Revert "deploy on avalanche and bnb"

.gas-snapshot

@@ -1,72 +1,72 @@
-AddOwnerAddressTest:testEmitsAddOwner() (gas: 92402)
-AddOwnerAddressTest:testIncreasesOwnerIndex() (gas: 90676)
-AddOwnerAddressTest:testRevertsIfAlreadyOwner() (gas: 93191)
-AddOwnerAddressTest:testRevertsIfCalledByNonOwner() (gas: 11764)
-AddOwnerAddressTest:testSetsIsOwner() (gas: 90470)
-AddOwnerAddressTest:testSetsOwnerAtIndex() (gas: 98970)
-AddOwnerPublicKeyTest:testEmitsAddOwner() (gas: 115537)
-AddOwnerPublicKeyTest:testFuzzIsOwnerPublicKey(bytes32,bytes32) (runs: 256, μ: 115328, ~: 115328)
-AddOwnerPublicKeyTest:testRevertsIfAlreadyOwner() (gas: 116355)
-AddOwnerPublicKeyTest:testRevertsIfCalledByNonOwner() (gas: 11754)
-AddOwnerPublicKeyTest:testSetsIsOwner() (gas: 113769)
-AddOwnerPublicKeyTest:testSetsOwnerAtIndex() (gas: 128616)
-CoinbaseSmartWallet1271InputGeneratorTest:testGetReplaySafeHashForDeployedAccount() (gas: 308446)
-CoinbaseSmartWallet1271InputGeneratorTest:testGetReplaySafeHashForUndeployedAccount() (gas: 291475)
-CoinbaseSmartWalletFactoryTest:testDeployDeterministicPassValues() (gas: 267250)
-CoinbaseSmartWalletFactoryTest:test_CreateAccount_ReturnsPredeterminedAddress_WhenAccountAlreadyExists() (gas: 287003)
-CoinbaseSmartWalletFactoryTest:test_RevertsIfLength32ButLargerThanAddress() (gas: 298636)
-CoinbaseSmartWalletFactoryTest:test_createAccountDeploysToPredeterminedAddress() (gas: 268601)
-CoinbaseSmartWalletFactoryTest:test_createAccountSetsOwnersCorrectly() (gas: 277291)
-CoinbaseSmartWalletFactoryTest:test_exitIfAccountIsAlreadyInitialized() (gas: 267718)
-CoinbaseSmartWalletFactoryTest:test_implementation_returnsExpectedAddress() (gas: 7654)
-CoinbaseSmartWalletFactoryTest:test_initCodeHash() (gas: 7890)
-CoinbaseSmartWalletFactoryTest:test_revertsIfNoOwners() (gas: 29214)
-ERC1271Test:test_returnsExpectedDomainHashWhenProxy() (gas: 29198)
-ERC1271Test:test_static() (gas: 3243921)
+AddOwnerAddressTest:testEmitsAddOwner() (gas: 92424)
+AddOwnerAddressTest:testIncreasesOwnerIndex() (gas: 90698)
+AddOwnerAddressTest:testRevertsIfAlreadyOwner() (gas: 93235)
+AddOwnerAddressTest:testRevertsIfCalledByNonOwner() (gas: 11786)
+AddOwnerAddressTest:testSetsIsOwner() (gas: 90492)
+AddOwnerAddressTest:testSetsOwnerAtIndex() (gas: 98992)
+AddOwnerPublicKeyTest:testEmitsAddOwner() (gas: 115559)
+AddOwnerPublicKeyTest:testFuzzIsOwnerPublicKey(bytes32,bytes32) (runs: 257, μ: 115372, ~: 115372)
+AddOwnerPublicKeyTest:testRevertsIfAlreadyOwner() (gas: 116399)
+AddOwnerPublicKeyTest:testRevertsIfCalledByNonOwner() (gas: 11776)
+AddOwnerPublicKeyTest:testSetsIsOwner() (gas: 113813)
+AddOwnerPublicKeyTest:testSetsOwnerAtIndex() (gas: 128638)
