ERC-8150: Zero-Knowledge Agent Payment Verification

┌─────────────────────────────────────────────────────────────────────────────┐
│                              USER FLOW                                      │
└─────────────────────────────────────────────────────────────────────────────┘

┌──────────────┐      ┌──────────────┐      ┌──────────────┐      ┌──────────────┐
│   STEP 1     │      │   STEP 2     │      │   STEP 3     │      │   STEP 4     │
│   Agent      │─────▶│   Alice      │─────▶│   Alice      │─────▶│   Alice      │
│   Proposes   │      │   Reviews    │      │   Signs      │      │   Approves   │
└──────┬───────┘      └──────┬───────┘      └──────┬───────┘      └──────┬───────┘
       │                     │                     │                     │
       ▼                     ▼                     ▼                     ▼
Intent Bundle:         "Pay 3 merchants      Sign(Hash(           USDC.approve(
A: 10 USDC            Total: 195 USDC"       IntentBundle))       AgentWallet,
B: 150 USDC                                                        195 USDC)
C: 35 USDC

┌──────────────┐      ┌──────────────┐      ┌──────────────┐      ┌──────────────┐
│   STEP 5     │      │   STEP 6     │      │   STEP 7     │      │   STEP 8     │
│   Agent      │─────▶│   Agent      │─────▶│   Verify     │─────▶│   On-chain   │
│   Generates  │      │   Submits    │      │   Proof      │      │   Checks     │
└──────┬───────┘      └──────┬───────┘      └──────┬───────┘      └──────┬───────┘
       │                     │                     │                     │
       ▼                     ▼                     ▼                     ▼
ZK circuit proves:      Proof + Txs           Verifier checks       Nonce unused
- Hash matches          to chain              proof validity        Not expired
- Calldata correct                                                  Hash matches
- Chain, payer, nonce,
expiry match

┌──────────────┐
│   STEP 9     │
│   Execute    │
│   Payments   │
└──────┬───────┘
       │
       ▼
Multicall executes
all transfers
atomically

struct IntentBundle {
    string version;        // Protocol version (e.g., "1.0")
    uint256 chainId;       // Target blockchain ID
    bytes32 nonce;         // Unique nonce for replay protection
    uint256 expiry;        // Unix timestamp after which intent is invalid
    address payer;         // User's wallet address (EOA or smart contract)
    Action[] actions;      // Array of intended actions
}

struct Action {
    string actionType;     // e.g., "ERC20_TRANSFER"
    address token;         // Token contract address
    address to;            // Recipient address
    uint256 amount;        // Amount in token's smallest unit
}

{
  "version": "1.0",
  "chainId": 1,
  "nonce": 0x42,
  "expiry": 1736700000,
  "payer": "0xAliceAddress...",
  "actions": [
    {"actionType": "ERC20_TRANSFER", "token": "0xUSDC", "to": "0xAAA", "amount": "10000000"},
    {"actionType": "ERC20_TRANSFER", "token": "0xUSDC", "to": "0xBBB", "amount": "150000000"},
    {"actionType": "ERC20_TRANSFER", "token": "0xUSDC", "to": "0xCCC", "amount": "35000000"}
  ]
}

bytes memory encodedBundle = abi.encode(intentBundle);
bytes32 commitment = keccak256(encodedBundle);
bytes memory signature = userSign(commitment);

function deriveCalldata(Action memory action, address payer)
    internal
    pure
    returns (address target, bytes memory data)
{
		require(keccak256(bytes(action.actionType)) == keccak256("ERC20_TRANSFER"), "Unsupported action type");

    // Target is the token contract
    target = action.token;

    // ERC20 transferFrom function selector: 0x23b872dd
    // transferFrom(address from, address to, uint256 amount)
    data = abi.encodeWithSelector(
        bytes4(0x23b872dd),
        payer,           // from: the user who approved
        action.to,       // to: the recipient
        action.amount    // amount: transfer amount
    );
}

struct EIP712Domain { string name;string version; uint256 chainId; address verifyingContract; }

