EIP-8141 Frame Transaction 완전 정복 — EIP-86에서 시작된 9년짜리 Account Abstraction의 종착점

Vitalik이 2016년 제안한 EIP-86은 "모든 계정은 컨트랙트다"라는 비전을 처음으로 공식화했다. null 서명(chain_id, 0, 0)이 담긴 트랜잭션은 NULL_SENDER 주소로 가고, 사용자는 커스텀 검증 로직을 가진 컨트랙트에 ETH를 보유한다. 트랜잭션 발신자(origin)와 서명 방식을 프로토콜에서 분리하자는 핵심 아이디어였다.

🚧 왜 실패했나: 너무 급진적이었다. 합의 레이어 변경이 필요했고, 안전한 mempool 전파를 위한 검증 프레임워크가 없었다. CREATE2가 이 EIP에서 처음 등장했지만 별도로(EIP-1014) 먼저 배포됐다.

// Frame Transaction RLP structure
[chain_id, nonce, sender, frames, signatures, fees, blob_versioned_hashes]

frames = [[mode, flags, target, limits, value, data], ...]
limits = [execution_gas, state_gas]   // 2D gas budgets

// Signature entries
signatures = [[scheme, signer, msg, signature], ...]

// Fee fields
fees = [max_priority_fee_per_gas, max_fee_per_gas, max_fee_per_blob_gas]

// scope values
APPROVE_PAYMENT             = 0x1   // gas payment only
APPROVE_EXECUTION           = 0x2   // execution only
APPROVE_EXECUTION_AND_PAYMENT = 0x3 // both

// Rules:
// 1. Only callable if ADDRESS == resolved_target (self-call only)
// 2. Once an approval bit is set, it cannot be set again
// 3. APPROVE_PAYMENT effects:
//    - nonce++
//    - deduct max_cost from payer balance
//    - payer = this frame's target
// 4. APPROVE_EXECUTION effects:
//    - sender_approved = true
//    - (only valid if frame.target == tx.sender)

Frame 0: batch_flag=1  ─┐
Frame 1: batch_flag=0  ─┘  Batch 1

Frame 2: batch_flag=1  ─┐
Frame 3: batch_flag=1   │  Batch 2
Frame 4: batch_flag=0  ─┘

frame_tx_intrinsic_gas = (
    12_000                           # base cost
  + 475 * len(tx.frames)             # per-frame cost
  + frame_data_cost                  # calldata
  + signature_data_cost              # sig bytes
  + signature_verification_cost      # SECP256K1: 2800, P256: 6700, ARBITRARY: 100
  + value_transfer_cost
)

# Warm/cold state initial values:
# - tx.sender, coinbase, active precompiles → warm
# - frame targets → NOT auto-warmed (important for gas estimates!)
# - payer → warmed only when APPROVE touches it

[self_verify]                       # basic self-relay
[deploy] → [self_verify]            # self-relay with account deployment

[only_verify] → [pay]               # canonical paymaster basic
[deploy] → [only_verify] → [pay]    # canonical paymaster + deployment

import { RLP } from '@ethereumjs/rlp';
import { keccak256, hexToBytes, bytesToHex } from 'viem';

// Transaction type byte
const TX_TYPE_FRAME = 0x06;

// Frame modes
const FRAME_MODE_DEFAULT = 0;
const FRAME_MODE_VERIFY  = 1;
const FRAME_MODE_SENDER  = 2;

// APPROVE scope constants
const APPROVE_PAYMENT             = 0x1;
const APPROVE_EXECUTION           = 0x2;
const APPROVE_EXECUTION_AND_PAYMENT = 0x3;

// Signature schemes
const SIG_ARBITRARY  = 0x0;
const SIG_SECP256K1  = 0x1;
const SIG_P256       = 0x2;

interface Frame {
  mode: number;
  flags: bigint;        // 256-bit flags field
  target: string | null; // address or null (= tx.sender)
  executionGas: bigint;
  stateGas: bigint;
  value: bigint;
  data: Uint8Array;
}

interface FrameSignature {
  scheme: number;
  signer: string;   // address (20 bytes)
  message: Uint8Array;
  signature: Uint8Array;
}

interface FrameTx {
  chainId: bigint;
  nonce: bigint;
  sender: string;
  frames: Frame[];
  signatures: FrameSignature[];
  maxPriorityFeePerGas: bigint;
  maxFeePerGas: bigint;
  maxFeePerBlobGas: bigint;
  blobVersionedHashes: Uint8Array[];
}

