dequanto 0.0.1 → 0.1.3

package/test/fixtures/erc4337/samples/VerifyingPaymaster.sol

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: GPL-3.0
+pragma solidity ^0.8.12;
+
+/* solhint-disable reason-string */
+/* solhint-disable no-inline-assembly */
+
+import "../core/BasePaymaster.sol";
+import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
+/**
+ * A sample paymaster that uses external service to decide whether to pay for the UserOp.
+ * The paymaster trusts an external signer to sign the transaction.
+ * The calling user must pass the UserOp to that external signer first, which performs
+ * whatever off-chain verification before signing the UserOp.
+ * Note that this signature is NOT a replacement for the account-specific signature:
+ * - the paymaster checks a signature to agree to PAY for GAS.
+ * - the account checks a signature to prove identity and account ownership.
+ */
+contract VerifyingPaymaster is BasePaymaster {
+
+    using ECDSA for bytes32;
+    using UserOperationLib for UserOperation;
+
+    address public immutable verifyingSigner;
+
+    uint256 private constant VALID_TIMESTAMP_OFFSET = 20;
+
+    uint256 private constant SIGNATURE_OFFSET = 84;
+
+    constructor(IEntryPoint _entryPoint, address _verifyingSigner) BasePaymaster(_entryPoint) {
+        verifyingSigner = _verifyingSigner;
+    }
+
+    mapping(address => uint256) public senderNonce;
+
+    function pack(UserOperation calldata userOp) internal pure returns (bytes memory ret) {
+        // lighter signature scheme. must match UserOp.ts#packUserOp
+        bytes calldata pnd = userOp.paymasterAndData;
+        // copy directly the userOp from calldata up to (but not including) the paymasterAndData.
+        // this encoding depends on the ABI encoding of calldata, but is much lighter to copy
+        // than referencing each field separately.
+        assembly {
+            let ofs := userOp
+            let len := sub(sub(pnd.offset, ofs), 32)
+            ret := mload(0x40)
+            mstore(0x40, add(ret, add(len, 32)))
+            mstore(ret, len)
+            calldatacopy(add(ret, 32), ofs, len)
+        }
+    }
+
+    /**
+     * return the hash we're going to sign off-chain (and validate on-chain)
+     * this method is called by the off-chain service, to sign the request.
+     * it is called on-chain from the validatePaymasterUserOp, to validate the signature.
+     * note that this signature covers all fields of the UserOperation, except the "paymasterAndData",
+     * which will carry the signature itself.
+     */
+    function getHash(UserOperation calldata userOp, uint48 validUntil, uint48 validAfter)
+    public view returns (bytes32) {
+        //can't use userOp.hash(), since it contains also the paymasterAndData itself.
+
+        return keccak256(abi.encode(
+                pack(userOp),
+                block.chainid,
+                address(this),
+                senderNonce[userOp.getSender()],
+                validUntil,
+                validAfter
+            ));
+    }
+
+    /**
+     * verify our external signer signed this request.
+     * the "paymasterAndData" is expected to be the paymaster and a signature over the entire request params
+     * paymasterAndData[:20] : address(this)
+     * paymasterAndData[20:84] : abi.encode(validUntil, validAfter)
+     * paymasterAndData[84:] : signature
+     */
+    function _validatePaymasterUserOp(UserOperation calldata userOp, bytes32 /*userOpHash*/, uint256 requiredPreFund)
+    internal override returns (bytes memory context, uint256 validationData) {
+        (requiredPreFund);
+
+        (uint48 validUntil, uint48 validAfter, bytes calldata signature) = parsePaymasterAndData(userOp.paymasterAndData);
+        //ECDSA library supports both 64 and 65-byte long signatures.