EIP712Domain domain = EIP712Domain({ name: "Agent Wallet", version: "1", chainId: 1, verifyingContract: agentWalletAddress });

bytes32 constant ACTION_TYPEHASH = keccak256(
    "Action(string actionType,address token,address to,uint256 amount)"
);

bytes32 constant INTENT_BUNDLE_TYPEHASH = keccak256(
    "IntentBundle(string version,uint256 chainId,bytes32 nonce,uint256 expiry,address payer,Action[] actions)"
    "Action(string actionType,address token,address to,uint256 amount)"
);

const domain = {
    name: 'Agent Wallet',
    version: '1',
    chainId: 1,
    verifyingContract: agentWalletAddress
};

const types = {
    IntentBundle: [
        { name: 'version', type: 'string' },
        { name: 'chainId', type: 'uint256' },
        { name: 'nonce', type: 'bytes32' },
        { name: 'expiry', type: 'uint256' },
        { name: 'payer', type: 'address' },
        { name: 'actions', type: 'Action[]' }
    ],
    Action: [
        { name: 'actionType', type: 'string' },
        { name: 'token', type: 'address' },
        { name: 'to', type: 'address' },
        { name: 'amount', type: 'uint256' }
    ]
};

const value = {
    version: "1.0",
    chainId: 1,
    nonce: "0x42...",
    expiry: 1736700000,
    payer: "0xAlice...",
    actions: [
        { actionType: "ERC20_TRANSFER", token: "0xUSDC", to: "0xAAA", amount: "10000000" },
        { actionType: "ERC20_TRANSFER", token: "0xUSDC", to: "0xBBB", amount: "150000000" },
        { actionType: "ERC20_TRANSFER", token: "0xUSDC", to: "0xCCC", amount: "35000000" }
    ]
};

const signature = await signer._signTypedData(domain, types, value);

function hashIntentBundle(IntentBundle memory bundle) internal pure returns (bytes32) {
    bytes32[] memory actionHashes = new bytes32[](bundle.actions.length);
    for (uint i = 0; i < bundle.actions.length; i++) {
        actionHashes[i] = keccak256(abi.encode(
            ACTION_TYPEHASH,
            keccak256(bytes(bundle.actions[i].actionType)),
            bundle.actions[i].token,
            bundle.actions[i].to,
            bundle.actions[i].amount
        ));
    }

    return keccak256(abi.encode(
        INTENT_BUNDLE_TYPEHASH,
        keccak256(bytes(bundle.version)),
        bundle.chainId,
        bundle.nonce,
        bundle.expiry,
        bundle.payer,
        keccak256(abi.encodePacked(actionHashes))
    ));
}

function getCommitment(IntentBundle memory bundle) public view returns (bytes32) {
    bytes32 domainSeparator = keccak256(abi.encode(
        keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
        keccak256("Agent Wallet"),
        keccak256("1"),
        block.chainid,
        address(this)
    ));

    bytes32 structHash = hashIntentBundle(bundle);

    return keccak256(abi.encodePacked("\\x19\\x01", domainSeparator, structHash));
}

// User calls this on each token contract they want the agent to spend
IERC20(tokenAddress).approve(agentWalletAddress, approvalAmount);

template AgentPaymentVerifier(maxActions, maxBundleSize) {
    // Public inputs
    signal input commitment;
    signal input chainId;
    signal input signerAddress;
    signal input multicallDataHash;
    signal input nonce;
    signal input expiry;

    // Private inputs
    signal input intentBundle[maxBundleSize];
    signal input bundleLength;
    signal input actions[maxActions][4]; // [token, to, amount, actionType]
    signal input numActions;
   
    // Step 1: Verify commitment hash
    component hasher = Keccak256(maxBundleSize);
    for (var i = 0; i < maxBundleSize; i++) {
        hasher.in[i] <== intentBundle[i];
    }
    hasher.length <== bundleLength;
    commitment === hasher.out;

    // Step 2: Verify chain correctness
    signal extractedChainId;
    extractedChainId <== intentBundle[chainIdOffset];
    chainId === extractedChainId;
    
    // Step 3: Verify payer from intent bundle matches signer
    signal payer;
    payer <== intentBundle[payerOffset];
    payer === signerAddress;

