ox 0.14.40 → 0.14.42

package/tempo/MultisigOperation.test.ts

@@ -36,7 +36,7 @@ const config = MultisigConfig.from({
   ],
   threshold: 2,
 })
-const initializedConfig = MultisigConfig.from({ ...config, version: 1n })
+const currentConfig = MultisigConfig.from({ ...config, version: 1n })
 const account = MultisigConfig.getAddress(config)
 const ownerSignature_1 = owners[0]!.signature
 const approval_1 = SignatureEnvelope.serialize(ownerSignature_1)
@@ -63,14 +63,14 @@ const keyAuthorization = KeyAuthorization.serialize(
 
 const transactionHash_ = MultisigConfig.getSignPayload({
   account,
-  config: initializedConfig,
+  config: currentConfig,
   payload: TxEnvelopeTempo.getSignPayload(
     TxEnvelopeTempo.deserialize(transaction),
   ),
 })
 const keyAuthorizationHash = MultisigConfig.getSignPayload({
   account,
-  config: initializedConfig,
+  config: currentConfig,
   payload: KeyAuthorization.getSignPayload(
     KeyAuthorization.deserialize(keyAuthorization),
   ),
@@ -79,10 +79,8 @@ const keyAuthorizationHash = MultisigConfig.getSignPayload({
 const base = {
   account,
   approvals: [approval_1],
-  config: initializedConfig,
-  configVersion: 1n,
+  config: currentConfig,
   createdAt: 1,
-  init: false,
   signatureCount: 1,
   threshold: 2,
   updatedAt: 2,
@@ -139,13 +137,13 @@ describe('getHash', () => {
     expect({
       keyAuthorization: MultisigOperation.getHash({
         account,
-        configVersion: 1n,
+        config: currentConfig,
         keyAuthorization,
         type: 'keyAuthorization',
       }),
       transaction: MultisigOperation.getHash({
         account,
-        configVersion: 1n,
+        config: currentConfig,
         transaction,
         type: 'transaction',
       }),
@@ -171,7 +169,7 @@ describe('selectApprovals', () => {
     const account = MultisigConfig.getAddress(config)
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 1n,
+      config: { ...config, version: 1n },
       transaction,
       type: 'transaction',
     })
@@ -244,13 +242,13 @@ describe('selectApprovals', () => {
     const account = MultisigConfig.getAddress(config)
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 1n,
+      config: { ...config, version: 1n },
       transaction,
       type: 'transaction',
     })
     const childHash = MultisigConfig.getSignPayload({
       account: child,
-      config: { version: 2n },
+      config: { ...childConfig, version: 2n },
       payload: hash,
     })
     const childApprovals = [
@@ -258,15 +256,6 @@ describe('selectApprovals', () => {
       signApproval(owners[2]!, childHash),
     ]
     const rootApproval = signApproval(owners[0]!, hash)
-    const resolveConfig: MultisigOperation.selectApprovals.ResolveConfig = ({
-      account,
-    }) => {
-      if (!Address.isEqual(account, child)) throw new Error('unknown account')
-      return {
-        config: MultisigConfig.from({ ...childConfig, version: 2n }),
-        version: 2n,
-      }
-    }
     const partial = await MultisigOperation.selectApprovals({
       account,
       approvals: [
@@ -280,7 +269,6 @@ describe('selectApprovals', () => {
       ],
       config,
       hash,
-      resolveConfig,
     })
     const complete = await MultisigOperation.selectApprovals({
       account,
@@ -297,7 +285,6 @@ describe('selectApprovals', () => {
       ],
       config,
       hash,
-      resolveConfig,
     })
 
     expect({
@@ -341,7 +328,7 @@ describe('selectApprovals', () => {
     `)
   })
 
-  test('rejects mismatched nested config versions', async () => {
+  test('rejects conflicting nested config witnesses', async () => {
     const childConfig = MultisigConfig.from({
       owners: [{ owner: owners[1]!.address, weight: 1 }],
       threshold: 1,
@@ -354,17 +341,26 @@ describe('selectApprovals', () => {
     const account = MultisigConfig.getAddress(config)
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 1n,
+      config: { ...config, version: 1n },
       transaction,
       type: 'transaction',
     })
-    const resolvedConfig = MultisigConfig.from({
+    const config_2 = MultisigConfig.from({
       ...childConfig,
       version: 2n,
     })
-    const childHash = MultisigConfig.getSignPayload({
+    const config_3 = MultisigConfig.from({
+      ...childConfig,
+      version: 3n,
+    })
+    const childHash_2 = MultisigConfig.getSignPayload({
+      account: child,
+      config: config_2,
+      payload: hash,
+    })
+    const childHash_3 = MultisigConfig.getSignPayload({
       account: child,
-      config: resolvedConfig,
+      config: config_3,
       payload: hash,
     })
 
