ox 1.8.10 → 1.8.13

package/src/tempo/SignatureEnvelope.test.ts

@@ -1769,9 +1769,7 @@ describe('sortApprovals', () => {
     owners: ascendingOwners.map((o) => ({ owner: o.address, weight: 1 })),
   })
   const payload = `0x${'42'.repeat(32)}` as const
-  const account = AccountConfig.getAddress(genesisConfig, {
-    factory: '0x7171717171717171717171717171717171717171',
-  })
+  const account = AccountConfig.getAddress(genesisConfig)
   const version = 3n
   const digest = AccountConfig.getSignPayload({
     payload,

package/src/tempo/TxEnvelopeTempo.test.ts

@@ -106,6 +106,19 @@ describe('assert', () => {
     )
   })
 
+  test('tip above zero fee cap', () => {
+    expect(() =>
+      TxEnvelopeTempo.assert({
+        calls: [{ to: '0x0000000000000000000000000000000000000000' }],
+        chainId: 1,
+        maxFeePerGas: 0n,
+        maxPriorityFeePerGas: 1n,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[TransactionEnvelope.TipAboveFeeCapError: The provided tip (\`maxPriorityFeePerGas\` = 0.000000001 gwei) cannot be higher than the fee cap (\`maxFeePerGas\` = 0 gwei).]`,
+    )
+  })
+
   test('invalid chain id', () => {
     expect(() =>
       TxEnvelopeTempo.assert({
@@ -138,6 +151,19 @@ describe('deserialize', () => {
     expect(deserialized).toEqual(transaction)
   })
 
+  test('tip above empty fee cap', () => {
+    const serialized = TxEnvelopeTempo.serialize({
+      calls: [{ to: '0x0000000000000000000000000000000000000000' }],
+      chainId: 1,
+      maxPriorityFeePerGas: 1n,
+    })
+    expect(() =>
+      TxEnvelopeTempo.deserialize(serialized),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[TransactionEnvelope.TipAboveFeeCapError: The provided tip (\`maxPriorityFeePerGas\` = 0.000000001 gwei) cannot be higher than the fee cap (\`maxFeePerGas\` = 0 gwei).]`,
+    )
+  })
+
   test('fee payer', () => {
     const serialized = TxEnvelopeTempo.serialize(transaction, {
       format: 'feePayer',

package/src/tempo/TxEnvelopeTempo.ts

@@ -214,8 +214,8 @@ export function assert(envelope: PartialBy<TxEnvelopeTempo, 'type'>) {
     })
 
   if (
-    maxPriorityFeePerGas &&
-    maxFeePerGas &&
+    typeof maxPriorityFeePerGas === 'bigint' &&
+    typeof maxFeePerGas === 'bigint' &&
     maxPriorityFeePerGas > maxFeePerGas
   )
     throw new TransactionEnvelope.TipAboveFeeCapError({
@@ -335,6 +335,12 @@ export function deserialize(serialized: Serialized): Compute<TxEnvelopeTempo> {
     transaction.maxFeePerGas = BigInt(maxFeePerGas)
   if (Hex.validate(maxPriorityFeePerGas) && maxPriorityFeePerGas !== '0x')
     transaction.maxPriorityFeePerGas = BigInt(maxPriorityFeePerGas)
+  // An empty `maxFeePerGas` encodes zero, so a tip above it is rejected.
+  if (
+    transaction.maxPriorityFeePerGas &&
+    typeof transaction.maxFeePerGas === 'undefined'
+  )
+    transaction.maxFeePerGas = 0n
   if (Hex.validate(nonceKey))
     transaction.nonceKey = nonceKey === '0x' ? 0n : BigInt(nonceKey)
   if (Hex.validate(validBefore) && validBefore !== '0x')

