@zerodev/sdk 4.0.9 → 4.0.11

package/src/kernel-zerodev/validator/kill-switch-validator.ts

@@ -7,7 +7,11 @@ import {
   type UserOperationRequest,
   type SignTypedDataParams,
 } from "@alchemy/aa-core";
-import { KernelBaseValidator, type KernelBaseValidatorParams } from "./base.js";
+import {
+  KernelBaseValidator,
+  ValidatorMode,
+  type KernelBaseValidatorParams,
+} from "./base.js";
 import {
   concat,
   concatHex,
@@ -37,6 +41,7 @@ export class KillSwitchValidator extends KernelBaseValidator {
     super(params);
     this.guardian = params.guardian;
     this.delaySeconds = params.delaySeconds;
+    this.mode = params.mode ?? ValidatorMode.plugin;
   }
 
   public static async init(

package/src/kernel-zerodev/validator/session-key-validator.ts

@@ -0,0 +1,483 @@
+import {
+  getUserOperationHash,
+  type Address,
+  type Hex,
+  type SmartAccountSigner,
+  type UserOperationRequest,
+  getChain,
+  type SignTypedDataParams,
+} from "@alchemy/aa-core";
+import {
+  KernelBaseValidator,
+  ValidatorMode,
+  type KernelBaseValidatorParams,
+  type ValidatorPluginData,
+} from "./base.js";
+import {
+  encodeFunctionData,
+  toBytes,
+  concat,
+  pad,
+  toHex,
+  keccak256,
+  encodeAbiParameters,
+  concatHex,
+  zeroAddress,
+  decodeFunctionData,
+  isHex,
+  getFunctionSelector,
+} from "viem";
+import { SessionKeyValidatorAbi } from "../abis/SessionKeyValidatorAbi.js";
+import { DUMMY_ECDSA_SIG } from "../constants.js";
+import { KernelAccountAbi } from "../abis/KernelAccountAbi.js";
+import { MerkleTree } from "merkletreejs";
+import type { Operation } from "../provider.js";
+import { getChainId } from "../api/index.js";
+import { fixSignedData } from "../utils.js";
+
+export interface SessionKeyValidatorParams extends KernelBaseValidatorParams {
+  sessionKey: SmartAccountSigner;
+  sessionKeyData: SessionKeyData;
+}
+
+export type SessionKeyParams = Pick<
+  SessionKeyValidatorParams,
+  "sessionKeyData" | "enableSignature"
+> &
+  ValidatorPluginData & {
+    sessionPrivateKey?: Hex;
+    initCode?: Hex;
+    accountAddress?: Address;
+  };
+
+export enum ParamCondition {
+  EQUAL = 0,
+  GREATER_THAN = 1,
+  LESS_THAN = 2,
+  GREATER_THAN_OR_EQUAL = 3,
+  LESS_THAN_OR_EQUAL = 4,
+  NOT_EQUAL = 5,
+}
+
+export interface ParamRules {
+  offset: number;
+  condition: ParamCondition;
+  param: Hex;
+}
+
+export interface Permission {
+  target: Address;
+  valueLimit: number;
+  sig: Hex;
+  rules: ParamRules[];
+  operation: Operation;
+}
+
+export interface SessionKeyData {
+  validUntil: number;
+  validAfter: number;
+  paymaster?: Address;
+  permissions?: Permission[];
+}
+
+export class SessionKeyValidator extends KernelBaseValidator {
+  protected sessionKey: SmartAccountSigner;
+  sessionKeyData: SessionKeyData;
+  merkleTree: MerkleTree;
+
+  constructor(params: SessionKeyValidatorParams) {
+    super(params);
+    this.sessionKey = params.sessionKey;
+    this.sessionKeyData = {
+      ...params.sessionKeyData,
+      paymaster: params.sessionKeyData.paymaster ?? zeroAddress,
+    };
+    this.merkleTree = this.getMerkleTree();
+    this.selector =
+      params.selector ??
+      getFunctionSelector("execute(address, uint256, bytes, uint8)");
+    this.executor = params.executor ?? zeroAddress;
+    this.mode = params.mode ?? ValidatorMode.plugin;
+  }
+
+  public static async init(
+    params: SessionKeyValidatorParams
+  ): Promise<SessionKeyValidator> {
+    const chainId = await getChainId(params.projectId);
+    if (!chainId) {
+      throw new Error("ChainId not found");
+    }
+    const chain = getChain(chainId);
+    const instance = new SessionKeyValidator({ ...params, chain });
+    return instance;