@@ -374,10 +370,20 @@ describe('selectApprovals', () => {
         approvals: [
           SignatureEnvelope.serialize({
             account: child,
-            config: resolvedConfig,
+            config: config_2,
             signatures: [
               SignatureEnvelope.deserialize(
-                signApproval(owners[1]!, childHash),
+                signApproval(owners[1]!, childHash_2),
+              ),
+            ],
+            type: 'multisig',
+          }),
+          SignatureEnvelope.serialize({
+            account: child,
+            config: config_3,
+            signatures: [
+              SignatureEnvelope.deserialize(
+                signApproval(owners[1]!, childHash_3),
               ),
             ],
             type: 'multisig',
@@ -385,17 +391,32 @@ describe('selectApprovals', () => {
         ],
         config,
         hash,
-        resolveConfig: () => ({ config: childConfig, version: 2n }),
       }),
     ).rejects.toThrowErrorMatchingInlineSnapshot(
-      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: resolved config.version must equal version for nested multisig owner 0x7888d60e9cc26c8569d394fce435c248f1e49c3b.]`,
+      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: nested multisig owner 0x7888d60e9cc26c8569d394fce435c248f1e49c3b has conflicting config witnesses.]`,
+    )
+  })
+
+  test('rejects an initial root config for another account', async () => {
+    await expect(
+      MultisigOperation.selectApprovals({
+        account,
+        approvals: [],
+        config: MultisigConfig.from({
+          ...config,
+          salt: `0x${'ff'.repeat(32)}`,
+        }),
+        hash: transactionHash_,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: initial config does not derive the root multisig account.]`,
     )
   })
 
   test('rejects invalid and non-owner approvals', async () => {
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 1n,
+      config: currentConfig,
       transaction,
       type: 'transaction',
     })
@@ -427,7 +448,7 @@ describe('selectApprovals', () => {
     )
   })
 
-  test('requires a resolver for nested owners', async () => {
+  test('reads current nested config witnesses from approvals', async () => {
     const childConfig = MultisigConfig.from({
       owners: [{ owner: owners[1]!.address, weight: 1 }],
       threshold: 1,
@@ -440,36 +461,49 @@ describe('selectApprovals', () => {
     const account = MultisigConfig.getAddress(config)
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 1n,
+      config: { ...config, version: 1n },
       transaction,
       type: 'transaction',
     })
     const childHash = MultisigConfig.getSignPayload({
       account: child,
-      config: { version: 1n },
+      config: { ...childConfig, version: 1n },
       payload: hash,
     })
 
-    await expect(
-      MultisigOperation.selectApprovals({
-        account,
-        approvals: [
-          SignatureEnvelope.serialize({
-            account: child,
-            config: MultisigConfig.from({ ...childConfig, version: 1n }),
-            signatures: [
-              SignatureEnvelope.deserialize(
-                signApproval(owners[1]!, childHash),
-              ),
-            ],
-            type: 'multisig',
-          }),
+    const selection = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [
+        SignatureEnvelope.serialize({
+          account: child,
+          config: MultisigConfig.from({ ...childConfig, version: 1n }),
+          signatures: [
+            SignatureEnvelope.deserialize(signApproval(owners[1]!, childHash)),
+          ],
+          type: 'multisig',
+        }),
+      ],
+      config,
+      hash,
+    })
+    expect(selection).toMatchInlineSnapshot(
+      {
+        approvals: [expect.any(String)],
+        selectedApprovals: [expect.any(String)],
+      },
+      `
+      {
+        "approvals": [
+          Any<String>,
         ],
-        config,
-        hash,
-      }),
-    ).rejects.toThrowErrorMatchingInlineSnapshot(
-      `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: nested multisig owner 0x7888d60e9cc26c8569d394fce435c248f1e49c3b requires a config resolver.]`,
+        "selectedApprovals": [
+          Any<String>,
+        ],
+        "signatureCount": 1,
+        "threshold": 1,
+        "weight": 1,
+      }
+    `,
     )
   })
 