+CoinbaseSmartWallet1271InputGeneratorTest:testGetReplaySafeHashForDeployedAccount() (gas: 308479)
+CoinbaseSmartWallet1271InputGeneratorTest:testGetReplaySafeHashForUndeployedAccount() (gas: 291508)
+CoinbaseSmartWalletFactoryTest:testDeployDeterministicPassValues() (gas: 267283)
+CoinbaseSmartWalletFactoryTest:test_CreateAccount_ReturnsPredeterminedAddress_WhenAccountAlreadyExists() (gas: 286935)
+CoinbaseSmartWalletFactoryTest:test_RevertsIfLength32ButLargerThanAddress() (gas: 298669)
+CoinbaseSmartWalletFactoryTest:test_constructor_setsImplementation(address) (runs: 257, μ: 313355, ~: 313355)
+CoinbaseSmartWalletFactoryTest:test_createAccountDeploysToPredeterminedAddress() (gas: 268634)
+CoinbaseSmartWalletFactoryTest:test_createAccountSetsOwnersCorrectly() (gas: 277324)
+CoinbaseSmartWalletFactoryTest:test_exitIfAccountIsAlreadyInitialized() (gas: 267739)
+CoinbaseSmartWalletFactoryTest:test_implementation_returnsExpectedAddress() (gas: 7676)
+CoinbaseSmartWalletFactoryTest:test_initCodeHash() (gas: 7912)
+CoinbaseSmartWalletFactoryTest:test_revertsIfNoOwners() (gas: 29232)
+ERC1271Test:test_returnsExpectedDomainHashWhenProxy() (gas: 29243)
+ERC1271Test:test_static() (gas: 3247131)
 MultiOwnableInitializeTest:testRevertsIfLength32ButLargerThanAddress() (gas: 81111)
 MultiOwnableInitializeTest:testRevertsIfLength32NotAddress() (gas: 81092)
 MultiOwnableInitializeTest:testRevertsIfLengthNot32Or64() (gas: 103395)
-RemoveLastOwnerTest:test_emitsRemoveOwner() (gas: 50337)
-RemoveLastOwnerTest:test_removesOwner() (gas: 49609)
-RemoveLastOwnerTest:test_removesOwnerAtIndex() (gas: 49562)
-RemoveLastOwnerTest:test_revert_whenCalledByNonOwner(address) (runs: 256, μ: 19094, ~: 19094)
-RemoveLastOwnerTest:test_revert_whenNoOwnerAtIndex() (gas: 48379)
-RemoveLastOwnerTest:test_revert_whenWrongOwnerAtIndex() (gas: 34153)
-RemoveLastOwnerTest:test_reverts_whenNotLastOwner() (gas: 123412)
-RemoveOwnerAtIndexTest:test_emitsRemoveOwner() (gas: 55524)
-RemoveOwnerAtIndexTest:test_removesOwner() (gas: 54784)
-RemoveOwnerAtIndexTest:test_removesOwnerAtIndex() (gas: 54540)
-RemoveOwnerAtIndexTest:test_revert_whenCalledByNonOwner(address) (runs: 256, μ: 19145, ~: 19145)
-RemoveOwnerAtIndexTest:test_revert_whenNoOwnerAtIndex() (gas: 33372)
-RemoveOwnerAtIndexTest:test_revert_whenWrongOwnerAtIndex() (gas: 36694)
-RemoveOwnerAtIndexTest:test_reverts_ifIsLastOwner() (gas: 7471805)
-TestCanSkipChainIdValidation:test_approvedSelectorsReturnTrue() (gas: 15845)
-TestCanSkipChainIdValidation:test_otherSelectorsReturnFalse() (gas: 12469)
-TestExecuteWithoutChainIdValidation:testExecute() (gas: 424837)
