@zerodev/sdk 4.0.17 → 4.0.19

package/src/kernel-zerodev/validator/recovery-validator.ts

@@ -0,0 +1,370 @@
+import {
+  getChain,
+  type Address,
+  type Hex,
+  type SmartAccountSigner,
+  type UserOperationRequest,
+  type SignTypedDataParams,
+} from "@alchemy/aa-core";
+import {
+  KernelBaseValidator,
+  ValidatorMode,
+  type KernelBaseValidatorParams,
+} from "./base.js";
+import {
+  concatHex,
+  encodeAbiParameters,
+  encodeFunctionData,
+  getContract,
+  parseAbiParameters,
+  type LocalAccount,
+  createWalletClient,
+  type WalletClient,
+  http,
+  custom,
+  type Transport,
+  type Chain,
+  type Account,
+  publicActions,
+  getFunctionSelector,
+} from "viem";
+import { WeightedValidatorAbi } from "../abis/WeightedValidatorAbi.js";
+import { getChainId } from "../api/index.js";
+import {
+  CHAIN_ID_TO_NODE,
+  DUMMY_ECDSA_SIG,
+  RECOVERY_ACTION,
+} from "../constants.js";
+import { KernelAccountAbi } from "../abis/KernelAccountAbi.js";
+import { fixSignedData } from "../utils.js";
+import type { EthereumProvider } from "./types.js";
+import { polygonMumbai } from "viem/chains";
+import { RecoveryActionAbi } from "../abis/RecoveryActionAbi.js";
+
+interface WeightedGuardians {
+  [guardian: Address]: number;
+}
+export interface RecoveryValidatorParams extends KernelBaseValidatorParams {
+  guardians?: WeightedGuardians;
+  threshold?: number;
+  delaySeconds?: number;
+  accountSigner?: SmartAccountSigner;
+  guardianAccountOrProvider?: LocalAccount<string> | EthereumProvider;
+  walletClient?: WalletClient<Transport, Chain>;
+  signatures?: Hex;
+}
+
+export type RecoveryConfig = Required<
+  Pick<RecoveryValidatorParams, "guardians" | "threshold" | "delaySeconds">
+>;
+
+export function isLocalAccount(account: any): account is LocalAccount<string> {
+  return account && account.signTransaction !== undefined;
+}
+
+export function isEthereumProvider(
+  provider: any
+): provider is EthereumProvider {
+  return provider && provider.request !== undefined;
+}
+
+type WalletClientAccountType<T> = T extends LocalAccount<string>
+  ? Account
+  : T extends EthereumProvider
+  ? undefined
+  : never;
+
+export const recoverySelector = getFunctionSelector(
+  "doRecovery(address, bytes)"
+);
+
+export class RecoveryValidator extends KernelBaseValidator {
+  protected guardians?: WeightedGuardians;
+  protected threshold?: number;
+  protected delaySeconds: number;
+  protected accountSigner?: SmartAccountSigner;
+  protected guardianAccountOrProvider?: LocalAccount<string> | EthereumProvider;
+  protected signatures?: Hex;
+  walletClient?: WalletClient<
+    Transport,
+    Chain,
+    WalletClientAccountType<typeof this.guardianAccountOrProvider>
+  >;
+
+  constructor(params: RecoveryValidatorParams) {
+    super(params);
+    this.guardians = params.guardians;
+    this.threshold = params.threshold;
+    this.delaySeconds = params.delaySeconds ?? 0;
+    this.accountSigner = params.accountSigner;
+    this.mode = params.mode ?? ValidatorMode.plugin;
+    this.guardianAccountOrProvider = params.guardianAccountOrProvider;
+    this.signatures = params.signatures;
+    this.validAfter = params.validAfter ?? 0;
+    this.validUntil = params.validUntil ?? 0;
+    this.executor = params.executor ?? RECOVERY_ACTION;
+    this.selector = params.selector ?? recoverySelector;
+    if (isLocalAccount(params.guardianAccountOrProvider)) {
+      this.walletClient = createWalletClient({
+        account: params.guardianAccountOrProvider,
+        chain: this.chain ?? polygonMumbai,
+        transport: http(CHAIN_ID_TO_NODE[this.chain?.id ?? polygonMumbai.id]),
+      }).extend(publicActions);
+    } else if (isEthereumProvider(params.guardianAccountOrProvider)) {
