zk-agent-cli 0.1.0-beta.1 → 0.1.0-beta.2

package/dist/builtin-account-profiles/contracts/daily-spend-limit/AAFactory.sol

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/Constants.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/SystemContractsCaller.sol';
+
+contract AAFactory {
+  bytes32 public aaBytecodeHash;
+
+  constructor(bytes32 _aaBytecodeHash) {
+    aaBytecodeHash = _aaBytecodeHash;
+  }
+
+  function deployAccount(bytes32 salt, address owner) external returns (address accountAddress) {
+    (bool success, bytes memory returnData) = SystemContractsCaller.systemCallWithReturndata(
+      uint32(gasleft()),
+      address(DEPLOYER_SYSTEM_CONTRACT),
+      uint128(0),
+      abi.encodeCall(
+        DEPLOYER_SYSTEM_CONTRACT.create2Account,
+        (salt, aaBytecodeHash, abi.encode(owner), IContractDeployer.AccountAbstractionVersion.Version1)
+      )
+    );
+    require(success, 'Deployment failed');
+
+    (accountAddress) = abi.decode(returnData, (address));
+  }
+}

package/dist/builtin-account-profiles/contracts/daily-spend-limit/Account.sol

@@ -0,0 +1,179 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/interfaces/IAccount.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/TransactionHelper.sol';
+import '@openzeppelin/contracts/interfaces/IERC1271.sol';
+import '@openzeppelin/contracts/utils/cryptography/ECDSA.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/Constants.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/SystemContractsCaller.sol';
+import './SpendLimit.sol';
+
+contract Account is IAccount, IERC1271, SpendLimit {
+  using TransactionHelper for Transaction;
+
+  address public owner;
+
+  bytes4 constant EIP1271_SUCCESS_RETURN_VALUE = 0x1626ba7e;
+
+  modifier onlyBootloader() {
+    require(msg.sender == BOOTLOADER_FORMAL_ADDRESS, 'Only bootloader can call this method');
+    _;
+  }
+
+  constructor(address _owner) {
+    owner = _owner;
+  }
+
+  function validateTransaction(
+    bytes32,
+    bytes32 _suggestedSignedHash,
+    Transaction calldata _transaction
+  ) external payable override onlyBootloader returns (bytes4 magic) {
+    return _validateTransaction(_suggestedSignedHash, _transaction);
+  }
+
+  function _validateTransaction(
+    bytes32 _suggestedSignedHash,
+    Transaction calldata _transaction
+  ) internal returns (bytes4 magic) {
+    SystemContractsCaller.systemCallWithPropagatedRevert(
+      uint32(gasleft()),
+      address(NONCE_HOLDER_SYSTEM_CONTRACT),
+      0,
+      abi.encodeCall(INonceHolder.incrementMinNonceIfEquals, (_transaction.nonce))
+    );
+
+    bytes32 txHash;
+    if (_suggestedSignedHash == bytes32(0)) {
+      txHash = _transaction.encodeHash();
+    } else {
+      txHash = _suggestedSignedHash;
+    }
+
+    uint256 totalRequiredBalance = _totalRequiredBalance(_transaction);
+    require(totalRequiredBalance <= address(this).balance, 'Not enough balance for fee + value');
+
+    if (isValidSignature(txHash, _transaction.signature) == EIP1271_SUCCESS_RETURN_VALUE) {
+      magic = ACCOUNT_VALIDATION_SUCCESS_MAGIC;
+    } else {
+      magic = bytes4(0);
+    }
+  }
+
+  function executeTransaction(
+    bytes32,
+    bytes32,
+    Transaction calldata _transaction