-TestExecuteWithoutChainIdValidation:testExecuteBatch() (gas: 728897)
-TestExecuteWithoutChainIdValidation:testExecuteBatch(uint256) (runs: 256, μ: 3612753, ~: 3472828)
-TestExecuteWithoutChainIdValidation:test__codesize() (gas: 49960)
-TestExecuteWithoutChainIdValidation:test__codesize() (gas: 50195)
-TestExecuteWithoutChainIdValidation:test_revertsWithReservedNonce() (gas: 82347)
-TestExecuteWithoutChainIdValidation:test_reverts_whenCallerNotEntryPoint() (gas: 11053)
-TestExecuteWithoutChainIdValidation:test_reverts_whenOneCallReverts() (gas: 467906)
-TestExecuteWithoutChainIdValidation:test_reverts_whenOneSelectorNotApproved() (gas: 179678)
-TestExecuteWithoutChainIdValidation:test_reverts_whenSelectorNotApproved() (gas: 106769)
-TestExecuteWithoutChainIdValidation:test_succeeds_whenSelectorAllowed() (gas: 424367)
-TestImplementation:testImplementation() (gas: 12623)
-TestInitialize:testInitialize() (gas: 21034)
-TestInitialize:test_cannotInitImplementation() (gas: 2899105)
-TestIsValidSignature:testReturnsInvalidIfPasskeySigButWrongOwnerLength() (gas: 40187)
-TestIsValidSignature:testRevertsIfEthereumSignatureButWrongOwnerLength() (gas: 24040)
-TestIsValidSignature:testRevertsIfOwnerIsInvalidEthereumAddress() (gas: 22021)
-TestIsValidSignature:testSmartWalletSigner() (gas: 3174740)
-TestIsValidSignature:testValidateSignatureWithEOASigner() (gas: 24922)
-TestIsValidSignature:testValidateSignatureWithEOASignerFailsWithWrongSigner() (gas: 23877)
-TestIsValidSignature:testValidateSignatureWithPasskeySigner() (gas: 423238)
-TestIsValidSignature:testValidateSignatureWithPasskeySignerFailsBadOwnerIndex() (gas: 35664)
-TestIsValidSignature:testValidateSignatureWithPasskeySignerFailsWithWrongBadSignature() (gas: 430704)
-TestUpgradeToAndCall:testUpgradeToAndCall() (gas: 25477)
-TestValidateUserOp:test_reverts_whenReplayableNonceKeyInvalidForSelector() (gas: 14551)
-TestValidateUserOp:test_reverts_whenSelectorInvalidForReplayableNonceKey() (gas: 14816)
-TestValidateUserOp:test_succeedsWithEOASigner() (gas: 447664)
-TestValidateUserOp:test_succeedsWithPasskeySigner() (gas: 785032)
+RemoveLastOwnerTest:test_emitsRemoveOwner() (gas: 50363)
+RemoveLastOwnerTest:test_removesOwner() (gas: 49657)
+RemoveLastOwnerTest:test_removesOwnerAtIndex() (gas: 49588)
+RemoveLastOwnerTest:test_revert_whenCalledByNonOwner(address) (runs: 257, μ: 19094, ~: 19094)
+RemoveLastOwnerTest:test_revert_whenNoOwnerAtIndex() (gas: 48407)
+RemoveLastOwnerTest:test_revert_whenWrongOwnerAtIndex() (gas: 34181)
+RemoveLastOwnerTest:test_reverts_whenNotLastOwner() (gas: 123462)
+RemoveOwnerAtIndexTest:test_emitsRemoveOwner() (gas: 55549)
+RemoveOwnerAtIndexTest:test_removesOwner() (gas: 54828)