+  }
+
+  shouldDelegateViaFallback(): boolean {
+    return this.merkleTree.getHexRoot() === pad("0x00", { size: 32 });
+  }
+
+  findMatchingPermission(callData: Hex): Permission | undefined {
+    try {
+      const { functionName, args } = decodeFunctionData({
+        abi: KernelAccountAbi,
+        data: callData,
+      });
+
+      if (functionName !== "execute") return undefined;
+
+      const permissionsList = this.sessionKeyData.permissions;
+      if (!permissionsList || !permissionsList.length) return undefined;
+
+      const targetToMatch = args[0].toLowerCase();
+
+      // Filter permissions by target
+      let targetPermissions = permissionsList.filter(
+        (permission) => permission.target.toLowerCase() === targetToMatch
+      );
+
+      // If no permissions match the exact target, check for generic permissions (using zero address)
+      if (!targetPermissions.length) {
+        targetPermissions = permissionsList.filter(
+          (permission) =>
+            permission.target.toLowerCase() === zeroAddress.toLowerCase()
+        );
+      }
+
+      if (!targetPermissions.length) return undefined;
+
+      const operationPermissions = this.filterByOperation(
+        targetPermissions,
+        args[3]
+      );
+
+      if (!operationPermissions.length) return undefined;
+
+      const signaturePermissions = this.filterBySignature(
+        operationPermissions,
+        args[2].slice(0, 10).toLowerCase()
+      );
+
+      const valueLimitPermissions = signaturePermissions.filter(
+        (permission) => permission.valueLimit >= args[1]
+      );
+
+      if (!valueLimitPermissions.length) return undefined;
+
+      const sortedPermissions = valueLimitPermissions.sort(
+        (a, b) => b.valueLimit - a.valueLimit
+      );
+
+      return this.findPermissionByRule(sortedPermissions, args[2]);
+    } catch (error) {
+      return undefined;
+    }
+  }
+
+  private filterByOperation(
+    permissions: Permission[],
+    operation: Operation
+  ): Permission[] {
+    return permissions.filter(
+      (permission) => permission.operation === operation
+    );
+  }
+
+  private filterBySignature(
+    permissions: Permission[],
+    signature: string
+  ): Permission[] {
+    return permissions.filter(
+      (permission) => permission.sig.toLowerCase() === signature
+    );
+  }
+
+  private findPermissionByRule(
+    permissions: Permission[],
+    data: string
+  ): Permission | undefined {
+    return permissions.find((permission) => {
+      for (const rule of permission.rules) {
+        const dataParam: Hex = this.getFormattedHex(
+          "0x" + data.slice(10 + rule.offset * 2, 10 + rule.offset * 2 + 64)
+        );
+        const ruleParam: Hex = this.getFormattedHex(rule.param);
+
+        if (!this.evaluateRuleCondition(dataParam, ruleParam, rule.condition)) {
+          return false;
+        }
+      }
+      return true;
+    });
+  }
+
+  private getFormattedHex(value: string): Hex {
+    return pad(isHex(value) ? value : toHex(value), {
+      size: 32,
+    }).toLowerCase() as Hex;
+  }
+
+  private evaluateRuleCondition(
+    dataParam: Hex,
+    ruleParam: Hex,
+    condition: ParamCondition
+  ): boolean {
+    switch (condition) {
+      case ParamCondition.EQUAL:
+        return dataParam === ruleParam;
+      case ParamCondition.GREATER_THAN:
+        return dataParam > ruleParam;
+      case ParamCondition.LESS_THAN:
+        return dataParam < ruleParam;
+      case ParamCondition.GREATER_THAN_OR_EQUAL:
+        return dataParam >= ruleParam;
+      case ParamCondition.LESS_THAN_OR_EQUAL:
+        return dataParam <= ruleParam;
+      case ParamCondition.NOT_EQUAL:
+        return dataParam !== ruleParam;
