ox 0.14.43 → 0.14.45

package/tempo/MultisigConfig.test.ts

@@ -1,6 +1,7 @@
 import { Hash, Hex, Rlp } from 'ox'
 import { MultisigConfig } from 'ox/tempo'
 import { describe, expect, test } from 'vitest'
+import { factory } from '../../test/tempo/multisig.js'
 
 const owner_1 = '0x1111111111111111111111111111111111111111'
 const owner_2 = '0x2222222222222222222222222222222222222222'
@@ -9,7 +10,7 @@ const config = MultisigConfig.from({
   owners: [{ owner: owner_1, weight: 1 }],
   threshold: 1,
 })
-const account = MultisigConfig.getAddress(config)
+const account = MultisigConfig.getAddress(config, { factory })
 
 describe('from', () => {
   test('behavior: normalizes an initial configuration', () => {
@@ -99,35 +100,59 @@ describe('fromRpc/toRpc', () => {
 })
 
 describe('getAddress', () => {
-  test('example: matches the frozen version-0 vector', () => {
+  test('example: matches the frozen CREATE2 vector', () => {
     expect(account).toMatchInlineSnapshot(
-      `"0x8820d1497eeaf4f68e00b2cfc00a2f3b1dbb00da"`,
+      `"0x90ba71cb7534da990a1182cf28c9bf415055e03d"`,
     )
+    expect(account).not.toBe('0x8820d1497eeaf4f68e00b2cfc00a2f3b1dbb00da')
   })
 
   test('behavior: includes salt, threshold, and owners', () => {
     expect(
-      MultisigConfig.getAddress({
-        owners: [
-          { owner: owner_1, weight: 1 },
-          { owner: owner_2, weight: 2 },
-        ],
-        salt: `0x${'42'.repeat(32)}`,
-        threshold: 2,
-      }),
-    ).toMatchInlineSnapshot(`"0x0773e28146400643e42cb28f6659b74e7c0b451d"`)
+      MultisigConfig.getAddress(
+        {
+          owners: [
+            { owner: owner_1, weight: 1 },
+            { owner: owner_2, weight: 2 },
+          ],
+          salt: `0x${'42'.repeat(32)}`,
+          threshold: 2,
+        },
+        { factory },
+      ),
+    ).toMatchInlineSnapshot(`"0x7898a7d1dd96946d2a968de1540ca884a244320c"`)
+  })
+
+  test('behavior: is stable and binds the salt', () => {
+    expect({
+      repeated: MultisigConfig.getAddress(config, { factory }),
+      salted: MultisigConfig.getAddress(
+        {
+          ...config,
+          salt: `0x${'42'.repeat(32)}`,
+        },
+        { factory },
+      ),
+    }).toMatchInlineSnapshot(`
+      {
+        "repeated": "0x90ba71cb7534da990a1182cf28c9bf415055e03d",
+        "salted": "0xa1a8472f4a01772db729d8ebc73fe46120750b83",
+      }
+    `)
   })
 
   test('error: rejects a current configuration', () => {
     expect(() =>
-      MultisigConfig.getAddress({ ...config, version: 1n }),
+      MultisigConfig.getAddress({ ...config, version: 1n }, { factory }),
     ).toThrowErrorMatchingInlineSnapshot(
       `[MultisigConfig.InvalidConfigError: Invalid native multisig config: account address requires version zero.]`,
     )
   })
 
   test('behavior: accepts numeric zero for an initial configuration', () => {
-    expect(MultisigConfig.getAddress({ ...config, version: 0 })).toBe(account)
+    expect(
+      MultisigConfig.getAddress({ ...config, version: 0 }, { factory }),
+    ).toBe(account)
   })
 })
 
@@ -152,7 +177,7 @@ describe('getSignPayload', () => {
     expect(
       MultisigConfig.getSignPayload({ account, config, payload }),
     ).toMatchInlineSnapshot(
-      `"0xbf944a7a752b2cfab0418d5fb4591c5a7ff62976488edce11794d7f35fb34f41"`,
+      `"0x728efe90611b01c91c2be0da56e7eb8e0d2c274c84f97182e274187dde0b8a20"`,
     )
   })
 