+        // we only "require" it here so that the revert reason on invalid signature will be of "VerifyingPaymaster", and not "ECDSA"
+        require(signature.length == 64 || signature.length == 65, "VerifyingPaymaster: invalid signature length in paymasterAndData");
+        bytes32 hash = ECDSA.toEthSignedMessageHash(getHash(userOp, validUntil, validAfter));
+        senderNonce[userOp.getSender()]++;
+
+        //don't revert on signature failure: return SIG_VALIDATION_FAILED
+        if (verifyingSigner != ECDSA.recover(hash, signature)) {
+            return ("",_packValidationData(true,validUntil,validAfter));
+        }
+
+        //no need for other on-chain validation: entire UserOp should have been checked
+        // by the external service prior to signing it.
+        return ("",_packValidationData(false,validUntil,validAfter));
+    }
+
+    function parsePaymasterAndData(bytes calldata paymasterAndData) public pure returns(uint48 validUntil, uint48 validAfter, bytes calldata signature) {
+        (validUntil, validAfter) = abi.decode(paymasterAndData[VALID_TIMESTAMP_OFFSET:SIGNATURE_OFFSET],(uint48, uint48));
+        signature = paymasterAndData[SIGNATURE_OFFSET:];
+    }
+}

package/test/fixtures/erc4337/samples/bls/BLSAccount.sol

@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: GPL-3.0
+pragma solidity ^0.8.12;
+
+import "../SimpleAccount.sol";
+import "./IBLSAccount.sol";
+
+/**
+ * Minimal BLS-based account that uses an aggregated signature.
+ * The account must maintain its own BLS public key, and expose its trusted signature aggregator.
+ * Note that unlike the "standard" SimpleAccount, this account can't be called directly
+ * (normal SimpleAccount uses its "signer" address as both the ecrecover signer, and as a legitimate
+ * Ethereum sender address. Obviously, a BLS public key is not a valid Ethereum sender address.)
+ */
+contract BLSAccount is SimpleAccount, IBLSAccount {
+    address public immutable aggregator;
+    uint256[4] private publicKey;
+
+    // The constructor is used only for the "implementation" and only sets immutable values.
+    // Mutable value slots for proxy accounts are set by the 'initialize' function.
+    constructor(IEntryPoint anEntryPoint, address anAggregator) SimpleAccount(anEntryPoint)  {
+        aggregator = anAggregator;
+    }
+
+    /**
+     * The initializer for the BLSAccount instance.
+     * @param aPublicKey public key from a BLS keypair that will have a full ownership and control of this account.
+     */
+    function initialize(uint256[4] memory aPublicKey) public virtual initializer {
+        super._initialize(address(0));
+        _setBlsPublicKey(aPublicKey);
+    }
+
+    function _validateSignature(UserOperation calldata userOp, bytes32 userOpHash)
+    internal override view returns (uint256 validationData) {
+
+        (userOp, userOpHash);
+        if (userOp.initCode.length != 0) {
+            // BLSSignatureAggregator.getUserOpPublicKey() assumes that during account creation, the public key is
+            // the suffix of the initCode.
+            // The account MUST validate it
+            bytes32 pubKeyHash = keccak256(abi.encode(getBlsPublicKey()));
+            require(keccak256(userOp.initCode[userOp.initCode.length - 128 :]) == pubKeyHash, "wrong pubkey");
+        }
+        return _packValidationData(ValidationData(aggregator, 0,0));
+    }
+
+    /**
+     * Allows the owner to set or change the BLS key.
+     * @param newPublicKey public key from a BLS keypair that will have a full ownership and control of this account.
+     */
+    function setBlsPublicKey(uint256[4] memory newPublicKey) public onlyOwner {
+        _setBlsPublicKey(newPublicKey);
+    }
+
+    function _setBlsPublicKey(uint256[4] memory newPublicKey) internal {
+        emit PublicKeyChanged(publicKey, newPublicKey);
+        publicKey = newPublicKey;
+    }
+
+    /// @inheritdoc IBLSAccount
+    function getBlsPublicKey() public override view returns (uint256[4] memory) {
+        return publicKey;
+    }
+}

package/test/fixtures/erc4337/samples/bls/BLSAccountFactory.sol

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-3.0
+pragma solidity ^0.8.12;
+
+import "@openzeppelin/contracts/utils/Create2.sol";
+import "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
+
+import "../../interfaces/IEntryPoint.sol";
+import "./BLSAccount.sol";
+
+/* solhint-disable no-inline-assembly */
+
+/**
+ * Based on SimpleAccountFactory.
