@zerodev/sdk 4.2.2 → 4.3.0

package/src/kernel-zerodev/abis/SessionKeyValidatorAbi.ts

@@ -1,4 +1,9 @@
 export const SessionKeyValidatorAbi = [
+  {
+    inputs: [],
+    name: "NotImplemented",
+    type: "error",
+  },
   {
     inputs: [
       {
@@ -25,6 +30,72 @@ export const SessionKeyValidatorAbi = [
     stateMutability: "payable",
     type: "function",
   },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "permissionKey",
+        type: "bytes32",
+      },
+      {
+        internalType: "address",
+        name: "kernel",
+        type: "address",
+      },
+    ],
+    name: "executionStatus",
+    outputs: [
+      {
+        internalType: "ValidAfter",
+        name: "validAfter",
+        type: "uint48",
+      },
+      {
+        internalType: "uint48",
+        name: "runs",
+        type: "uint48",
+      },
+    ],
+    stateMutability: "view",
+    type: "function",
+  },
+  {
+    inputs: [
+      {
+        internalType: "uint128",
+        name: "nonce",
+        type: "uint128",
+      },
+    ],
+    name: "invalidateNonce",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function",
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "kernel",
+        type: "address",
+      },
+    ],
+    name: "nonces",
+    outputs: [
+      {
+        internalType: "uint128",
+        name: "lastNonce",
+        type: "uint128",
+      },
+      {
+        internalType: "uint128",
+        name: "invalidNonce",
+        type: "uint128",
+      },
+    ],
+    stateMutability: "view",
+    type: "function",
+  },
   {
     inputs: [
       {
@@ -61,9 +132,9 @@ export const SessionKeyValidatorAbi = [
         type: "address",
       },
       {
-        internalType: "bool",
-        name: "enabled",
-        type: "bool",
+        internalType: "uint256",
+        name: "nonce",
+        type: "uint256",
       },
     ],
     stateMutability: "view",
@@ -183,7 +254,7 @@ export const SessionKeyValidatorAbi = [
       },
       {
         internalType: "bytes32",
-        name: "userOpHash",
+        name: "",
         type: "bytes32",
       },
       {

package/src/kernel-zerodev/client/create-client.ts

@@ -29,6 +29,7 @@ function isMethodInErc4337RpcSchema(
       "eth_supportedEntryPoints",
       "eth_maxPriorityFeePerGas",
       "rundler_maxPriorityFeePerGas",
+      "pimlico_getUserOperationGasPrice",
     ] as const
   ).includes(variable as MethodsOfErc4337RpcSchema);
 }

package/src/kernel-zerodev/constants.ts

@@ -26,7 +26,7 @@ export const ERC165_SESSION_KEY_VALIDATOR_ADDRESS =
   "0xe149290800De29D4b0BF9dB82c508255D81902E6";
 export const TOKEN_ACTION = "0x2087C7FfD0d0DAE80a00EE74325aBF3449e0eaf1";
 export const SESSION_KEY_VALIDATOR_ADDRESS =
-  "0x1C1D5b70aD6e0c04366aab100261A6Bcc251EA3f";
+  "0xB8E3c4bEaACAd06f6092793012DA4a8cB23D6123";
 export const RECOVERY_VALIDATOR_ADDRESS =
   "0x4fd47D861c349bD49DC61341a922cb72F9dF7E8d";
 export const RECOVERY_ACTION = "0x2f65dB8039fe5CAEE0a8680D2879deB800F31Ae1";
@@ -102,6 +102,6 @@ export const CHAIN_ID_TO_NODE: { [key: number]: string } = {
   10200: "https://nd-810-853-201.p2pify.com/e828b09f0d43591de96c297b3f36fffd",
   59144: `https://linea-mainnet.infura.io/v3/${INFURA_API_KEY}`,
   59140: `https://linea-goerli.infura.io/v3/${INFURA_API_KEY}`,
-  204: 'https://opbnb.rpc.thirdweb.com/eed98c1f30120c0508f17c1f01d3102b',
+  204: "https://opbnb.rpc.thirdweb.com/eed98c1f30120c0508f17c1f01d3102b",
   // 5611: 'opBnb-testnet',
 };

