feat: introduce ScopedExecutionHook - #152
Merged
Merged
Conversation
…ay (M), validity-format ordering (M) (#58) * fix: gate enable-mode install on root signature success * test: enable-mode install rejected on failed root signature * fix: advance factory nonce on direct approval changes * test: direct factory approval advances nonce * fix: normalize validity ranges before format classification * test: validity-format ordering regressions * fix: RP-01 checkValidation EntryPoint v0.9 parity (#59) * fix: checkValidation block-mode and exclusive validAfter per EntryPoint v0.9 * test: cover checkValidation EntryPoint v0.9 boundaries * fix: vendor canonical EntryPoint v0.9 release initcode and address
Remove generic type-4 hooks, hook registration storage, sentinel-based installation state, and embedded hook configuration from validations, executors, and fallback selectors.
Remove stateless ERC-1271 module installation and the validation-mode signature byte. Structured signatures now begin with their validation type while ERC-4337 enable mode remains supported.
Add type-11 hooks scoped to validations, executors, and selectors, with explicit scoped identifiers and lifecycle checks. Route hooked validation execution through executeUserOp and prevent direct validation reentry.
Replace generic-hook coverage with validation-, executor-, and selector-scoped lifecycle and execution tests. Update formal harnesses, invariants, mocks, and gas snapshots for the scoped model.
Replace stateless enable-mode coverage with the validation-type-first structured signature format and Kernel7702 raw-signature cases. Remove obsolete stateless validators and formal tests, and differentially fuzz Lib4337 validity handling against EntryPoint v0.9.
Restore the v0.4.0 entry-point gate on fallback selectors that have no scoped execution hook installed. Installing a type-11 selector-scoped execution hook makes a selector publicly callable; without one only the entry point may route to it. Update tests to install scoped hooks where public access is asserted, add a regression test and halmos proofs for the gate, and document the access control in the README.
leekt
marked this pull request as ready for review
October 3, 2026 01:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces generic type-4 hooks with type-11 execution hooks scoped to validations, executors, and fallback selectors. Structured ERC-1271 signatures use the validation-type-first format, and ERC-1271 enable-mode handling is removed.
Includes the final executor lifecycle fix from
e491d020c27cb965e569d0c46ba6cf7a5845d3a3: failedonInstallcalls cannot grant executor authority, EOAs remain supported, and failed cleanup cannot block removal. Production sources, dependencies, and compiler configuration are byte-identical to that audited revision and to kernel_v4 PR #60.Resolves the documentation conflicts with
dev, preserves the documented revocation limitation, and defers publication ofCHANGELOG_AUDIT.md,audit/, andaudits/. Also corrects the Staker invariant model to count nonce increments on direct factory approvals; this changes only the test model.Validation:
forge fmt --checkpassed.forge build --offline --sizes --skip MockKernelpassed; all production contracts fit the deployment size limit.forge test --offline --no-match-path 'test/invariant/*' -vv: 1,221 passed, 0 failed, 4 skipped.forge test --offline --match-path test/invariant/StakerInvariant.t.sol -vv: passed with 1,000 runs and depth 1,000 (1,000,000 calls).Source PR: zerodevapp/kernel_v4#60