+ * Cannot be a subclass since both constructor and createAccount depend on the
+ * constructor and initializer of the actual account contract.
+ */
+contract BLSAccountFactory {
+    BLSAccount public immutable accountImplementation;
+
+    constructor(IEntryPoint entryPoint, address aggregator){
+        accountImplementation = new BLSAccount(entryPoint, aggregator);
+    }
+
+    /**
+     * create an account, and return its address.
+     * returns the address even if the account is already deployed.
+     * Note that during UserOperation execution, this method is called only if the account is not deployed.
+     * This method returns an existing account address so that entryPoint.getSenderAddress() would work even after account creation
+     * Also note that our BLSSignatureAggregator requires that the public key is the last parameter
+     */
+    function createAccount(uint256 salt, uint256[4] calldata aPublicKey) public returns (BLSAccount) {
+
+        // the BLSSignatureAggregator depends on the public-key being the last 4 uint256 of msg.data.
+        uint slot;
+        assembly {slot := aPublicKey}
+        require(slot == msg.data.length - 128, "wrong pubkey offset");
+
+        address addr = getAddress(salt, aPublicKey);
+        uint codeSize = addr.code.length;
+        if (codeSize > 0) {
+            return BLSAccount(payable(addr));
+        }
+        return BLSAccount(payable(new ERC1967Proxy{salt : bytes32(salt)}(
+                address(accountImplementation),
+                abi.encodeCall(BLSAccount.initialize, aPublicKey)
+            )));
+    }
+
+    /**
+     * calculate the counterfactual address of this account as it would be returned by createAccount()
+     */
+    function getAddress(uint256 salt, uint256[4] memory aPublicKey) public view returns (address) {
+        return Create2.computeAddress(bytes32(salt), keccak256(abi.encodePacked(
+                type(ERC1967Proxy).creationCode,
+                abi.encode(
+                    address(accountImplementation),
+                    abi.encodeCall(BLSAccount.initialize, (aPublicKey))
+                )
+            )));
+    }
+}

package/test/fixtures/erc4337/samples/bls/BLSHelper.sol

@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: GPL-3.0
+pragma solidity ^0.8.12;
+
+// code taken from : https://github.com/witnet/elliptic-curve-solidity/blob/master/contracts/EllipticCurve.sol
+// missing core functions from "thehubbleproject/bls": jacAdd (and sum)
+library  BLSHelper {
+
+    struct XY {
+        uint x;
+        uint y;
+    }
+    /**
+     * sum all the points in the array
+     * NOTE: the "ecAdd" (below) has a special case where x1==y2.
+     * @param points an array of bytes32[2], representing an (x,y) of a point
+     * @param _pp the modulus of the curve
+     * @return ret the sum of all points
+     */
+    function sum(XY[] memory points, uint256 _pp) internal pure returns (XY memory ret){
+        uint x = points[0].x;
+        uint y = points[0].y;
+        uint z = 1;
+
+        for (uint i = 1; i < points.length; i++) {
+            (x, y, z) = jacAdd(x, y, z, points[i].x, points[i].y, 1, _pp);
+        }
+        (x, y) = toAffine(x, y, z, _pp);
+        ret.x = x;
+        ret.y = y;
+    }
+
+    /// @dev Adds two points (x1, y1, z1) and (x2, y2, z2).