package/src/kernel-zerodev/middleware/gas-estimator.ts

@@ -9,6 +9,7 @@ import {
 } from "@alchemy/aa-core";
 import { ENTRYPOINT_ADDRESS } from "../constants.js";
 import { calcPreVerificationGas } from "../utils/calc-pre-verification-gas.js";
+import { type PaymasterAndBundlerProviders } from "../paymaster/types.js";
 
 export const withZeroDevGasEstimator = (
   provider: ZeroDevProvider
@@ -121,17 +122,30 @@ export const getPreVerificationGas = async (
   return calcPreVerificationGas(p);
 };
 
+export const GAS_PRICE_RPC_METHODS_BY_BUNDLER: {
+  [K in PaymasterAndBundlerProviders]: string;
+} = {
+  STACKUP: "eth_maxPriorityFeePerGas",
+  ALCHEMY: "rundler_maxPriorityFeePerGas",
+  PIMLICO: "pimlico_getUserOperationGasPrice",
+};
+
 export const eip1559GasPrice = async (provider: ZeroDevProvider) => {
-  const [fee, block] = await Promise.all([
-    provider.bundlerProvider === "ALCHEMY"
-      ? (provider.rpcClient.request({
-          // @ts-expect-error
-          method: "rundler_maxPriorityFeePerGas",
-        }) as Promise<Hex>)
-      : provider.rpcClient.getMaxPriorityFeePerGas(),
+  let [fee, block] = await Promise.all([
+    provider.rpcClient.request({
+      method:
+        // @ts-expect-error
+        GAS_PRICE_RPC_METHODS_BY_BUNDLER[provider.bundlerProvider] ??
+        "eth_maxPriorityFeePerGas",
+      params: [],
+    }) as any,
     provider.rpcClient.getBlock({ blockTag: "latest" }),
   ]);
 
+  if (provider.bundlerProvider === "PIMLICO") {
+    fee = fee.standard.maxPriorityFeePerGas;
+  }
+
   const tip = BigInt(fee);
   const buffer = (tip / 100n) * 13n;
   let maxPriorityFeePerGas = tip + buffer;

package/src/kernel-zerodev/validator/base.ts

@@ -93,7 +93,7 @@ export abstract class KernelBaseValidator {
 
   abstract encodeDisable(enableData: Hex): Hex;
 
-  abstract getEnableData(): Promise<Hex>;
+  abstract getEnableData(kernelAccountAddress?: Address): Promise<Hex>;
 
   abstract signMessage(message: Uint8Array | string | Hex): Promise<Hex>;
 
@@ -141,7 +141,7 @@ export abstract class KernelBaseValidator {
       calldata
     );
     if (validatorMode === ValidatorMode.enable) {
-      const enableData = await this.getEnableData();
+      const enableData = await this.getEnableData(kernelAccountAddress);
       const enableDataLength = enableData.length / 2 - 1;
       const enableSigLength = 65;
       const staticDummySig = concatHex([
@@ -241,7 +241,7 @@ export abstract class KernelBaseValidator {
           { size: 32 }
         ),
         executor: executor as Address,
-        enableData: await validator.getEnableData(),
+        enableData: await validator.getEnableData(kernel),
       },
       primaryType: "ValidatorApproved",
     });
@@ -297,7 +297,7 @@ export abstract class KernelBaseValidator {
     if (mode === ValidatorMode.sudo || mode === ValidatorMode.plugin) {
       return concatHex([this.mode, await this.signUserOp(userOp)]);
     } else {
-      const enableData = await this.getEnableData();
+      const enableData = await this.getEnableData(userOp.sender);
       const enableDataLength = enableData.length / 2 - 1;
       const enableSignature = this.getEnableSignature();
       if (!enableSignature) {