@@ -489,7 +523,7 @@ describe('selectApprovals', () => {
     const account = MultisigConfig.getAddress(config)
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 1n,
+      config: { ...config, version: 1n },
       transaction,
       type: 'transaction',
     })
@@ -531,7 +565,6 @@ describe('selectApprovals', () => {
       ],
       config,
       hash,
-      resolveConfig: () => ({ config: childConfig, version: 0n }),
     })
     expect({
       signatureCount: selection.signatureCount,
@@ -553,7 +586,7 @@ describe('selectApprovals', () => {
     })
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 2n,
+      config: { ...config, version: 2n },
       transaction,
       type: 'transaction',
     })
@@ -595,18 +628,18 @@ describe('selectApprovals', () => {
     const account = MultisigConfig.getAddress(config)
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 1n,
+      config: { ...config, version: 1n },
       transaction,
       type: 'transaction',
     })
     const childHash = MultisigConfig.getSignPayload({
       account: child,
-      config: { version: 1n },
+      config: { ...childConfig, version: 1n },
       payload: hash,
     })
     const grandchildHash = MultisigConfig.getSignPayload({
       account: grandchild,
-      config: { version: 1n },
+      config: { ...grandchildConfig, version: 1n },
       payload: childHash,
     })
 
@@ -637,20 +670,6 @@ describe('selectApprovals', () => {
         ],
         config,
         hash,
-        resolveConfig: ({ account }) => {
-          if (Address.isEqual(account, child))
-            return {
-              config: MultisigConfig.from({ ...childConfig, version: 1n }),
-              version: 1n,
-            }
-          return {
-            config: MultisigConfig.from({
-              ...grandchildConfig,
-              version: 1n,
-            }),
-            version: 1n,
-          }
-        },
       }),
     ).rejects.toThrowErrorMatchingInlineSnapshot(
       `[MultisigOperation.InvalidApprovalError: Invalid multisig approval: nested multisig owner 0xf529c8f6b2b4c72102af4cfe5eeb55b7d45dede2 is invalid.]`,
@@ -658,15 +677,107 @@ describe('selectApprovals', () => {
   })
 })
 
