ox 0.14.37 → 0.14.39

package/tempo/MultisigOperation.test.ts

@@ -1,4 +1,4 @@
-import { Address, P256 } from 'ox'
+import { Address, Hash, P256 } from 'ox'
 import {
   KeyAuthorization,
   MultisigConfig,
@@ -10,11 +10,14 @@ import { describe, expect, test } from 'vitest'
 
 const owners = [1n, 2n, 3n]
   .map((value, index) => {
+    const privateKey = `0x${value.toString(16).padStart(64, '0')}` as const
     const publicKey = P256.getPublicKey({
-      privateKey: `0x${value.toString(16).padStart(64, '0')}`,
+      privateKey,
     })
     return {
       address: Address.fromPublicKey(publicKey),
+      privateKey,
+      publicKey,
       signature: {
         prehash: false,
         publicKey,
@@ -33,6 +36,7 @@ const config = MultisigConfig.from({
   ],
   threshold: 2,
 })
+const initializedConfig = MultisigConfig.from({ ...config, version: 1n })
 const account = MultisigConfig.getAddress(config)
 const ownerSignature_1 = owners[0]!.signature
 const approval_1 = SignatureEnvelope.serialize(ownerSignature_1)
@@ -59,23 +63,23 @@ const keyAuthorization = KeyAuthorization.serialize(
 
 const transactionHash_ = MultisigConfig.getSignPayload({
   account,
+  config: initializedConfig,
   payload: TxEnvelopeTempo.getSignPayload(
     TxEnvelopeTempo.deserialize(transaction),
   ),
-  version: 1n,
 })
 const keyAuthorizationHash = MultisigConfig.getSignPayload({
   account,
+  config: initializedConfig,
   payload: KeyAuthorization.getSignPayload(
     KeyAuthorization.deserialize(keyAuthorization),
   ),
-  version: 1n,
 })
 
 const base = {
   account,
   approvals: [approval_1],
-  config,
+  config: initializedConfig,
   configVersion: 1n,
   createdAt: 1,
   init: false,
@@ -101,6 +105,701 @@ const keyAuthorizationPending = {
   type: 'keyAuthorization',
 } as const
 
+function signApproval(
+  owner: (typeof owners)[number],
+  hash: `0x${string}`,
+  extraEntropy: false | `0x${string}` = false,
+) {
+  return SignatureEnvelope.serialize({
+    prehash: false,
+    publicKey: owner.publicKey,
+    signature: P256.sign({
+      extraEntropy,
+      payload: hash,
+      privateKey: owner.privateKey,
+    }),
+    type: 'p256',
+  })
+}
+
+function approvalAddresses(
+  approvals: readonly `0x${string}`[],
+  hash: `0x${string}`,
+) {
+  return approvals.map((approval) =>
+    SignatureEnvelope.extractAddress({
+      payload: hash,
+      signature: SignatureEnvelope.deserialize(approval),
+    }),
+  )
+}
+
+describe('getHash', () => {
+  test('transaction and key authorization', () => {
+    expect({
+      keyAuthorization: MultisigOperation.getHash({
+        account,
+        configVersion: 1n,
+        keyAuthorization,
+        type: 'keyAuthorization',
+      }),
+      transaction: MultisigOperation.getHash({
+        account,
+        configVersion: 1n,
+        transaction,
+        type: 'transaction',
+      }),
+    }).toMatchInlineSnapshot(`
+      {
+        "keyAuthorization": "0xf6995eb69c12c03d3d13b357abf7cac22b4effe52fba8ff02e5aef26161f77a0",
+        "transaction": "0xcdbc24a8fb192f799c5d166b13a99fb29cbb15e71a5e730988d6f8b3c5959d02",
+      }
+    `)
+  })
+})
+
+describe('selectApprovals', () => {
+  test('selects a deterministic weighted quorum', async () => {
+    const config = MultisigConfig.from({
+      owners: [
+        { owner: owners[0]!.address, weight: 2 },
+        { owner: owners[1]!.address, weight: 1 },
+        { owner: owners[2]!.address, weight: 1 },
+      ],
+      threshold: 3,
+    })
+    const account = MultisigConfig.getAddress(config)
+    const hash = MultisigOperation.getHash({
+      account,
+      configVersion: 1n,
+      transaction,
+      type: 'transaction',
+    })
+    const approvals = owners.map((owner) => signApproval(owner, hash))
+    const alternate = signApproval(owners[0]!, hash, `0x${'01'.repeat(32)}`)
+    const selection = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [
+        approvals[2]!,
+        approvals[0]!,
+        approvals[1]!,
+        alternate,
+        approvals[0]!,
+      ],
+      config,
+      hash,
+    })
+    const reversed = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [
+        approvals[0]!,
+        alternate,
