Weekly Development Update (7/18/24)

[CodesMcCabe]

• Account self call restrictions feat: [v0.8-develop] account self call restrictions reference-implementation#78

  • ERC-6900 v0.8 defines account self-calls to bypass validation for efficiency and new workflows like executeUserOp and executeWithAuthorization. Self-calls risk privilege escalation, giving validation functions unintended "root" access.
  • Added checks during validation:
    • For execute, disallow targeting the account.
    • For executeBatch, ensure validations apply and prevent recursive calls to execute or executeBatch.
  • This keeps self-calls for batching and new workflows while preventing privilege issues. A comprehensive test with ComprehensivePlugin ensures functionality.

• Expanded validation features with composability and multiple installations of same validation [1/n] Introduce EntityId in account and plugins reference-implementation#93

  • We now support multiple installations of same validation by introducing an entityId to represent different instances of installation.
  • Example validation (1SingleSignerValidation1) is added to show case how validation composability can be accomplished in v0.8.

• Direct plugin calls with validation & permission hooks Allow direct plugin calls with validation & permission hooks reference-implementation#90

  • To support workflows where actions are allowed only if authorized by a plugin (e.g., blocking transfers unless authorized by a plugin), we need a way for plugins to directly call account functions while allowing validation and permission hooks.
  • Added a field for allowed direct calls to account storage. This field is a mapping from caller to selector, containing a boolean and an array of validation hooks. In _checkPermittedCallerIfNotFromEP, called from wrapNativeFunction, the system now checks if the call is allowed to occur and executes its respective validation hooks.