+describe('serializeKeyAuthorization', () => {
+  test('behavior: current and initial authorizations', async () => {
+    const results = []
+    for (const applicableConfig of [currentConfig, config]) {
+      const hash = MultisigOperation.getHash({
+        account,
+        config: applicableConfig,
+        keyAuthorization,
+        type: 'keyAuthorization',
+      })
+      const selection = await MultisigOperation.selectApprovals({
+        account,
+        approvals: [
+          signApproval(owners[1]!, hash),
+          signApproval(owners[0]!, hash),
+        ],
+        config: applicableConfig,
+        hash,
+      })
+      const serialized = MultisigOperation.serializeKeyAuthorization(
+        keyAuthorization,
+        {
+          account,
+          approvals: selection.selectedApprovals,
+          config: applicableConfig,
+        },
+      )
+      const value = KeyAuthorization.deserialize(serialized)
+      results.push({
+        account:
+          value.signature?.type === 'multisig'
+            ? value.signature.account
+            : undefined,
+        hash: Hash.keccak256(serialized),
+        signatureCount:
+          value.signature?.type === 'multisig'
+            ? value.signature.signatures.length
+            : 0,
+        version:
+          value.signature?.type === 'multisig'
+            ? value.signature.config.version
+            : undefined,
+      })
+    }
+
+    expect(results).toMatchInlineSnapshot(`
+      [
+        {
+          "account": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
+          "hash": "0x14b3a60f7c3120e3983b1f6e085ab5b234e71f58f0a4f39d19a5ff64b89a2afe",
+          "signatureCount": 2,
+          "version": 1n,
+        },
+        {
+          "account": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
+          "hash": "0xbfdc90810a0634f413e627bdefea88ae8c42ed41d6670a70fd1d7574aedda2a4",
+          "signatureCount": 2,
+          "version": 0n,
+        },
+      ]
+    `)
+  })
+
+  test('error: signed authorization', async () => {
+    const selection = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [
+        signApproval(owners[0]!, keyAuthorizationHash),
+        signApproval(owners[1]!, keyAuthorizationHash),
+      ],
+      config: currentConfig,
+      hash: keyAuthorizationHash,
+    })
+    const signed = MultisigOperation.serializeKeyAuthorization(
+      keyAuthorization,
+      {
+        account,
+        approvals: selection.selectedApprovals,
+        config: currentConfig,
+      },
+    )
+
+    expect(() =>
+      MultisigOperation.serializeKeyAuthorization(signed, {
+        account,
+        approvals: selection.selectedApprovals,
+        config: currentConfig,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidOperationError: Invalid multisig operation: keyAuthorization must not contain a signature.]`,
+    )
+  })
+})
+
 describe('serializeTransaction', () => {
-  test('initialized and bootstrap transactions', async () => {
+  test('current and initial transactions', async () => {
     const results = []
-    for (const init of [false, true]) {
-      const configVersion = init ? 0n : 1n
-      const applicableConfig = init ? config : initializedConfig
+    for (const applicableConfig of [currentConfig, config]) {
       const hash = MultisigOperation.getHash({
         account,
-        configVersion,
+        config: applicableConfig,
         transaction,
         type: 'transaction',
       })
@@ -683,10 +794,8 @@ describe('serializeTransaction', () => {
         account,
         approvals: selection.approvals,
         config: applicableConfig,
-        configVersion,
         createdAt: 1,
         hash,
-        init,
         signatureCount: selection.signatureCount,
         status: 'pending',
         threshold: selection.threshold,
@@ -701,7 +810,7 @@ describe('serializeTransaction', () => {
       const value = TxEnvelopeTempo.deserialize(serialized)
       results.push({
         account: value.signature?.account,
-        configVersion:
+        version:
           value.signature?.type === 'multisig'
             ? value.signature.config.version
             : undefined,
@@ -718,17 +827,17 @@ describe('serializeTransaction', () => {
       [
         {
           "account": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
-          "configVersion": 1n,
           "hash": "0x8309740edaf304284186f7bcfe4527745cd4eb48e7441795ebdd970798091f8f",
           "signatureCount": 2,
           "type": "0x76",
+          "version": 1n,
         },