+      this.walletClient = createWalletClient({
+        chain: this.chain ?? polygonMumbai,
+        transport: custom(params.guardianAccountOrProvider),
+      }).extend(publicActions);
+    } else if (params.walletClient) {
+      this.walletClient = params.walletClient.extend(publicActions);
+    } else if (params.guardianAccountOrProvider) {
+      throw Error("Incorrect guardianAccountOrProvider type");
+    }
+  }
+
+  public static async init(
+    params: RecoveryValidatorParams
+  ): Promise<RecoveryValidator> {
+    const chainId = await getChainId(params.projectId);
+    if (!chainId) {
+      throw new Error("ChainId not found");
+    }
+    const chain = getChain(chainId);
+    const instance = new RecoveryValidator({ ...params, chain });
+    return instance;
+  }
+
+  getNonceKey(): bigint {
+    return BigInt(this.validatorAddress);
+  }
+
+  setRecoverySignatures(signatures: Hex) {
+    this.signatures = signatures;
+  }
+
+  getRecoverySignatures(): Hex | undefined {
+    return this.signatures;
+  }
+
+  getRecoveryConfig(): RecoveryConfig {
+    if (
+      this.guardians === undefined ||
+      !this.threshold ||
+      Object.values(this.guardians).reduce((a, c) => a + c, 0) !==
+        this.threshold
+    ) {
+      throw Error("Recovery config unintialised");
+    }
+    return {
+      guardians: this.guardians,
+      threshold: this.threshold,
+      delaySeconds: this.delaySeconds,
+    };
+  }
+
+  async signer(): Promise<SmartAccountSigner> {
+    if (!this.accountSigner) {
+      throw Error("AccountSigner not set");
+    }
+    return await Promise.resolve(this.accountSigner);
+  }
+
+  async getEnableData(): Promise<Hex> {
+    if (
+      this.guardians === undefined ||
+      !this.threshold ||
+      Object.values(this.guardians).reduce((a, c) => a + c, 0) !==
+        this.threshold
+    ) {
+      throw Error("Recovery config unintialised");
+    }
+    return encodeAbiParameters(
+      parseAbiParameters(
+        "address[] guardians, uint24[] weights, uint24 threshold, uint48 delay"
+      ),
+      [
+        Object.keys(this.guardians) as Address[],
+        Object.values(this.guardians),
+        this.threshold,
+        this.delaySeconds,
+      ]
+    );
+  }
+
+  encodeEnable(recoveryData: Hex): Hex {
+    return encodeFunctionData({
+      abi: WeightedValidatorAbi,
+      functionName: "enable",
+      args: [recoveryData],
+    });
+  }
+
+  encodeDisable(disableData: Hex = "0x"): Hex {
+    return encodeFunctionData({
+      abi: WeightedValidatorAbi,
+      functionName: "disable",
+      args: [disableData],
+    });
+  }
+
+  encodeApprove(callDataAndNonceHash: Hex, kernelAccountAddress: Address): Hex {
+    return encodeFunctionData({
+      abi: WeightedValidatorAbi,
+      functionName: "approve",
+      args: [callDataAndNonceHash, kernelAccountAddress],
+    });
+  }
+
+  encodeApproveWithSig(
+    callDataAndNonceHash: Hex,
+    kernelAccountAddress: Address,
+    sigs: Hex
+  ): Hex {
+    return encodeFunctionData({
+      abi: WeightedValidatorAbi,
+      functionName: "approveWithSig",
+      args: [callDataAndNonceHash, kernelAccountAddress, sigs],
+    });
+  }
+
+  encodeVeto(callDataAndNonceHash: Hex): Hex {
+    return encodeFunctionData({
+      abi: WeightedValidatorAbi,
+      functionName: "veto",
+      args: [callDataAndNonceHash],
+    });
+  }
+
+  encodeRecoveryAction(enableData: Hex, defaultValidatorAddress: Address): Hex {
+    return encodeFunctionData({
+      abi: RecoveryActionAbi,
+      functionName: "doRecovery",
+      args: [defaultValidatorAddress, enableData],
+    });
+  }
+
+  async isPluginEnabled(
+    kernelAccountAddress: Address,
+    selector: Hex
+  ): Promise<boolean> {