+  ) external payable override onlyBootloader {
+    _executeTransaction(_transaction);
+  }
+
+  function _executeTransaction(Transaction calldata _transaction) internal {
+    address to = address(uint160(_transaction.to));
+    uint128 value = _transactionMsgValue(_transaction);
+    bytes memory data = _transaction.data;
+
+    if (value > 0) {
+      _checkSpendingLimit(address(BASE_TOKEN_SYSTEM_CONTRACT), value);
+    }
+
+    if (to == address(DEPLOYER_SYSTEM_CONTRACT)) {
+      uint32 gas = Utils.safeCastToU32(gasleft());
+      SystemContractsCaller.systemCallWithPropagatedRevert(gas, to, value, data);
+    } else {
+      bool success;
+      assembly {
+        success := call(gas(), to, value, add(data, 0x20), mload(data), 0, 0)
+      }
+      require(success, 'Account call failed');
+    }
+  }
+
+  function executeTransactionFromOutside(Transaction calldata _transaction) external payable {
+    bytes4 magic = _validateTransaction(bytes32(0), _transaction);
+    require(magic == ACCOUNT_VALIDATION_SUCCESS_MAGIC, 'NOT VALIDATED');
+    _executeTransaction(_transaction);
+  }
+
+  function isValidSignature(bytes32 _hash, bytes memory _signature)
+    public
+    view
+    override
+    returns (bytes4 magic)
+  {
+    magic = EIP1271_SUCCESS_RETURN_VALUE;
+
+    if (_signature.length != 65) {
+      _signature = new bytes(65);
+      _signature[64] = bytes1(uint8(27));
+    }
+
+    uint8 v;
+    bytes32 r;
+    bytes32 s;
+    assembly {
+      r := mload(add(_signature, 0x20))
+      s := mload(add(_signature, 0x40))
+      v := and(mload(add(_signature, 0x41)), 0xff)
+    }
+
+    if (v != 27 && v != 28) {
+      magic = bytes4(0);
+    }
+
+    if (uint256(s) > 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0) {
+      magic = bytes4(0);
+    }
+
+    address recoveredAddress = ecrecover(_hash, v, r, s);
+    if (recoveredAddress != owner && recoveredAddress != address(0)) {
+      magic = bytes4(0);
+    }
+  }
+
+  function payForTransaction(
+    bytes32,
+    bytes32,
+    Transaction calldata _transaction
+  ) external payable override onlyBootloader {
+    bool success = _transaction.payToTheBootloader();
+    require(success, 'Failed to pay the fee to the operator');
+  }
+
+  function prepareForPaymaster(
+    bytes32,
+    bytes32,
+    Transaction calldata _transaction
+  ) external payable override onlyBootloader {
+    _transaction.processPaymasterInput();
+  }
+
+  fallback() external {
+    assert(msg.sender != BOOTLOADER_FORMAL_ADDRESS);
+  }
+
+  receive() external payable {}
+
+  function _transactionMsgValue(Transaction calldata _transaction) internal pure returns (uint128) {
+    uint256 value = _transaction.reserved[1];
+    if (value == 0) {
+      value = _transaction.value;
+    }
+
+    return Utils.safeCastToU128(value);
+  }
+
+  function _totalRequiredBalance(Transaction calldata _transaction) internal pure returns (uint256) {
+    uint256 value = _transaction.reserved[1];
+    if (value == 0) {
+      value = _transaction.value;
+    }
+
+    if (address(uint160(_transaction.paymaster)) != address(0)) {
+      return value;
+    }
+
+    return _transaction.maxFeePerGas * _transaction.gasLimit + value;
+  }
+}