         {
           "account": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
-          "configVersion": 0n,
           "hash": "0x636af84d8445d87cbcd33039d5a3a2274a5911036b1b7ceb740ac41e2f638611",
           "signatureCount": 2,
           "type": "0x76",
+          "version": 0n,
         },
       ]
     `)
@@ -756,7 +865,7 @@ describe('serializeTransaction', () => {
     for (const transaction of transactions) {
       const hash = MultisigOperation.getHash({
         account,
-        configVersion: 1n,
+        config: currentConfig,
         transaction,
         type: 'transaction',
       })
@@ -766,18 +875,16 @@ describe('serializeTransaction', () => {
           signApproval(owners[0]!, hash),
           signApproval(owners[1]!, hash),
         ],
-        config: initializedConfig,
+        config: currentConfig,
         hash,
       })
       const serialized = MultisigOperation.serializeTransaction(
         MultisigOperation.from({
           account,
           approvals: selection.approvals,
-          config: initializedConfig,
-          configVersion: 1n,
+          config: currentConfig,
           createdAt: 1,
           hash,
-          init: false,
           signatureCount: selection.signatureCount,
           status: 'pending',
           threshold: selection.threshold,
@@ -825,7 +932,7 @@ describe('serializeTransaction', () => {
   test('rejects an approval not retained by the operation', async () => {
     const hash = MultisigOperation.getHash({
       account,
-      configVersion: 1n,
+      config: currentConfig,
       transaction,
       type: 'transaction',
     })
@@ -834,17 +941,15 @@ describe('serializeTransaction', () => {
     const selection = await MultisigOperation.selectApprovals({
       account,
       approvals: [approval_1],
-      config: initializedConfig,
+      config: currentConfig,
       hash,
     })
     const operation = MultisigOperation.from({
       account,
       approvals: selection.approvals,
-      config: initializedConfig,
-      configVersion: 1n,
+      config: currentConfig,
       createdAt: 1,
       hash,
-      init: false,
       signatureCount: selection.signatureCount,
       status: 'pending',
       threshold: selection.threshold,
@@ -907,10 +1012,8 @@ describe('from', () => {
             "threshold": 2,
             "version": 1n,
           },
-          "configVersion": 1n,
           "createdAt": 1,
           "hash": "0xcdbc24a8fb192f799c5d166b13a99fb29cbb15e71a5e730988d6f8b3c5959d02",
-          "init": false,
           "signatureCount": 1,
           "status": "pending",
           "threshold": 2,
@@ -940,11 +1043,9 @@ describe('from', () => {
             "threshold": 2,
             "version": 1n,
           },
-          "configVersion": 1n,
           "createdAt": 1,
           "expiresAt": 10,
           "hash": "0xcdbc24a8fb192f799c5d166b13a99fb29cbb15e71a5e730988d6f8b3c5959d02",
-          "init": false,
           "signatureCount": 2,
           "status": "submitting",
           "submissionId": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
@@ -975,10 +1076,8 @@ describe('from', () => {
             "threshold": 2,
             "version": 1n,
           },
-          "configVersion": 1n,
           "createdAt": 1,
           "hash": "0xcdbc24a8fb192f799c5d166b13a99fb29cbb15e71a5e730988d6f8b3c5959d02",
-          "init": false,
           "signatureCount": 2,
           "status": "success",
           "threshold": 2,
@@ -1004,7 +1103,7 @@ describe('from', () => {
       ...transactionPending,
       hash: MultisigConfig.getSignPayload({
         account,
-        config: initializedConfig,
+        config: currentConfig,
         payload: TxEnvelopeTempo.getSignPayload(
           TxEnvelopeTempo.deserialize(transaction),
         ),
@@ -1038,10 +1137,8 @@ describe('from', () => {
           "threshold": 2,
           "version": 1n,
         },
-        "configVersion": 1n,
         "createdAt": 1,
         "hash": Any<String>,
-        "init": false,
         "signatureCount": 1,
         "status": "pending",
         "threshold": 2,
@@ -1067,7 +1164,7 @@ describe('from', () => {
       ...transactionPending,
       hash: MultisigConfig.getSignPayload({
         account,
-        config: initializedConfig,
+        config: currentConfig,
         payload: TxEnvelopeTempo.getSignPayload(
           TxEnvelopeTempo.deserialize(transaction),
         ),
@@ -1078,11 +1175,10 @@ describe('from', () => {
     expect(operation.transaction).toBe(transaction)
   })
 