+    if (
+      this.guardians === undefined ||
+      !this.threshold ||
+      Object.values(this.guardians).reduce((a, c) => a + c, 0) !==
+        this.threshold
+    ) {
+      throw Error("Recovery config unintialised");
+    }
+    if (!this.publicClient) {
+      throw new Error("Validator uninitialized: PublicClient missing");
+    }
+    try {
+      const kernel = getContract({
+        abi: KernelAccountAbi,
+        address: kernelAccountAddress,
+        publicClient: this.publicClient,
+      });
+      const execDetail = await kernel.read.getExecution([selector]);
+      const enableData = await this.publicClient.readContract({
+        abi: WeightedValidatorAbi,
+        address: this.validatorAddress,
+        functionName: "weightedStorage",
+        args: [kernelAccountAddress],
+      });
+
+      return (
+        execDetail.validator.toLowerCase() ===
+          this.validatorAddress.toLowerCase() &&
+        enableData[0] ===
+          Object.values(this.guardians).reduce((a, c) => a + c, 0) &&
+        enableData[1] === this.threshold &&
+        enableData[2] === this.delaySeconds &&
+        this.isGuardiansEnabled(kernelAccountAddress)
+      );
+    } catch (error) {
+      return false;
+    }
+  }
+
+  async isGuardiansEnabled(kernelAccountAddress: Address): Promise<boolean> {
+    if (
+      this.guardians === undefined ||
+      !this.threshold ||
+      Object.values(this.guardians).reduce((a, c) => a + c, 0) !==
+        this.threshold
+    ) {
+      throw Error("Recovery config unintialised");
+    }
+    const weightedValidator = getContract({
+      abi: WeightedValidatorAbi,
+      address: this.validatorAddress,
+      publicClient: this.publicClient,
+    });
+    for (const [addr, weight] of Object.entries(this.guardians)) {
+      const result = await weightedValidator.read.guardian([
+        addr as Address,
+        kernelAccountAddress,
+      ]);
+      if (result[0] !== weight) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  async getDummyUserOpSignature(): Promise<Hex> {
+    let dummySignature: Hex = "0x";
+    if (this.signatures) {
+      const totalSigs = this.signatures.substring(2).length / 130;
+      for (let i = 0; i < totalSigs; i++) {
+        dummySignature = concatHex([dummySignature, DUMMY_ECDSA_SIG]);
+      }
+      // Hack - Fix this to not send original signatures
+      return this.signatures;
+    }
+    return DUMMY_ECDSA_SIG;
+  }
+
+  async signMessage(message: string | Uint8Array): Promise<Hex> {
+    if (!this.accountSigner) {
+      throw Error("AccountSigner not set");
+    }
+    return await this.accountSigner.signMessage(message);
+  }
+
+  async signTypedData(params: SignTypedDataParams): Promise<Hex> {
+    if (!this.accountSigner) {
+      throw Error("AccountSigner not set");
+    }
+    return fixSignedData(await this.accountSigner.signTypedData(params));
+  }
+
+  async signRecoveryHash(recoveryHash: Hex): Promise<Hex> {
+    if (!this.chain) {
+      throw new Error("Validator uninitialized");
+    }
+    const signer = await this.signer();
+    return await signer.signTypedData({
+      domain: {
+        name: "WeightedECDSAValidator",
+        version: "1",
+        chainId: this.chain.id,
+        verifyingContract: this.validatorAddress,
+      },
+      types: {
+        Approve: [{ name: "callDataAndNonceHash", type: "bytes32" }],
+      },
+      message: {
+        callDataAndNonceHash: recoveryHash,
+      },
+      primaryType: "Approve",
+    });
+  }
+
+  async signUserOp(_userOp: UserOperationRequest): Promise<Hex> {
+    if (!this.chain) {
+      throw new Error("Validator uninitialized");
+    }
+    return this.signatures ?? DUMMY_ECDSA_SIG;
+  }
+}

