ox 0.14.60 → 0.14.61

package/tempo/KeyAuthorization.ts

@@ -45,7 +45,14 @@ export type KeyAuthorization<
   chainId: bigintType
   /** Unix timestamp when key expires (undefined = never expires). */
   expiry?: numberType | null | undefined
-  /** Whether this authorization provisions an admin access key. */
+  /**
+   * Whether this authorization provisions an admin access key (TIP-1049).
+   *
+   * @deprecated Admin access keys are removed at T14 by
+   * [TIP-1137](https://docs.tempo.xyz/protocol/tips/tip-1137). From T14 the Tempo
+   * node rejects any key authorization with `isAdmin: true`. The field is still
+   * encoded and decoded so pre-T14 history round-trips.
+   */
   isAdmin?: boolean | undefined
   /**
    * TIP20 spending limits for this key.
@@ -77,13 +84,19 @@ export type KeyAuthorization<
   witness?: Hex.Hex | undefined
 } & (
   | {
-      /** Account address this authorization is bound to. Required when an admin access key signs the grant (TIP-1049). */
+      /**
+       * Account address this authorization is bound to. When present, the Tempo node
+       * requires it to equal the transaction sender.
+       */
       account?: addressType | undefined
       /** Primitive key type. */
       type: SignatureEnvelope.Type
     }
   | {
-      /** Account address this authorization is bound to. Required when an admin access key signs the grant (TIP-1049). */
+      /**
+       * Account address this authorization is bound to. When present, the Tempo node
+       * requires it to equal the transaction sender.
+       */
       account?: addressType | undefined
       /** Configurable account key type. */
       type: 'configurable'
@@ -128,7 +141,12 @@ export type Rpc = {
   chainId: Hex.Hex
   /** Expiry timestamp (hex quantity or null). */
   expiry: Hex.Hex | null | undefined
-  /** Whether this authorization provisions an admin access key (TIP-1049). */
+  /**
+   * Whether this authorization provisions an admin access key (TIP-1049).
+   *
+   * @deprecated Rejected from T14 by [TIP-1137](https://docs.tempo.xyz/protocol/tips/tip-1137).
+   * Still decoded for pre-T14 history.
+   */
   isAdmin?: boolean | null | undefined
   /** Key identifier. */
   keyId: Address.Address
@@ -140,13 +158,13 @@ export type Rpc = {
   witness?: Hex.Hex | null | undefined
 } & (
   | {
-      /** Optional account address binding (TIP-1049). */
+      /** Optional account address binding. When present, must equal the transaction sender. */
       account?: Address.Address | null | undefined
       /** Primitive key type. */
       keyType: SignatureEnvelope.Type
     }
   | {
-      /** Optional account address binding (TIP-1049). */
+      /** Optional account address binding. When present, must equal the transaction sender. */
       account?: Address.Address | null | undefined
       /** Configurable account key type, named `configurableAccount` by the node. */
       keyType: 'configurableAccount'
@@ -723,7 +741,9 @@ export function fromTuple<const tuple extends Tuple>(
   const isAdmin = (() => {
     if (isAbsent(rawIsAdmin)) return undefined
     // TIP-1049: the admin marker is strictly `0x01`. Any other value is a
-    // protocol-level decode error on the node, so reject it here too.
+    // protocol-level decode error on the node, so reject it here too. T14
+    // (TIP-1137) rejects admin authorizations at validation, not decoding,
+    // so pre-T14 history still decodes.
     if (rawIsAdmin !== '0x01')
       throw new InvalidAdminMarkerError(rawIsAdmin as Hex.Hex)
     return true
@@ -1135,8 +1155,9 @@ export function toTuple<const authorization extends KeyAuthorization>(
     { value: witness, placeholder: '0x' },
     // TIP-1049: admin marker. Present = `0x01` (RLP integer 1); absent
     // skipped or omitted. Any other value is a hard decode error on the node.
+    // TIP-1137 keeps this encoding but rejects `0x01` from T14.
     { value: isAdmin ? '0x01' : undefined, placeholder: '0x' },
-    // TIP-1049: optional account binding. Last field — never a placeholder.
+    // Optional account binding. Last field — never a placeholder.
     { value: account, placeholder: '0x' },
   ]
   let lastPresent = -1
@@ -1238,8 +1259,8 @@ export class InvalidSignatureTypeError extends Error {
 /**
  * Thrown when a configurable account key grant omits its parent account binding.
  *
- * @deprecated No longer thrown. The Tempo node only requires `account` on grants
- * signed by an admin access key, which it checks against the transaction sender.
+ * @deprecated No longer thrown. The Tempo node does not require `account`; when
+ * present, it must equal the transaction sender.
  */
 export class MissingAccountError extends Error {
   override readonly name = 'KeyAuthorization.MissingAccountError'

package/tempo/TxEnvelopeTempo.test.ts

@@ -106,6 +106,19 @@ describe('assert', () => {
     )
   })
 
