|
| 1 | +// SPDX-License-Identifier: MIT |
| 2 | + |
| 3 | +pragma solidity ^0.8.20; |
| 4 | + |
| 5 | +import {Calldata} from "../Calldata.sol"; |
| 6 | + |
| 7 | +/** |
| 8 | + * @dev Utilities to process https://ercs.ethereum.org/ERCS/erc-7739[ERC-7739] typed data signatures |
| 9 | + * that are specific to an EIP-712 domain. |
| 10 | + * |
| 11 | + * This library provides methods to wrap, unwrap and operate over typed data signatures with a defensive |
| 12 | + * rehashing mechanism that includes the application's xref:api:utils#EIP712-_domainSeparatorV4[EIP-712] |
| 13 | + * and preserves readability of the signed content using an EIP-712 nested approach. |
| 14 | + * |
| 15 | + * A smart contract domain can validate a signature for a typed data structure in two ways: |
| 16 | + * |
| 17 | + * - As an application validating a typed data signature. See {typedDataSignStructHash}. |
| 18 | + * - As a smart contract validating a raw message signature. See {personalSignStructHash}. |
| 19 | + * |
| 20 | + * NOTE: A provider for a smart contract wallet would need to return this signature as the |
| 21 | + * result of a call to `personal_sign` or `eth_signTypedData`, and this may be unsupported by |
| 22 | + * API clients that expect a return value of 129 bytes, or specifically the `r,s,v` parameters |
| 23 | + * of an xref:api:utils#ECDSA[ECDSA] signature, as is for example specified for |
| 24 | + * xref:api:utils#EIP712[EIP-712]. |
| 25 | + */ |
| 26 | +library ERC7739Utils { |
| 27 | + /** |
| 28 | + * @dev An EIP-712 type to represent "personal" signatures |
| 29 | + * (i.e. mimic of `personal_sign` for smart contracts). |
| 30 | + */ |
| 31 | + bytes32 private constant PERSONAL_SIGN_TYPEHASH = keccak256("PersonalSign(bytes prefixed)"); |
| 32 | + |
| 33 | + /** |
| 34 | + * @dev Nest a signature for a given EIP-712 type into a nested signature for the domain of the app. |
| 35 | + * |
| 36 | + * Counterpart of {decodeTypedDataSig} to extract the original signature and the nested components. |
| 37 | + */ |
| 38 | + function encodeTypedDataSig( |
| 39 | + bytes memory signature, |
| 40 | + bytes32 appSeparator, |
| 41 | + bytes32 contentsHash, |
| 42 | + string memory contentsDescr |
| 43 | + ) internal pure returns (bytes memory) { |
| 44 | + return |
| 45 | + abi.encodePacked(signature, appSeparator, contentsHash, contentsDescr, uint16(bytes(contentsDescr).length)); |
| 46 | + } |
| 47 | + |
| 48 | + /** |
| 49 | + * @dev Parses a nested signature into its components. |
| 50 | + * |
| 51 | + * Constructed as follows: |
| 52 | + * |
| 53 | + * `signature ‖ APP_DOMAIN_SEPARATOR ‖ contentsHash ‖ contentsDescr ‖ uint16(contentsDescr.length)` |
| 54 | + * |
| 55 | + * - `signature` is the signature for the (ERC-7739) nested struct hash. This signature indirectly signs over the |
| 56 | + * original "contents" hash (from the app) and the account's domain separator. |
| 57 | + * - `APP_DOMAIN_SEPARATOR` is the EIP-712 {EIP712-_domainSeparatorV4} of the application smart contract that is |
| 58 | + * requesting the signature verification (though ERC-1271). |
| 59 | + * - `contentsHash` is the hash of the underlying data structure or message. |
| 60 | + * - `contentsDescr` is a descriptor of the "contents" part of the the EIP-712 type of the nested signature. |
| 61 | + * |
| 62 | + * NOTE: This function returns empty if the input format is invalid instead of reverting. |