    // Step 4: Verify calldata correctness
    // For each action, derive the transferFrom calldata
    component calldataHasher = Keccak256(maxActions * calldataSize);
    var calldataIndex = 0;
    
    for (var i = 0; i < maxActions; i++) {
        // Only process if this action exists
        signal actionExists;
        actionExists <== LessThan(252)([i, numActions]);
        
        if (actionExists) {
            // Derive: transferFrom(payer, actions[i].to, actions[i].amount)
            // Function selector: 0x23b872dd
            signal selector[4] <== [0x23, 0xb8, 0x72, 0xdd];
            
            // Encode parameters (simplified version here. actual implementation needs full ABI encoding)
            // selector + abi.encode(payer, to, amount)
            for (var j = 0; j < 4; j++) {
                calldataHasher.in[calldataIndex++] <== selector[j];
            }
            // below add ABI-encoded parameters (signerAddress, actions[i].to, actions[i].amount)
            ...
        }
    }
    
    // Step 5: Verify multicall hash
    calldataHasher.length <== calldataIndex;
    multicallDataHash === calldataHasher.out;

    // Step 6: Verify nonce freshness
    signal extractedNonce;
    extractedNonce <== intentBundle[nonceOffset];
    nonce === extractedNonce;

    // Step 7: Verify expiry
    signal extractedExpiry;
    extractedExpiry <== intentBundle[expiryOffset];
    expiry === extractedExpiry;
}

// Compile with specific parameters
component main {public [commitment, chainId, signerAddress, multicallDataHash, nonce, expiry]} = AgentPaymentVerifier(10, 2048);

interface IAgentWallet {
    /**
     * @notice Execute a batch of token transfers with ZK proof verification
     * @param proof The ZK-SNARK proof
     * @param signature User's ECDSA signature on the commitment
     * @param publicInputs Public inputs for proof verification
     * @param calls Array of calls (target contracts and calldata)
     * @return success Whether execution succeeded
     */
    function executeWithProof(
        bytes calldata proof,
        bytes calldata signature,
        PublicInputs calldata publicInputs,
        Call[] calldata calls
    ) external returns (bool success);
}

struct PublicInputs {
    bytes32 commitment;         // Hash of intent bundle
    uint256 chainId;            // Target blockchain ID
    address signerAddress;      // User's address
    bytes32 multicallDataHash;  // Hash of the call data
    bytes32 nonce;              // Unique nonce
    uint256 expiry;             // Expiry timestamp
}

struct Call {
    address target;  // Token contract address
    bytes data;      // transferFrom calldata
}

mapping(address => bytes32) public minValidNonce;

mapping(address => mapping(bytes32 => bool)) public usedNonces;

function invalidateNonceRange(bytes32 newMinNonce) external {
    require(
        uint256(newMinNonce) > uint256(minValidNonce[msg.sender]), 
        "Must increase min nonce"
    );
    minValidNonce[msg.sender] = newMinNonce;
    emit NonceRangeInvalidated(msg.sender, oldMinNonce, newMinNonce);
}

function _verifyAndConsumeNonce(address user, bytes32 nonce) internal {
    require(uint256(nonce) >= uint256(minValidNonce[user]), "Nonce below minimum");
    require(!usedNonces[user][nonce], "Nonce already used");
    
    usedNonces[user][nonce] = true;
}

function isNonceUsed(address user, bytes32 nonce) external view returns (bool used) {
    return usedNonces[user][nonce];
}

function isNonceInRange(address user, bytes32 nonce) internal view returns (bool inRange) {
		return uint256(nonce) >= uint256(minValidNonce[user]);
}

mapping(address => mapping(bytes32 => bool)) public cancelledIntents;

// called by user to cancel an intent
// commitment = commitment hash of the intent to cancel
function cancelIntent(bytes32 nonce, bytes32 commitment) external {
    require(!usedNonces[msg.sender][nonce], "Nonce already used");
    require(uint256(nonce) >= uint256(minValidNonce[msg.sender]), "Nonce already invalidated");
    
    usedNonces[msg.sender][nonce] = true;
    
    emit IntentCancelled(msg.sender, commitment, nonce);
}

function isIntentCancelled(address user, bytes32 commitment) external view returns (bool cancelled) {
		return cancelledIntents[user][commitment];
}