function encodeFrame(f: Frame): Uint8Array[] {
  return [
    RLP.encode(f.mode),
    RLP.encode(f.flags),
    f.target ? hexToBytes(f.target as `0x${string}`) : new Uint8Array(0),
    RLP.encode([f.executionGas, f.stateGas]),
    RLP.encode(f.value),
    f.data,
  ];
}

function encodeSignature(s: FrameSignature): Uint8Array[] {
  return [
    RLP.encode(s.scheme),
    hexToBytes(s.signer as `0x${string}`),
    s.message,
    s.signature,
  ];
}

export function encodeFrameTx(tx: FrameTx): Uint8Array {
  const encoded = RLP.encode([
    tx.chainId,
    tx.nonce,
    hexToBytes(tx.sender as `0x${string}`),
    tx.frames.map(encodeFrame),
    tx.signatures.map(encodeSignature),
    [tx.maxPriorityFeePerGas, tx.maxFeePerGas, tx.maxFeePerBlobGas],
    tx.blobVersionedHashes,
  ]);
  // Prepend transaction type byte 0x06
  const result = new Uint8Array(1 + encoded.length);
  result[0] = TX_TYPE_FRAME;
  result.set(encoded, 1);
  return result;
}

// Signing hash: keccak256(0x06 || rlp(payload))
export function frameTxSigningHash(tx: FrameTx): `0x${string}` {
  return keccak256(encodeFrameTx(tx));
}

import { privateKeyToAccount } from 'viem/accounts';
import { createWalletClient, http, parseEther } from 'viem';
import { mainnet } from 'viem/chains';

const account = privateKeyToAccount('0x...');

// Simple ETH transfer as Frame Transaction
// Frame 0: VERIFY (self-pay, self-authorize execution)
// Frame 1: SENDER (actual transfer)
const tx: FrameTx = {
  chainId: 1n,
  nonce: 0n,
  sender: account.address,
  frames: [
    {
      mode: FRAME_MODE_VERIFY,
      flags: BigInt(APPROVE_EXECUTION_AND_PAYMENT), // scope 0x3
      target: null,  // target = tx.sender (self)
      executionGas: 50_000n,
      stateGas: 0n,
      value: 0n,
      data: new Uint8Array(0),
    },
    {
      mode: FRAME_MODE_SENDER,
      flags: 0n,
      target: '0xRecipientAddress',
      executionGas: 21_000n,
      stateGas: 0n,
      value: parseEther('0.1'),
      data: new Uint8Array(0),
    },
  ],
  signatures: [
    {
      scheme: SIG_SECP256K1,
      signer: account.address,
      message: new Uint8Array(0), // auto-computed by protocol for self-verify
      signature: new Uint8Array(0), // filled after signing
    },
  ],
  maxPriorityFeePerGas: 1_000_000_000n,
  maxFeePerGas: 30_000_000_000n,
  maxFeePerBlobGas: 0n,
  blobVersionedHashes: [],
};

// Sign the transaction
const hash = frameTxSigningHash(tx);
const sig = await account.sign({ hash });

// Insert signature (v=1/0, r, s — 65 bytes)
tx.signatures[0].signature = hexToBytes(sig);

const rawTx = encodeFrameTx(tx);
// Submit: eth_sendRawTransaction
const txHash = await client.request({
  method: 'eth_sendRawTransaction',
  params: [bytesToHex(rawTx)],
});

// Paymaster pattern:
// Frame 0: VERIFY (userAccount → APPROVE_EXECUTION only)
// Frame 1: VERIFY (paymasterContract → APPROVE_PAYMENT only)
// Frame 2: SENDER (actual user action)

