[Draft] feat: add guardian recovery

package.json

@@ -37,6 +37,7 @@
     "@nomad-xyz/excessively-safe-call": "0.0.1-rc.1",
     "@nomicfoundation/hardhat-chai-matchers": "2.0.8",
     "@nomicfoundation/hardhat-ethers": "3.0.8",
+    "@nomicfoundation/hardhat-network-helpers": "^1.0.12",
     "@nomicfoundation/hardhat-toolbox": "^5.0.0",
     "@nomicfoundation/hardhat-verify": "2.0.11",
     "@openzeppelin/contracts": "4.9.6",

scripts/deploy.ts

@@ -6,12 +6,13 @@ import { Wallet } from "zksync-ethers";
 
 const WEBAUTH_NAME = "WebAuthValidator";
 const SESSIONS_NAME = "SessionKeyValidator";
+const GUARDIAN_RECOVERY_NAME = "GuardianRecoveryValidator";
 const ACCOUNT_IMPL_NAME = "SsoAccount";
 const FACTORY_NAME = "AAFactory";
 const PAYMASTER_NAME = "ExampleAuthServerPaymaster";
 const BEACON_NAME = "SsoBeacon";
 
-async function deploy(name: string, deployer: Wallet, proxy: boolean, args?: any[]): Promise<string> {
+async function deploy(name: string, deployer: Wallet, proxy: boolean, args?: any[], initArgs?: any): Promise<string> {
   // eslint-disable-next-line @typescript-eslint/no-require-imports
   const { deployFactory, create2, ethersStaticSalt } = require("../test/utils");
   console.log("Deploying", name, "contract...");
@@ -26,13 +27,12 @@ async function deploy(name: string, deployer: Wallet, proxy: boolean, args?: any
     console.log(name, "contract deployed at:", implAddress, "\n");
     return implAddress;
   }
-  const proxyContract = await create2("TransparentProxy", deployer, ethersStaticSalt, [implAddress]);
+  const proxyContract = await create2("TransparentProxy", deployer, ethersStaticSalt, [implAddress, initArgs ?? "0x"]);
   const proxyAddress = await proxyContract.getAddress();
   console.log(name, "proxy contract deployed at:", proxyAddress, "\n");
   return proxyAddress;
 }
 
-
 task("deploy", "Deploys ZKsync SSO contracts")
   .addOptionalParam("only", "name of a specific contract to deploy")
   .addFlag("noProxy", "do not deploy transparent proxies for factory and modules")
@@ -76,12 +76,14 @@ task("deploy", "Deploys ZKsync SSO contracts")
     }
 
     if (!cmd.only) {
-      await deploy(WEBAUTH_NAME, deployer, !cmd.noProxy);
+      const webauth = await deploy(WEBAUTH_NAME, deployer, !cmd.noProxy);
       const sessions = await deploy(SESSIONS_NAME, deployer, !cmd.noProxy);
       const implementation = await deploy(ACCOUNT_IMPL_NAME, deployer, false);
       const beacon = await deploy(BEACON_NAME, deployer, false, [implementation]);
       const factory = await deploy(FACTORY_NAME, deployer, !cmd.noProxy, [beacon]);
-      const paymaster = await deploy(PAYMASTER_NAME, deployer, false, [factory, sessions]);
+      const guardianInterface = new ethers.Interface((await hre.artifacts.readArtifact(GUARDIAN_RECOVERY_NAME)).abi);
+      const recovery = await deploy(GUARDIAN_RECOVERY_NAME, deployer, !cmd.noProxy, [webauth], guardianInterface.encodeFunctionData("initialize", [webauth]));
+      const paymaster = await deploy(PAYMASTER_NAME, deployer, false, [factory, sessions, recovery]);
 
       await fundPaymaster(paymaster, cmd.fund);
     } else {

src/TransparentProxy.sol

@@ -12,7 +12,10 @@ import { TransparentUpgradeableProxy } from "@openzeppelin/contracts/proxy/trans
 /// cheap delegate calls on ZKsync.
 /// @dev This proxy is placed in front of `AAFactory` and all modules (`WebAuthValidator`, `SessionKeyValidator`).
 contract TransparentProxy is TransparentUpgradeableProxy, EfficientProxy {
-  constructor(address implementation) TransparentUpgradeableProxy(implementation, msg.sender, bytes("")) {}
+  constructor(
+    address implementation,
+    bytes memory data
+  ) TransparentUpgradeableProxy(implementation, msg.sender, data) {}
 
   function _delegate(address implementation) internal override(EfficientProxy, Proxy) {
     EfficientProxy._delegate(implementation);