+RemoveOwnerAtIndexTest:test_removesOwnerAtIndex() (gas: 54566)
+RemoveOwnerAtIndexTest:test_revert_whenCalledByNonOwner(address) (runs: 257, μ: 19145, ~: 19145)
+RemoveOwnerAtIndexTest:test_revert_whenNoOwnerAtIndex() (gas: 33406)
+RemoveOwnerAtIndexTest:test_revert_whenWrongOwnerAtIndex() (gas: 36728)
+RemoveOwnerAtIndexTest:test_reverts_ifIsLastOwner() (gas: 7647492)
+TestCanSkipChainIdValidation:test_approvedSelectorsReturnTrue() (gas: 17781)
+TestCanSkipChainIdValidation:test_otherSelectorsReturnFalse() (gas: 12579)
+TestExecuteWithoutChainIdValidation:testExecute() (gas: 403873)
+TestExecuteWithoutChainIdValidation:testExecuteBatch() (gas: 728942)
+TestExecuteWithoutChainIdValidation:testExecuteBatch(uint256) (runs: 257, μ: 3628778, ~: 3584759)
+TestExecuteWithoutChainIdValidation:test__codesize() (gas: 50211)
+TestExecuteWithoutChainIdValidation:test_revertsWithReservedNonce() (gas: 81941)
+TestExecuteWithoutChainIdValidation:test_reverts_whenCallerNotEntryPoint() (gas: 11031)
+TestExecuteWithoutChainIdValidation:test_reverts_whenOneCallReverts() (gas: 467783)
+TestExecuteWithoutChainIdValidation:test_reverts_whenOneSelectorNotApproved() (gas: 179662)
+TestExecuteWithoutChainIdValidation:test_reverts_whenSelectorNotApproved() (gas: 106736)
+TestExecuteWithoutChainIdValidation:test_succeeds_whenSelectorAllowed() (gas: 423963)
+TestImplementation:testImplementation() (gas: 12558)
+TestInitialize:testInitialize() (gas: 21012)
+TestInitialize:test_cannotInitImplementation() (gas: 2896342)
+TestIsValidSignature:testReturnsInvalidIfPasskeySigButWrongOwnerLength() (gas: 40165)
+TestIsValidSignature:testRevertsIfEthereumSignatureButWrongOwnerLength() (gas: 24018)
+TestIsValidSignature:testRevertsIfOwnerIsInvalidEthereumAddress() (gas: 21999)
+TestIsValidSignature:testSmartWalletSigner() (gas: 3177948)
+TestIsValidSignature:testValidateSignatureWithEOASigner() (gas: 24900)
+TestIsValidSignature:testValidateSignatureWithEOASignerFailsWithWrongSigner() (gas: 23855)
+TestIsValidSignature:testValidateSignatureWithPasskeySigner() (gas: 437729)
+TestIsValidSignature:testValidateSignatureWithPasskeySignerFailsBadOwnerIndex() (gas: 35642)
+TestIsValidSignature:testValidateSignatureWithPasskeySignerFailsWithWrongBadSignature() (gas: 428169)
+TestUpgradeToAndCall:testUpgradeToAndCall() (gas: 25499)
+TestValidateUserOp:test_reverts_whenReplayableNonceKeyInvalidForSelector() (gas: 14211)
+TestValidateUserOp:test_reverts_whenSelectorInvalidForReplayableNonceKey() (gas: 14476)
+TestValidateUserOp:test_succeedsWithEOASigner() (gas: 448010)
+TestValidateUserOp:test_succeedsWithPasskeySigner() (gas: 785198)