package/src/kernel-zerodev/validator/session-key-validator.ts

@@ -20,7 +20,6 @@ import {
   concat,
   pad,
   toHex,
-  keccak256,
   encodeAbiParameters,
   concatHex,
   zeroAddress,
@@ -28,13 +27,13 @@ import {
   isHex,
   getFunctionSelector,
   type GetAbiItemParameters,
+  keccak256,
 } from "viem";
 import { formatAbiItem } from "viem/utils";
 import { SessionKeyValidatorAbi } from "../abis/SessionKeyValidatorAbi.js";
 import { DUMMY_ECDSA_SIG } from "../constants.js";
 import { KernelAccountAbi } from "../abis/KernelAccountAbi.js";
 import { MerkleTree } from "merkletreejs";
-import { Operation } from "../provider.js";
 import { getChainId } from "../api/index.js";
 import { fixSignedData } from "../utils.js";
 import type { GetAbiItemReturnType } from "viem/dist/types/utils/abi/getAbiItem.js";
@@ -75,6 +74,16 @@ export enum ParamOperator {
   NOT_EQUAL = 5,
 }
 
+export type SessionNonces = {
+  lastNonce: bigint;
+  invalidNonce: bigint;
+};
+
+export type ExecutionRule = {
+  validAfter: number; // 48 bits
+  interval: number; // 48 bits
+  runs: number; // 48 bits
+};
 export interface ParamRules {
   offset: number;
   condition: ParamOperator;
@@ -83,10 +92,11 @@ export interface ParamRules {
 
 export type Permission = {
   target: Address;
+  index?: number;
   rules?: ParamRules[];
   sig?: Hex;
   valueLimit?: bigint;
-  operation?: Operation;
+  executionRule?: ExecutionRule;
 };
 
 export interface SessionKeyData {
@@ -141,7 +151,6 @@ export function getPermissionFromABI<
   target,
   args,
   functionName,
-  operation,
   valueLimit,
 }: GeneratePermissionFromArgsParameters<TAbi, TFunctionName>): Permission {
   const abiItem = getAbiItem({
@@ -175,7 +184,6 @@ export function getPermissionFromABI<
     sig: functionSelector,
     rules: paramRules,
     target,
-    operation: operation ?? Operation.Call,
     valueLimit: valueLimit ?? 0n,
   };
 }
@@ -195,18 +203,20 @@ export class SessionKeyValidator extends KernelBaseValidator {
       paymaster: params.sessionKeyData.paymaster ?? zeroAddress,
     };
     this.sessionKeyData.permissions = this.sessionKeyData.permissions?.map(
-      (perm) => ({
+      (perm, index) => ({
         ...perm,
-        operation: perm.operation ?? Operation.Call,
         valueLimit: perm.valueLimit ?? 0n,
         sig: perm.sig ?? pad("0x", { size: 4 }),
         rules: perm.rules ?? [],
+        index,
+        executionRule: perm.executionRule ?? {
+          validAfter: 0,
+          interval: 0,
+          runs: 0,
+        },
       })
     );
     this.merkleTree = this.getMerkleTree();
-    if (this.shouldDelegateViaFallback()) {
-      throw Error("Session key permissions not set");
-    }
     this.selector =
       params.selector ??
       getFunctionSelector("execute(address, uint256, bytes, uint8)");
@@ -230,19 +240,54 @@ export class SessionKeyValidator extends KernelBaseValidator {
     return this.merkleTree.getHexRoot() === pad("0x00", { size: 32 });
   }
 
-  findMatchingPermission(callData: Hex): Permission | undefined {
+  findMatchingPermissions(
+    callData: Hex
+  ): Permission | Permission[] | undefined {
     try {
       const { functionName, args } = decodeFunctionData({
         abi: KernelAccountAbi,
         data: callData,
       });
 
-      if (functionName !== "execute") return undefined;
+      if (functionName !== "execute" && functionName !== "executeBatch")
+        return undefined;
+      if (functionName === "execute") {
+        const [to, value, data] = args;
+        return this.filterPermissions([to], [data], [value])?.[0];
+      } else if (functionName === "executeBatch") {
+        let targets: Hex[] = [],
+          values: bigint[] = [],
+          dataArray: Hex[] = [];
+        args[0].forEach((arg) => {
+          targets.push(arg.to);
+          values.push(arg.value);
+          dataArray.push(arg.data);
+        });
+        return this.filterPermissions(targets, dataArray, values);
+      } else {
+        throw Error("Invalid function");
+      }
+    } catch (error) {
+      return undefined;
+    }
+  }
 