const userTx: FrameTx = {
  chainId: 1n,
  nonce: 0n,
  sender: userAddress,
  frames: [
    {
      mode: FRAME_MODE_VERIFY,
      flags: BigInt(APPROVE_EXECUTION), // scope 0x2 (execution only)
      target: null,  // userAddress
      executionGas: 50_000n,
      stateGas: 0n,
      value: 0n,
      data: new Uint8Array(0),
    },
    {
      mode: FRAME_MODE_VERIFY,
      flags: BigInt(APPROVE_PAYMENT), // scope 0x1 (payment only)
      target: PAYMASTER_ADDRESS,
      executionGas: 80_000n,
      stateGas: 0n,
      value: 0n,
      // paymasterData: ABI-encoded validation params
      data: encodePaymasterData({ userAddress, expiry: BigInt(Date.now() / 1000 + 3600) }),
    },
    {
      mode: FRAME_MODE_SENDER,
      flags: 0n,
      target: UNISWAP_ROUTER,
      executionGas: 200_000n,
      stateGas: 50_000n,
      value: 0n,
      data: encodeSwapData(...),
    },
  ],
  signatures: [
    // sig[0]: user's SECP256K1 signature (for VERIFY frame 0)
    { scheme: SIG_SECP256K1, signer: userAddress, message: new Uint8Array(0), signature: userSig },
    // sig[1]: paymaster's SECP256K1 signature (for VERIFY frame 1)
    { scheme: SIG_SECP256K1, signer: paymasterSigner, message: new Uint8Array(0), signature: paymasterSig },
  ],
  maxPriorityFeePerGas: 1_000_000_000n,
  maxFeePerGas: 30_000_000_000n,
  maxFeePerBlobGas: 0n,
  blobVersionedHashes: [],
};

// NOTE: In this pattern, payer = PAYMASTER_ADDRESS (set when APPROVE_PAYMENT is called)
// Gas deducted from paymaster contract's ETH balance, not user's

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.30;

// EIP-8141 opcodes as assembly constants
// APPROVE    = 0xaa
// TXPARAM    = 0xb0
// FRAMEPARAM = 0xb3
// SIGPARAM   = 0xb4

contract MinimalSmartAccount {
    // ── Storage ──────────────────────────────────────────────────────
    address public owner;

    constructor(address _owner) {
        owner = _owner;
    }

    // ── VERIFY frame entry point ──────────────────────────────────────
    // Called by ENTRY_POINT (0xaa) as STATICCALL
    // Must call APPROVE to signal validation success
    fallback() external {
        // Read which frame mode we're in via FRAMEPARAM
        uint8 frameMode;
        assembly {
            // FRAMEPARAM(0) returns frame mode
            mstore(0x00, 0)
            let ok := staticcall(gas(), 0xb3, 0x00, 0x20, 0x00, 0x20)
            frameMode := mload(0x00)
        }

        if (frameMode == 1) {
            // VERIFY frame: validate and APPROVE
            _verify();
        }
        // SENDER frame: execution is handled by SENDER mode caller
        // DEFAULT frame: post-op hooks can go here
    }

    function _verify() internal view {
        // 1. Read the signing hash from TXPARAM
        //    TXPARAM(4) = signing_hash (what the protocol computes over the tx)
        bytes32 signingHash;
        assembly {
            mstore(0x00, 4)
            staticcall(gas(), 0xb0, 0x00, 0x20, 0x00, 0x20)
            signingHash := mload(0x00)
        }

        // 2. Read SECP256K1 signature from signatures list
        //    SIGPARAM(0) = number of signatures
        //    For SECP256K1: signature is (v, r, s) = 65 bytes
        uint8 v;
        bytes32 r;
        bytes32 s;
        assembly {
            // SIGPARAM(sigIndex=0, field=0) → scheme
            // For brevity, read SECP256K1 sig at index 0
            // Real impl: read SIGPARAM to get scheme, then SIGDATACOPY
            let ptr := mload(0x40)
            // v = 27 or 28
            mstore(ptr, 0)          // sig index = 0
            mstore(add(ptr, 0x20), 1) // field = 1 (sig data start)
            // SIGDATACOPY(destOffset, sigIndex, srcOffset, length)
            // Stack: [sigIndex, destOffset, srcOffset, length]
            // For secp256k1: v=1byte at offset 0, r=32 at offset 1, s=32 at offset 33
        }
        // NOTE: in practice use SIGDATACOPY via assembly to copy bytes
        // Simplified here: assume sig loaded via library

        // 3. ecrecover and check owner
        address recovered = ecrecover(signingHash, v, r, s);
        require(recovered == owner, "Invalid signature");