@@ -207,14 +232,14 @@ describe('assert/validate', () => {
     })
     const rlp = Rlp.fromHex(MultisigConfig.toTuple(boundary))
     expect({
-      account: MultisigConfig.getAddress(boundary),
+      account: MultisigConfig.getAddress(boundary, { factory }),
       commitment: MultisigConfig.getCommitment(boundary),
       rlpHash: Hash.keccak256(rlp),
       rlpLength: Hex.size(rlp),
       valid: MultisigConfig.validate(boundary),
     }).toMatchInlineSnapshot(`
       {
-        "account": "0x6c67c57e0eed05341137dbf88e4e7a90dc46ef50",
+        "account": "0x6acb25715a2b0cf05c098f753a87d9b38471e99f",
         "commitment": "0x0dc47a7ab45ffa21a01bfd115427e26617b5a57d7ccbea57db2fd4537ba96f56",
         "rlpHash": "0xbaf0d030add91caaa10815d2e99c942f1e39b0d199216973781adb4fc1af6955",
         "rlpLength": 1145,
@@ -230,7 +255,7 @@ describe('assert/validate', () => {
           { owner: owner_1, weight: 128 },
           { owner: owner_2, weight: 127 },
         ],
-        threshold: 255,
+        threshold: 8,
       }),
     ).toBe(true)
   })
@@ -296,7 +321,7 @@ describe('assert/validate', () => {
           { owner: owner_1, weight: 128 },
           { owner: owner_2, weight: 128 },
         ],
-        threshold: 255,
+        threshold: 8,
       },
       name: 'weight overflow',
     },
@@ -343,7 +368,6 @@ describe('assert/validate', () => {
 test('exports', () => {
   expect(Object.keys(MultisigConfig)).toMatchInlineSnapshot(`
     [
-      "maxNestingDepth",
       "maxOwnerSignatureBytes",
       "maxOwners",
       "maxSignatures",

package/tempo/MultisigConfig.ts

@@ -1,16 +1,11 @@
 import * as Address from '../core/Address.js'
 import type * as Bytes from '../core/Bytes.js'
+import * as ContractAddress from '../core/ContractAddress.js'
 import * as Errors from '../core/Errors.js'
 import * as Hash from '../core/Hash.js'
 import * as Hex from '../core/Hex.js'
 import type { Compute } from '../core/internal/types.js'
 
-/**
- * Maximum number of native multisig signatures in one nested authorization
- * path, including the top-level transaction signature.
- */
-export const maxNestingDepth = 2
-
 /** Maximum encoded byte length for one primitive owner approval. */
 export const maxOwnerSignatureBytes = 2049
 
@@ -21,7 +16,7 @@ export const maxOwners = 48
 export const maxSignatures = 8
 
 /** Maximum threshold accepted by a native multisig config. */
-export const maxThreshold = 0xff
+export const maxThreshold = 8
 
 /** Maximum version accepted by a native multisig config. */
 export const maxVersion = 2n ** 64n - 1n
@@ -38,6 +33,10 @@ const accountDomain = 'tempo:multisig:account'
 /** Domain prefix for native multisig configuration commitments. */
 const configDomain = 'tempo:multisig:config'
 
+/** Keccak-256 of the canonical recovery wallet creation code. */
+const recoveryWalletInitCodeHash =
+  '0x583cc63a2e37f645b43eac911b1a6d6de08b83abdc308c61364edda8cfc3bd37'
+
 /** Domain prefix for native multisig owner approvals. */
 const signatureDomain = 'tempo:multisig:signature'
 
@@ -292,7 +291,33 @@ export declare namespace fromRpc {
  */
 export function fromTuple(tuple: Tuple): Config {
   const [salt, version, threshold, owners] = tuple
-  return {
+  if (
+    tuple.length !== 4 ||
+    typeof salt !== 'string' ||
+    Hex.size(salt) !== 32 ||
+    typeof version !== 'string' ||
+    Hex.size(version) > 8 ||
+    version.startsWith('0x00') ||
+    typeof threshold !== 'string' ||
+    Hex.size(threshold) > 1 ||
+    threshold.startsWith('0x00') ||
+    !Array.isArray(owners) ||
+    owners.some(
+      (owner) =>
+        !Array.isArray(owner) ||
+        owner.length !== 2 ||
+        typeof owner[0] !== 'string' ||
+        !Address.validate(owner[0]) ||
+        typeof owner[1] !== 'string' ||
+        Hex.size(owner[1] as Hex.Hex) > 1 ||
+        owner[1].startsWith('0x00'),
+    )
+  )
+    throw new InvalidConfigError({ reason: 'invalid config RLP tuple' })
+  const config = {
+    salt: salt && salt !== '0x' ? Hex.padLeft(salt, 32) : zeroSalt,
+    version: version === '0x' ? 0n : Hex.toBigInt(version),
+    threshold: threshold === '0x' ? 0 : Hex.toNumber(threshold),
     owners: owners.map((owner) => {
       const [ownerAddress, weight] = owner as readonly Hex.Hex[]
       return {
@@ -300,17 +325,17 @@ export function fromTuple(tuple: Tuple): Config {
         weight: !weight || weight === '0x' ? 0 : Hex.toNumber(weight),
       }
     }),
-    salt: salt && salt !== '0x' ? Hex.padLeft(salt, 32) : zeroSalt,
-    threshold: threshold === '0x' ? 0 : Hex.toNumber(threshold),
-    version: version === '0x' ? 0n : Hex.toBigInt(version),
   }
+  assert(config)
+  return config
 }
 