+        approvals[1]!,
+        approvals[0]!,
+        approvals[2]!,
+      ],
+      config,
+      hash,
+    })
+
+    expect(reversed).toStrictEqual(selection)
+    expect({
+      ...selection,
+      approvals: approvalAddresses(selection.approvals, hash),
+      selectedApprovals: approvalAddresses(selection.selectedApprovals, hash),
+    }).toMatchInlineSnapshot(`
+      {
+        "approvals": [
+          "0x07e1ed8ea0e9601e5546b0a03aed683df3601407",
+          "0x288f0cd85005f34168f731a468aef268c2f9456f",
+          "0xd3a9f047ad43d7e2e4e7e491f1fe2e657a2651b6",
+        ],
+        "selectedApprovals": [
+          "0x07e1ed8ea0e9601e5546b0a03aed683df3601407",
+          "0x288f0cd85005f34168f731a468aef268c2f9456f",
+        ],
+        "signatureCount": 2,
+        "threshold": 3,
+        "weight": 3,
+      }
+    `)
+  })
+
+  test('counts a nested owner only after its quorum', async () => {
+    const childConfig = MultisigConfig.from({
+      owners: [
+        { owner: owners[1]!.address, weight: 1 },
+        { owner: owners[2]!.address, weight: 1 },
+      ],
+      threshold: 2,
+    })
+    const child = MultisigConfig.getAddress(childConfig)
+    const config = MultisigConfig.from({
+      owners: [
+        { owner: owners[0]!.address, weight: 1 },
+        { owner: child, weight: 2 },
+      ],
+      threshold: 2,
+    })
+    const account = MultisigConfig.getAddress(config)
+    const hash = MultisigOperation.getHash({
+      account,
+      configVersion: 1n,
+      transaction,
+      type: 'transaction',
+    })
+    const childHash = MultisigConfig.getSignPayload({
+      account: child,
+      config: { version: 2n },
+      payload: hash,
+    })
+    const childApprovals = [
+      signApproval(owners[1]!, childHash),
+      signApproval(owners[2]!, childHash),
+    ]
+    const rootApproval = signApproval(owners[0]!, hash)
+    const resolveConfig: MultisigOperation.selectApprovals.ResolveConfig = ({
+      account,
+    }) => {
+      if (!Address.isEqual(account, child)) throw new Error('unknown account')
+      return { config: childConfig, version: 2n }
+    }
+    const partial = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [
+        rootApproval,
+        SignatureEnvelope.serialize({
+          account: child,
+          config: MultisigConfig.from({ ...childConfig, version: 2n }),
+          signatures: [SignatureEnvelope.deserialize(childApprovals[0]!)],
+          type: 'multisig',
+        }),
+      ],
+      config,
+      hash,
+      resolveConfig,
+    })
+    const complete = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [
+        rootApproval,
+        SignatureEnvelope.serialize({
+          account: child,
+          config: MultisigConfig.from({ ...childConfig, version: 2n }),
+          signatures: childApprovals.map((approval) =>
+            SignatureEnvelope.deserialize(approval),
+          ),
+          type: 'multisig',
+        }),
+      ],
+      config,
+      hash,
+      resolveConfig,
+    })
+
+    expect({
+      complete: {
+        ...complete,
+        approvals: approvalAddresses(complete.approvals, hash),
+        selectedApprovals: approvalAddresses(complete.selectedApprovals, hash),
+      },
+      partial: {
+        ...partial,
+        approvals: approvalAddresses(partial.approvals, hash),
+        selectedApprovals: approvalAddresses(partial.selectedApprovals, hash),
+      },
+    }).toMatchInlineSnapshot(`
+      {
+        "complete": {
+          "approvals": [
+            "0x07e1ed8ea0e9601e5546b0a03aed683df3601407",
+            "0xe2d2c3c2fc4b17af341cc5c1a459af9606167e8a",
+          ],
+          "selectedApprovals": [
+            "0xe2d2c3c2fc4b17af341cc5c1a459af9606167e8a",
+          ],
+          "signatureCount": 1,
+          "threshold": 2,
+          "weight": 2,
+        },
+        "partial": {
+          "approvals": [
+            "0x07e1ed8ea0e9601e5546b0a03aed683df3601407",
+            "0xe2d2c3c2fc4b17af341cc5c1a459af9606167e8a",
+          ],
+          "selectedApprovals": [
+            "0x07e1ed8ea0e9601e5546b0a03aed683df3601407",
+          ],
+          "signatureCount": 1,
+          "threshold": 2,