+  test('tip above zero fee cap', () => {
+    expect(() =>
+      TxEnvelopeTempo.assert({
+        calls: [{ to: '0x0000000000000000000000000000000000000000' }],
+        chainId: 1,
+        maxFeePerGas: 0n,
+        maxPriorityFeePerGas: 1n,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[TransactionEnvelope.TipAboveFeeCapError: The provided tip (\`maxPriorityFeePerGas\` = 0.000000001 gwei) cannot be higher than the fee cap (\`maxFeePerGas\` = 0 gwei).]`,
+    )
+  })
+
   test('invalid chain id', () => {
     expect(() =>
       TxEnvelopeTempo.assert({
@@ -138,6 +151,44 @@ describe('deserialize', () => {
     expect(deserialized).toEqual(transaction)
   })
 
+  test('tip above empty fee cap', () => {
+    const serialized = TxEnvelopeTempo.serialize({
+      calls: [{ to: '0x0000000000000000000000000000000000000000' }],
+      chainId: 1,
+      maxPriorityFeePerGas: 1n,
+    })
+    expect(() =>
+      TxEnvelopeTempo.deserialize(serialized),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[TransactionEnvelope.TipAboveFeeCapError: The provided tip (\`maxPriorityFeePerGas\` = 0.000000001 gwei) cannot be higher than the fee cap (\`maxFeePerGas\` = 0 gwei).]`,
+    )
+  })
+
+  test('fee payer', () => {
+    const serialized = TxEnvelopeTempo.serialize(transaction, {
+      format: 'feePayer',
+      sender: '0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266',
+    })
+
+    expect(TxEnvelopeTempo.deserialize(serialized)).toMatchInlineSnapshot(`
+      {
+        "calls": [
+          {
+            "to": "0x70997970c51812dc3a010c7d01b50e0d17dc79c8",
+          },
+        ],
+        "chainId": 1,
+        "feePayerSignature": null,
+        "from": "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266",
+        "maxFeePerGas": 2000000000n,
+        "maxPriorityFeePerGas": 2000000000n,
+        "nonce": 785n,
+        "nonceKey": 0n,
+        "type": "tempo",
+      }
+    `)
+  })
+
   test('minimal', () => {
     const transaction = TxEnvelopeTempo.from({
       chainId: 1,

package/tempo/TxEnvelopeTempo.ts

@@ -215,8 +215,8 @@ export function assert(envelope: PartialBy<TxEnvelopeTempo, 'type'>) {
     })
 
   if (
-    maxPriorityFeePerGas &&
-    maxFeePerGas &&
+    typeof maxPriorityFeePerGas === 'bigint' &&
+    typeof maxFeePerGas === 'bigint' &&
     maxPriorityFeePerGas > maxFeePerGas
   )
     throw new TransactionEnvelope.TipAboveFeeCapError({
@@ -326,6 +326,12 @@ export function deserialize(serialized: Serialized): Compute<TxEnvelopeTempo> {
     transaction.maxFeePerGas = BigInt(maxFeePerGas)
   if (Hex.validate(maxPriorityFeePerGas) && maxPriorityFeePerGas !== '0x')
     transaction.maxPriorityFeePerGas = BigInt(maxPriorityFeePerGas)
+  // An empty `maxFeePerGas` encodes zero, so a tip above it is rejected.
+  if (
+    transaction.maxPriorityFeePerGas &&
+    typeof transaction.maxFeePerGas === 'undefined'
+  )
+    transaction.maxFeePerGas = 0n
   if (Hex.validate(nonceKey))
     transaction.nonceKey = nonceKey === '0x' ? 0n : BigInt(nonceKey)
   if (Hex.validate(validBefore) && validBefore !== '0x')

package/tempo/e2e.test.ts

@@ -2849,14 +2849,10 @@ describe('behavior: keyAuthorization', () => {
     },
   )
 
-  // TIP-1049 admin keys are not yet in any released tempo tag (only on
-  // `main` via PR #4265). CI runs the localnet job against the `edge`
-  // image which tracks main; devnet/testnet still ship the older
-  // release and would reject the 9-field wire format with
-  // `failed to decode signed transaction`.
-  // TODO: remove skipIf when devnet/testnet have T6 (TIP-1049).
+  // TIP-1137 removes TIP-1049 admin keys at T14. The localnet job runs the
+  // `edge` image, which has T14 active; devnet/testnet may not.
   test.skipIf(nodeEnv !== 'localnet')(
-    'behavior: TIP-1049 admin access key round-trips through registration',
+    'behavior: TIP-1137 rejects an admin key authorization',
     async () => {
       const accessPrivateKey = Secp256k1.randomPrivateKey()
       const accessAddress = Address.fromPublicKey(
@@ -2864,8 +2860,8 @@ describe('behavior: keyAuthorization', () => {
       )
 