+    /// @param _x1 coordinate x of P1
+    /// @param _y1 coordinate y of P1
+    /// @param _z1 coordinate z of P1
+    /// @param _x2 coordinate x of square
+    /// @param _y2 coordinate y of square
+    /// @param _z2 coordinate z of square
+    /// @param _pp the modulus
+    /// @return (qx, qy, qz) P1+square in Jacobian
+    function jacAdd(
+        uint256 _x1,
+        uint256 _y1,
+        uint256 _z1,
+        uint256 _x2,
+        uint256 _y2,
+        uint256 _z2,
+        uint256 _pp)
+    internal pure returns (uint256, uint256, uint256)
+    {
+        if (_x1 == 0 && _y1 == 0)
+            return (_x2, _y2, _z2);
+        if (_x2 == 0 && _y2 == 0)
+            return (_x1, _y1, _z1);
+
+        // We follow the equations described in https://pdfs.semanticscholar.org/5c64/29952e08025a9649c2b0ba32518e9a7fb5c2.pdf Section 5
+        uint[4] memory zs;
+        // z1^2, z1^3, z2^2, z2^3
+        zs[0] = mulmod(_z1, _z1, _pp);
+        zs[1] = mulmod(_z1, zs[0], _pp);
+        zs[2] = mulmod(_z2, _z2, _pp);
+        zs[3] = mulmod(_z2, zs[2], _pp);
+
+        // u1, s1, u2, s2
+        zs = [
+        mulmod(_x1, zs[2], _pp),
+        mulmod(_y1, zs[3], _pp),
+        mulmod(_x2, zs[0], _pp),
+        mulmod(_y2, zs[1], _pp)
+        ];
+
+        // In case of zs[0] == zs[2] && zs[1] == zs[3], double function should be used
+        require(zs[0] != zs[2] || zs[1] != zs[3], "Use jacDouble function instead");
+
+        uint[4] memory hr;
+        //h
+        hr[0] = addmod(zs[2], _pp - zs[0], _pp);
+        //r
+        hr[1] = addmod(zs[3], _pp - zs[1], _pp);
+        //h^2
+        hr[2] = mulmod(hr[0], hr[0], _pp);
+        // h^3
+        hr[3] = mulmod(hr[2], hr[0], _pp);
+        // qx = -h^3  -2u1h^2+r^2
+        uint256 qx = addmod(mulmod(hr[1], hr[1], _pp), _pp - hr[3], _pp);
+        qx = addmod(qx, _pp - mulmod(2, mulmod(zs[0], hr[2], _pp), _pp), _pp);
+        // qy = -s1*z1*h^3+r(u1*h^2 -x^3)
+        uint256 qy = mulmod(hr[1], addmod(mulmod(zs[0], hr[2], _pp), _pp - qx, _pp), _pp);
+        qy = addmod(qy, _pp - mulmod(zs[1], hr[3], _pp), _pp);
+        // qz = h*z1*z2
+        uint256 qz = mulmod(hr[0], mulmod(_z1, _z2, _pp), _pp);
+        return (qx, qy, qz);
+    }
+
+
+    /// @dev Converts a point (x, y, z) expressed in Jacobian coordinates to affine coordinates (x', y', 1).
+    /// @param _x coordinate x
+    /// @param _y coordinate y
+    /// @param _z coordinate z
+    /// @param _pp the modulus
+    /// @return (x', y') affine coordinates
+    function toAffine(
+        uint256 _x,
+        uint256 _y,
+        uint256 _z,
+        uint256 _pp)
+    internal pure returns (uint256, uint256)
+    {
+        uint256 zInv = invMod(_z, _pp);
+        uint256 zInv2 = mulmod(zInv, zInv, _pp);
+        uint256 x2 = mulmod(_x, zInv2, _pp);
+        uint256 y2 = mulmod(_y, mulmod(zInv, zInv2, _pp), _pp);
+
+        return (x2, y2);
+    }
+
+
+    /// @dev Modular euclidean inverse of a number (mod p).
+    /// @param _x The number
+    /// @param _pp The modulus
+    /// @return q such that x*q = 1 (mod _pp)
+    function invMod(uint256 _x, uint256 _pp) internal pure returns (uint256) {
+        require(_x != 0 && _x != _pp && _pp != 0, "Invalid number");
+        uint256 q = 0;
+        uint256 newT = 1;
+        uint256 r = _pp;
+        uint256 t;
+        while (_x != 0) {
+            t = r / _x;
+            (q, newT) = (newT, addmod(q, (_pp - mulmod(t, newT, _pp)), _pp));
+            (r, _x) = (_x, r - t * _x);
+        }
+
+        return q;
+    }
+
+    /// @dev Doubles a point (x, y, z).