.github/workflows/certora.yml

@@ -54,5 +54,6 @@ jobs:
       max-parallel: 4
       matrix:
         params: 
-          - {name: ERC4337Account, command: 'ERC4337Account.conf'}
+          - {name: ERC4337Account, command: 'ERC4337Account.conf --rule cantInitTwice'}
+          - {name: ERC4337Account, command: 'ERC4337Account.conf --exclude_rule cantInitTwice'}
           - {name: ERC4337AccountInv, command: 'ERC4337AccountInv.conf'}

.github/workflows/test.yml

@@ -38,6 +38,11 @@ jobs:
           forge fmt --check
         id: fmt
 
+      - name: Check snapshot
+        run: |
+          forge snapshot --check --tolerance 1
+        id: snapshot
+
   forge-coverage:
       name: Run Coverage Reporting
       runs-on: ubuntu-latest

.gitignore

@@ -7,7 +7,7 @@ out/
 /broadcast/*/31337/
 /broadcast/**/dry-run/
 
-/broadcast
+/broadcast/DeployERC4337Factory.s.sol
 
 # Docs
 docs/
@@ -16,6 +16,4 @@ docs/
 .env
 .VSCodeCounter/
 
-lib/
-
 .certora_internal/

.gitmodules

@@ -7,15 +7,15 @@
 [submodule "lib/account-abstraction"]
 	path = lib/account-abstraction
 	url = https://github.com/eth-infinitism/account-abstraction
-[submodule "lib/FreshCryptoLib"]
-	path = lib/FreshCryptoLib
-	url = https://github.com/rdubois-crypto/FreshCryptoLib
 [submodule "lib/solady"]
 	path = lib/solady
 	url = https://github.com/vectorized/solady
-[submodule "lib/webauthn-sol"]
-	path = lib/webauthn-sol
-	url = https://github.com/base-org/webauthn-sol
 [submodule "lib/openzeppelin-contracts"]
 	path = lib/openzeppelin-contracts
 	url = https://github.com/openzeppelin/openzeppelin-contracts
+[submodule "lib/webauthn-sol"]
+	path = lib/webauthn-sol
+	url = https://github.com/base-org/webauthn-sol
+[submodule "lib/safe-singleton-deployer-sol"]
+	path = lib/safe-singleton-deployer-sol
+	url = https://github.com/wilsoncusack/safe-singleton-deployer-sol

Makefile

@@ -0,0 +1 @@
+deploy :; source .env && export FOUNDRY_PROFILE=deploy && forge script script/DeployFactory.s.sol --rpc-url $${RPC_URL}  --account $${ACCOUNT} --broadcast --verify

README.md

@@ -1,6 +1,3 @@
-> [!IMPORTANT]  
-> The code in this repository and its dependencies are still under audit. It is not yet recommended for production use.
-
 # Smart Wallet
 
 This repository contains code for a new, [ERC-4337](https://eips.ethereum.org/EIPS/eip-4337) compliant smart contract wallet from Coinbase. 
@@ -11,7 +8,7 @@ It supports
 - Cross-chain replayability for owner updates and other actions: sign once, update everywhere. 
 
 ## Multiple Owners
-Our smart wallet supports up to 256 concurrent owners. Each owner can transact independently, without sign off from any other owner. 
+Our smart wallet supports a practically unlimited number of concurrent owners (max 2^256). Each owner can transact independently, without sign off from any other owner. 
 
 Owners are identified as `bytes` to allow both Ethereum address owners and passkey (Secp256r1) public key owners. 
 
@@ -82,10 +79,10 @@ Today, allowed are
 - UUPSUpgradeable.upgradeToAndCall
 
 ## Deployments
-
-| Network   | CoinbaseSmartWalletFactory Address                        |
+Factory and implementation are deployed via [Safe Singleton Factory](https://github.com/safe-global/safe-singleton-factory), which today will give the same address across 248 chains. See "Deploying" below for instructions on how to deploy to new chains. 
+| Version   | Factory Address                        |
 |-----------|-----------------------------------------|
-| Base Sepolia | [0xeD4EAeBDBBA52DBB37259a2b75AbB87abF3a19E8](https://sepolia.basescan.org/address/0xeD4EAeBDBBA52DBB37259a2b75AbB87abF3a19E8) |
+| 1 | [0x0BA5ED0c6AA8c49038F819E587E2633c4A9F428a](https://basescan.org/address/0x0BA5ED0c6AA8c49038F819E587E2633c4A9F428a) |
 
 
 ## Developing 
@@ -94,5 +91,22 @@ After cloning the repo, run the tests using Forge, from [Foundry](https://github
 forge test
 ```
 
+## Deploying
+To deploy on a new chain, in your `.env` set
+```bash
+#`cast wallet` name
+ACCOUNT=
+# Node RPC URL
+RPC_URL=
+# Optional Etherscan API key for contract verification
+ETHERSCAN_API_KEY=
+```
+See [here](https://book.getfoundry.sh/reference/cast/cast-wallet-import) for more details on `cast wallet`.
+
+Then run 
+```
+make deploy
+```
+
 ## Influences
 Much of the code in this repository started from Solady's [ERC4337](https://github.com/Vectorized/solady/blob/main/src/accounts/ERC4337.sol) implementation. We were also influenced by [DaimoAccount](https://github.com/daimo-eth/daimo/blob/master/packages/contract/src/DaimoAccount.sol), which pioneered using passkey signers on ERC-4337 accounts, and [LightAccount](https://github.com/alchemyplatform/light-account).

audits/Code4rena-March-2024.md

@@ -0,0 +1 @@
+[View report.](https://code4rena.com/reports/2024-03-coinbase)