package/src/tempo/configurableAccounts.e2e.test.ts

@@ -1,7 +1,6 @@
 import { AbiFunction, Address, Hex, Secp256k1, Value } from 'ox'
 import { describe, expect, test } from 'vp/test'
 import { chain, client, fundAddress } from '../../test/tempo/config.js'
-import { factory } from '../../test/tempo/configurableAccounts.js'
 import {
   AccountConfig,
   KeyAuthorization,
@@ -31,7 +30,7 @@ async function setup() {
     threshold: 2,
     owners: keys.map((key) => ({ owner: key.address, weight: 1 })),
   })
-  const account = AccountConfig.getAddress(config, { factory })
+  const account = AccountConfig.getAddress(config)
   await fundAddress(client, { address: account })
   return { account, config, keys }
 }

package/src/tempo/e2e.test.ts

@@ -2807,14 +2807,10 @@ describe('behavior: keyAuthorization', () => {
     },
   )
 
-  // TIP-1049 admin keys are not yet in any released tempo tag (only on
-  // `main` via PR #4265). CI runs the localnet job against the `edge`
-  // image which tracks main; devnet/testnet still ship the older
-  // release and would reject the 9-field wire format with
-  // `failed to decode signed transaction`.
-  // TODO: remove skipIf when devnet/testnet have T6 (TIP-1049).
+  // TIP-1137 removes TIP-1049 admin keys at T14. The localnet job runs the
+  // `edge` image, which has T14 active; devnet/testnet may not.
   test.skipIf(nodeEnv !== 'localnet')(
-    'behavior: TIP-1049 admin access key round-trips through registration',
+    'behavior: TIP-1137 rejects an admin key authorization',
     async () => {
       const accessPrivateKey = Secp256k1.randomPrivateKey()
       const accessAddress = Address.fromPublicKey(
@@ -2822,8 +2818,8 @@ describe('behavior: keyAuthorization', () => {
       )
 
       const keyAuth = KeyAuthorization.from({
-        address: accessAddress,
         account: root.address,
+        address: accessAddress,
         chainId: BigInt(chainId),
         isAdmin: true,
         type: 'secp256k1',
@@ -2847,15 +2843,79 @@ describe('behavior: keyAuthorization', () => {
         calls: [{ to: '0x0000000000000000000000000000000000000000' }],
         chainId,
         feeToken: '0x20c0000000000000000000000000000000000001',
+        gas: 1_000_000n,
         keyAuthorization: keyAuth_signed,
+        maxFeePerGas: Value.fromGwei('20'),
+        maxPriorityFeePerGas: Value.fromGwei('10'),
         nonce: BigInt(nonce),
+      })
+
+      const signature = Secp256k1.sign({
+        payload: TxEnvelopeTempo.getSignPayload(transaction, {
+          from: root.address,
+        }),
+        privateKey: accessPrivateKey,
+      })
+
+      const serialized_signed = TxEnvelopeTempo.serialize(transaction, {
+        signature: SignatureEnvelope.from({
+          inner: SignatureEnvelope.from(signature),
+          type: 'keychain',
+          userAddress: root.address,
+        }),
+      })
+
+      // From T14 no path can set `is_admin = true`.
+      await expect(
+        client.request({
+          method: 'eth_sendRawTransactionSync',
+          params: [serialized_signed],
+        }),
+      ).rejects.toThrow('InvalidKeyId')
+    },
+  )
+
+  test.skipIf(nodeEnv !== 'localnet')(
+    'behavior: account-bound key authorization round-trips through registration',
+    async () => {
+      const accessPrivateKey = Secp256k1.randomPrivateKey()
+      const accessAddress = Address.fromPublicKey(
+        Secp256k1.getPublicKey({ privateKey: accessPrivateKey }),
+      )
+
+      // From T14 an `account` binding must equal the transaction sender.
+      const keyAuth = KeyAuthorization.from({
+        account: root.address,
+        address: accessAddress,
+        chainId: BigInt(chainId),
+        type: 'secp256k1',
+      })
+
+      const keyAuth_signed = KeyAuthorization.from(keyAuth, {
+        signature: SignatureEnvelope.from(
+          Secp256k1.sign({
+            payload: KeyAuthorization.getSignPayload(keyAuth),
+            privateKey: root.privateKey,
+          }),
+        ),
+      })
+
+      const nonce = await getTransactionCount(client, {
+        address: root.address,
+        blockTag: 'pending',
+      })
+
+      const transaction = TxEnvelopeTempo.from({
+        calls: [{ to: '0x0000000000000000000000000000000000000000' }],
+        chainId,
+        feeToken: '0x20c0000000000000000000000000000000000001',
         gas: 1_000_000n,
+        keyAuthorization: keyAuth_signed,
         maxFeePerGas: Value.fromGwei('20'),
         maxPriorityFeePerGas: Value.fromGwei('10'),
+        nonce: BigInt(nonce),
       })
 