src/interfaces/IGuardianRecoveryValidator.sol

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MIT
+import { IModuleValidator } from "./IModuleValidator.sol";
+import { Transaction } from "@matterlabs/zksync-contracts/l2/system-contracts/libraries/TransactionHelper.sol";
+
+interface IGuardianRecoveryValidator is IModuleValidator {
+  struct GuardianConfirmation {
+    address ssoAccount;
+  }
+
+  function proposeValidationKey(address externalAccount) external;
+
+  function removeValidationKey(address externalAccount) external;
+
+  function initRecovery(address accountToRecover, bytes memory passkey) external;
+
+  // IModuleValidator
+  function addValidationKey(bytes memory key) external returns (bool);
+
+  // IModuleValidator
+  function validateTransaction(
+    bytes32 signedHash,
+    bytes memory signature,
+    Transaction calldata transaction
+  ) external returns (bool);
+
+  // IModuleValidator
+  function validateSignature(bytes32 signedHash, bytes memory signature) external view returns (bool);
+}

src/test/ExampleAuthServerPaymaster.sol

@@ -10,26 +10,31 @@ import "@openzeppelin/contracts/access/Ownable.sol";
 
 import { AAFactory } from "../AAFactory.sol";
 import { SessionKeyValidator } from "../validators/SessionKeyValidator.sol";
+import { GuardianRecoveryValidator } from "../validators/GuardianRecoveryValidator.sol";
 
 /// @author Matter Labs
 /// @notice This contract does not include any validations other than using the paymaster general flow.
 contract ExampleAuthServerPaymaster is IPaymaster, Ownable {
   address public immutable AA_FACTORY_CONTRACT_ADDRESS;
   address public immutable SESSION_KEY_VALIDATOR_CONTRACT_ADDRESS;
+  address public immutable ACCOUNT_RECOVERY_VALIDATOR_CONTRACT_ADDRESS;
   bytes4 constant DEPLOY_ACCOUNT_SELECTOR = AAFactory.deployProxySsoAccount.selector;
   bytes4 constant SESSION_CREATE_SELECTOR = SessionKeyValidator.createSession.selector;
   bytes4 constant SESSION_REVOKE_KEY_SELECTOR = SessionKeyValidator.revokeKey.selector;
   bytes4 constant SESSION_REVOKE_KEYS_SELECTOR = SessionKeyValidator.revokeKeys.selector;
+  bytes4 constant ACCOUNT_RECOVERY_ADD_KEY_SELECTOR = GuardianRecoveryValidator.addValidationKey.selector;
+  bytes4 constant ACCOUNT_RECOVERY_PROPOSE_KEY_SELECTOR = GuardianRecoveryValidator.proposeValidationKey.selector;
 
   modifier onlyBootloader() {
     require(msg.sender == BOOTLOADER_FORMAL_ADDRESS, "Only bootloader can call this method");
     // Continue execution if called from the bootloader.
     _;
   }
 
-  constructor(address aaFactoryAddress, address sessionKeyValidatorAddress) {
+  constructor(address aaFactoryAddress, address sessionKeyValidatorAddress, address accountRecoveryValidatorAddress) {
     AA_FACTORY_CONTRACT_ADDRESS = aaFactoryAddress;
     SESSION_KEY_VALIDATOR_CONTRACT_ADDRESS = sessionKeyValidatorAddress;
+    ACCOUNT_RECOVERY_VALIDATOR_CONTRACT_ADDRESS = accountRecoveryValidatorAddress;
   }
 
   function validateAndPayForPaymasterTransaction(
@@ -44,7 +49,9 @@ contract ExampleAuthServerPaymaster is IPaymaster, Ownable {
     // Ensure the transaction is calling one of our allowed contracts
     address to = address(uint160(_transaction.to));
     require(
-      to == AA_FACTORY_CONTRACT_ADDRESS || to == SESSION_KEY_VALIDATOR_CONTRACT_ADDRESS,
+      to == AA_FACTORY_CONTRACT_ADDRESS ||
+        to == SESSION_KEY_VALIDATOR_CONTRACT_ADDRESS ||
+        to == ACCOUNT_RECOVERY_VALIDATOR_CONTRACT_ADDRESS,
       "Unsupported contract address"
     );
 
@@ -62,6 +69,12 @@ contract ExampleAuthServerPaymaster is IPaymaster, Ownable {
         "Unsupported method"
       );
     }
+    if (to == SESSION_KEY_VALIDATOR_CONTRACT_ADDRESS) {
+      require(
+        methodSelector == ACCOUNT_RECOVERY_ADD_KEY_SELECTOR || methodSelector == ACCOUNT_RECOVERY_PROPOSE_KEY_SELECTOR,
+        "Unsupported method"
+      );
+    }
 
     bytes4 paymasterInputSelector = bytes4(_transaction.paymasterInput[0:4]);
     require(paymasterInputSelector == IPaymasterFlow.general.selector, "Unsupported paymaster flow");