        // 4. APPROVE — tell the protocol this frame is validated
        //    APPROVE(offset=0, length=0, scope=0x3)
        //    scope 0x3 = APPROVE_EXECUTION_AND_PAYMENT
        uint8 scope = 0x3; // or read from frame flags
        assembly {
            // Stack: [offset, length, scope]
            // APPROVE opcode = 0xaa
            mstore(0x00, 0)    // offset
            mstore(0x20, 0)    // length
            mstore(0x40, scope) // scope
            // Call APPROVE via assembly
            // Note: APPROVE is a new opcode, not a precompile call
            // In real EIP-8141 EVM it's a native opcode
            pop(call(gas(), 0xaa, 0, 0, 0x60, 0, 0))
        }
    }
}

// Two separate VERIFY frames pattern:
// Frame 0: userAccount verifies sig → APPROVE(scope=0x2) execution only
// Frame 1: paymasterContract verifies policy → APPROVE(scope=0x1) payment only

contract UserSmartAccount {
    address public owner;

    fallback() external {
        uint8 frameMode = _getFrameMode();
        if (frameMode != 1) return; // Only handle VERIFY frames

        // Read allowed scope from frame flags
        // flags & 0x3 = scope bits
        uint256 flags = _getFrameFlags();
        uint8 allowedScope = uint8(flags & 0x3);
        require(allowedScope != 0, "No scope allowed");

        // Verify signature
        bytes32 sigHash = _getTxSigningHash();
        require(_verifyOwnerSig(sigHash), "Bad sig");

        // APPROVE only execution (not payment — paymaster handles that)
        _approve(APPROVE_EXECUTION); // scope = 0x2
    }

    function _approve(uint8 scope) internal {
        assembly {
            // APPROVE opcode 0xaa
            // Arguments pushed to stack: offset=0, length=0, scope
            let ok := call(gas(), 0xaa, 0, 0, 0, 0, 0)
            // The actual EIP-8141 APPROVE opcode takes scope from frame flags
            // or from the call arguments depending on final spec
        }
    }

    // Helper: read frame mode via FRAMEPARAM opcode
    function _getFrameMode() internal view returns (uint8 mode) {
        assembly {
            mstore(0x00, 0) // param index 0 = mode
            staticcall(gas(), 0xb3, 0x00, 0x20, 0x00, 0x20)
            mode := and(mload(0x00), 0xff)
        }
    }

    function _getFrameFlags() internal view returns (uint256 flags) {
        assembly {
            mstore(0x00, 1) // param index 1 = flags
            staticcall(gas(), 0xb3, 0x00, 0x20, 0x00, 0x20)
            flags := mload(0x00)
        }
    }

    function _getTxSigningHash() internal view returns (bytes32 h) {
        assembly {
            mstore(0x00, 4) // TXPARAM index 4 = signing_hash
            staticcall(gas(), 0xb0, 0x00, 0x20, 0x00, 0x20)
            h := mload(0x00)
        }
    }

    function _verifyOwnerSig(bytes32 hash) internal view returns (bool) {
        // In practice: SIGDATACOPY to load sig bytes, then ecrecover
        // Simplified: assume library call
        return true; // placeholder
    }

    uint8 constant APPROVE_EXECUTION = 0x2;
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.30;

/// @title MinimalPaymaster
/// @notice EIP-8141 Canonical Paymaster implementation
/// @dev Receives VERIFY frames with scope=APPROVE_PAYMENT (0x1)
///      Validates user policy and calls APPROVE to cover tx costs
contract MinimalPaymaster {
    // ── Constants ──────────────────────────────────────────────────────
    uint8 constant FRAME_MODE_VERIFY = 1;
    uint8 constant APPROVE_PAYMENT   = 0x1;

    // EIP-8141 special address for ENTRY_POINT
    address constant ENTRY_POINT = address(0xaa);

    // ── Storage ────────────────────────────────────────────────────────
    address public admin;
    // user address → whether they are whitelisted for free gas
    mapping(address => bool) public whitelist;
    // user address → USDC allowance for gas payment
    mapping(address => uint256) public usdcGasBalance;
    // accumulated protocol fee in USDC
    uint256 public feePool;

    event GasSponsored(address indexed user, uint256 maxCost);
    event GasPaidInUsdc(address indexed user, uint256 usdcAmount);

    constructor() {
        admin = msg.sender;
    }

    // ── Deposit / Admin ────────────────────────────────────────────────
    receive() external payable {}  // Accept ETH to fund gas

    function depositUsdcFor(address user, uint256 amount) external {
        // Pull USDC from caller (requires ERC-20 approve first)
        IERC20(USDC_ADDRESS).transferFrom(msg.sender, address(this), amount);
        usdcGasBalance[user] += amount;
    }

    function setWhitelist(address user, bool allowed) external {
        require(msg.sender == admin, "Not admin");
        whitelist[user] = allowed;
    }