+    /// @param _x coordinate x of P1
+    /// @param _y coordinate y of P1
+    /// @param _z coordinate z of P1
+    /// @param _aa the a scalar in the curve equation
+    /// @param _pp the modulus
+    /// @return (qx, qy, qz) 2P in Jacobian
+    function jacDouble(
+        uint256 _x,
+        uint256 _y,
+        uint256 _z,
+        uint256 _aa,
+        uint256 _pp)
+    internal pure returns (uint256, uint256, uint256)
+    {
+        if (_z == 0)
+            return (_x, _y, _z);
+
+        // We follow the equations described in https://pdfs.semanticscholar.org/5c64/29952e08025a9649c2b0ba32518e9a7fb5c2.pdf Section 5
+        // Note: there is a bug in the paper regarding the m parameter, M=3*(x1^2)+a*(z1^4)
+        // x, y, z at this point represent the squares of _x, _y, _z
+        uint256 x = mulmod(_x, _x, _pp); //x1^2
+        uint256 y = mulmod(_y, _y, _pp); //y1^2
+        uint256 z = mulmod(_z, _z, _pp); //z1^2
+
+        // s
+        uint s = mulmod(4, mulmod(_x, y, _pp), _pp);
+        // m
+        uint m = addmod(mulmod(3, x, _pp), mulmod(_aa, mulmod(z, z, _pp), _pp), _pp);
+
+        // x, y, z at this point will be reassigned and rather represent qx, qy, qz from the paper
+        // This allows to reduce the gas cost and stack footprint of the algorithm
+        // qx
+        x = addmod(mulmod(m, m, _pp), _pp - addmod(s, s, _pp), _pp);
+        // qy = -8*y1^4 + M(S-T)
+        y = addmod(mulmod(m, addmod(s, _pp - x, _pp), _pp), _pp - mulmod(8, mulmod(y, y, _pp), _pp), _pp);
+        // qz = 2*y1*z1
+        z = mulmod(2, mulmod(_y, _z, _pp), _pp);
+
+        return (x, y, z);
+    }
+
+    /// @dev Add two points (x1, y1) and (x2, y2) in affine coordinates.
+    /// @param _x1 coordinate x of P1
+    /// @param _y1 coordinate y of P1
+    /// @param _x2 coordinate x of P2
+    /// @param _y2 coordinate y of P2
+    /// @param _aa constant of the curve
+    /// @param _pp the modulus
+    /// @return (qx, qy) = P1+P2 in affine coordinates
+    function ecAdd(
+        uint256 _x1,
+        uint256 _y1,
+        uint256 _x2,
+        uint256 _y2,
+        uint256 _aa,
+        uint256 _pp)
+    internal pure returns (uint256, uint256)
+    {
+        uint x = 0;
+        uint y = 0;
+        uint z = 0;
+
+        // Double if x1==x2 else add
+        if (_x1 == _x2) {
+            // y1 = -y2 mod p
+            if (addmod(_y1, _y2, _pp) == 0) {
+                return (0, 0);
+            } else {
+                // P1 = P2
+                (x, y, z) = jacDouble(
+                    _x1,
+                    _y1,
+                    1,
+                    _aa,
+                    _pp);
+            }
+        } else {
+            (x, y, z) = jacAdd(
+                _x1,
+                _y1,
+                1,
+                _x2,
+                _y2,
+                1,
+                _pp);
+        }
+        // Get back to affine
+        return toAffine(
+            x,
+            y,
+            z,
+            _pp);
+    }
+
+}

package/test/fixtures/erc4337/samples/bls/BLSSignatureAggregator.sol

@@ -0,0 +1,164 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity >=0.8.4 <0.9.0;
+pragma abicoder v2;
+
+import "../../interfaces/IAggregator.sol";
+import "../../interfaces/IEntryPoint.sol";
+import {BLSOpen} from  "./lib/BLSOpen.sol";
+import "./IBLSAccount.sol";
+import "./BLSHelper.sol";
+
+/**
+ * A BLS-based signature aggregator, to validate aggregated signature of multiple UserOps if BLSAccount
+ */
+contract BLSSignatureAggregator is IAggregator {
+    using UserOperationLib for UserOperation;
+
+    bytes32 public constant BLS_DOMAIN = keccak256("eip4337.bls.domain");
+
+     //copied from BLS.sol
+    uint256 public  constant N = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
+
+    /**
+     * @return publicKey - the public key from a BLS keypair the Aggregator will use to verify this UserOp;
+     *         normally public key will be queried from the deployed BLSAccount itself;
+     *         the public key will be read from the 'initCode' if the account is not deployed yet;
+     */
+    function getUserOpPublicKey(UserOperation memory userOp) public view returns (uint256[4] memory publicKey) {
+        bytes memory initCode = userOp.initCode;
+        if (initCode.length > 0) {
+            publicKey = getTrailingPublicKey(initCode);
+        } else {
+            return IBLSAccount(userOp.sender).getBlsPublicKey{gas : 50000}();
+        }
+    }
+
+    /**
+     * return the trailing 4 words of input data
+     */
+    function getTrailingPublicKey(bytes memory data) public pure returns (uint256[4] memory publicKey) {
+        uint len = data.length;
+        require(len > 32 * 4, "data too short for sig");
+
+        /* solhint-disable-next-line no-inline-assembly */
+        assembly {
+        // actual buffer starts at data+32, so last 128 bytes start at data+32+len-128 = data+len-96
+            let ofs := sub(add(data, len), 96)
+            mstore(publicKey, mload(ofs))
+            mstore(add(publicKey, 32), mload(add(ofs, 32)))
+            mstore(add(publicKey, 64), mload(add(ofs, 64)))
+            mstore(add(publicKey, 96), mload(add(ofs, 96)))
+        }
+    }
+
+    /// @inheritdoc IAggregator
+    function validateSignatures(UserOperation[] calldata userOps, bytes calldata signature)
+    external view override {
+        require(signature.length == 64, "BLS: invalid signature");
+        (uint256[2] memory blsSignature) = abi.decode(signature, (uint256[2]));
+
+        uint userOpsLen = userOps.length;
+        uint256[4][] memory blsPublicKeys = new uint256[4][](userOpsLen);
+        uint256[2][] memory messages = new uint256[2][](userOpsLen);
+        for (uint256 i = 0; i < userOpsLen; i++) {
+
+            UserOperation memory userOp = userOps[i];
+            blsPublicKeys[i] = getUserOpPublicKey(userOp);
+
+            messages[i] = _userOpToMessage(userOp, _getPublicKeyHash(blsPublicKeys[i]));
+        }
+        require(BLSOpen.verifyMultiple(blsSignature, blsPublicKeys, messages), "BLS: validateSignatures failed");
+    }
+
+    /**
+     * get a hash of userOp
+     * NOTE: this hash is not the same as UserOperation.hash()
+     *  (slightly less efficient, since it uses memory userOp)
+     */
+    function internalUserOpHash(UserOperation memory userOp) internal pure returns (bytes32) {
+        return keccak256(abi.encode(
+                userOp.sender,
+                userOp.nonce,
+                keccak256(userOp.initCode),
+                keccak256(userOp.callData),
+                userOp.callGasLimit,
+                userOp.verificationGasLimit,
+                userOp.preVerificationGas,
+                userOp.maxFeePerGas,
+                userOp.maxPriorityFeePerGas,
+                keccak256(userOp.paymasterAndData)
+            ));
+    }
+
+    /**
+     * return the BLS "message" for the given UserOp.