package/dist/builtin-account-profiles/contracts/daily-spend-limit/SpendLimit.sol

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+contract SpendLimit {
+  uint256 public constant ONE_DAY = 24 hours;
+
+  struct Limit {
+    uint256 limit;
+    uint256 available;
+    uint256 resetTime;
+    bool isEnabled;
+  }
+
+  mapping(address => Limit) public limits;
+
+  modifier onlyAccount() {
+    require(msg.sender == address(this), 'Only the account contract can call this method.');
+    _;
+  }
+
+  function setSpendingLimit(address _token, uint256 _amount) public onlyAccount {
+    require(_amount != 0, 'Invalid amount');
+
+    uint256 resetTime;
+    uint256 timestamp = block.timestamp;
+
+    if (isValidUpdate(_token)) {
+      resetTime = timestamp + ONE_DAY;
+    } else {
+      resetTime = timestamp;
+    }
+
+    _updateLimit(_token, _amount, _amount, resetTime, true);
+  }
+
+  function removeSpendingLimit(address _token) public onlyAccount {
+    require(isValidUpdate(_token), 'Invalid Update');
+    _updateLimit(_token, 0, 0, 0, false);
+  }
+
+  function isValidUpdate(address _token) internal view returns (bool) {
+    if (limits[_token].isEnabled) {
+      require(
+        limits[_token].limit == limits[_token].available || block.timestamp > limits[_token].resetTime,
+        'Invalid Update'
+      );
+
+      return true;
+    }
+
+    return false;
+  }
+
+  function _updateLimit(
+    address _token,
+    uint256 _limit,
+    uint256 _available,
+    uint256 _resetTime,
+    bool _isEnabled
+  ) private {
+    Limit storage limit = limits[_token];
+    limit.limit = _limit;
+    limit.available = _available;
+    limit.resetTime = _resetTime;
+    limit.isEnabled = _isEnabled;
+  }
+
+  function _checkSpendingLimit(address _token, uint256 _amount) internal {
+    Limit memory limit = limits[_token];
+    if (!limit.isEnabled) return;
+
+    uint256 timestamp = block.timestamp;
+
+    if (limit.limit != limit.available && timestamp > limit.resetTime) {
+      limit.resetTime = timestamp + ONE_DAY;
+      limit.available = limit.limit;
+    } else if (limit.limit == limit.available) {
+      limit.resetTime = timestamp + ONE_DAY;
+    }
+
+    require(limit.available >= _amount, 'Exceeds daily limit');
+    limit.available -= _amount;
+    limits[_token] = limit;
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/Account.sol