    // ── Main VERIFY frame handler ──────────────────────────────────────
    fallback() external {
        // Only handle VERIFY frames
        require(_frameMode() == FRAME_MODE_VERIFY, "Not VERIFY frame");

        // Read tx params via TXPARAM
        address txSender = _txParam(0);
        uint256 maxCost  = _txParam(2); // max ETH cost of entire tx

        // ── Policy check: whitelist OR USDC prepayment ──────────────
        if (whitelist[txSender]) {
            // Free sponsorship for whitelisted users
            emit GasSponsored(txSender, maxCost);
            _approve(APPROVE_PAYMENT);
        } else {
            // Check USDC gas balance covers cost (using price oracle)
            uint256 usdcRequired = _ethToUsdc(maxCost);
            require(usdcGasBalance[txSender] >= usdcRequired, "Insufficient USDC gas balance");

            // Deduct USDC upfront (debit during VERIFY, refund in post-op if needed)
            usdcGasBalance[txSender] -= usdcRequired;
            feePool += usdcRequired;

            emit GasPaidInUsdc(txSender, usdcRequired);
            _approve(APPROVE_PAYMENT);
        }
        // If we reach here without APPROVE, tx is rejected
    }

    // ── EIP-8141 Opcode wrappers ────────────────────────────────────────
    function _approve(uint8 scope) internal {
        assembly {
            // APPROVE opcode 0xaa: sets payer = address(this), nonce++, deducts max_cost
            pop(call(gas(), 0xaa, 0, 0, 0, 0, 0))
        }
    }

    function _frameMode() internal view returns (uint8 mode) {
        assembly {
            mstore(0, 0)
            staticcall(gas(), 0xb3, 0, 0x20, 0, 0x20)
            mode := and(mload(0), 0xff)
        }
    }

    function _txParam(uint256 idx) internal view returns (address val) {
        assembly {
            mstore(0, idx)
            staticcall(gas(), 0xb0, 0, 0x20, 0, 0x20)
            val := mload(0)
        }
    }

    function _ethToUsdc(uint256 ethAmount) internal view returns (uint256) {
        // Simplified: use a price oracle (Chainlink ETH/USD)
        // Real impl: IPriceFeed(ORACLE).latestRoundData()
        uint256 ethPriceInUsdc = 3000 * 1e6; // $3000 per ETH, 6 decimals
        return (ethAmount * ethPriceInUsdc) / 1e18;
    }

    address constant USDC_ADDRESS = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48; // mainnet USDC
}

interface IERC20 {
    function transferFrom(address, address, uint256) external returns (bool);
    function transfer(address, uint256) external returns (bool);
}

// P256 signer address derivation:
// When signature scheme = P256 (0x2), signature encoding is:
//   r(32) || s(32) || qx(32) || qy(32)  = 128 bytes
//
// Protocol derives signer address as:
//   keccak256(qx || qy)[12:]  ← last 20 bytes of keccak hash
//
// This is analogous to ECDSA but uses P256 public key components.

contract P256SmartAccount {
    // The P256 "signer address" stored at construction
    // = keccak256(pubKeyX || pubKeyY)[12:]
    address public p256Signer;

    uint8 constant FRAME_MODE_VERIFY = 1;

    constructor(bytes32 pubKeyX, bytes32 pubKeyY) {
        // Compute P256 signer address from public key
        p256Signer = address(uint160(uint256(keccak256(abi.encodePacked(pubKeyX, pubKeyY)))));
    }

    fallback() external {
        if (_frameMode() != FRAME_MODE_VERIFY) return;

        // For P256 scheme, the protocol itself verifies the signature.
        // The VERIFY frame's job is just to confirm the signer matches owner.
        // Use SIGPARAM to read the signer address that the protocol resolved.

        address resolvedSigner;
        assembly {
            // SIGPARAM(sigIndex=0, field=2) = signer address resolved by protocol
            mstore(0x00, 0)  // sig index 0
            mstore(0x20, 2)  // field 2 = resolved signer
            staticcall(gas(), 0xb4, 0x00, 0x40, 0x00, 0x20)
            resolvedSigner := mload(0x00)
        }

        require(resolvedSigner == p256Signer, "P256: wrong signer");

