EIP-7702 revocation

src/common_ui.h

@@ -33,6 +33,7 @@ bool ui_gcs(void);
 
 // EIP-7702
 void ui_sign_7702_auth(void);
+void ui_sign_7702_revocation(void);
 #ifdef HAVE_EIP7702
 void ui_error_no_7702(void);
 #ifdef HAVE_EIP7702_WHITELIST

src_bagl/common_ui.c

@@ -71,6 +71,10 @@ void ui_sign_7702_auth(void) {
     ux_flow_init(0, ux_auth7702_flow, NULL);
 }
 
+void ui_sign_7702_revocation(void) {
+    ux_flow_init(0, ux_revocation7702_flow, NULL);
+}
+
 void ui_error_no_7702(void) {
     ux_flow_init(0, ux_error_7702_not_enabled_flow, NULL);
 }

src_bagl/ui_flow.h

@@ -38,6 +38,8 @@ extern const ux_flow_step_t ux_warning_blind_signing_warn_step;
 
 extern const ux_flow_step_t* const ux_auth7702_flow[];
 
+extern const ux_flow_step_t* const ux_revocation7702_flow[];
+
 extern const ux_flow_step_t* const ux_error_7702_not_enabled_flow[];
 
 #ifdef HAVE_EIP7702_WHITELIST

src_bagl/ui_flow_signAuthorization7702.c

@@ -1,33 +1,33 @@
 #include "ui_callbacks.h"
 
 // clang-format off
-UX_STEP_NOCB(ux_auth7702_review_step,
+UX_STEP_NOCB(ux_7702_review_step,
     pnn,
     {
       &C_icon_eye,
       "Review",
       "authorization",
     });
-UX_STEP_NOCB(ux_auth7702_account_step,
+UX_STEP_NOCB(ux_7702_account_step,
     bnnn_paging,
     {
       .title = "Account",
       .text = strings.common.fromAddress
     });
-UX_STEP_NOCB(ux_auth7702_delegate_step,
+UX_STEP_NOCB(ux_7702_delegate_step,
     bnnn_paging,
     {
       .title = "Delegate to",
       .text = strings.common.toAddress
     });
-UX_STEP_NOCB(ux_auth7702_network_step,
+UX_STEP_NOCB(ux_7702_network_step,
     bnnn_paging,
     {
       .title = "Delegate on network",
       .text = strings.common.network_name
     });
 UX_STEP_CB(
-    ux_auth7702_accept_step,
+    ux_7702_accept_step,
     pbb,
     auth_7702_ok_cb(),
     {
@@ -36,18 +36,26 @@ UX_STEP_CB(
       "and send",
     });
 UX_STEP_CB(
-    ux_auth7702_reject_step,
+    ux_7702_reject_step,
     pb,
     auth_7702_cancel_cb(),
     {
       &C_icon_crossmark,
       "Reject",
     });
+// clang-format off
 
 UX_FLOW(ux_auth7702_flow,
-	&ux_auth7702_review_step,
-	&ux_auth7702_account_step,
-	&ux_auth7702_delegate_step,
-	&ux_auth7702_network_step,
-	&ux_auth7702_accept_step,
-	&ux_auth7702_reject_step);
+        &ux_7702_review_step,
+        &ux_7702_account_step,
+        &ux_7702_delegate_step,
+        &ux_7702_network_step,
+        &ux_7702_accept_step,
+        &ux_7702_reject_step);
+
+UX_FLOW(ux_revocation7702_flow,
+        &ux_7702_review_step,
+        &ux_7702_account_step,
+        &ux_7702_network_step,
+        &ux_7702_accept_step,
+        &ux_7702_reject_step);

src_features/signAuthorizationEIP7702/commands_7702.c

@@ -136,26 +136,28 @@ static bool handleAuth7702TLV(const uint8_t *payload, uint16_t size, bool to_fre
     strings.common.fromAddress[1] = 'x';
     getEthAddressStringFromRawKey(publicKey.W, strings.common.fromAddress + 2, auth7702->chainId);
     // * Delegate
+    if (!allzeroes(auth7702->delegate, sizeof(auth7702->delegate))) {
 #ifdef HAVE_EIP7702_WHITELIST
-    // Check if the delegate is on the whitelist for this chainId
-    delegateName = get_delegate_name(&auth7702->chainId, auth7702->delegate);
-    if (delegateName == NULL) {
-        // Reject if not in the whitelist
-        ui_error_no_7702_whitelist();
-        g_7702_sw = APDU_RESPONSE_CONDITION_NOT_SATISFIED;
-        return false;
-    } else {
-        strlcpy(strings.common.toAddress, delegateName, sizeof(strings.common.toAddress));
-    }
+        // Check if the delegate is on the whitelist for this chainId
+        delegateName = get_delegate_name(&auth7702->chainId, auth7702->delegate);
+        if (delegateName == NULL) {
+            // Reject if not in the whitelist
+            ui_error_no_7702_whitelist();
+            g_7702_sw = APDU_RESPONSE_CONDITION_NOT_SATISFIED;
+            return false;
+        } else {
+            strlcpy(strings.common.toAddress, delegateName, sizeof(strings.common.toAddress));
+        }
 #else
-    if (!getEthDisplayableAddress(delegate,
-                                  strings.common.toAddress,
-                                  sizeof(strings.common.toAddress),
-                                  auth7702->chainId)) {
-        g_7702_sw = APDU_RESPONSE_UNKNOWN;
-        return false;
-    }
+        if (!getEthDisplayableAddress(delegate,
+                                      strings.common.toAddress,
+                                      sizeof(strings.common.toAddress),
+                                      auth7702->chainId)) {
+            g_7702_sw = APDU_RESPONSE_UNKNOWN;
+            return false;
+        }
 #endif  // HAVE_EIP7702_WHITELIST
+    }
     // * ChainId
     if (auth7702->chainId == CHAIN_ID_ALL) {
         // handle special wildcard case
@@ -177,7 +179,11 @@ static bool handleAuth7702TLV(const uint8_t *payload, uint16_t size, bool to_fre
         }
     }
 