+     * the account checks the signature over this value using its public key
+     */
+    function userOpToMessage(UserOperation memory userOp) public view returns (uint256[2] memory) {
+        bytes32 publicKeyHash = _getPublicKeyHash(getUserOpPublicKey(userOp));
+        return _userOpToMessage(userOp, publicKeyHash);
+    }
+
+    function _userOpToMessage(UserOperation memory userOp, bytes32 publicKeyHash) internal view returns (uint256[2] memory) {
+        bytes32 userOpHash = _getUserOpHash(userOp, publicKeyHash);
+        return BLSOpen.hashToPoint(BLS_DOMAIN, abi.encodePacked(userOpHash));
+    }
+
+    // helper for test
+    function getUserOpHash(UserOperation memory userOp) public view returns (bytes32) {
+        bytes32 publicKeyHash = _getPublicKeyHash(getUserOpPublicKey(userOp));
+        return _getUserOpHash(userOp, publicKeyHash);
+    }
+
+    function _getUserOpHash(UserOperation memory userOp, bytes32 publicKeyHash) internal view returns (bytes32) {
+        return keccak256(abi.encode(internalUserOpHash(userOp), publicKeyHash, address(this), block.chainid));
+    }
+
+    function _getPublicKeyHash(uint256[4] memory publicKey) internal pure returns(bytes32) {
+        return keccak256(abi.encode(publicKey));
+    }
+    /**
+     * validate signature of a single userOp
+     * This method is called after EntryPoint.simulateValidation() returns an aggregator.
+     * First it validates the signature over the userOp. then it return data to be used when creating the handleOps:
+     * @param userOp the userOperation received from the user.
+     * @return sigForUserOp the value to put into the signature field of the userOp when calling handleOps.
+     *    (usually empty, unless account and aggregator support some kind of "multisig"
+     */
+    function validateUserOpSignature(UserOperation calldata userOp)
+    external view returns (bytes memory sigForUserOp) {
+        uint256[2] memory signature = abi.decode(userOp.signature, (uint256[2]));
+        uint256[4] memory pubkey = getUserOpPublicKey(userOp);
+        uint256[2] memory message = _userOpToMessage(userOp, _getPublicKeyHash(pubkey));
+
+        require(BLSOpen.verifySingle(signature, pubkey, message), "BLS: wrong sig");
+        return "";
+    }
+
+
+    /**
+     * aggregate multiple signatures into a single value.
+     * This method is called off-chain to calculate the signature to pass with handleOps()
+     * bundler MAY use optimized custom code perform this aggregation
+     * @param userOps array of UserOperations to collect the signatures from.
+     * @return aggregatedSignature the aggregated signature
+     */
+    function aggregateSignatures(UserOperation[] calldata userOps) external pure returns (bytes memory aggregatedSignature) {
+        BLSHelper.XY[] memory points = new BLSHelper.XY[](userOps.length);
+        for (uint i = 0; i < points.length; i++) {
+            (uint256 x, uint256 y) = abi.decode(userOps[i].signature, (uint256, uint256));
+            points[i] = BLSHelper.XY(x, y);
+        }
+        BLSHelper.XY memory sum = BLSHelper.sum(points, N);
+        return abi.encode(sum.x, sum.y);
+    }
+
+    /**
+     * allow staking for this aggregator
+     * there is no limit on stake or delay, but it is not a problem, since it is a permissionless
+     * signature aggregator, which doesn't support unstaking.
+     */
+    function addStake(IEntryPoint entryPoint, uint32 delay) external payable {
+        entryPoint.addStake{value : msg.value}(delay);
+    }
+}

package/test/fixtures/erc4337/samples/bls/IBLSAccount.sol

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity >=0.7.6;
+
+import "../../interfaces/IAccount.sol";
+
+/**
+ * a BLS account should expose its own public key.
+ */
+interface IBLSAccount is IAccount {
+    event PublicKeyChanged(uint256[4] oldPublicKey, uint256[4] newPublicKey);
+
+    /**
+     * @return public key from a BLS keypair that is used to verify the BLS signature, both separately and aggregated.
+     */
+    function getBlsPublicKey() external view returns (uint256[4] memory);
+}