ERC-8335: Account-Level Transfer With Authorization

event TransferAuthorizationUsed(
    address indexed token,
    address indexed from,
    address indexed to,
    uint256 value,
    bytes32 authorizationNonce
);

/// @notice The ERC-7528 native asset address, representing the chain's native asset (ETH on Ethereum).
address constant NATIVE_ASSET = 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE;

/**
 * @notice Returns the state of a transfer authorization nonce.
 * @param authorizationNonce  The authorization nonce to check
 * @return                    True if the authorization nonce has been used or canceled
 * @dev    MUST return the used/canceled state tracked internally
 *         (see Authorization Nonce Management).
 */
function transferAuthorizationState(
    bytes32 authorizationNonce
) external view returns (bool);

/**
 * @notice Execute a transfer of any ERC-20 token or native asset with a signed authorization.
 * @dev    MUST verify the signature against the account's owner(s).
 *         The EIP-712 signed data MUST include `from` (= address(this)), but it is not
 *         passed as a function parameter; the contract uses address(this) directly.
 *         MUST verify the authorizationNonce has not been used.
 *         MUST verify block.timestamp is within (validAfter, validBefore).
 *         MUST transfer `value` of `token` to `to` (NATIVE_ASSET denotes the native asset)
 *         as a single atomic transfer; the transfer mechanism is left to the
 *         implementation (see Execution).
 *         MUST mark the authorizationNonce as used.
 *         MUST emit TransferAuthorizationUsed.
 *         MUST revert if any check fails.
 *
 *         Any address MAY call this function (the caller is the relayer/facilitator).
 */
function executeTransferWithAuthorization(
    address token,
    address to,
    uint256 value,
    uint256 validAfter,
    uint256 validBefore,
    bytes32 authorizationNonce,
    bytes calldata signature
) external;

/**
 * @notice Execute a transfer with a signed authorization, callable only by the payee.
 * @dev    Behaves exactly like executeTransferWithAuthorization, with one additional
 *         check: MUST verify that msg.sender == to. This lets a payee contract pull the
 *         payment atomically within its own call, so a front-runner cannot trigger the
 *         transfer outside the payee's execution flow.
 *         The authorization MUST be signed under the ReceiveWithAuthorization type hash,
 *         so it cannot be replayed through executeTransferWithAuthorization.
 *         MUST emit TransferAuthorizationUsed.
 *         MUST revert if any check fails.
 */
function receiveWithAuthorization(
    address token,
    address to,
    uint256 value,
    uint256 validAfter,
    uint256 validBefore,
    bytes32 authorizationNonce,
    bytes calldata signature
) external;

// keccak256("CancelTransferAuthorization(bytes32 authorizationNonce)")
bytes32 constant CANCEL_TRANSFER_AUTHORIZATION_TYPEHASH =
    0xf30be15aedf9b01d0dac5525241af3753865a4968ffb9fb1a7ad6d2553d29f8e;

event TransferAuthorizationCanceled(
    bytes32 indexed authorizationNonce
);

/**
 * @notice Cancel an unused transfer authorization.
 * @dev    If signature is non-empty, MUST verify the signature against the account's owner(s).
 *         If signature is empty (length 0), MUST verify that msg.sender == address(this),
 *         allowing cancellation via the account's own execution path without redundant signing.
 *         MUST mark the authorizationNonce as used.
 *         MUST emit TransferAuthorizationCanceled.
 */
function cancelTransferAuthorization(
    bytes32 authorizationNonce,
    bytes calldata signature
) external;

// keccak256("ExecuteTransferWithAuthorization(address token,address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 authorizationNonce)")
bytes32 constant EXECUTE_TRANSFER_WITH_AUTHORIZATION_TYPEHASH =
    0xe751bf1b144414a77b82ede1d2a433edc347fef283ab5e53e96f438392517b3c;

// keccak256("ReceiveWithAuthorization(address token,address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 authorizationNonce)")
bytes32 constant RECEIVE_WITH_AUTHORIZATION_TYPEHASH =
    0xd8a04c474fcb45b6fb4b17a80506c180af4818903f1ace6c1ff59053338529fd;

// "‖" denotes concatenation
Digest := Keccak256(
    0x1901 ‖ DomainSeparator ‖ Keccak256(ABIEncode(TypeHash, Params...))
)

if (token == NATIVE_ASSET) {
    (bool success, ) = to.call{value: value}("");
    require(success);
} else {
    // SafeERC20 handles non-compliant tokens (e.g. USDT) that do not return a bool
    IERC20(token).safeTransfer(to, value);
}