+          "weight": 1,
+        },
+      }
+    `)
+  })
+
+  test('rejects invalid and non-owner approvals', async () => {
+    const hash = MultisigOperation.getHash({
+      account,
+      configVersion: 1n,
+      transaction,
+      type: 'transaction',
+    })
+    const invalid = signApproval(
+      owners[0]!,
+      `0x${'ff'.repeat(32)}` as `0x${string}`,
+    )
+    const nonOwner = signApproval(owners[2]!, hash)
+
+    await expect(
+      MultisigOperation.selectApprovals({
+        account,
+        approvals: [invalid],
+        config,
+        hash,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: signature from owner 0x07e1ed8ea0e9601e5546b0a03aed683df3601407 is invalid.]`,
+    )
+    await expect(
+      MultisigOperation.selectApprovals({
+        account,
+        approvals: [nonOwner],
+        config,
+        hash,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: signature is from non-owner 0xd3a9f047ad43d7e2e4e7e491f1fe2e657a2651b6.]`,
+    )
+  })
+
+  test('requires a resolver for nested owners', async () => {
+    const childConfig = MultisigConfig.from({
+      owners: [{ owner: owners[1]!.address, weight: 1 }],
+      threshold: 1,
+    })
+    const child = MultisigConfig.getAddress(childConfig)
+    const config = MultisigConfig.from({
+      owners: [{ owner: child, weight: 1 }],
+      threshold: 1,
+    })
+    const account = MultisigConfig.getAddress(config)
+    const hash = MultisigOperation.getHash({
+      account,
+      configVersion: 1n,
+      transaction,
+      type: 'transaction',
+    })
+    const childHash = MultisigConfig.getSignPayload({
+      account: child,
+      config: { version: 1n },
+      payload: hash,
+    })
+
+    await expect(
+      MultisigOperation.selectApprovals({
+        account,
+        approvals: [
+          SignatureEnvelope.serialize({
+            account: child,
+            config: MultisigConfig.from({ ...childConfig, version: 1n }),
+            signatures: [
+              SignatureEnvelope.deserialize(
+                signApproval(owners[1]!, childHash),
+              ),
+            ],
+            type: 'multisig',
+          }),
+        ],
+        config,
+        hash,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: nested multisig owner 0x7888d60e9cc26c8569d394fce435c248f1e49c3b requires a config resolver.]`,
+    )
+  })
+
+  test('rejects keychain and accepts initial nested approvals', async () => {
+    const childConfig = MultisigConfig.from({
+      owners: [{ owner: owners[1]!.address, weight: 1 }],
+      threshold: 1,
+    })
+    const child = MultisigConfig.getAddress(childConfig)
+    const config = MultisigConfig.from({
+      owners: [
+        { owner: owners[0]!.address, weight: 1 },
+        { owner: child, weight: 1 },
+      ],
+      threshold: 1,
+    })
+    const account = MultisigConfig.getAddress(config)
+    const hash = MultisigOperation.getHash({
+      account,
+      configVersion: 1n,
+      transaction,
+      type: 'transaction',
+    })
+    const childHash = MultisigConfig.getSignPayload({
+      account: child,
+      config: childConfig,
+      payload: hash,
+    })
+
+    await expect(
+      MultisigOperation.selectApprovals({
+        account,
+        approvals: [
+          SignatureEnvelope.serialize({
+            inner: SignatureEnvelope.deserialize(
+              signApproval(owners[0]!, hash),
+            ),
+            type: 'keychain',
+            userAddress: owners[0]!.address,
+          }),
+        ],
+        config,
+        hash,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: keychain signatures cannot approve a multisig operation.]`,
+    )
+    const selection = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [
+        SignatureEnvelope.serialize({
+          account: child,
+          config: childConfig,
+          signatures: [
+            SignatureEnvelope.deserialize(signApproval(owners[1]!, childHash)),
+          ],
+          type: 'multisig',
+        }),
+      ],
+      config,
+      hash,
+      resolveConfig: () => ({ config: childConfig, version: 0n }),
+    })
+    expect({
+      signatureCount: selection.signatureCount,