 /**
  * Derives the stable native multisig account address.
  *
- * Preimage (fixed-width big-endian, **not** RLP):
- * `keccak256("tempo:multisig:account" || salt || u8(threshold) || u8(owners.length) || (owner || u8(weight)) for each owner)[12:32]`.
+ * The initial config is hashed into a CREATE2 salt using fixed-width
+ * big-endian fields, not RLP. The account uses the chain-configured recovery
+ * factory and wallet init-code hash.
  *
  * The address is derived once from the initial version-0 config. Config
  * updates do not change it.
@@ -326,19 +351,26 @@ export function fromTuple(tuple: Tuple): Config {
  *   threshold: 1,
  * })
  *
- * const address = MultisigConfig.getAddress(initialConfig)
+ * const address = MultisigConfig.getAddress(initialConfig, {
+ *   factory: '0x7171717171717171717171717171717171717171'
+ * })
  * ```
  *
  * @param config - The initial multisig config.
+ * @param options - The recovery factory configured by the chain.
  * @returns The multisig account address.
  */
-export function getAddress(config: Input): Address.Address {
+export function getAddress(
+  config: Input,
+  options: getAddress.Options,
+): Address.Address {
+  Address.assert(options.factory)
   assert(config)
   if (BigInt(config.version ?? 0) !== 0n)
     throw new InvalidConfigError({
       reason: 'account address requires version zero',
     })
-  const hash = Hash.keccak256(
+  const accountSalt = Hash.keccak256(
     Hex.concat(
       Hex.fromString(accountDomain),
       Hex.padLeft(config.salt ?? zeroSalt, 32),
@@ -350,7 +382,11 @@ export function getAddress(config: Input): Address.Address {
       ]),
     ),
   )
-  const account = Address.from(Hex.slice(hash, 12, 32))
+  const account = ContractAddress.fromCreate2({
+    bytecodeHash: recoveryWalletInitCodeHash,
+    from: options.factory,
+    salt: accountSalt,
+  })
   if (Hex.toBigInt(account) === 0n)
     throw new InvalidConfigError({ reason: 'derived account cannot be zero' })
   if (config.owners.some((owner) => Address.isEqual(owner.owner, account)))
@@ -361,14 +397,18 @@ export function getAddress(config: Input): Address.Address {
 }
 
 export declare namespace getAddress {
+  type Options = {
+    /** Recovery factory configured by the chain. */
+    factory: Address.Address
+  }
+
   type ErrorType =
     | assert.ErrorType
-    | Address.from.ErrorType
+    | ContractAddress.fromCreate2.ErrorType
     | Hash.keccak256.ErrorType
     | Hex.concat.ErrorType
     | Hex.fromNumber.ErrorType
     | Hex.fromString.ErrorType
-    | Hex.slice.ErrorType
     | Errors.GlobalErrorType
 }
 
@@ -432,9 +472,6 @@ export declare namespace getCommitment {
  * version. Initial approvals use version `0n`; each config update increments
  * it.
  *
- * For a nested multisig owner approval, the parent digest becomes the nested
- * approval's `payload`, with the nested multisig `account`.
- *
  * @example
  * ```ts twoslash
  * import { MultisigConfig, TxEnvelopeTempo } from 'ox/tempo'
@@ -452,7 +489,9 @@ export declare namespace getCommitment {
  * })
  *
  * const digest = MultisigConfig.getSignPayload({
- *   account: MultisigConfig.getAddress(config),
+ *   account: MultisigConfig.getAddress(config, {
+ *     factory: '0x7171717171717171717171717171717171717171'
+ *   }),
  *   config,
  *   payload: TxEnvelopeTempo.getSignPayload(envelope),
  * })
@@ -464,6 +503,9 @@ export declare namespace getCommitment {
 export function getSignPayload(value: getSignPayload.Value): Hex.Hex {
   const { account, config, payload } = value
   assertVersion(config.version)
+  Address.assert(account)
+  if (Hex.size(Hex.from(payload)) !== 32)
+    throw new InvalidConfigError({ reason: 'payload must be 32 bytes' })
   return Hash.keccak256(
     Hex.concat(
       Hex.fromString(signatureDomain),