-      // The admin access key signs and authorizes itself in the same tx
-      // (the canonical "auth+use" registration pattern).
       const signature = Secp256k1.sign({
         payload: TxEnvelopeTempo.getSignPayload(transaction, {
           from: root.address,
@@ -2865,9 +2925,9 @@ describe('behavior: keyAuthorization', () => {
 
       const serialized_signed = TxEnvelopeTempo.serialize(transaction, {
         signature: SignatureEnvelope.from({
-          userAddress: root.address,
           inner: SignatureEnvelope.from(signature),
           type: 'keychain',
+          userAddress: root.address,
         }),
       })
 
@@ -2887,12 +2947,8 @@ describe('behavior: keyAuthorization', () => {
         .then((tx) => Transaction.fromRpc(tx as any))
       if (!response) throw new Error()
 
-      // isAdmin + account must survive the round trip through the node.
-      expect(response.keyAuthorization?.isAdmin).toBe(true)
+      expect(response.keyAuthorization?.isAdmin).toBeUndefined()
       expect(response.keyAuthorization?.account).toBe(root.address)
-
-      // The signing hash of the round-tripped authorization equals the
-      // admin-bearing hash.
       expect(KeyAuthorization.hash(response.keyAuthorization!)).toBe(
         KeyAuthorization.hash(keyAuth_signed),
       )
@@ -2901,7 +2957,7 @@ describe('behavior: keyAuthorization', () => {
 
   // TODO: remove skipIf when devnet/testnet have T6.
   test.skipIf(nodeEnv !== 'localnet')(
-    'behavior: TIP-1049 non-admin authorization is byte-equivalent to pre-TIP-1049',
+    'behavior: unbound authorization is byte-equivalent to pre-TIP-1049',
     async () => {
       const accessPrivateKey = Secp256k1.randomPrivateKey()
       const accessAddress = Address.fromPublicKey(