+  private filterPermissions(
+    targets: Address[],
+    dataArray: Hex[],
+    values: bigint[]
+  ): Permission[] | undefined {
+    if (
+      targets.length !== dataArray.length ||
+      targets.length !== values.length
+    ) {
+      throw Error("Invalid arguments");
+    }
+    const filteredPermissions = targets.map((target, index) => {
       const permissionsList = this.sessionKeyData.permissions;
       if (!permissionsList || !permissionsList.length) return undefined;
 
-      const targetToMatch = args[0].toLowerCase();
+      const targetToMatch = target.toLowerCase();
 
       // Filter permissions by target
       let targetPermissions = permissionsList.filter(
@@ -259,20 +304,13 @@ export class SessionKeyValidator extends KernelBaseValidator {
 
       if (!targetPermissions.length) return undefined;
 
-      const operationPermissions = this.filterByOperation(
-        targetPermissions,
-        args[3]
-      );
-
-      if (!operationPermissions.length) return undefined;
-
       const signaturePermissions = this.filterBySignature(
-        operationPermissions,
-        args[2].slice(0, 10).toLowerCase()
+        targetPermissions,
+        dataArray[index].slice(0, 10).toLowerCase()
       );
 
       const valueLimitPermissions = signaturePermissions.filter(
-        (permission) => (permission.valueLimit ?? 0n) >= args[1]
+        (permission) => (permission.valueLimit ?? 0n) >= values[index]
       );
 
       if (!valueLimitPermissions.length) return undefined;
@@ -287,20 +325,11 @@ export class SessionKeyValidator extends KernelBaseValidator {
         }
       });
 
-      return this.findPermissionByRule(sortedPermissions, args[2]);
-    } catch (error) {
-      return undefined;
-    }
-  }
-
-  private filterByOperation(
-    permissions: Permission[],
-    operation: Operation
-  ): Permission[] {
-    return permissions.filter(
-      (permission) =>
-        permission.operation === operation || Operation.Call === operation
-    );
+      return this.findPermissionByRule(sortedPermissions, dataArray[index]);
+    });
+    return filteredPermissions.every((permission) => permission !== undefined)
+      ? (filteredPermissions as Permission[])
+      : undefined;
   }
 
   private filterBySignature(
@@ -368,34 +397,43 @@ export class SessionKeyValidator extends KernelBaseValidator {
 
     // Having one leaf returns empty array in getProof(). To hack it we push the leaf twice
     // issue - https://github.com/merkletreejs/merkletreejs/issues/58
-    if (permissionPacked?.length === 1)
+    if (permissionPacked && permissionPacked.length === 1)
       permissionPacked.push(permissionPacked[0]);
 
     return permissionPacked && permissionPacked.length !== 0
       ? new MerkleTree(permissionPacked, keccak256, {
-          sortPairs: true,
           hashLeaves: true,
+          complete: true,
+          sort: true,
         })
       : new MerkleTree([pad("0x00", { size: 32 })], keccak256, {
           hashLeaves: false,
+          complete: true,
         });
   }
 