+      threshold: selection.threshold,
+      weight: selection.weight,
+    }).toMatchInlineSnapshot(`
+      {
+        "signatureCount": 1,
+        "threshold": 1,
+        "weight": 1,
+      }
+    `)
+  })
+
+  test('rejects nested account cycles while serializing', () => {
+    const config = MultisigConfig.from({
+      owners: [{ owner: account, weight: 1 }],
+      threshold: 1,
+    })
+    const hash = MultisigOperation.getHash({
+      account,
+      configVersion: 2n,
+      transaction,
+      type: 'transaction',
+    })
+    const nestedHash = MultisigConfig.getSignPayload({
+      account,
+      config: { version: 2n },
+      payload: hash,
+    })
+
+    expect(() =>
+      SignatureEnvelope.serialize({
+        account,
+        config: MultisigConfig.from({ ...config, version: 2n }),
+        signatures: [
+          SignatureEnvelope.deserialize(signApproval(owners[0]!, nestedHash)),
+        ],
+        type: 'multisig',
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: multisig account cannot be an owner.]`,
+    )
+  })
+
+  test('rejects excess nesting depth', async () => {
+    const grandchildConfig = MultisigConfig.from({
+      owners: [{ owner: owners[2]!.address, weight: 1 }],
+      threshold: 1,
+    })
+    const grandchild = MultisigConfig.getAddress(grandchildConfig)
+    const childConfig = MultisigConfig.from({
+      owners: [{ owner: grandchild, weight: 1 }],
+      threshold: 1,
+    })
+    const child = MultisigConfig.getAddress(childConfig)
+    const config = MultisigConfig.from({
+      owners: [{ owner: child, weight: 1 }],
+      threshold: 1,
+    })
+    const account = MultisigConfig.getAddress(config)
+    const hash = MultisigOperation.getHash({
+      account,
+      configVersion: 1n,
+      transaction,
+      type: 'transaction',
+    })
+    const childHash = MultisigConfig.getSignPayload({
+      account: child,
+      config: { version: 1n },
+      payload: hash,
+    })
+    const grandchildHash = MultisigConfig.getSignPayload({
+      account: grandchild,
+      config: { version: 1n },
+      payload: childHash,
+    })
+
+    await expect(
+      MultisigOperation.selectApprovals({
+        account,
+        approvals: [
+          SignatureEnvelope.serialize({
+            account: child,
+            config: MultisigConfig.from({ ...childConfig, version: 1n }),
+            signatures: [
+              {
+                account: grandchild,
+                config: MultisigConfig.from({
+                  ...grandchildConfig,
+                  version: 1n,
+                }),
+                signatures: [
+                  SignatureEnvelope.deserialize(
+                    signApproval(owners[2]!, grandchildHash),
+                  ),
+                ],
+                type: 'multisig',
+              },
+            ],
+            type: 'multisig',
+          }),
+        ],
+        config,
+        hash,
+        resolveConfig: ({ account }) => {
+          if (Address.isEqual(account, child))
+            return { config: childConfig, version: 1n }
+          return { config: grandchildConfig, version: 1n }
+        },
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: nested multisig owner 0xf529c8f6b2b4c72102af4cfe5eeb55b7d45dede2 is invalid.]`,
+    )
+  })
+})
+
+describe('serializeTransaction', () => {
+  test('initialized and bootstrap transactions', async () => {
+    const results = []
+    for (const init of [false, true]) {
+      const configVersion = init ? 0n : 1n
+      const hash = MultisigOperation.getHash({
+        account,
+        configVersion,
+        transaction,
+        type: 'transaction',
+      })
+      const selection = await MultisigOperation.selectApprovals({
+        account,
+        approvals: [
+          signApproval(owners[1]!, hash),
+          signApproval(owners[0]!, hash),
+        ],
+        config,
+        hash,
+      })
+      const operation = MultisigOperation.from({
+        account,
+        approvals: selection.approvals,
+        config,
+        configVersion,
+        createdAt: 1,
+        hash,
+        init,
+        signatureCount: selection.signatureCount,