-    ui_sign_7702_auth();
+    if (allzeroes(auth7702->delegate, sizeof(auth7702->delegate))) {
+        ui_sign_7702_revocation();
+    } else {
+        ui_sign_7702_auth();
+    }
     return true;
 
 end:

src_features/signAuthorizationEIP7702/whitelist_7702.c

@@ -12,9 +12,6 @@
 // Chain ID 0 is valid for all chain IDs
 static const eip7702_whitelist_t EIP7702_WHITELIST[] = {
 #ifdef HAVE_EIP7702_WHITELIST_TEST
-    {.chain_id = 0, .name = "Zero", .address = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
     {.chain_id = 1, .name = "One", .address = {0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
                                                0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
                                                0x01, 0x01, 0x01, 0x01, 0x01, 0x01}},

src_nbgl/ui_sign_authorization_7702.c

@@ -5,7 +5,7 @@
 #include "nbgl_use_case.h"
 #include "common_ui.h"
 
-static nbgl_contentTagValue_t pairs[4] = {0};
+static nbgl_contentTagValue_t pairs[3] = {0};
 static nbgl_contentTagValueList_t pairsList = {0};
 
 static void review7702Choice(bool confirm) {
@@ -26,14 +26,14 @@ void ui_sign_7702_auth(void) {
     pairs[2].item = "Delegate on network";
     pairs[2].value = strings.common.network_name;
 
-    pairsList.nbPairs = 3;
+    pairsList.nbPairs = ARRAYLEN(pairs);
     pairsList.pairs = pairs;
 
     nbgl_useCaseReview(TYPE_OPERATION,
                        &pairsList,
                        &ICON_APP_REVIEW,
-                       "Review authorization\nto upgrade into smart\ncontract account ?",
+                       "Review authorization to upgrade into smart contract account?",
                        NULL,
-                       "Sign authorization to\nupgrade into smart\ncontract account ?",
+                       "Sign authorization to upgrade into smart contract account?",
                        review7702Choice);
 }

src_nbgl/ui_sign_revocation_7702.c

@@ -0,0 +1,37 @@
+#include "nbgl_page.h"
+#include "shared_context.h"
+#include "ui_callbacks.h"
+#include "ui_nbgl.h"
+#include "nbgl_use_case.h"
+#include "common_ui.h"
+
+static nbgl_contentTagValue_t pairs[2] = {0};
+static nbgl_contentTagValueList_t pairsList = {0};
+
+static void review7702Choice(bool confirm) {
+    if (confirm) {
+        auth_7702_ok_cb();
+        nbgl_useCaseReviewStatus(STATUS_TYPE_OPERATION_SIGNED, ui_idle);
+    } else {
+        auth_7702_cancel_cb();
+        nbgl_useCaseReviewStatus(STATUS_TYPE_OPERATION_REJECTED, ui_idle);
+    }
+}
+
+void ui_sign_7702_revocation(void) {
+    pairs[0].item = "Account";
+    pairs[0].value = strings.common.fromAddress;
+    pairs[1].item = "Revoke on network";
+    pairs[1].value = strings.common.network_name;
+
+    pairsList.nbPairs = ARRAYLEN(pairs);
+    pairsList.pairs = pairs;
+
+    nbgl_useCaseReview(TYPE_OPERATION,
+                       &pairsList,
+                       &ICON_APP_REVIEW,
+                       "Review authorization to revoke smart contract delegation?",
+                       NULL,
+                       "Sign authorization to revoke smart contract delegation?",
+                       review7702Choice);
+}

tests/ragger/test_eip7702.py

@@ -15,7 +15,7 @@
 from client.utils import recover_authorization
 
 BIP32_PATH = "m/44'/60'/0'/0/0"
-TEST_ADDRESS_0 = bytes.fromhex("00" * 20)
+ADDRESS_REVOCATION = bytes.fromhex("00" * 20)
 TEST_ADDRESS_1 = bytes.fromhex("01" * 20)
 TEST_ADDRESS_2 = bytes.fromhex("02" * 20)
 TEST_ADDRESS_NO_WHITELIST = bytes.fromhex("42" * 20)
@@ -116,7 +116,8 @@ def test_eip7702_in_whitelist_all_chain_whitelisted(firmware: Firmware,
            backend,
            scenario_navigator,
            test_name,
-           TEST_ADDRESS_0,
+           # Simple7702Account, which is whitelisted for all chains
+           bytes.fromhex("4Cd241E8d1510e30b2076397afc7508Ae59C66c9"),
            NONCE,
            CHAIN_ID_2)
 
@@ -180,3 +181,19 @@ def test_eip7702_not_enabled(firmware: Firmware,
     if firmware == Firmware.NANOS:
         pytest.skip("Not supported on LNS")
     common_rejected(firmware, backend, scenario_navigator, test_name, TEST_ADDRESS_1, NONCE, CHAIN_ID_1)
+
+
+def test_eip7702_revocation(firmware: Firmware,
+                            backend: BackendInterface,
+                            scenario_navigator: NavigateWithScenario,
+                            test_name: str):
+    if firmware == Firmware.NANOS:
+        pytest.skip("Not supported on LNS")
+    settings_toggle(firmware, scenario_navigator.navigator, [SettingID.EIP7702])
+    common(firmware,
+           backend,
+           scenario_navigator,
+           test_name,
+           ADDRESS_REVOCATION,
+           NONCE,
+           CHAIN_ID_1)