const data = {
  types: {
    EIP712Domain: [
      { name: "name", type: "string" },
      { name: "version", type: "string" },
      { name: "chainId", type: "uint256" },
      { name: "verifyingContract", type: "address" },
    ],
    ExecuteTransferWithAuthorization: [
      { name: "token", type: "address" },
      { name: "from", type: "address" },
      { name: "to", type: "address" },
      { name: "value", type: "uint256" },
      { name: "validAfter", type: "uint256" },
      { name: "validBefore", type: "uint256" },
      { name: "authorizationNonce", type: "bytes32" },
    ],
  },
  domain: {
    name: smartAccountDomainName, // Account implementation-defined (e.g., "ExampleAccount")
    version: smartAccountDomainVersion, // Account implementation-defined (e.g., "1")
    chainId: selectedChainId,
    verifyingContract: smartAccountAddress, // The smart account's own address
  },
  primaryType: "ExecuteTransferWithAuthorization",
  message: {
    token: tokenAddress, // Any ERC-20 token, or NATIVE_ASSET for native asset
    from: smartAccountAddress, // MUST equal the smart account address (not a function param, but signed)
    to: recipientAddress,
    value: amountBN.toString(10),
    validAfter: 0,
    validBefore: Math.floor(Date.now() / 1000) + 3600, // Valid for 1 hour
    authorizationNonce: ethers.hexlify(ethers.randomBytes(32)),
  },
};

const signature = await provider.send("eth_signTypedData_v4", [
  ownerAddress,
  JSON.stringify(data),
]);

IAccountTransferAuthorization(smartAccountAddress).executeTransferWithAuthorization(
    token,
    to,
    value,
    validAfter,
    validBefore,
    authorizationNonce,
    signature
);

// ERC-165 ID = executeTransferWithAuthorization.selector ^ receiveWithAuthorization.selector ^ transferAuthorizationState.selector
bytes4 constant INTERFACE_ID = 0x305aa238; // 0x0e720282 ^ 0x88b7ab63 ^ 0xb69f0bd9

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.20;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {EIP712} from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";

/**
 * @title AccountTransferAuthorization
 * @notice Reference implementation of this ERC for smart contract accounts.
 * @dev    This is a simplified implementation for illustration. Production
 *         implementations should integrate with their account's existing
 *         signature validation logic.
 */
abstract contract AccountTransferAuthorization is EIP712 {
    using SafeERC20 for IERC20;

    address public constant NATIVE_ASSET = 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE;

    // keccak256("ExecuteTransferWithAuthorization(address token,address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 authorizationNonce)")
    bytes32 public constant EXECUTE_TRANSFER_WITH_AUTHORIZATION_TYPEHASH =
        0xe751bf1b144414a77b82ede1d2a433edc347fef283ab5e53e96f438392517b3c;

    // keccak256("ReceiveWithAuthorization(address token,address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 authorizationNonce)")
    bytes32 public constant RECEIVE_WITH_AUTHORIZATION_TYPEHASH =
        0xd8a04c474fcb45b6fb4b17a80506c180af4818903f1ace6c1ff59053338529fd;

    // keccak256("CancelTransferAuthorization(bytes32 authorizationNonce)")
    bytes32 public constant CANCEL_TRANSFER_AUTHORIZATION_TYPEHASH =
        0xf30be15aedf9b01d0dac5525241af3753865a4968ffb9fb1a7ad6d2553d29f8e;

    mapping(bytes32 => bool) private _authorizationStates;

    event TransferAuthorizationUsed(
        address indexed token,
        address indexed from,
        address indexed to,
        uint256 value,
        bytes32 authorizationNonce
    );

    event TransferAuthorizationCanceled(
        bytes32 indexed authorizationNonce
    );

    error AuthorizationAlreadyUsed(bytes32 authorizationNonce);
    error AuthorizationNotYetValid(uint256 validAfter, uint256 currentTime);
    error AuthorizationExpired(uint256 validBefore, uint256 currentTime);
    error InvalidSignature();
    error NativeTransferFailed();
    error CallerNotPayee();
    error CallerNotSelf();

    constructor(string memory name, string memory version)
        EIP712(name, version)  // Smart account provider sets their own domain name and version
    {}

    function executeTransferWithAuthorization(
        address token,
        address to,
        uint256 value,
        uint256 validAfter,
        uint256 validBefore,
        bytes32 authorizationNonce,
        bytes calldata signature
    ) external {
        _authorizeAndTransfer(
            EXECUTE_TRANSFER_WITH_AUTHORIZATION_TYPEHASH,
            token, to, value, validAfter, validBefore, authorizationNonce, signature
        );
    }

    function receiveWithAuthorization(
        address token,
        address to,
        uint256 value,
        uint256 validAfter,
        uint256 validBefore,
        bytes32 authorizationNonce,
        bytes calldata signature
    ) external {
        // Only the payee may settle; prevents front-running outside the payee's flow
        if (msg.sender != to) revert CallerNotPayee();