+        status: 'pending',
+        threshold: selection.threshold,
+        transaction,
+        type: 'transaction',
+        updatedAt: 1,
+        weight: selection.weight,
+      })
+      const serialized = MultisigOperation.serializeTransaction(operation, {
+        approvals: selection.selectedApprovals,
+      })
+      const value = TxEnvelopeTempo.deserialize(serialized)
+      results.push({
+        account: value.signature?.account,
+        configVersion:
+          value.signature?.type === 'multisig'
+            ? value.signature.config.version
+            : undefined,
+        hash: Hash.keccak256(serialized),
+        signatureCount:
+          value.signature?.type === 'multisig'
+            ? value.signature.signatures.length
+            : 0,
+        type: serialized.slice(0, 4),
+      })
+    }
+
+    expect(results).toMatchInlineSnapshot(`
+      [
+        {
+          "account": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
+          "configVersion": 1n,
+          "hash": "0x8309740edaf304284186f7bcfe4527745cd4eb48e7441795ebdd970798091f8f",
+          "signatureCount": 2,
+          "type": "0x76",
+        },
+        {
+          "account": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
+          "configVersion": 0n,
+          "hash": "0x636af84d8445d87cbcd33039d5a3a2274a5911036b1b7ceb740ac41e2f638611",
+          "signatureCount": 2,
+          "type": "0x76",
+        },
+      ]
+    `)
+  })
+
+  test('fee-payer transactions', async () => {
+    const envelope = TxEnvelopeTempo.from({
+      calls: [{ data: '0x1234', to: owner_1 }],
+      chainId: 4217,
+    })
+    const transactions = [
+      TxEnvelopeTempo.serialize(envelope, {
+        format: 'feePayer',
+        sender: account,
+      }),
+      TxEnvelopeTempo.serialize(
+        {
+          ...envelope,
+          feePayerSignature: { r: 5n, s: 6n, yParity: 0 },
+        },
+        { format: 'feePayer' },
+      ),
+    ] as const
+    const results = []
+    for (const transaction of transactions) {
+      const hash = MultisigOperation.getHash({
+        account,
+        configVersion: 1n,
+        transaction,
+        type: 'transaction',
+      })
+      const selection = await MultisigOperation.selectApprovals({
+        account,
+        approvals: [
+          signApproval(owners[0]!, hash),
+          signApproval(owners[1]!, hash),
+        ],
+        config,
+        hash,
+      })
+      const serialized = MultisigOperation.serializeTransaction(
+        MultisigOperation.from({
+          account,
+          approvals: selection.approvals,
+          config,
+          configVersion: 1n,
+          createdAt: 1,
+          hash,
+          init: false,
+          signatureCount: selection.signatureCount,
+          status: 'pending',
+          threshold: selection.threshold,
+          transaction,
+          type: 'transaction',
+          updatedAt: 1,
+          weight: selection.weight,
+        }),
+        { approvals: selection.selectedApprovals },
+      )
+      const value = TxEnvelopeTempo.deserialize(serialized)
+      results.push({
+        feePayerSignature: value.feePayerSignature,
+        from: value.from,
+        signatureCount:
+          value.signature?.type === 'multisig'
+            ? value.signature.signatures.length
+            : 0,
+        type: serialized.slice(0, 4),
+      })
+    }
+
+    expect(results).toMatchInlineSnapshot(`
+      [
+        {
+          "feePayerSignature": null,
+          "from": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
+          "signatureCount": 2,
+          "type": "0x78",
+        },
+        {
+          "feePayerSignature": {
+            "r": 5n,
+            "s": 6n,
+            "yParity": 0,
+          },
+          "from": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
+          "signatureCount": 2,
+          "type": "0x78",
+        },
+      ]
+    `)
+  })
+
+  test('rejects an approval not retained by the operation', async () => {
+    const hash = MultisigOperation.getHash({
+      account,
+      configVersion: 1n,
+      transaction,
+      type: 'transaction',
+    })
+    const approval_1 = signApproval(owners[0]!, hash)