-  test('bootstrap transaction', () => {
+  test('initial transaction', () => {
     const operation = MultisigOperation.from({
       ...transactionPending,
       config,
-      configVersion: 0n,
       hash: MultisigConfig.getSignPayload({
         account,
         config,
@@ -1090,7 +1186,6 @@ describe('from', () => {
           TxEnvelopeTempo.deserialize(transaction),
         ),
       }),
-      init: true,
     })
 
     expect(operation).toMatchInlineSnapshot(
@@ -1119,10 +1214,8 @@ describe('from', () => {
           "threshold": 2,
           "version": 0n,
         },
-        "configVersion": 0n,
         "createdAt": 1,
         "hash": Any<String>,
-        "init": true,
         "signatureCount": 1,
         "status": "pending",
         "threshold": 2,
@@ -1135,31 +1228,6 @@ describe('from', () => {
     )
   })
 
-  test('initialized transaction at config version zero', () => {
-    const operation = MultisigOperation.from({
-      ...transactionPending,
-      config,
-      configVersion: 0n,
-      hash: MultisigConfig.getSignPayload({
-        account,
-        config,
-        payload: TxEnvelopeTempo.getSignPayload(
-          TxEnvelopeTempo.deserialize(transaction),
-        ),
-      }),
-    })
-
-    expect({
-      configVersion: operation.configVersion,
-      init: operation.init,
-    }).toMatchInlineSnapshot(`
-      {
-        "configVersion": 0n,
-        "init": false,
-      }
-    `)
-  })
-
   test('key authorization states', () => {
     const pending = MultisigOperation.from(keyAuthorizationPending)
     const authorization = KeyAuthorization.deserialize(keyAuthorization)
@@ -1170,7 +1238,7 @@ describe('from', () => {
         KeyAuthorization.from(authorization, {
           signature: {
             account,
-            config: initializedConfig,
+            config: currentConfig,
             signatures: [
               SignatureEnvelope.deserialize(approval_1),
               SignatureEnvelope.deserialize(approval_2),
@@ -1206,10 +1274,8 @@ describe('from', () => {
             "threshold": 2,
             "version": 1n,
           },
-          "configVersion": 1n,
           "createdAt": 1,
           "hash": "0xf6995eb69c12c03d3d13b357abf7cac22b4effe52fba8ff02e5aef26161f77a0",
-          "init": false,
           "keyAuthorization": "0xf838f782107980943333333333333333333333333333333333333333846b49d2008080808094f81b7763d3a6876195d780865bd783dbd97dd36e",
           "signatureCount": 1,
           "status": "pending",
@@ -1239,10 +1305,8 @@ describe('from', () => {
             "threshold": 2,
             "version": 1n,
           },
-          "configVersion": 1n,
           "createdAt": 1,
           "hash": "0xf6995eb69c12c03d3d13b357abf7cac22b4effe52fba8ff02e5aef26161f77a0",
-          "init": false,
           "keyAuthorization": "0xf901b3f782107980943333333333333333333333333333333333333333846b49d2008080808094f81b7763d3a6876195d780865bd783dbd97dd36eb9017805f9017494f81b7763d3a6876195d780865bd783dbd97dd36ef852a000000000000000000000000000000000000000000000000000000000000000000102eed69407e1ed8ea0e9601e5546b0a03aed683df360140701d694288f0cd85005f34168f731a468aef268c2f9456f01f90108b88201000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200b88201000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
           "signatureCount": 2,
           "status": "success",
@@ -1255,7 +1319,7 @@ describe('from', () => {
     `)
   })
 
-  test('bootstrap key authorization', () => {
+  test('initial key authorization', () => {
     const authorization = KeyAuthorization.deserialize(keyAuthorization)
     const keyAuthorization_ = KeyAuthorization.serialize(
       KeyAuthorization.from(authorization, {
@@ -1274,13 +1338,11 @@ describe('from', () => {
       ...keyAuthorizationPending,
       approvals: [approval_1, approval_2],
       config,
-      configVersion: 0n,
       hash: MultisigConfig.getSignPayload({
         account,
         config,
         payload: KeyAuthorization.getSignPayload(authorization),
       }),
-      init: true,
       keyAuthorization: keyAuthorization_,
       signatureCount: 2,
       status: 'success',
@@ -1314,10 +1376,8 @@ describe('from', () => {
           "threshold": 2,
           "version": 0n,
         },
-        "configVersion": 0n,
         "createdAt": 1,
         "hash": Any<String>,
-        "init": true,
         "keyAuthorization": Any<String>,
         "signatureCount": 2,
         "status": "success",
@@ -1361,10 +1421,8 @@ describe('RPC conversion', () => {
             "threshold": 2,
             "version": "0x1",
           },
-          "configVersion": "0x1",
           "createdAt": 1,
           "hash": "0xf6995eb69c12c03d3d13b357abf7cac22b4effe52fba8ff02e5aef26161f77a0",
-          "init": false,
           "keyAuthorization": "0xf838f782107980943333333333333333333333333333333333333333846b49d2008080808094f81b7763d3a6876195d780865bd783dbd97dd36e",
           "signatureCount": 1,
           "status": "pending",
@@ -1393,10 +1451,8 @@ describe('RPC conversion', () => {
             "threshold": 2,
             "version": "0x1",
           },
-          "configVersion": "0x1",
           "createdAt": 1,
           "hash": "0xcdbc24a8fb192f799c5d166b13a99fb29cbb15e71a5e730988d6f8b3c5959d02",
-          "init": false,
           "signatureCount": 1,
           "status": "pending",
           "threshold": 2,
@@ -1529,7 +1585,7 @@ describe('validation', () => {
         account: '0x0000000000000000000000000000000000000000',
         hash: MultisigConfig.getSignPayload({
           account: '0x0000000000000000000000000000000000000000',
-          config: initializedConfig,
+          config: currentConfig,
           payload: TxEnvelopeTempo.getSignPayload(
             TxEnvelopeTempo.deserialize(transaction),
           ),
@@ -1596,7 +1652,7 @@ describe('validation', () => {
       },
     },
     {
-      name: 'nested bootstrap owner approval',
+      name: 'nested non-owner approval',
       operation: {
         ...transactionPending,
         approvals: [
@@ -1609,35 +1665,48 @@ describe('validation', () => {
         ],
       },
     },
-    {
-      name: 'bootstrap with initialized version',
-      operation: { ...transactionPending, init: true },
-    },
   ])('rejects $name', ({ operation }) => {
     expect(() =>
       MultisigOperation.from(operation as MultisigOperation.Operation),
     ).toThrowError(MultisigOperation.InvalidOperationError)
   })
 
