@trustvc/eip7702 1.1.0-beta.5 → 1.1.0-beta.6

package/README.md

@@ -50,7 +50,7 @@ Per-platform ERC-4337 paymaster cloned from a shared implementation.
 
 - `initialize(owner, dailyLimit, tdocDeployer)` — called once by the factory after clone; guarded by `owner() == address(0)`
 - `deployRegistry(impl, name, symbol)` — deploys a TradeTrust registry, consumes one credit, auto-authorizes it
-- `mintDocument(registry, beneficiary, holder, tokenId, remark)` — mints a document, auto-authorizes the title escrow. Escrow calls are sponsored only for the escrow's current holder/beneficiary (read live at validation), so sponsorship follows the document across transfers
+- `mintDocument(registry, beneficiary, holder, tokenId, remark)` — mints a document, auto-authorizes the title escrow. Escrow calls are sponsored only for the escrow's current holder/beneficiary (read live at validation) or the platform owner, so sponsorship follows the document across transfers
 - `setUserWhitelist / removeUserFromWhitelist` — manage deployment credits (`onlyOwner`)
 - `addRegistry / removeRegistry` — manage authorized registries (`onlyOwner`)
 - `addTitleEscrow / removeTitleEscrow` — manage authorized title escrows (`onlyOwner`)

package/contracts/PlatformPaymaster.sol

@@ -144,8 +144,10 @@ contract PlatformPaymaster is BasePaymaster {
 
     // Deploys a TDoc clone on behalf of a whitelisted user; consumes one credit.
     // Role setup (atomic, no follow-up txs needed):
-    //   - msg.sender (EOA) gets DEFAULT_ADMIN_ROLE
-    //   - paymaster gets MINTER_ROLE + RESTORER_ROLE + ACCEPTER_ROLE
+    //   - msg.sender (EOA) gets DEFAULT_ADMIN_ROLE + MINTER_ROLE + RESTORER_ROLE + ACCEPTER_ROLE
+    //     (MINTER_ROLE is checked by mintDocument; restore/accept are called on the registry directly)
+    //   - paymaster keeps MINTER_ROLE + RESTORER_ROLE + ACCEPTER_ROLE from initialization
+    //     and renounces DEFAULT_ADMIN_ROLE
     function deployRegistry(
         address implementation,
         string memory name,
@@ -160,6 +162,8 @@ contract PlatformPaymaster is BasePaymaster {
         // Paymaster is temporary admin so it can configure roles after deploy
         bytes memory params = abi.encode(name, symbol, address(this));
         deployed = tdocDeployer.deploy(implementation, params);
+        // Don't rely on the deployer: only configure/authorize a deployed contract (also rules out address(0))
+        require(deployed.code.length > 0, "invalid registry");
 
         IAccessControl(deployed).grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
         IAccessControl(deployed).grantRole(RESTORER_ROLE, msg.sender);
@@ -455,7 +459,11 @@ contract PlatformPaymaster is BasePaymaster {
         (bool ok, bytes memory ret) = target.staticcall(
             abi.encodeWithSelector(selector)
         );
-        if (ok && ret.length >= 32) result = abi.decode(ret, (address));
+        if (ok && ret.length >= 32) {
+            // Decode as uint256: abi.decode to address reverts on dirty high bits
+            uint256 word = abi.decode(ret, (uint256));
+            if (word <= type(uint160).max) result = address(uint160(word));
+        }
     }
 
     // hasRole reads _roles[role][account] — storage associated with the sender (ERC-7562).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trustvc/eip7702",
-  "version": "1.1.0-beta.5",
+  "version": "1.1.0-beta.6",
   "description": "EIP-7702 smart account, platform paymaster, and factory contracts for TrustVC",
   "author": "DexTech",
   "license": "MIT",