+    const approval_2 = signApproval(owners[1]!, hash)
+    const selection = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [approval_1],
+      config,
+      hash,
+    })
+    const operation = MultisigOperation.from({
+      account,
+      approvals: selection.approvals,
+      config,
+      configVersion: 1n,
+      createdAt: 1,
+      hash,
+      init: false,
+      signatureCount: selection.signatureCount,
+      status: 'pending',
+      threshold: selection.threshold,
+      transaction,
+      type: 'transaction',
+      updatedAt: 1,
+      weight: selection.weight,
+    })
+
+    expect(() =>
+      MultisigOperation.serializeTransaction(operation, {
+        approvals: [approval_2],
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidOperationError: Invalid multisig operation: transaction signature is not a retained approval.]`,
+    )
+  })
+})
+
 describe('from', () => {
   test('transaction states', () => {
     const pending = MultisigOperation.from(transactionPending)
@@ -142,6 +841,7 @@ describe('from', () => {
             ],
             "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
             "threshold": 2,
+            "version": 1n,
           },
           "configVersion": 1n,
           "createdAt": 1,
@@ -174,6 +874,7 @@ describe('from', () => {
             ],
             "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
             "threshold": 2,
+            "version": 1n,
           },
           "configVersion": 1n,
           "createdAt": 1,
@@ -208,6 +909,7 @@ describe('from', () => {
             ],
             "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
             "threshold": 2,
+            "version": 1n,
           },
           "configVersion": 1n,
           "createdAt": 1,
@@ -238,10 +940,10 @@ describe('from', () => {
       ...transactionPending,
       hash: MultisigConfig.getSignPayload({
         account,
+        config: initializedConfig,
         payload: TxEnvelopeTempo.getSignPayload(
           TxEnvelopeTempo.deserialize(transaction),
         ),
-        version: 1n,
       }),
       transaction,
     })
@@ -270,6 +972,7 @@ describe('from', () => {
           ],
           "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
           "threshold": 2,
+          "version": 1n,
         },
         "configVersion": 1n,
         "createdAt": 1,
@@ -300,10 +1003,10 @@ describe('from', () => {
       ...transactionPending,
       hash: MultisigConfig.getSignPayload({
         account,
+        config: initializedConfig,
         payload: TxEnvelopeTempo.getSignPayload(
           TxEnvelopeTempo.deserialize(transaction),
         ),
-        version: 1n,
       }),
       transaction,
     })
@@ -317,10 +1020,10 @@ describe('from', () => {
       configVersion: 0n,
       hash: MultisigConfig.getSignPayload({
         account,
+        config,
         payload: TxEnvelopeTempo.getSignPayload(
           TxEnvelopeTempo.deserialize(transaction),
         ),
-        version: 0n,
       }),
       init: true,
     })
@@ -349,6 +1052,7 @@ describe('from', () => {
           ],
           "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
           "threshold": 2,
+          "version": 0n,
         },
         "configVersion": 0n,
         "createdAt": 1,
@@ -372,10 +1076,10 @@ describe('from', () => {
       configVersion: 0n,
       hash: MultisigConfig.getSignPayload({
         account,
+        config,
         payload: TxEnvelopeTempo.getSignPayload(
           TxEnvelopeTempo.deserialize(transaction),
         ),
-        version: 0n,
       }),
     })
 
@@ -400,6 +1104,7 @@ describe('from', () => {
         KeyAuthorization.from(authorization, {
           signature: {
             account,
+            config: initializedConfig,
             signatures: [
               SignatureEnvelope.deserialize(approval_1),
               SignatureEnvelope.deserialize(approval_2),
@@ -433,6 +1138,7 @@ describe('from', () => {
             ],
             "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
             "threshold": 2,
+            "version": 1n,
           },
           "configVersion": 1n,