-  test('rejects mismatched config versions', () => {
+  test('rejects an initial config for another account', () => {
+    const config = MultisigConfig.from({
+      ...transactionPending.config,
+      salt: `0x${'ff'.repeat(32)}`,
+      version: 0n,
+    })
     expect(() =>
       MultisigOperation.from({
         ...transactionPending,
-        config: { ...initializedConfig, version: 2n },
+        config,
+        hash: MultisigConfig.getSignPayload({
+          account,
+          config,
+          payload: TxEnvelopeTempo.getSignPayload(
+            TxEnvelopeTempo.deserialize(transaction),
+          ),
+        }),
       }),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[MultisigOperation.InvalidOperationError: Invalid multisig operation: config.version must equal configVersion.]`,
+      `
+      [MultisigOperation.InvalidOperationError: Invalid multisig operation.
+
+      Details: Invalid native multisig owner approval: initial multisig config does not derive account.]
+    `,
     )
   })
 
   test('rejects noncanonical RPC quantities', () => {
+    const operation = MultisigOperation.toRpc(transactionPending)
     expect(() =>
       MultisigOperation.fromRpc({
-        ...MultisigOperation.toRpc(transactionPending),
-        configVersion: '0x01',
+        ...operation,
+        config: { ...operation.config, version: '0x01' },
       }),
     ).toThrowError(
-      'Invalid multisig operation: configVersion must use canonical quantity encoding.',
+      'Invalid multisig operation: config.version must use canonical quantity encoding.',
     )
   })
 
@@ -1650,7 +1719,7 @@ describe('validation', () => {
         KeyAuthorization.from(authorization, {
           signature: {
             account,
-            config: initializedConfig,
+            config: currentConfig,
             signatures: [
               SignatureEnvelope.deserialize(approval_1),
               SignatureEnvelope.deserialize(approval_3),
@@ -1674,7 +1743,7 @@ describe('validation', () => {
     const signatures = [
       ...SignatureEnvelope.sortMultisigApprovals({
         account,
-        config: initializedConfig,
+        config: currentConfig,
         payload: KeyAuthorization.getSignPayload(authorization),
         signatures: [
           SignatureEnvelope.deserialize(approval_1),
@@ -1689,7 +1758,7 @@ describe('validation', () => {
         KeyAuthorization.from(authorization, {
           signature: {
             account,
-            config: initializedConfig,
+            config: currentConfig,
             signatures,
             type: 'multisig',
           },
@@ -1714,7 +1783,7 @@ describe('validation', () => {
         KeyAuthorization.from(authorization, {
           signature: {
             account,
-            config: initializedConfig,
+            config: currentConfig,
             signatures: [
               SignatureEnvelope.deserialize(approval_1),
               SignatureEnvelope.deserialize(approval_1),
@@ -1763,7 +1832,7 @@ describe('validation', () => {
     })
     const selected = SignatureEnvelope.sortMultisigApprovals({
       account,
-      config: initializedConfig,
+      config: currentConfig,
       payload: KeyAuthorization.getSignPayload(authorization),
       signatures: [selectedNested, SignatureEnvelope.deserialize(approval_2)],
     })
@@ -1774,7 +1843,7 @@ describe('validation', () => {
         KeyAuthorization.from(authorization, {
           signature: {
             account,
-            config: initializedConfig,
+            config: currentConfig,
             signatures: selected,
             type: 'multisig',
           },
@@ -1790,7 +1859,7 @@ describe('validation', () => {
     )
   })
 
-  test('accepts case-insensitive bootstrap configs', () => {
+  test('accepts case-insensitive initial configs', () => {
     const config = MultisigConfig.from({
       owners: [
         {
@@ -1831,14 +1900,12 @@ describe('validation', () => {
       account,
       approvals,
       config,
-      configVersion: 0n,
       createdAt: 1,
       hash: MultisigConfig.getSignPayload({
         account,
         config,
         payload: KeyAuthorization.getSignPayload(authorization),
       }),
-      init: true,
       keyAuthorization: KeyAuthorization.serialize(
         KeyAuthorization.from(authorization, {
           signature: {