        _authorizeAndTransfer(
            RECEIVE_WITH_AUTHORIZATION_TYPEHASH,
            token, to, value, validAfter, validBefore, authorizationNonce, signature
        );
    }

    function transferAuthorizationState(
        bytes32 authorizationNonce
    ) external view returns (bool) {
        return _authorizationStates[authorizationNonce];
    }

    function cancelTransferAuthorization(
        bytes32 authorizationNonce,
        bytes calldata signature
    ) external {
        if (_authorizationStates[authorizationNonce]) revert AuthorizationAlreadyUsed(authorizationNonce);

        if (signature.length == 0) {
            // Signature-free cancellation: must be called by the account itself
            if (msg.sender != address(this)) revert CallerNotSelf();
        } else {
            // Signed cancellation: verify signature
            bytes32 structHash = keccak256(abi.encode(
                CANCEL_TRANSFER_AUTHORIZATION_TYPEHASH,
                authorizationNonce
            ));
            bytes32 digest = _hashTypedDataV4(structHash);
            _requireValidSignature(digest, signature);
        }

        _markAuthorizationUsed(authorizationNonce);
        emit TransferAuthorizationCanceled(authorizationNonce);
    }

    // ──────────────────────────────────────────────
    // Internal helpers
    // ──────────────────────────────────────────────

    // Shared by executeTransferWithAuthorization and receiveWithAuthorization.
    // The two differ only in the type hash (and receive's msg.sender == to check);
    // distinct type hashes keep the two authorizations non-interchangeable.
    function _authorizeAndTransfer(
        bytes32 typeHash,
        address token,
        address to,
        uint256 value,
        uint256 validAfter,
        uint256 validBefore,
        bytes32 authorizationNonce,
        bytes calldata signature
    ) private {
        _requireValidAuthorization(validAfter, validBefore, authorizationNonce);

        // `from` is address(this); included in the signed hash but not as a function parameter
        bytes32 structHash = keccak256(abi.encode(
            typeHash,
            token, address(this), to, value, validAfter, validBefore, authorizationNonce
        ));
        bytes32 digest = _hashTypedDataV4(structHash);

        _requireValidSignature(digest, signature);
        _markAuthorizationUsed(authorizationNonce);

        _executeTransfer(token, to, value);

        emit TransferAuthorizationUsed(token, address(this), to, value, authorizationNonce);
    }

    function _executeTransfer(
        address token,
        address to,
        uint256 value
    ) private {
        if (token == NATIVE_ASSET) {
            (bool success, ) = to.call{value: value}("");
            if (!success) revert NativeTransferFailed();
        } else {
            IERC20(token).safeTransfer(to, value);
        }
    }

    function _requireValidAuthorization(
        uint256 validAfter,
        uint256 validBefore,
        bytes32 authorizationNonce
    ) private view {
        if (_authorizationStates[authorizationNonce]) revert AuthorizationAlreadyUsed(authorizationNonce);
        if (block.timestamp <= validAfter) revert AuthorizationNotYetValid(validAfter, block.timestamp);
        if (block.timestamp >= validBefore) revert AuthorizationExpired(validBefore, block.timestamp);
    }

    function _markAuthorizationUsed(bytes32 authorizationNonce) private {
        _authorizationStates[authorizationNonce] = true;
    }

    function _requireValidSignature(
        bytes32 digest,
        bytes calldata signature
    ) internal view virtual;
}

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.20;

import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
import {AccountTransferAuthorization} from "./AccountTransferAuthorization.sol";

contract SimpleECDSAAccount is AccountTransferAuthorization {

    address public immutable owner;

    constructor(address _owner)
        AccountTransferAuthorization("SimpleECDSAAccount", "1")
    {
        owner = _owner;
    }

    function _requireValidSignature(
        bytes32 digest,
        bytes calldata signature
    ) internal view override {
        address recovered = ECDSA.recover(digest, signature);
        if (recovered != owner) revert InvalidSignature();
    }

    receive() external payable {}
}

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.20;

import {AccountTransferAuthorization} from "./AccountTransferAuthorization.sol";
import {IERC1271} from "@openzeppelin/contracts/interfaces/IERC1271.sol";

contract ModularAccount is AccountTransferAuthorization {

    mapping(address => bool) public validators;

    constructor(address initialValidator)
        AccountTransferAuthorization("ModularAccount", "1")
    {
        validators[initialValidator] = true;
    }

    // Signature layout: [validator address (20 bytes)][validator-specific data]
    function _requireValidSignature(
        bytes32 digest,
        bytes calldata signature
    ) internal view override {
        if (signature.length < 20) revert InvalidSignature();

        address validator = address(bytes20(signature[:20]));
        if (!validators[validator]) revert InvalidSignature();

        // Delegate to validator's ERC-1271 isValidSignature
        bytes4 result = IERC1271(validator).isValidSignature(
            digest,
            signature[20:]
        );
        if (result != IERC1271.isValidSignature.selector) revert InvalidSignature();
    }

    receive() external payable {}
}