           "createdAt": 1,
@@ -465,12 +1171,13 @@ describe('from', () => {
             ],
             "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
             "threshold": 2,
+            "version": 1n,
           },
           "configVersion": 1n,
           "createdAt": 1,
           "hash": "0xf6995eb69c12c03d3d13b357abf7cac22b4effe52fba8ff02e5aef26161f77a0",
           "init": false,
-          "keyAuthorization": "0xf9015ff782107980943333333333333333333333333333333333333333846b49d2008080808094f81b7763d3a6876195d780865bd783dbd97dd36eb9012405f9012094f81b7763d3a6876195d780865bd783dbd97dd36ef90108b88201000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200b88201000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
+          "keyAuthorization": "0xf901b3f782107980943333333333333333333333333333333333333333846b49d2008080808094f81b7763d3a6876195d780865bd783dbd97dd36eb9017805f9017494f81b7763d3a6876195d780865bd783dbd97dd36ef852a000000000000000000000000000000000000000000000000000000000000000000102eed69407e1ed8ea0e9601e5546b0a03aed683df360140701d694288f0cd85005f34168f731a468aef268c2f9456f01f90108b88201000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200b88201000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
           "signatureCount": 2,
           "status": "success",
           "threshold": 2,
@@ -488,7 +1195,7 @@ describe('from', () => {
       KeyAuthorization.from(authorization, {
         signature: {
           account,
-          init: config,
+          config,
           signatures: [
             SignatureEnvelope.deserialize(approval_1),
             SignatureEnvelope.deserialize(approval_2),
@@ -503,8 +1210,8 @@ describe('from', () => {
       configVersion: 0n,
       hash: MultisigConfig.getSignPayload({
         account,
+        config,
         payload: KeyAuthorization.getSignPayload(authorization),
-        version: 0n,
       }),
       init: true,
       keyAuthorization: keyAuthorization_,
@@ -538,6 +1245,7 @@ describe('from', () => {
           ],
           "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
           "threshold": 2,
+          "version": 0n,
         },
         "configVersion": 0n,
         "createdAt": 1,
@@ -561,6 +1269,9 @@ describe('RPC conversion', () => {
     const transactionRpc = MultisigOperation.toRpc(transactionPending)
     const keyAuthorizationRpc = MultisigOperation.toRpc(keyAuthorizationPending)
 
+    expect(() =>
+      JSON.stringify({ keyAuthorizationRpc, transactionRpc }),
+    ).not.toThrow()
     expect({ keyAuthorizationRpc, transactionRpc }).toMatchInlineSnapshot(`
       {
         "keyAuthorizationRpc": {
@@ -581,6 +1292,7 @@ describe('RPC conversion', () => {
             ],
             "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
             "threshold": 2,
+            "version": "0x1",
           },
           "configVersion": "0x1",
           "createdAt": 1,
@@ -612,6 +1324,7 @@ describe('RPC conversion', () => {
             ],
             "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
             "threshold": 2,
+            "version": "0x1",
           },
           "configVersion": "0x1",
           "createdAt": 1,
@@ -749,10 +1462,10 @@ describe('validation', () => {
         account: '0x0000000000000000000000000000000000000000',
         hash: MultisigConfig.getSignPayload({
           account: '0x0000000000000000000000000000000000000000',
+          config: initializedConfig,
           payload: TxEnvelopeTempo.getSignPayload(
             TxEnvelopeTempo.deserialize(transaction),
           ),
-          version: 1n,
         }),
       },
     },
@@ -822,7 +1535,7 @@ describe('validation', () => {
         approvals: [
           SignatureEnvelope.serialize({
             account,
-            init: config,
+            config,
             signatures: [ownerSignature_1],
             type: 'multisig',
           }),
@@ -859,6 +1572,7 @@ describe('validation', () => {
         KeyAuthorization.from(authorization, {
           signature: {
             account,
+            config: initializedConfig,
             signatures: [
               SignatureEnvelope.deserialize(approval_1),