+      default:
+        return false;
+    }
+  }
+
+  getMerkleTree(): MerkleTree {
+    const permissionPacked = this.sessionKeyData.permissions?.map(
+      (permission) => this.encodePermissionData(permission)
+    );
+
+    // Having one leaf returns empty array in getProof(). To hack it we push the leaf twice
+    // issue - https://github.com/merkletreejs/merkletreejs/issues/58
+    if (permissionPacked?.length === 1)
+      permissionPacked.push(permissionPacked[0]);
+
+    return permissionPacked && permissionPacked.length !== 0
+      ? new MerkleTree(permissionPacked, keccak256, {
+          sortPairs: true,
+          hashLeaves: true,
+        })
+      : new MerkleTree([pad("0x00", { size: 32 })], keccak256, {
+          hashLeaves: false,
+        });
+  }
+
+  encodePermissionData(permission: Permission, merkleProof?: string[]): Hex {
+    let permissionParam = {
+      components: [
+        {
+          name: "target",
+          type: "address",
+        },
+        {
+          name: "valueLimit",
+          type: "uint256",
+        },
+        {
+          name: "sig",
+          type: "bytes4",
+        },
+        {
+          components: [
+            {
+              name: "offset",
+              type: "uint256",
+            },
+            {
+              internalType: "enum ParamCondition",
+              name: "condition",
+              type: "uint8",
+            },
+            {
+              name: "param",
+              type: "bytes32",
+            },
+          ],
+          name: "rules",
+          type: "tuple[]",
+        },
+        {
+          internalType: "enum Operation",
+          name: "operation",
+          type: "uint8",
+        },
+      ],
+      name: "permission",
+      type: "tuple",
+    };
+    let params;
+    let values;
+    if (merkleProof) {
+      params = [
+        permissionParam,
+        {
+          name: "merkleProof",
+          type: "bytes32[]",
+        },
+      ];
+      values = [permission, merkleProof];
+    } else {
+      params = [permissionParam];
+      values = [permission];
+    }
+    return encodeAbiParameters(params, values);
+  }
+
+  getSessionData(): SessionKeyParams {
+    if (!this.selector || !this.executor) {
+      throw Error("Plugin Validator data params uninitialised");
+    }
+    return {
+      selector: this.selector,
+      executor: this.executor,
+      validUntil: this.validUntil,
+      validAfter: this.validAfter,
+      sessionKeyData: this.sessionKeyData,
+      enableSignature: this.enableSignature,
+    };
+  }
+
+  async signer(): Promise<SmartAccountSigner> {
+    return await Promise.resolve(this.sessionKey);
+  }
+
+  async getEnableData(): Promise<Hex> {
+    if (!this.merkleTree) {
+      throw Error("SessionKeyValidator: MerkleTree not generated");
+    }
+    return concat([
+      await this.sessionKey.getAddress(),
+      pad(this.merkleTree.getHexRoot() as Hex, { size: 32 }),
+      pad(toHex(this.sessionKeyData.validAfter), { size: 6 }),
+      pad(toHex(this.sessionKeyData.validUntil), { size: 6 }),
+      this.sessionKeyData.paymaster!,
+    ]);
+  }
+
+  async isPluginEnabled(
+    kernelAccountAddress: Address,
+    selector: Hex
+  ): Promise<boolean> {
+    if (!this.publicClient) {
+      throw new Error("Validator uninitialized: PublicClient missing");
+    }
+    const execDetail = await this.publicClient.readContract({
+      abi: KernelAccountAbi,
+      address: kernelAccountAddress,
+      functionName: "getExecution",
+      args: [selector],
+    });
+    const enableData = await this.publicClient.readContract({
+      abi: SessionKeyValidatorAbi,
+      address: this.validatorAddress,