-  encodePermissionData(permission: Permission, merkleProof?: string[]): Hex {
+  encodePermissionData(
+    permission: Permission | Permission[],
+    merkleProof?: string[] | string[][]
+  ): Hex {
     let permissionParam = {
       components: [
         {
-          name: "target",
-          type: "address",
+          name: "index",
+          type: "uint32",
         },
         {
-          name: "valueLimit",
-          type: "uint256",
+          name: "target",
+          type: "address",
         },
         {
           name: "sig",
           type: "bytes4",
         },
+        {
+          name: "valueLimit",
+          type: "uint256",
+        },
         {
           components: [
             {
@@ -416,13 +454,27 @@ export class SessionKeyValidator extends KernelBaseValidator {
           type: "tuple[]",
         },
         {
-          internalType: "enum Operation",
-          name: "operation",
-          type: "uint8",
+          components: [
+            {
+              name: "interval",
+              type: "uint48",
+            },
+            {
+              name: "runs",
+              type: "uint48",
+            },
+            {
+              internalType: "ValidAfter",
+              name: "validAfter",
+              type: "uint48",
+            },
+          ],
+          name: "executionRule",
+          type: "tuple",
         },
       ],
       name: "permission",
-      type: "tuple",
+      type: Array.isArray(permission) ? "tuple[]" : "tuple",
     };
     let params;
     let values;
@@ -431,7 +483,7 @@ export class SessionKeyValidator extends KernelBaseValidator {
         permissionParam,
         {
           name: "merkleProof",
-          type: "bytes32[]",
+          type: Array.isArray(merkleProof[0]) ? "bytes32[][]" : "bytes32[]",
         },
       ];
       values = [permission, merkleProof];
@@ -460,16 +512,41 @@ export class SessionKeyValidator extends KernelBaseValidator {
     return await Promise.resolve(this.sessionKey);
   }
 
-  async getEnableData(): Promise<Hex> {
+  async getSessionNonces(
+    kernelAccountAddress: Address
+  ): Promise<SessionNonces> {
+    if (!this.publicClient) {
+      throw new Error("Validator uninitialized: PublicClient missing");
+    }
+    const nonce = await this.publicClient.readContract({
+      abi: SessionKeyValidatorAbi,
+      address: this.validatorAddress,
+      functionName: "nonces",
+      args: [kernelAccountAddress],
+    });
+    return { lastNonce: nonce[0], invalidNonce: nonce[1] };
+  }
+
+  async getEnableData(
+    kernelAccountAddress?: Address,
+    enabledLastNonce?: bigint
+  ): Promise<Hex> {
     if (!this.merkleTree) {
       throw Error("SessionKeyValidator: MerkleTree not generated");
     }
+    if (!kernelAccountAddress) {
+      throw Error("SessionKeyValidator: Kernel account address not provided");
+    }
+    const lastNonce =
+      enabledLastNonce ??
+      (await this.getSessionNonces(kernelAccountAddress)).lastNonce + 1n;
     return concat([
       await this.sessionKey.getAddress(),
       pad(this.merkleTree.getHexRoot() as Hex, { size: 32 }),
       pad(toHex(this.sessionKeyData.validAfter), { size: 6 }),
       pad(toHex(this.sessionKeyData.validUntil), { size: 6 }),
       this.sessionKeyData.paymaster!,
+      pad(toHex(lastNonce), { size: 32 }),
     ]);
   }
 
@@ -494,21 +571,32 @@ export class SessionKeyValidator extends KernelBaseValidator {
     });
     const enableDataHex = concatHex([
       await this.sessionKey.getAddress(),
-      pad(enableData[0], { size: 4 }),
+      pad(enableData[0], { size: 32 }),
       pad(toHex(enableData[1]), { size: 6 }),
       pad(toHex(enableData[2]), { size: 6 }),
       enableData[3],
+      pad(toHex(enableData[4]), { size: 32 }),
     ]);
     return (
       execDetail.validator.toLowerCase() ===
         this.validatorAddress.toLowerCase() &&
-      enableData[4] &&
-      enableDataHex.toLowerCase() === (await this.getEnableData()).toLowerCase()
+      enableDataHex.toLowerCase() ===
+        (
+          await this.getEnableData(kernelAccountAddress, enableData[4])
+        ).toLowerCase()
     );
   }
 