               SignatureEnvelope.deserialize(approval_3),
@@ -882,12 +1596,12 @@ describe('validation', () => {
     const signatures = [
       ...SignatureEnvelope.sortMultisigApprovals({
         account,
+        config: initializedConfig,
         payload: KeyAuthorization.getSignPayload(authorization),
         signatures: [
           SignatureEnvelope.deserialize(approval_1),
           SignatureEnvelope.deserialize(approval_2),
         ],
-        version: 1n,
       }),
     ].reverse()
     const operation = {
@@ -895,7 +1609,12 @@ describe('validation', () => {
       approvals: [approval_1, approval_2],
       keyAuthorization: KeyAuthorization.serialize(
         KeyAuthorization.from(authorization, {
-          signature: { account, signatures, type: 'multisig' },
+          signature: {
+            account,
+            config: initializedConfig,
+            signatures,
+            type: 'multisig',
+          },
         }),
       ),
       signatureCount: 2,
@@ -917,6 +1636,7 @@ describe('validation', () => {
         KeyAuthorization.from(authorization, {
           signature: {
             account,
+            config: initializedConfig,
             signatures: [
               SignatureEnvelope.deserialize(approval_1),
               SignatureEnvelope.deserialize(approval_1),
@@ -937,37 +1657,49 @@ describe('validation', () => {
 
   test('rejects reordered nested key authorization approvals', () => {
     const authorization = KeyAuthorization.deserialize(keyAuthorization)
+    const nestedConfig = MultisigConfig.from({
+      owners: [{ owner: owner_2, weight: 1 }],
+      threshold: 1,
+      version: 1n,
+    })
     const childSignatures = SignatureEnvelope.sortMultisigApprovals({
       account: owner_1,
+      config: nestedConfig,
       payload: keyAuthorizationHash,
       signatures: [
         SignatureEnvelope.deserialize(approval_1),
         SignatureEnvelope.deserialize(approval_2),
       ],
-      version: 1n,
     })
     const retainedNested = SignatureEnvelope.from({
       account: owner_1,
+      config: nestedConfig,
       signatures: childSignatures,
       type: 'multisig',
     })
     const selectedNested = SignatureEnvelope.from({
       account: owner_1,
+      config: nestedConfig,
       signatures: [...childSignatures].reverse(),
       type: 'multisig',
     })
     const selected = SignatureEnvelope.sortMultisigApprovals({
       account,
+      config: initializedConfig,
       payload: KeyAuthorization.getSignPayload(authorization),
       signatures: [selectedNested, SignatureEnvelope.deserialize(approval_2)],
-      version: 1n,
     })
     const operation = {
       ...keyAuthorizationPending,
       approvals: [SignatureEnvelope.serialize(retainedNested), approval_2],
       keyAuthorization: KeyAuthorization.serialize(
         KeyAuthorization.from(authorization, {
-          signature: { account, signatures: selected, type: 'multisig' },
+          signature: {
+            account,
+            config: initializedConfig,
+            signatures: selected,
+            type: 'multisig',
+          },
         }),
       ),
       signatureCount: 2,
@@ -1006,12 +1738,12 @@ describe('validation', () => {
     })
     const signatures = SignatureEnvelope.sortMultisigApprovals({
       account,
+      config,
       payload: KeyAuthorization.getSignPayload(authorization),
       signatures: [
         SignatureEnvelope.deserialize(approval_1),
         SignatureEnvelope.deserialize(approval_2),
       ],
-      version: 0n,
     })
     const approvals = signatures.map((signature) =>
       SignatureEnvelope.serialize(signature),
@@ -1025,15 +1757,15 @@ describe('validation', () => {
       createdAt: 1,
       hash: MultisigConfig.getSignPayload({
         account,
+        config,
         payload: KeyAuthorization.getSignPayload(authorization),
-        version: 0n,
       }),
       init: true,
       keyAuthorization: KeyAuthorization.serialize(
         KeyAuthorization.from(authorization, {
           signature: {
             account,
-            init: config,
+            config,
             signatures,
             type: 'multisig',
           },