+      functionName: "sessionData",
+      args: [await this.sessionKey.getAddress(), kernelAccountAddress],
+    });
+    const enableDataHex = concatHex([
+      await this.sessionKey.getAddress(),
+      pad(enableData[0], { size: 4 }),
+      pad(toHex(enableData[1]), { size: 6 }),
+      pad(toHex(enableData[2]), { size: 6 }),
+      enableData[3],
+    ]);
+    return (
+      execDetail.validator.toLowerCase() ===
+        this.validatorAddress.toLowerCase() &&
+      enableData[4] &&
+      enableDataHex.toLowerCase() === (await this.getEnableData()).toLowerCase()
+    );
+  }
+
+  async getDummyUserOpSignature(callData: Hex): Promise<Hex> {
+    const matchingPermission = this.findMatchingPermission(callData);
+    if (!matchingPermission && !this.shouldDelegateViaFallback()) {
+      throw Error(
+        "SessionKeyValidator: No matching permission found for the userOp"
+      );
+    }
+    const encodedPermissionData =
+      this.sessionKeyData.permissions &&
+      this.sessionKeyData.permissions.length !== 0 &&
+      matchingPermission
+        ? this.encodePermissionData(matchingPermission)
+        : "0x";
+    const merkleProof = this.merkleTree.getHexProof(
+      keccak256(encodedPermissionData)
+    );
+    const encodedData =
+      this.sessionKeyData.permissions &&
+      this.sessionKeyData.permissions.length !== 0 &&
+      matchingPermission
+        ? this.encodePermissionData(matchingPermission, merkleProof)
+        : "0x";
+    return concatHex([
+      await this.sessionKey.getAddress(),
+      DUMMY_ECDSA_SIG,
+      encodedData,
+    ]);
+  }
+
+  encodeEnable(sessionKeyEnableData: Hex): Hex {
+    return encodeFunctionData({
+      abi: SessionKeyValidatorAbi,
+      functionName: "enable",
+      args: [sessionKeyEnableData],
+    });
+  }
+
+  encodeDisable(sessionKey: Hex): Hex {
+    return encodeFunctionData({
+      abi: SessionKeyValidatorAbi,
+      functionName: "disable",
+      args: [sessionKey],
+    });
+  }
+
+  async signMessage(message: string | Uint8Array): Promise<Hex> {
+    return await this.sessionKey.signMessage(message);
+  }
+
+  async signTypedData(params: SignTypedDataParams): Promise<Hex> {
+    return fixSignedData(await this.sessionKey.signTypedData(params));
+  }
+
+  async signUserOp(userOp: UserOperationRequest): Promise<Hex> {
+    if (!this.chain) {
+      throw new Error("Validator uninitialized");
+    }
+    const hash = getUserOperationHash(
+      {
+        ...userOp,
+        signature: "0x",
+      },
+      this.entryPointAddress,
+      BigInt(this.chain.id)
+    );
+    const formattedMessage = typeof hash === "string" ? toBytes(hash) : hash;
+
+    const matchingPermission = this.findMatchingPermission(userOp.callData);
+    if (!matchingPermission && !this.shouldDelegateViaFallback()) {
+      throw Error(
+        "SessionKeyValidator: No matching permission found for the userOp"
+      );
+    }
+    const encodedPermissionData =
+      this.sessionKeyData.permissions &&
+      this.sessionKeyData.permissions.length !== 0 &&
+      matchingPermission
+        ? this.encodePermissionData(matchingPermission)
+        : "0x";
+    const merkleProof = this.merkleTree.getHexProof(
+      keccak256(encodedPermissionData)
+    );
+    const encodedData =
+      this.sessionKeyData.permissions &&
+      this.sessionKeyData.permissions.length !== 0 &&
+      matchingPermission
+        ? this.encodePermissionData(matchingPermission, merkleProof)
+        : "0x";
+    const signature = concat([
+      await this.sessionKey.getAddress(),
+      await this.sessionKey.signMessage(formattedMessage),
+      encodedData,
+    ]);
+    return signature;
+  }
+}