       const keyAuth = KeyAuthorization.from({
-        address: accessAddress,
         account: root.address,
+        address: accessAddress,
         chainId: BigInt(chainId),
         isAdmin: true,
         type: 'secp256k1',
@@ -2889,15 +2885,79 @@ describe('behavior: keyAuthorization', () => {
         calls: [{ to: '0x0000000000000000000000000000000000000000' }],
         chainId,
         feeToken: '0x20c0000000000000000000000000000000000001',
+        gas: 1_000_000n,
         keyAuthorization: keyAuth_signed,
+        maxFeePerGas: Value.fromGwei('20'),
+        maxPriorityFeePerGas: Value.fromGwei('10'),
         nonce: BigInt(nonce),
+      })
+
+      const signature = Secp256k1.sign({
+        payload: TxEnvelopeTempo.getSignPayload(transaction, {
+          from: root.address,
+        }),
+        privateKey: accessPrivateKey,
+      })
+
+      const serialized_signed = TxEnvelopeTempo.serialize(transaction, {
+        signature: SignatureEnvelope.from({
+          inner: SignatureEnvelope.from(signature),
+          type: 'keychain',
+          userAddress: root.address,
+        }),
+      })
+
+      // From T14 no path can set `is_admin = true`.
+      await expect(
+        client.request({
+          method: 'eth_sendRawTransactionSync',
+          params: [serialized_signed],
+        }),
+      ).rejects.toThrow('InvalidKeyId')
+    },
+  )
+
+  test.skipIf(nodeEnv !== 'localnet')(
+    'behavior: account-bound key authorization round-trips through registration',
+    async () => {
+      const accessPrivateKey = Secp256k1.randomPrivateKey()
+      const accessAddress = Address.fromPublicKey(
+        Secp256k1.getPublicKey({ privateKey: accessPrivateKey }),
+      )
+
+      // From T14 an `account` binding must equal the transaction sender.
+      const keyAuth = KeyAuthorization.from({
+        account: root.address,
+        address: accessAddress,
+        chainId: BigInt(chainId),
+        type: 'secp256k1',
+      })
+
+      const keyAuth_signed = KeyAuthorization.from(keyAuth, {
+        signature: SignatureEnvelope.from(
+          Secp256k1.sign({
+            payload: KeyAuthorization.getSignPayload(keyAuth),
+            privateKey: root.privateKey,
+          }),
+        ),
+      })
+
+      const nonce = await getTransactionCount(client, {
+        address: root.address,
+        blockTag: 'pending',
+      })
+
+      const transaction = TxEnvelopeTempo.from({
+        calls: [{ to: '0x0000000000000000000000000000000000000000' }],
+        chainId,
+        feeToken: '0x20c0000000000000000000000000000000000001',
         gas: 1_000_000n,
+        keyAuthorization: keyAuth_signed,
         maxFeePerGas: Value.fromGwei('20'),
         maxPriorityFeePerGas: Value.fromGwei('10'),
+        nonce: BigInt(nonce),
       })
 
-      // The admin access key signs and authorizes itself in the same tx
-      // (the canonical "auth+use" registration pattern).
       const signature = Secp256k1.sign({
         payload: TxEnvelopeTempo.getSignPayload(transaction, {
           from: root.address,
@@ -2907,9 +2967,9 @@ describe('behavior: keyAuthorization', () => {
 
       const serialized_signed = TxEnvelopeTempo.serialize(transaction, {
         signature: SignatureEnvelope.from({
-          userAddress: root.address,
           inner: SignatureEnvelope.from(signature),
           type: 'keychain',
+          userAddress: root.address,
         }),
       })
 
@@ -2929,12 +2989,8 @@ describe('behavior: keyAuthorization', () => {
         .then((tx) => Transaction.fromRpc(tx as any))
       if (!response) throw new Error()
 
-      // isAdmin + account must survive the round trip through the node.
-      expect(response.keyAuthorization?.isAdmin).toBe(true)
+      expect(response.keyAuthorization?.isAdmin).toBeUndefined()
       expect(response.keyAuthorization?.account).toBe(root.address)
-
-      // The signing hash of the round-tripped authorization equals the
-      // admin-bearing hash.
       expect(KeyAuthorization.hash(response.keyAuthorization!)).toBe(
         KeyAuthorization.hash(keyAuth_signed),
       )
@@ -2943,7 +2999,7 @@ describe('behavior: keyAuthorization', () => {
 
   // TODO: remove skipIf when devnet/testnet have T6.
   test.skipIf(nodeEnv !== 'localnet')(
-    'behavior: TIP-1049 non-admin authorization is byte-equivalent to pre-TIP-1049',
+    'behavior: unbound authorization is byte-equivalent to pre-TIP-1049',
     async () => {
       const accessPrivateKey = Secp256k1.randomPrivateKey()
       const accessAddress = Address.fromPublicKey(

package/version.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export const version = '0.14.60'
+export const version = '0.14.61'