@@ -0,0 +1,230 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/interfaces/IAccount.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/TransactionHelper.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/EfficientCall.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/Constants.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/SystemContractsCaller.sol';
+import '@openzeppelin/contracts/interfaces/IERC1271.sol';
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/Utils.sol';
+import './EOAValidator.sol';
+import './IValidator.sol';
+import './OwnerManager.sol';
+import './ValidatorManager.sol';
+import './ModuleManager.sol';
+import './ValidationHookManager.sol';
+
+contract Account is
+  IAccount,
+  IERC1271,
+  OwnerManager,
+  ValidatorManager,
+  ModuleManager,
+  ValidationHookManager
+{
+  using TransactionHelper for Transaction;
+
+  bytes4 private constant EIP1271_SUCCESS_RETURN_VALUE = 0x1626ba7e;
+
+  struct Call {
+    address target;
+    bool allowFailure;
+    uint256 value;
+    bytes callData;
+  }
+
+  struct NativeSpendCap {
+    uint256 maxPerTx;
+    bool enabled;
+  }
+
+  NativeSpendCap public nativeSpendCap;
+  event NativeSpendCapSet(uint256 maxPerTx);
+  event NativeSpendCapRemoved();
+
+  constructor(address _owner) {
+    _initializeOwner(_owner);
+    _setValidator(address(new EOAValidator()));
+  }
+
+  function validateTransaction(
+    bytes32,
+    bytes32 _suggestedSignedHash,
+    Transaction calldata _transaction
+  ) external payable override onlyBootloader returns (bytes4 magic) {
+    return _validateTransaction(_suggestedSignedHash, _transaction);
+  }
+
+  function executeTransaction(
+    bytes32,
+    bytes32,
+    Transaction calldata _transaction
+  ) external payable override onlyBootloader {
+    _executeTransaction(_transaction);
+  }
+
+  function executeTransactionFromOutside(Transaction calldata _transaction)
+    external
+    payable
+    override
+  {
+    require(msg.sender == owner, 'Only owner can call this method');
+    bytes4 magic = _validateTransaction(bytes32(0), _transaction);
+    require(magic == ACCOUNT_VALIDATION_SUCCESS_MAGIC, 'NOT VALIDATED');
+    _executeTransaction(_transaction);
+  }
+
+  function payForTransaction(
+    bytes32,
+    bytes32,
+    Transaction calldata _transaction
+  ) external payable override onlyBootloader {
+    bool success = _transaction.payToTheBootloader();
+    require(success, 'Failed to pay the fee to the operator');
+  }
+
+  function prepareForPaymaster(
+    bytes32,
+    bytes32,
+    Transaction calldata _transaction
+  ) external payable override onlyBootloader {
+    _transaction.processPaymasterInput();
+  }
+
+  function setNativeSpendCap(uint256 maxPerTx) external onlySelf {
+    require(maxPerTx > 0, 'Spend cap must be greater than zero');
+    nativeSpendCap = NativeSpendCap({ maxPerTx: maxPerTx, enabled: true });
+    emit NativeSpendCapSet(maxPerTx);
+  }
+
+  function removeNativeSpendCap() external onlySelf {
+    delete nativeSpendCap;
+    emit NativeSpendCapRemoved();
+  }
+
+  function executeBatch(Call[] calldata calls) external onlySelf {
+    uint256 length = calls.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      Call calldata calli = calls[i];
+      _executeCall(
+        calli.target,
+        Utils.safeCastToU128(calli.value),
+        calli.callData,
+        calli.allowFailure
+      );
+    }
+  }
+
+  function isValidSignature(bytes32 _hash, bytes memory _signature)
+    public
+    view
+    override
+    returns (bytes4 magic)
+  {
+    address currentValidator = validator;
+    if (currentValidator == address(0)) {
+      return bytes4(0);
+    }
+
+    address recoveredAddress = IK1Validator(currentValidator).validateSignature(_hash, _signature);
+    if (recoveredAddress != owner || recoveredAddress == address(0)) {
+      return bytes4(0);
+    }
+
+    return EIP1271_SUCCESS_RETURN_VALUE;
+  }
+
+  fallback() external {
+    assert(msg.sender != BOOTLOADER_FORMAL_ADDRESS);
+  }
+
+  receive() external payable {}
+
+  function _validateTransaction(
+    bytes32 _suggestedSignedHash,
+    Transaction calldata _transaction
+  ) internal returns (bytes4 magic) {
+    SystemContractsCaller.systemCallWithPropagatedRevert(
+      uint32(gasleft()),
+      address(NONCE_HOLDER_SYSTEM_CONTRACT),
+      0,
+      abi.encodeCall(INonceHolder.incrementMinNonceIfEquals, (_transaction.nonce))
+    );
+
+    bytes32 txHash = _suggestedSignedHash == bytes32(0)
+      ? _transaction.encodeHash()
+      : _suggestedSignedHash;
+
+    require(
+      _transaction.totalRequiredBalance() <= address(this).balance,
+      'Not enough balance for fee + value'
+    );
+
+    uint256 nativeValue = _transactionMsgValue(_transaction);
+    if (nativeSpendCap.enabled && nativeValue > nativeSpendCap.maxPerTx) {
+      revert('Native transfer exceeds per-tx cap');
+    }
+
+    _runValidationHooks(txHash, _transaction);
+
+    if (isValidSignature(txHash, _transaction.signature) == EIP1271_SUCCESS_RETURN_VALUE) {
+      return ACCOUNT_VALIDATION_SUCCESS_MAGIC;
+    }
+
+    return bytes4(0);
+  }
+
+  function _executeTransaction(Transaction calldata _transaction) internal {
+    _executeCall(
+      address(uint160(_transaction.to)),
+      Utils.safeCastToU128(_transactionMsgValue(_transaction)),
+      _transaction.data,
+      false
+    );
+  }
+
+  function _transactionMsgValue(Transaction calldata _transaction) internal pure returns (uint256) {
+    if (_transaction.reserved[1] != 0) {
+      return _transaction.reserved[1];
+    }
+
+    return _transaction.value;
+  }
+
+  function _executeCall(
+    address to,
+    uint128 value,
+    bytes calldata data,
+    bool allowFailure
+  ) internal {
+    uint32 gasToPass = Utils.safeCastToU32(gasleft());
+
+    if (to == address(DEPLOYER_SYSTEM_CONTRACT)) {
+      (bool deploymentSuccess, bytes memory returnData) = SystemContractsCaller.systemCallWithReturndata(
+        gasToPass,
+        to,
+        value,
+        data
+      );
+
+      if (!deploymentSuccess && !allowFailure) {
+        assembly {
+          let size := mload(returnData)
+          revert(add(returnData, 0x20), size)
+        }
+      }
+
+      return;
+    }
+
+    bool success = EfficientCall.rawCall(gasToPass, to, value, data, false);
+    if (!success && !allowFailure) {
+      EfficientCall.propagateRevert();
+    }
+  }
+
+  function _executeModuleCall(address to, uint128 value, bytes calldata data) internal override {
+    _executeCall(to, value, data, false);
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/Auth.sol