package/src/kernel-zerodev/validator/types.ts

@@ -11,22 +11,33 @@ import type {
   KillSwitchValidator,
   KillSwitchValidatorParams,
 } from "./kill-switch-validator.js";
+import type {
+  SessionKeyValidator,
+  SessionKeyValidatorParams,
+  ParamRules,
+  Permission,
+  SessionKeyData,
+  SessionKeyParams,
+} from "./session-key-validator.js";
 
 export type SupportedValidators =
   | "ECDSA"
   | "KILL_SWITCH"
-  | "ERC165_SESSION_KEY";
+  | "ERC165_SESSION_KEY"
+  | "SESSION_KEY";
 
 export type ValidatorTypeMap = {
   ECDSA: ECDSAValidator;
   KILL_SWITCH: KillSwitchValidator;
   ERC165_SESSION_KEY: ERC165SessionKeyValidator;
+  SESSION_KEY: SessionKeyValidator;
 };
 
 export type ValidatorParamsMap = {
   ECDSA: ECDSAValidatorParams;
   KILL_SWITCH: KillSwitchValidatorParams;
   ERC165_SESSION_KEY: ERC165SessionKeyValidatorParams;
+  SESSION_KEY: SessionKeyValidatorParams;
 };
 
 export type ValidatorMap = {
@@ -34,3 +45,5 @@ export type ValidatorMap = {
     params: ValidatorParamsMap[V]
   ) => ValidatorTypeMap[V];
 };
+
+export type { ParamRules, Permission, SessionKeyData, SessionKeyParams };

package/src/kernel-zerodev/validator-provider/base.ts

@@ -1,8 +1,4 @@
-import {
-  type Hex,
-  type SendUserOperationResult,
-  type SmartAccountSigner,
-} from "@alchemy/aa-core";
+import { type Hex, type SendUserOperationResult } from "@alchemy/aa-core";
 import { ZeroDevProvider, type ZeroDevProviderConfig } from "../provider.js";
 import type {
   KernelBaseValidator,
@@ -34,10 +30,13 @@ export type ValidatorProviderParamsOpts<P extends KernelBaseValidatorParams> = {
 
 export interface ValidatorProviderParams<P extends KernelBaseValidatorParams> {
   projectId: string;
-  owner: SmartAccountSigner;
   bundlerProvider?: PaymasterAndBundlerProviders;
   opts?: ValidatorProviderParamsOpts<P>;
   usePaymaster?: boolean;
+  defaultProvider?: ValidatorProvider<
+    KernelBaseValidator,
+    KernelBaseValidatorParams
+  >;
 }
 
 export type ExtendedValidatorProviderParams<
@@ -47,8 +46,13 @@ export type ExtendedValidatorProviderParams<
 // A simple facade abstraction for validator related provider operations
 // Needs to be implemented for each validator plugin
 export abstract class ValidatorProvider<
+  V extends KernelBaseValidator,
   P extends KernelBaseValidatorParams
 > extends ZeroDevProvider {
+  protected defaultProvider?: ValidatorProvider<
+    KernelBaseValidator,
+    KernelBaseValidatorParams
+  >;
   constructor(
     params: ExtendedValidatorProviderParams<P>,
     validator: KernelBaseValidator
@@ -64,28 +68,35 @@ export abstract class ValidatorProvider<
       () =>
         new KernelSmartContractAccount({
           projectId: params.projectId,
-          owner: params.owner,
           validator,
+          defaultValidator: params.defaultProvider?.getValidator(),
           rpcClient: this.rpcClient,
           bundlerProvider: params.bundlerProvider,
+          index: params.defaultProvider?.getAccount().getIndex(),
           ...params.opts?.accountConfig,
         })
     );
     if (params.usePaymaster === undefined || params.usePaymaster) {
-      withZeroDevPaymasterAndData(
-        this,
-        params.opts?.paymasterConfig ?? { policy: "VERIFYING_PAYMASTER" }
-      );
+      let paymasterConfig = params.opts?.paymasterConfig ?? {
+        policy: "VERIFYING_PAYMASTER",
+      };
+      paymasterConfig = {
+        ...paymasterConfig,
+        paymasterProvider:
+          params.opts?.paymasterConfig?.paymasterProvider ??
+          params.bundlerProvider,
+      };
+      withZeroDevPaymasterAndData(this, paymasterConfig);
     }
   }
 