| 63 | + * data instead. |
| 64 | + */ |
| 65 | + function decodeTypedDataSig( |
| 66 | + bytes calldata encodedSignature |
| 67 | + ) |
| 68 | + internal |
| 69 | + pure |
| 70 | + returns (bytes calldata signature, bytes32 appSeparator, bytes32 contentsHash, string calldata contentsDescr) |
| 71 | + { |
| 72 | + unchecked { |
| 73 | + uint256 sigLength = encodedSignature.length; |
| 74 | + |
| 75 | + // 66 bytes = contentsDescrLength (2 bytes) + contentsHash (32 bytes) + APP_DOMAIN_SEPARATOR (32 bytes). |
| 76 | + if (sigLength < 66) return (Calldata.emptyBytes(), 0, 0, Calldata.emptyString()); |
| 77 | + |
| 78 | + uint256 contentsDescrEnd = sigLength - 2; // Last 2 bytes |
| 79 | + uint256 contentsDescrLength = uint16(bytes2(encodedSignature[contentsDescrEnd:])); |
| 80 | + |
| 81 | + // Check for space for `contentsDescr` in addition to the 66 bytes documented above |
| 82 | + if (sigLength < 66 + contentsDescrLength) return (Calldata.emptyBytes(), 0, 0, Calldata.emptyString()); |
| 83 | + |
| 84 | + uint256 contentsHashEnd = contentsDescrEnd - contentsDescrLength; |
| 85 | + uint256 separatorEnd = contentsHashEnd - 32; |
| 86 | + uint256 signatureEnd = separatorEnd - 32; |
| 87 | + |
| 88 | + signature = encodedSignature[:signatureEnd]; |
| 89 | + appSeparator = bytes32(encodedSignature[signatureEnd:separatorEnd]); |
| 90 | + contentsHash = bytes32(encodedSignature[separatorEnd:contentsHashEnd]); |
| 91 | + contentsDescr = string(encodedSignature[contentsHashEnd:contentsDescrEnd]); |
| 92 | + } |
| 93 | + } |
| 94 | + |
| 95 | + /** |
| 96 | + * @dev Nests an `ERC-191` digest into a `PersonalSign` EIP-712 struct, and returns the corresponding struct hash. |
| 97 | + * This struct hash must be combined with a domain separator, using {MessageHashUtils-toTypedDataHash} before |
| 98 | + * being verified/recovered. |
| 99 | + * |
| 100 | + * This is used to simulates the `personal_sign` RPC method in the context of smart contracts. |
| 101 | + */ |
| 102 | + function personalSignStructHash(bytes32 contents) internal pure returns (bytes32) { |
| 103 | + return keccak256(abi.encode(PERSONAL_SIGN_TYPEHASH, contents)); |
| 104 | + } |
| 105 | + |
| 106 | + /** |
| 107 | + * @dev Nests an `EIP-712` hash (`contents`) into a `TypedDataSign` EIP-712 struct, and returns the corresponding |
| 108 | + * struct hash. This struct hash must be combined with a domain separator, using {MessageHashUtils-toTypedDataHash} |
| 109 | + * before being verified/recovered. |
| 110 | + */ |
| 111 | + function typedDataSignStructHash( |
| 112 | + string calldata contentsName, |
| 113 | + string calldata contentsType, |
| 114 | + bytes32 contentsHash, |
| 115 | + bytes memory domainBytes |
| 116 | + ) internal pure returns (bytes32 result) { |
| 117 | + return |
| 118 | + bytes(contentsName).length == 0 |
| 119 | + ? bytes32(0) |
| 120 | + : keccak256( |
| 121 | + abi.encodePacked(typedDataSignTypehash(contentsName, contentsType), contentsHash, domainBytes) |
| 122 | + ); |
| 123 | + } |
| 124 | + |
| 125 | + /** |
| 126 | + * @dev Variant of {typedDataSignStructHash-string-string-bytes32-bytes} that takes a content descriptor |
| 127 | + * and decodes the `contentsName` and `contentsType` out of it. |
| 128 | + */ |
| 129 | + function typedDataSignStructHash( |
| 130 | + string calldata contentsDescr, |
| 131 | + bytes32 contentsHash, |