package/src/kernel-zerodev/validator/session-key-validator.ts

@@ -40,7 +40,7 @@ import { fixSignedData } from "../utils.js";
 // Using this trick: https://github.com/GoogleChromeLabs/jsbi/issues/30#issuecomment-1006086291
 (BigInt.prototype as any).toJSON = function () {
   return this.toString();
-}
+};
 
 export interface SessionKeyValidatorParams extends KernelBaseValidatorParams {
   sessionKey: SmartAccountSigner;
@@ -170,17 +170,15 @@ export class SessionKeyValidator extends KernelBaseValidator {
 
       if (!valueLimitPermissions.length) return undefined;
 
-      const sortedPermissions = valueLimitPermissions.sort(
-        (a, b) => {
-          if (b.valueLimit > a.valueLimit) {
-            return 1
-          } else if (b.valueLimit < a.valueLimit) {
-            return -1
-          } else {
-            return 0
-          }
+      const sortedPermissions = valueLimitPermissions.sort((a, b) => {
+        if (b.valueLimit > a.valueLimit) {
+          return 1;
+        } else if (b.valueLimit < a.valueLimit) {
+          return -1;
+        } else {
+          return 0;
         }
-      );
+      });
 
       return this.findPermissionByRule(sortedPermissions, args[2]);
     } catch (error) {
@@ -266,12 +264,12 @@ export class SessionKeyValidator extends KernelBaseValidator {
 
     return permissionPacked && permissionPacked.length !== 0
       ? new MerkleTree(permissionPacked, keccak256, {
-        sortPairs: true,
-        hashLeaves: true,
-      })
+          sortPairs: true,
+          hashLeaves: true,
+        })
       : new MerkleTree([pad("0x00", { size: 32 })], keccak256, {
-        hashLeaves: false,
-      });
+          hashLeaves: false,
+        });
   }
 
   encodePermissionData(permission: Permission, merkleProof?: string[]): Hex {
@@ -394,7 +392,7 @@ export class SessionKeyValidator extends KernelBaseValidator {
     ]);
     return (
       execDetail.validator.toLowerCase() ===
-      this.validatorAddress.toLowerCase() &&
+        this.validatorAddress.toLowerCase() &&
       enableData[4] &&
       enableDataHex.toLowerCase() === (await this.getEnableData()).toLowerCase()
     );
@@ -409,8 +407,8 @@ export class SessionKeyValidator extends KernelBaseValidator {
     }
     const encodedPermissionData =
       this.sessionKeyData.permissions &&
-        this.sessionKeyData.permissions.length !== 0 &&
-        matchingPermission
+      this.sessionKeyData.permissions.length !== 0 &&
+      matchingPermission
         ? this.encodePermissionData(matchingPermission)
         : "0x";
     const merkleProof = this.merkleTree.getHexProof(
@@ -418,8 +416,8 @@ export class SessionKeyValidator extends KernelBaseValidator {
     );
     const encodedData =
       this.sessionKeyData.permissions &&
-        this.sessionKeyData.permissions.length !== 0 &&
-        matchingPermission
+      this.sessionKeyData.permissions.length !== 0 &&
+      matchingPermission
         ? this.encodePermissionData(matchingPermission, merkleProof)
         : "0x";
     return concatHex([
@@ -475,8 +473,8 @@ export class SessionKeyValidator extends KernelBaseValidator {
     }
     const encodedPermissionData =
       this.sessionKeyData.permissions &&
-        this.sessionKeyData.permissions.length !== 0 &&
-        matchingPermission
+      this.sessionKeyData.permissions.length !== 0 &&
+      matchingPermission
         ? this.encodePermissionData(matchingPermission)
         : "0x";
     const merkleProof = this.merkleTree.getHexProof(
@@ -484,8 +482,8 @@ export class SessionKeyValidator extends KernelBaseValidator {
     );
     const encodedData =
       this.sessionKeyData.permissions &&
-        this.sessionKeyData.permissions.length !== 0 &&
-        matchingPermission
+      this.sessionKeyData.permissions.length !== 0 &&
+      matchingPermission
         ? this.encodePermissionData(matchingPermission, merkleProof)
         : "0x";
     const signature = concat([