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import './BootloaderAuth.sol';
+import './SelfAuth.sol';
+import './ModuleAuth.sol';
+
+abstract contract Auth is BootloaderAuth, SelfAuth, ModuleAuth {
+  modifier onlySelfOrModule() {
+    require(
+      msg.sender == address(this) || _isModule(msg.sender),
+      'Only the account contract or an enabled module can call this method'
+    );
+    _;
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/BootloaderAuth.sol

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/Constants.sol';
+
+abstract contract BootloaderAuth {
+  modifier onlyBootloader() {
+    require(msg.sender == BOOTLOADER_FORMAL_ADDRESS, 'Only bootloader can call this method');
+    _;
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/EOAValidator.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@openzeppelin/contracts/utils/cryptography/ECDSA.sol';
+import '@openzeppelin/contracts/utils/introspection/IERC165.sol';
+import './IValidator.sol';
+
+contract EOAValidator is IK1Validator {
+  using ECDSA for bytes32;
+
+  function validateSignature(
+    bytes32 signedHash,
+    bytes calldata signature
+  ) external pure override returns (address signer) {
+    (signer, , ) = signedHash.tryRecover(signature);
+  }
+
+  function supportsInterface(bytes4 interfaceId) external pure override returns (bool) {
+    return
+      interfaceId == type(IK1Validator).interfaceId ||
+      interfaceId == type(IERC165).interfaceId;
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/IValidationHook.sol

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/TransactionHelper.sol';
+import '@openzeppelin/contracts/utils/introspection/IERC165.sol';
+
+interface IInitable {
+  event Inited(address indexed account);
+  event Disabled(address indexed account);
+
+  function init(bytes calldata initData) external;
+
+  function disable() external;
+
+  function isInited(address account) external view returns (bool);
+}
+
+interface IValidationHook is IInitable, IERC165 {
+  function validationHook(bytes32 signedHash, Transaction calldata transaction) external;
+}

package/dist/builtin-account-profiles/contracts/sed-lite/IValidator.sol

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@openzeppelin/contracts/utils/introspection/IERC165.sol';
+
+interface IK1Validator is IERC165 {
+  function validateSignature(
+    bytes32 signedHash,
+    bytes calldata signature
+  ) external view returns (address signer);
+}

package/dist/builtin-account-profiles/contracts/sed-lite/ModuleAuth.sol

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+abstract contract ModuleAuth {
+  function _isModule(address addr) internal view virtual returns (bool);
+
+  modifier onlyModule() {
+    require(_isModule(msg.sender), 'Only enabled modules can call this method');
+    _;
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/ModuleManager.sol

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/Utils.sol';
+import './Auth.sol';
+
+abstract contract ModuleManager is Auth {
+  mapping(address => bool) public modules;
+
+  event ModuleAdded(address indexed module);
+  event ModuleRemoved(address indexed module);
+
+  function addModule(address module) external onlySelf {
+    _addModule(module);
+  }
+
+  function removeModule(address module) external onlySelf {
+    _removeModule(module);
+  }
+
+  function executeFromModule(address to, uint256 value, bytes calldata data) external onlyModule {
+    require(to != address(this), 'Recursive module calls are not allowed');
+    _executeModuleCall(to, Utils.safeCastToU128(value), data);
+  }
+
+  function _isModule(address addr) internal view virtual override returns (bool) {
+    return modules[addr];
+  }
+
+  function _addModule(address module) internal {
+    require(module != address(0), 'Module must not be zero');
+    require(module != address(this), 'Account can not be a module');
+    require(module.code.length > 0, 'Module must be a deployed contract');
+    require(!modules[module], 'Module already enabled');
+    modules[module] = true;
+    emit ModuleAdded(module);
+  }
+
+  function _removeModule(address module) internal {
+    require(modules[module], 'Module is not enabled');
+    delete modules[module];
+    emit ModuleRemoved(module);
+  }
+
+  function _executeModuleCall(address to, uint128 value, bytes calldata data) internal virtual;
+}