Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Improvement] Support for temporary runtime permissions #33

Open
noam-alchemy opened this issue Mar 24, 2024 · 1 comment
Open

[Improvement] Support for temporary runtime permissions #33

noam-alchemy opened this issue Mar 24, 2024 · 1 comment

Comments

@noam-alchemy
Copy link
Contributor

Support per-use permissions where the account requires explicit permission in UserOp.calldata for certain operations, so the user is made aware that the transaction is doing something that requires elevated privilege of some sort.

e.g.

require(someSpecialPermissionAppendedToCallData, "SpecialPermission needed")

When the wallet simulates the transaction without the user appending this SpecialPermission, the simulation reverts with "SpecialPermission needed" so the user cannot be tricked to do something that requires this permission without explicitly agreeing to it. On the wallet side, it'll see this revert in pre-signing simulation, append SpecialPermission to calldata and prompt the user to sign with it. The user is informed that the transaction requires a special permission such as ChangeOwnership.

For critical things like changing permission, it makes sense to require this explicit permission and ensure that there's no way to ever trigger these operations accidentally through some other operation.

@adamegyed
Copy link

The per-hook data PR makes this workflow possible via pre-validation hooks, but it does not yet contain an example of this workflow. We should add an example to the reference implementation before marking this as complete.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: No status
Development

No branches or pull requests

3 participants