package/src/kernel-zerodev/validator/types.ts

@@ -11,6 +11,10 @@ import type {
   KillSwitchValidator,
   KillSwitchValidatorParams,
 } from "./kill-switch-validator.js";
+import type {
+  RecoveryValidator,
+  RecoveryValidatorParams,
+} from "./recovery-validator.js";
 import type {
   SessionKeyValidator,
   SessionKeyValidatorParams,
@@ -24,13 +28,15 @@ export type SupportedValidators =
   | "ECDSA"
   | "KILL_SWITCH"
   | "ERC165_SESSION_KEY"
-  | "SESSION_KEY";
+  | "SESSION_KEY"
+  | "RECOVERY";
 
 export type ValidatorTypeMap = {
   ECDSA: ECDSAValidator;
   KILL_SWITCH: KillSwitchValidator;
   ERC165_SESSION_KEY: ERC165SessionKeyValidator;
   SESSION_KEY: SessionKeyValidator;
+  RECOVERY: RecoveryValidator;
 };
 
 export type ValidatorParamsMap = {
@@ -38,6 +44,7 @@ export type ValidatorParamsMap = {
   KILL_SWITCH: KillSwitchValidatorParams;
   ERC165_SESSION_KEY: ERC165SessionKeyValidatorParams;
   SESSION_KEY: SessionKeyValidatorParams;
+  RECOVERY: RecoveryValidatorParams;
 };
 
 export type ValidatorMap = {
@@ -46,4 +53,6 @@ export type ValidatorMap = {
   ) => ValidatorTypeMap[V];
 };
 
+export type EthereumProvider = { request(...args: any): Promise<any> };
+
 export type { ParamRules, Permission, SessionKeyData, SessionKeyParams };

package/src/kernel-zerodev/validator-provider/base.ts

@@ -74,6 +74,7 @@ export abstract class ValidatorProvider<
       projectId: params.projectId,
       bundlerProvider,
     });
+    this.defaultProvider = params.defaultProvider;
     this.connect(
       () =>
         new KernelSmartContractAccount({
@@ -117,7 +118,7 @@ export abstract class ValidatorProvider<
     return await this.account.validator.encodeEnable(enableData);
   };
 
-  getEncodedDisableData = async (disableData: Hex): Promise<Hex> => {
+  getEncodedDisableData = async (disableData: Hex = "0x"): Promise<Hex> => {
     if (!isKernelAccount(this.account) || !this.account.validator) {
       throw new Error(
         "ValidatorProvider: account with validator is not set, did you call all connects first?"
@@ -143,7 +144,7 @@ export abstract class ValidatorProvider<
   };
 
   sendDisableUserOperation = async (
-    disableData: Hex
+    disableData: Hex = "0x"
   ): Promise<SendUserOperationResult> => {
     const encodedDisableData = await this.getEncodedDisableData(disableData);
     if (!isKernelAccount(this.account) || !this.account.validator) {
@@ -151,8 +152,11 @@ export abstract class ValidatorProvider<
         "ValidatorProvider: account with validator is not set, did you call all connects first?"
       );
     }
+    if (!this.defaultProvider) {
+      throw Error("Default Validator provider unintialized");
+    }
 
-    return await this.sendUserOperation({
+    return await this.defaultProvider.sendUserOperation({
       target: this.account.validator.validatorAddress,
       data: encodedDisableData,
     });

package/src/kernel-zerodev/validator-provider/index.ts

@@ -1,6 +1,7 @@
 import { ECDSAProvider } from "./ecdsa-provider.js";
 import { ERC165SessionKeyProvider } from "./erc165-session-key-provider.js";
 import { KillSwitchProvider } from "./kill-switch-provider.js";
+import { RecoveryProvider } from "./recovery-provider.js";
 import { SessionKeyProvider } from "./session-key-provider.js";
 import type { ValidatorProviderMap } from "./types.js";
 
@@ -9,6 +10,7 @@ export const ValidatorProviders: ValidatorProviderMap = {
   KILL_SWITCH: KillSwitchProvider,
   ERC165_SESSION_KEY: ERC165SessionKeyProvider,
   SESSION_KEY: SessionKeyProvider,
+  RECOVERY: RecoveryProvider,
 };
 
 export {
@@ -16,4 +18,5 @@ export {
   KillSwitchProvider,
   ERC165SessionKeyProvider,
   SessionKeyProvider,
+  RecoveryProvider,
 };