package/src/tempo/index.ts

@@ -29,9 +29,7 @@
  *   ]
  * })
  *
- * const account = AccountConfig.getAddress(initialConfig, {
- *   factory: '0x7171717171717171717171717171717171717171'
- * })
+ * const account = AccountConfig.getAddress(initialConfig)
  * ```
  *
  * @category Reference

package/src/version.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export const version = '1.8.10'
+export const version = '1.8.13'

package/src/zod/Authorization.ts

@@ -1,16 +1,14 @@
 /* eslint-disable jsdoc-js/require-jsdoc, jsdoc-js/require-description, jsdoc-js/require-example */
 import * as z_Address from './Address.js'
 import * as z_Hex from './Hex.js'
+import { quantityHex } from './internal/Integer.js'
 import * as z_Number from './Number.js'
 import * as z_Uint from './Uint.js'
 import * as z from 'zod/mini'
 
-const yParityHex = z_Hex.Hex.check(
-  z.refine(
-    (value) => value === '0x0' || value === '0x1',
-    'expected yParity hex',
-  ),
-)
+// EIP-7702 permits any `y_parity` below 2**8 in an authorization tuple, so
+// every authorization schema accepts an 8-bit `yParity`.
+const yParityHex = quantityHex(8)
 
 /** Unsigned EIP-7702 authorization schema. */
 export const Unsigned = z.object(unsignedFields(z_Number.Number, z_Uint.Uint))
@@ -22,12 +20,12 @@ export const UnsignedToRpc = z.object(
 
 /** Signed EIP-7702 authorization schema. */
 export const Signed = z.object(
-  signedFields(z_Number.Number, z_Uint.Uint, yParityUint()),
+  signedFields(z_Number.Number, z_Uint.Uint, z_Uint.Uint8),
 )
 
 /** Encode-only signed EIP-7702 authorization schema accepting numberish `toRpc` inputs. */
 export const SignedToRpc = z.object(
-  signedFields(z_Number.NumberToRpc, z_Uint.UintToRpc, yParityUintToRpc()),
+  signedFields(z_Number.NumberToRpc, z_Uint.UintToRpc, z_Uint.Uint8ToRpc),
 )
 
 /** EIP-7702 authorization schema. */
@@ -71,22 +69,6 @@ export const TupleList = z.readonly(z.array(Tuple))
 /** Signed EIP-7702 authorization tuple list schema. */
 export const TupleListSigned = z.readonly(z.array(TupleSigned))
 
-function yParityUint() {
-  return z_Uint.Uint8.check(
-    z.refine((value) => value === 0 || value === 1, 'expected yParity'),
-  )
-}
-
-function yParityUintToRpc() {
-  return z_Uint.Uint8ToRpc.check(
-    z.refine(
-      (value) =>
-        value === 0 || value === 1 || value === '0x0' || value === '0x1',
-      'expected yParity',
-    ),
-  )
-}
-
 function unsignedFields<num extends z.ZodMiniType, uint extends z.ZodMiniType>(
   num: num,
   uint: uint,

package/src/zod/_test/Authorization.test.ts

@@ -165,6 +165,39 @@ describe('Authorization', () => {
     `)
   })
 
+  test('accepts yParity above 1', () => {
+    expect(
+      z.decode(z_Authorization.Signed, {
+        address,
+        chainId: '0x1',
+        nonce: '0x2',
+        r,
+        s,
+        yParity: '0x1c',
+      }).yParity,
+    ).toMatchInlineSnapshot(`28`)
+    expect(
+      z.encode(z_Authorization.SignedToRpc, {
+        address,
+        chainId: 1,
+        nonce: 2n,
+        r,
+        s,
+        yParity: 28,
+      }).yParity,
+    ).toMatchInlineSnapshot(`"0x1c"`)
+    expect(
+      z.decode(z_Authorization.TupleSigned, [
+        '0x1',
+        address,
+        '0x2',
+        '0x1c',
+        r,
+        s,
+      ])[3],
+    ).toMatchInlineSnapshot(`"0x1c"`)
+  })
+
   test('rejects invalid signatures', () => {
     expect(
       z.safeDecode(z_Authorization.Signed, {
@@ -173,7 +206,7 @@ describe('Authorization', () => {
         nonce: '0x2',
         r,
         s,
-        yParity: '0x2',
+        yParity: '0x100',
       }).success,
     ).toBe(false)
     expect(
@@ -181,7 +214,7 @@ describe('Authorization', () => {
         '0x1',
         address,
         '0x2',
-        '0x2',
+        '0x100',
         r,
         s,
       ]).success,

package/src/zod/_test/TransactionRequest.test.ts

@@ -214,7 +214,7 @@ describe('TransactionRequest', () => {
     expect(
       z.safeDecode(z_TransactionRequest.TransactionRequest, {
         authorizationList: [
-          { address, chainId: '0x1', nonce: '0x2', r, s, yParity: '0x2' },
+          { address, chainId: '0x1', nonce: '0x2', r, s, yParity: '0x100' },
         ],
       }).success,
     ).toBe(false)