Changes from CBSWv2 research - #46
Open
amiecorso wants to merge 10 commits into
Open
Conversation
- DefaultAccount: add single-call execute(address,uint256,bytes) (V1-compatible selector 0xb61d27f6) - CanonicalHighRatePayerAccount: lock-gate the new execute() outbound value transfer - PolicyManager: remove executeAttested; resolve the acting actorId from the tx-context precompile with a fallback to the account's own ITransactionContext surface, and enforce actor expiry on execute() - Add EIP7702ProxyFor8130: minimal EIP-8130-native 7702 delegation proxy (ported from base-account-v2), registry-gated setImplementation + default-implementation fallback, no EOA-key override Unreviewed prototype for team review.
- Require the resolved actor be gated to this manager (getPolicyManager == address(this)), mirroring the external path; closes an off-8130 confinement gap - Reject actorId == 0 explicitly (the "no acting actor" sentinel) - Require exact 32-byte returns in _resolveActorId so malformed data degrades to "no actor" instead of reverting decode - Document the off-8130 account-side trust assumption in NatSpec - Tests: add manager-mismatch rejection + execute() reentrancy regression coverage
…tePayerAccount - DefaultAccount now blocks outbound value transfers while locked (execute + executeBatch) via a shared _isLocked() helper, with an AccountLocked error — high-rate-payer-safe by default - Remove CanonicalHighRatePayerAccount: its lock-gate now lives in the base account. High-rate admission is ultimately a node allowlist, so an immutable ERC-1167 clone of DefaultAccount (or another allowlisted implementation) is the admission path; an immutable proxy can be added later if ever needed - Deploy.s.sol: deploy only DefaultAccount and log its ERC-1167 match bytecode for high-rate payers - README: document the single lock-respecting account + allowlist-based admission - Tests: fold lock-gating + execute() coverage into DefaultAccount.t.sol; drop the CanonicalHighRatePayerAccount suite
A policy-gated session key carrying a PAYER scope cannot be safely confined under ERC-4337, so policies are supported ONLY via native EIP-8130 protocol dispatch. - Remove the account-exposed ITransactionContext fallback in actor resolution: execute() reads the transaction-context precompile only; where it is absent the acting actorId is 0 and the call reverts NoActivePolicy (it just fails) - Revert execute() to the protocol-only form: drop the fallback-motivated manager-match, actorId==0, and local expiry checks (the 8130 protocol gate already guarantees these on the only reachable path) - Restore _actingActorId (precompile-only); document that there is deliberately no account-attested / 4337 policy path - Tests: drop the account-fallback / precedence / expiry / manager-match cases; keep the execute() reentrancy regression test
…o-EOA-fallback invariant Co-authored-by: OpenCode <opencode-noreply@coinbase.com>
…comment Co-authored-by: OpenCode <opencode-noreply@coinbase.com>
…r works on any chain Co-authored-by: OpenCode <opencode-noreply@coinbase.com>
Co-authored-by: OpenCode <opencode-noreply@coinbase.com>
amiecorso
marked this pull request as ready for review
July 29, 2026 21:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Captures several changes surfaced while researching a CBSWv1 -> v2 migration on EIP-8130.
1. DefaultAccount: single-call
executeAdds
execute(address,uint256,bytes)alongsideexecuteBatch— a single-call convenience with the same authorization and lock-gating. Its selector is0xb61d27f6, matching the widely deployedexecute(address,uint256,bytes)ABI, so integrations that call that ABI directly work against an 8130 account.2. DefaultAccount is high-rate-payer-safe by default; remove CanonicalHighRatePayerAccount
DefaultAccountnow blocks outbound ETH value transfers while the account is locked inAccountConfiguration(on bothexecuteandexecuteBatch); zero-value calls are unaffected. This makes lock-respecting the default behavior, so the separateCanonicalHighRatePayerAccountis removed. High-rate admission is ultimately a node allowlist over an ERC-1167 clone ofDefaultAccount(an immutable proxy or another conforming implementation can be allowlisted later if needed).Deploy.s.soland the README are updated to the single account.3. PolicyManager: remove
executeAttestedRemoves the
executeAttestedentrypoint. The account-actingexecutepath is EIP-8130-native: it resolves the actingactorIdsolely from the transaction-context precompile, and where the precompile is absent the acting actorId is0and the call revertsNoActivePolicy. The external-caller paths (executeFor/executeForMany) derive identity frommsg.senderand work on any chain. There is deliberately no ERC-4337 / off-8130 path forexecute: a policy-gated session key carrying a PAYER scope cannot be safely confined under 4337, so the manager will not accept an account-attested identity.4. EIP7702ProxyFor8130 (new)
Ports the minimal EIP-8130-native EIP-7702 delegation proxy from base-account-v2 into this repo for audit. It adds no authorization of its own beyond a registry-gated
setImplementationrecovery function and a default-implementation fallback; it does not override EOA key behavior (that is governed by AccountConfiguration).Testing
forge test: 331 pass, 0 fail.forge fmt --checkclean.Deploy.s.solcompiles and previews. Coverage added for single-callexecute(incl. lock-gating), aPolicyManagerreentrancy-guard case, and the new proxy (10 cases); removed theexecuteAttestedandCanonicalHighRatePayerAccountsuites. Tests and new-contract natspec conform to the team style/test conventions (harness test naming, per-test natspec, fuzz-by-default).