   async getDummyUserOpSignature(callData: Hex): Promise<Hex> {
-    const matchingPermission = this.findMatchingPermission(callData);
+    return concatHex([
+      await this.sessionKey.getAddress(),
+      DUMMY_ECDSA_SIG,
+      this.getEncodedPermissionProofData(callData),
+    ]);
+  }
+
+  private getEncodedPermissionProofData(callData: Hex): Hex {
+    const matchingPermission = this.findMatchingPermissions(callData);
     if (!matchingPermission && !this.shouldDelegateViaFallback()) {
       throw Error(
         "SessionKeyValidator: No matching permission found for the userOp"
@@ -520,20 +608,24 @@ export class SessionKeyValidator extends KernelBaseValidator {
       matchingPermission
         ? this.encodePermissionData(matchingPermission)
         : "0x";
-    const merkleProof = this.merkleTree.getHexProof(
-      keccak256(encodedPermissionData)
-    );
-    const encodedData =
-      this.sessionKeyData.permissions &&
+    let merkleProof: string[] | string[][] = [];
+    if (Array.isArray(matchingPermission)) {
+      let encodedPerms = matchingPermission.map((permission) =>
+        keccak256(this.encodePermissionData(permission))
+      );
+      merkleProof = encodedPerms.map((perm) =>
+        this.merkleTree.getHexProof(perm)
+      );
+    } else if (matchingPermission) {
+      merkleProof = this.merkleTree.getHexProof(
+        keccak256(encodedPermissionData)
+      );
+    }
+    return this.sessionKeyData.permissions &&
       this.sessionKeyData.permissions.length !== 0 &&
       matchingPermission
-        ? this.encodePermissionData(matchingPermission, merkleProof)
-        : "0x";
-    return concatHex([
-      await this.sessionKey.getAddress(),
-      DUMMY_ECDSA_SIG,
-      encodedData,
-    ]);
+      ? this.encodePermissionData(matchingPermission, merkleProof)
+      : "0x";
   }
 
   encodeEnable(sessionKeyEnableData: Hex): Hex {
@@ -574,31 +666,10 @@ export class SessionKeyValidator extends KernelBaseValidator {
     );
     const formattedMessage = typeof hash === "string" ? toBytes(hash) : hash;
 
-    const matchingPermission = this.findMatchingPermission(userOp.callData);
-    if (!matchingPermission && !this.shouldDelegateViaFallback()) {
-      throw Error(
-        "SessionKeyValidator: No matching permission found for the userOp"
-      );
-    }
-    const encodedPermissionData =
-      this.sessionKeyData.permissions &&
-      this.sessionKeyData.permissions.length !== 0 &&
-      matchingPermission
-        ? this.encodePermissionData(matchingPermission)
-        : "0x";
-    const merkleProof = this.merkleTree.getHexProof(
-      keccak256(encodedPermissionData)
-    );
-    const encodedData =
-      this.sessionKeyData.permissions &&
-      this.sessionKeyData.permissions.length !== 0 &&
-      matchingPermission
-        ? this.encodePermissionData(matchingPermission, merkleProof)
-        : "0x";
     const signature = concat([
       await this.sessionKey.getAddress(),
       await this.sessionKey.signMessage(formattedMessage),
-      encodedData,
+      this.getEncodedPermissionProofData(userOp.callData),
     ]);
     return signature;
   }

package/src/kernel-zerodev/validator/types.ts

@@ -120,7 +120,7 @@ export type GeneratePermissionFromArgsParameters<
   _FunctionName = TAbi extends Abi
     ? InferFunctionName<TAbi, TFunctionName>
     : never
-> = Pick<Permission, "operation" | "target" | "valueLimit"> & {
+> = Pick<Permission, "target" | "valueLimit"> & {
   functionName?: _FunctionName;
 } & (TFunctionName extends string
     ? { abi: Narrow<TAbi> } & GetFunctionArgs<TAbi, TFunctionName>

package/src/kernel-zerodev/validator-provider/base.ts

@@ -75,6 +75,19 @@ export abstract class ValidatorProvider<
       bundlerProvider,
     });
     this.defaultProvider = params.defaultProvider;
+    if (
+      (typeof params.opts?.providerConfig?.chain === "number" &&
+        typeof params.defaultProvider?.chain === "number" &&
+        params.opts?.providerConfig?.chain !== params.defaultProvider?.chain) ||
+      (typeof params.opts?.providerConfig?.chain === "object" &&
+        typeof params.defaultProvider?.chain === "object" &&
+        params.opts?.providerConfig?.chain.id !==
+          params.defaultProvider?.chain.id)
+    ) {
+      throw new Error(
+        "chainId mismatch between default provider and current provider - check projectIds"
+      );
+    }
     this.connect(
       () =>
         new KernelSmartContractAccount({