| 132 | + bytes memory domainBytes |
| 133 | + ) internal pure returns (bytes32 result) { |
| 134 | + (string calldata contentsName, string calldata contentsType) = decodeContentsDescr(contentsDescr); |
| 135 | + |
| 136 | + return typedDataSignStructHash(contentsName, contentsType, contentsHash, domainBytes); |
| 137 | + } |
| 138 | + |
| 139 | + /** |
| 140 | + * @dev Compute the EIP-712 typehash of the `TypedDataSign` structure for a given type (and typename). |
| 141 | + */ |
| 142 | + function typedDataSignTypehash( |
| 143 | + string calldata contentsName, |
| 144 | + string calldata contentsType |
| 145 | + ) internal pure returns (bytes32) { |
| 146 | + return |
| 147 | + keccak256( |
| 148 | + abi.encodePacked( |
| 149 | + "TypedDataSign(", |
| 150 | + contentsName, |
| 151 | + " contents,string name,string version,uint256 chainId,address verifyingContract,bytes32 salt)", |
| 152 | + contentsType |
| 153 | + ) |
| 154 | + ); |
| 155 | + } |
| 156 | + |
| 157 | + /** |
| 158 | + * @dev Parse the type name out of the ERC-7739 contents type description. Supports both the implicit and explicit |
| 159 | + * modes. |
| 160 | + * |
| 161 | + * Following ERC-7739 specifications, a `contentsName` is considered invalid if it's empty or it contains |
| 162 | + * any of the following bytes , )\x00 |
| 163 | + * |
| 164 | + * If the `contentsType` is invalid, this returns an empty string. Otherwise, the return string has non-zero |
| 165 | + * length. |
| 166 | + */ |
| 167 | + function decodeContentsDescr( |
| 168 | + string calldata contentsDescr |
| 169 | + ) internal pure returns (string calldata contentsName, string calldata contentsType) { |
| 170 | + bytes calldata buffer = bytes(contentsDescr); |
| 171 | + if (buffer.length == 0) { |
| 172 | + // pass through (fail) |
| 173 | + } else if (buffer[buffer.length - 1] == bytes1(")")) { |
| 174 | + // Implicit mode: read contentsName from the beginning, and keep the complete descr |
| 175 | + for (uint256 i = 0; i < buffer.length; ++i) { |
| 176 | + bytes1 current = buffer[i]; |
| 177 | + if (current == bytes1("(")) { |
| 178 | + // if name is empty - passthrough (fail) |
| 179 | + if (i == 0) break; |
| 180 | + // we found the end of the contentsName |
| 181 | + return (string(buffer[:i]), contentsDescr); |
| 182 | + } else if (_isForbiddenChar(current)) { |
| 183 | + // we found an invalid character (forbidden) - passthrough (fail) |
| 184 | + break; |
| 185 | + } |
| 186 | + } |
| 187 | + } else { |
| 188 | + // Explicit mode: read contentsName from the end, and remove it from the descr |
| 189 | + for (uint256 i = buffer.length; i > 0; --i) { |
| 190 | + bytes1 current = buffer[i - 1]; |
| 191 | + if (current == bytes1(")")) { |
| 192 | + // we found the end of the contentsName |
| 193 | + return (string(buffer[i:]), string(buffer[:i])); |
| 194 | + } else if (_isForbiddenChar(current)) { |
| 195 | + // we found an invalid character (forbidden) - passthrough (fail) |
| 196 | + break; |
| 197 | + } |
| 198 | + } |
| 199 | + } |
| 200 | + return (Calldata.emptyString(), Calldata.emptyString()); |
| 201 | + } |
| 202 | + |
| 203 | + function _isForbiddenChar(bytes1 char) private pure returns (bool) { |
| 204 | + return char == 0x00 || char == bytes1(" ") || char == bytes1(",") || char == bytes1("(") || char == bytes1(")"); |
| 205 | + } |
| 206 | +} |
0 commit comments