feat(extension): Account Abstraction

[jxom]

Adds support for an ERC-4337 Account Abstraction extension.

See Docs

[changeset-bot]

🦋 Changeset detected

Latest commit: 560363f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
viem	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
viem	✅ Ready (Inspect)	Visit Preview	Jul 24, 2024 4:00pm

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/webauthn-p256@0.0.5	None	0	187 kB	jmoxey
npm/ws@8.18.0	environment, network	0	147 kB	lpinca

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
Install scripts	npm/protobufjs@7.3.0	Install script: postinstall Source: node scripts/postinstall	orphan: npm/protobufjs@7.3.0	🚫
Install scripts	npm/protobufjs@7.3.2	Install script: postinstall Source: node scripts/postinstall	pnpm-lock.yaml	🚫

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/protobufjs@7.3.0
• @SocketSecurity ignore npm/protobufjs@7.3.2

[github-actions]

size-limit report 📦

Path	Size	Loading time (3g)	Running time (snapdragon)	Total time
import * from 'viem' (esm)	59.4 KB (+0.24% 🔺)	1.2 s (+0.24% 🔺)	17.5 s (+303.94% 🔺)	18.7 s
const viem = require('viem') (cjs)	70.08 KB (+0.52% 🔺)	1.5 s (+0.52% 🔺)	21.8 s (+58.06% 🔺)	23.2 s
import { createClient, http } from 'viem'	6.18 KB (+0.56% 🔺)	124 ms (+0.56% 🔺)	1.9 s (+75.61% 🔺)	2 s
import * from 'viem/accounts'	74.22 KB (+0.25% 🔺)	1.5 s (+0.25% 🔺)	7 s (-2.04% 🔽)	8.5 s
import { privateKeyToAccount } from 'viem/accounts'	19.15 KB (+0.16% 🔺)	384 ms (+0.16% 🔺)	3.2 s (-28.18% 🔽)	3.5 s
import * from 'viem/actions'	45.2 KB (+0.41% 🔺)	905 ms (+0.41% 🔺)	11.5 s (+27.71% 🔺)	12.4 s
import { getBlockNumber } from 'viem/actions'	318 B (0%)	10 ms (0%)	69 ms (+112.51% 🔺)	79 ms
import * from 'viem/chains'	29.93 KB (0%)	599 ms (0%)	9.9 s (+110.89% 🔺)	10.5 s
import { mainnet } from 'viem/chains'	324 B (0%)	10 ms (0%)	137 ms (+145.77% 🔺)	147 ms
import * from 'viem/chains/utils'	1.03 KB (0%)	21 ms (0%)	75 ms (-79.75% 🔽)	95 ms
import * from 'viem/ens'	45.4 KB (+0.1% 🔺)	909 ms (+0.1% 🔺)	7.6 s (-8.11% 🔽)	8.5 s
import { getEnsAvatar } from 'viem/ens'	22.12 KB (+0.42% 🔺)	443 ms (+0.42% 🔺)	8.8 s (+127.61% 🔺)	9.3 s
import * from 'viem/siwe'	30.35 KB (-0.03% 🔽)	608 ms (-0.03% 🔽)	5.3 s (-23.58% 🔽)	6 s
import { verifySiweMessage } from 'viem/siwe'	29.27 KB (+0.01% 🔺)	586 ms (+0.01% 🔺)	11.1 s (+60.53% 🔺)	11.6 s
import * from 'viem/account-abstraction'	43.65 KB (+100% 🔺)	874 ms (+100% 🔺)	10.5 s (+100% 🔺)	11.3 s
import { toCoinbaseSmartAccount } from 'viem/account-abstraction'	33.97 KB (+100% 🔺)	680 ms (+100% 🔺)	12.4 s (+100% 🔺)	13.1 s

[codecov]

Codecov Report

Attention: Patch coverage is 99.83205% with 7 lines in your changes missing coverage. Please review.

Project coverage is 99.67%. Comparing base (71a4e7a) to head (560363f).

Files	Patch %	Lines
...bstraction/actions/bundler/prepareUserOperation.ts	98.90%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2510      +/-   ##
==========================================
+ Coverage   99.66%   99.67%   +0.01%     
==========================================
  Files         716      749      +33     
  Lines       59689    67661    +7972     
  Branches     2852     3209     +357     
==========================================
+ Hits        59488    67441    +7953     
- Misses        187      207      +20     
+ Partials       14       13       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Silur]

the examples provided (https://viem.sh/account-abstraction/accounts/webauthn/createWebAuthnCredential) do no work neither in firefox nor in chrome:

import { 
  createWebAuthnCredential, 
  toWebAuthnAccount 
} from 'viem/account-abstraction'
 
// Register a credential (ie. passkey).
const credential = await createWebAuthnCredential({ 
  name: 'Example', 
}) 
 
// Create a WebAuthn account from the credential.
const account = toWebAuthnAccount({
  credential,
})

On firefox it throws NotAllowedError, and on chrome it just hangs with a warning message:

publicKey.pubKeyCredParams is missing at least one of the default algorithm identifiers: ES256 and RS256. This can result in registration failures on incompatible authenticators. See https://chromium.googlesource.com/chromium/src/+/main/content/browser/webauth/pub_key_cred_params.md for details

[jxom]

@Silur – example app that uses this snippet works for me:

CleanShot.2024-08-09.at.09.47.31.mp4

[holic]

is this intentionally named like the bundler client rather than a paymaster client?

[jxom]

It should be "paymaster"