-  getValidator = (): KernelBaseValidator => {
+  getValidator = (): V => {
     if (!isKernelAccount(this.account) || !this.account.validator) {
       throw new Error(
         "ValidatorProvider: account with validator is not set, did you call all connects first?"
       );
     }
-    return this.account.getValidator();
+    return this.account.getValidator() as unknown as V;
   };
 
   getEncodedEnableData = async (enableData: Hex): Promise<Hex> => {

package/src/kernel-zerodev/validator-provider/ecdsa-provider.ts

@@ -10,7 +10,10 @@ import { getChain } from "@alchemy/aa-core";
 import { getChainId } from "../api/index.js";
 import { polygonMumbai } from "viem/chains";
 
-export class ECDSAProvider extends ValidatorProvider<ECDSAValidatorParams> {
+export class ECDSAProvider extends ValidatorProvider<
+  ECDSAValidator,
+  ECDSAValidatorParams
+> {
   constructor(params: ExtendedValidatorProviderParams<ECDSAValidatorParams>) {
     const chain =
       typeof params.opts?.providerConfig?.chain === "number"

package/src/kernel-zerodev/validator-provider/erc165-session-key-provider.ts

@@ -11,7 +11,10 @@ import { getChainId } from "../api/index.js";
 import { polygonMumbai } from "viem/chains";
 import { ERC165_SESSION_KEY_VALIDATOR_ADDRESS } from "../constants.js";
 
-export class ERC165SessionKeyProvider extends ValidatorProvider<ERC165SessionKeyValidatorParams> {
+export class ERC165SessionKeyProvider extends ValidatorProvider<
+  ERC165SessionKeyValidator,
+  ERC165SessionKeyValidatorParams
+> {
   constructor(
     params: ExtendedValidatorProviderParams<ERC165SessionKeyValidatorParams>
   ) {

package/src/kernel-zerodev/validator-provider/index.ts

@@ -1,12 +1,19 @@
 import { ECDSAProvider } from "./ecdsa-provider.js";
 import { ERC165SessionKeyProvider } from "./erc165-session-key-provider.js";
 import { KillSwitchProvider } from "./kill-switch-provider.js";
+import { SessionKeyProvider } from "./session-key-provider.js";
 import type { ValidatorProviderMap } from "./types.js";
 
 export const ValidatorProviders: ValidatorProviderMap = {
   ECDSA: ECDSAProvider,
   KILL_SWITCH: KillSwitchProvider,
   ERC165_SESSION_KEY: ERC165SessionKeyProvider,
+  SESSION_KEY: SessionKeyProvider,
 };
 
-export { ECDSAProvider, KillSwitchProvider, ERC165SessionKeyProvider };
+export {
+  ECDSAProvider,
+  KillSwitchProvider,
+  ERC165SessionKeyProvider,
+  SessionKeyProvider,
+};

package/src/kernel-zerodev/validator-provider/kill-switch-provider.ts

@@ -11,7 +11,10 @@ import { getChainId } from "../api/index.js";
 import { polygonMumbai } from "viem/chains";
 import { KILL_SWITCH_VALIDATOR_ADDRESS } from "../constants.js";
 
-export class KillSwitchProvider extends ValidatorProvider<KillSwitchValidatorParams> {
+export class KillSwitchProvider extends ValidatorProvider<
+  KillSwitchValidator,
+  KillSwitchValidatorParams
+> {
   constructor(
     params: ExtendedValidatorProviderParams<KillSwitchValidatorParams>
   ) {