Skip to content

Document the EIP-7702 authority key trust model - #114

Open
Agusx1211 wants to merge 1 commit into
masterfrom
7702-authority-key-docs
Open

Agusx1211 wants to merge 1 commit into
masterfrom
7702-authority-key-docs

Conversation

@Agusx1211

Copy link
Copy Markdown
Member

Adds docs/EIP7702.md, which documents how an EOA becomes a Sequence wallet through EIP-7702 and what the trust model actually is once it does. The part that needed writing down: for a 7702 account a plain transaction the EOA sends to its own address has msg.sender == address(this), so the authority key satisfies onlySelf directly. That reaches updateImageHash, setStaticSignature, addHook, removeHook and selfExecute with no Sequence signature, no nonce, no checkpointer and no reentrancy guard, and neither a configuration update nor a Recovery takeover revokes it. The key can also re-delegate with a type-4 transaction, which no contract can prevent. Stage1 and Stage2 wallets can recover from a compromised initial key by rotating the configuration, a 7702 wallet cannot, and the only remedy is moving the funds. Any product surface that presents rotation or recovery as revocation is wrong for these accounts.

The doc also covers two related 7702 details that had no home. First, the counterfactual 1-of-1 configuration that Stage7702Auth.imageHash() returns until the first updateImageHash, including the liveness dependency on DEFAULT_CHECKPOINTER when it is non-zero: every fresh wallet's first signature has to name it, snapshotFor is called on it, and a reverting or misbehaving checkpointer blocks fresh wallets. It can block, it can never forge. Second, re-delegation does not clear storage, so an account delegated elsewhere before can arrive with a planted image hash, hooks, static signatures or a stuck reentrancy flag. The namespaced slots prevent accidental collisions, not deliberate ones. Section 7 lists what onboarding should read before trusting an account.

There is no contract-level fix for any of this, so the only code change is natspec: onlySelf in SelfAuth.sol now says that under EIP-7702 it gates on the wallet or its authority key, and points at the doc. forge build passes on a full recompile. No tests were added or changed, since nothing behavioral changed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant