]) {
+            if (
+                sender != owner() &&
+                !authorizedCallers[sender] &&
+                !_hasRegistryRole(target, sender)
+            ) {
                 emit UserOpRejected(sender, "caller not authorized");
                 return ("", _packValidationData(true, 0, 0));
             }
@@ -313,13 +341,22 @@ contract PlatformPaymaster is BasePaymaster {
             if (innerSel == MINT_DOCUMENT_SEL) {
                 // Mirror mintDocument's checks so non-minters can't get failing ops sponsored.
                 // hasRole reads _roles[role][sender] — storage associated with sender (ERC-7562).
-                if (innerData.length < 36) {
+                // selector + registry + beneficiary + holder
+                if (innerData.length < 100) {
                     emit UserOpRejected(sender, "mint calldata too short");
                     return ("", _packValidationData(true, 0, 0));
                 }
                 address registry;
+                address beneficiary;
+                address holder;
                 assembly {
                     registry := mload(add(innerData, 36))
+                    beneficiary := mload(add(innerData, 68))
+                    holder := mload(add(innerData, 100))
+                }
+                if (beneficiary == address(0) || holder == address(0)) {
+                    emit UserOpRejected(sender, "invalid beneficiary/holder");
+                    return ("", _packValidationData(true, 0, 0));
                 }
                 if (!authorizedRegistries[registry]) {
                     emit UserOpRejected(sender, "registry not authorized");
@@ -402,6 +439,46 @@ contract PlatformPaymaster is BasePaymaster {
         emit UserOpSponsored(sender, actualGasCost);
     }
 
+    // True if `account` is the escrow's current holder or beneficiary.
+    // An escrow that doesn't answer (e.g. a bad owner-added address) is treated as no match.
+    function _isEscrowParty(
+        address escrow,
+        address account
+    ) private view returns (bool) {
+        return
+            _readAddress(escrow, ITitleEscrow.holder.selector) == account ||
+            _readAddress(escrow, ITitleEscrow.beneficiary.selector) == account;
+    }
+
+    // Low-level so a target without code (or a reverting one) returns address(0)
+    // instead of reverting on ABI decode, which try/catch can't intercept.
+    function _readAddress(
+        address target,
+        bytes4 selector
+    ) private view returns (address result) {
+        (bool ok, bytes memory ret) = target.staticcall(
+            abi.encodeWithSelector(selector)
+        );
+        if (ok && ret.length >= 32) {
+            // Decode as uint256: abi.decode to address reverts on dirty high bits
+            uint256 word = abi.decode(ret, (uint256));
+            if (word <= type(uint160).max) result = address(uint160(word));
+        }
+    }
+
+    // hasRole reads _roles[role][account] — storage associated with the sender (ERC-7562).
+    function _hasRegistryRole(
+        address registry,
+        address account
+    ) private view returns (bool) {
+        IAccessControl r = IAccessControl(registry);
+        return
+            r.hasRole(DEFAULT_ADMIN_ROLE, account) ||
+            r.hasRole(MINTER_ROLE, account) ||
+            r.hasRole(RESTORER_ROLE, account) ||
+            r.hasRole(ACCEPTER_ROLE, account);
+    }
+
     // Strips the 4-byte selector and ABI-decodes deployRegistry's arguments.
     function _decodeDeployArgs(bytes memory innerData) private pure {
         uint256 argsLength = innerData.length - 4;

package/dist/index.d.mts

@@ -320,6 +320,20 @@ declare const platformAccountFactoryAbi: readonly [{
     }];
     readonly name: "TdocDeployerUpdated";
     readonly type: "event";
+}, {
+    readonly inputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly name: "attachedPaymaster";
+    readonly outputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
 }, {
     readonly inputs: readonly [{
         readonly internalType: "address";
@@ -364,6 +378,20 @@ declare const platformAccountFactoryAbi: readonly [{
     }];
     readonly stateMutability: "nonpayable";
     readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "platformAddress";
+        readonly type: "address";
+    }];
+    readonly name: "getAttachedPaymaster";
+    readonly outputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
 }, {
     readonly inputs: readonly [];
     readonly name: "owner";

package/dist/index.d.ts

@@ -320,6 +320,20 @@ declare const platformAccountFactoryAbi: readonly [{
     }];
     readonly name: "TdocDeployerUpdated";
     readonly type: "event";
+}, {
+    readonly inputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly name: "attachedPaymaster";
+    readonly outputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
 }, {
     readonly inputs: readonly [{
         readonly internalType: "address";
@@ -364,6 +378,20 @@ declare const platformAccountFactoryAbi: readonly [{
     }];
     readonly stateMutability: "nonpayable";
     readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "platformAddress";
+        readonly type: "address";
+    }];
+    readonly name: "getAttachedPaymaster";
+    readonly outputs: readonly [{
+        readonly internalType: "address";
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
 }, {
     readonly inputs: readonly [];
     readonly name: "owner";

package/dist/index.js

@@ -438,6 +438,25 @@ var platformAccountFactoryAbi = [
     "name": "TdocDeployerUpdated",
     "type": "event"
   },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "name": "attachedPaymaster",
+    "outputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
   {
     "inputs": [
       {
@@ -496,6 +515,25 @@ var platformAccountFactoryAbi = [
     "stateMutability": "nonpayable",
     "type": "function"
   },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "platformAddress",
+        "type": "address"
+      }
+    ],
+    "name": "getAttachedPaymaster",
+    "outputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
   {
     "inputs": [],
     "name": "owner",

package/dist/index.mjs

@@ -436,6 +436,25 @@ var platformAccountFactoryAbi = [
     "name": "TdocDeployerUpdated",
     "type": "event"
   },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "name": "attachedPaymaster",
+    "outputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
   {
     "inputs": [
       {
@@ -494,6 +513,25 @@ var platformAccountFactoryAbi = [
     "stateMutability": "nonpayable",
     "type": "function"
   },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "platformAddress",
+        "type": "address"
+      }
+    ],
+    "name": "getAttachedPaymaster",
+    "outputs": [
+      {
+        "internalType": "address",
+        "name": "",
+        "type": "address"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
   {
     "inputs": [],
     "name": "owner",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trustvc/eip7702",
-  "version": "1.1.0-beta.4",
+  "version": "1.1.0-beta.6",
   "description": "EIP-7702 smart account, platform paymaster, and factory contracts for TrustVC",
   "author": "DexTech",
   "license": "MIT",