        // Additional checks: nonce, expiry, scope
        _approve(0x3); // APPROVE_EXECUTION_AND_PAYMENT
    }

    function _approve(uint8 scope) internal {
        assembly { pop(call(gas(), 0xaa, 0, 0, 0, 0, 0)) }
    }

    function _frameMode() internal view returns (uint8 m) {
        assembly {
            mstore(0, 0)
            staticcall(gas(), 0xb3, 0, 0x20, 0, 0x20)
            m := and(mload(0), 0xff)
        }
    }
}

// ── ARBITRARY scheme: BLS / Custom Signature ──────────────────────────
// Use SIGDATACOPY to pull arbitrary sig bytes and verify with EVM bytecode

contract ArbitrarySignatureAccount {
    // For example: a simple 2-of-2 multi-sig with BLS aggregation
    bytes32 public blsPublicKeyHash; // hash of the aggregate BLS public key

    fallback() external {
        if (_frameMode() != 1) return;

        // 1. Get ARBITRARY sig length via SIGPARAM
        uint256 sigLen;
        assembly {
            mstore(0x00, 0)  // sig index 0
            mstore(0x20, 3)  // field 3 = signature byte length (for ARBITRARY)
            staticcall(gas(), 0xb4, 0x00, 0x40, 0x00, 0x20)
            sigLen := mload(0x00)
        }

        // 2. Copy signature bytes to memory via SIGDATACOPY
        bytes memory sigBytes = new bytes(sigLen);
        assembly {
            // SIGDATACOPY(sigIndex=0, destOffset=sigBytes+32, srcOffset=0, length=sigLen)
            mstore(0x00, 0)              // sig index
            mstore(0x20, add(sigBytes, 32)) // dest
            mstore(0x40, 0)              // src offset
            mstore(0x60, sigLen)         // length
            staticcall(gas(), 0xb5, 0x00, 0x80, 0x00, 0x00)
        }

        // 3. Verify BLS signature in EVM bytecode
        //    (In practice: call a BLS precompile or EIP-2537 G1/G2 operations)
        bytes32 sigHash = _getTxSigningHash();
        require(_verifyBLS(sigHash, sigBytes), "BLS: invalid signature");

        _approve(0x3);
    }

    function _verifyBLS(bytes32 msgHash, bytes memory sig) internal view returns (bool) {
        // EIP-2537 BLS precompile calls would go here
        // Placeholder implementation
        return sig.length > 0;
    }

    function _getTxSigningHash() internal view returns (bytes32 h) {
        assembly {
            mstore(0, 4)
            staticcall(gas(), 0xb0, 0, 0x20, 0, 0x20)
            h := mload(0)
        }
    }

    function _frameMode() internal view returns (uint8 m) {
        assembly {
            mstore(0, 0)
            staticcall(gas(), 0xb3, 0, 0x20, 0, 0x20)
            m := and(mload(0), 0xff)
        }
    }

    function _approve(uint8 scope) internal {
        assembly { pop(call(gas(), 0xaa, 0, 0, 0, 0, 0)) }
    }
}

// WebAuthn passkey authentication → EIP-8141 P256 signature
import { startAuthentication } from '@simplewebauthn/browser';
import { keccak256, hexToBytes, bytesToHex, concatBytes } from 'viem';

interface P256Signature {
  r: Uint8Array;  // 32 bytes
  s: Uint8Array;  // 32 bytes
  qx: Uint8Array; // 32 bytes (public key X)
  qy: Uint8Array; // 32 bytes (public key Y)
}

async function signFrameTxWithPasskey(
  txHash: `0x${string}`,
  credentialId: string,
): Promise<P256Signature> {
  // Convert tx hash to WebAuthn challenge
  const challenge = Buffer.from(hexToBytes(txHash)).toString('base64url');

  // Request WebAuthn authentication
  const assertion = await startAuthentication({
    optionsJSON: {
      challenge,
      rpId: window.location.hostname,
      allowCredentials: [{ id: credentialId, type: 'public-key' }],
      userVerification: 'required',
    },
  });

  // Parse the CBOR-encoded signature from WebAuthn response
  // assertion.response.signature contains DER-encoded P256 sig
  const derSig = Buffer.from(assertion.response.signature, 'base64url');

  // Parse DER signature → (r, s)
  const { r, s } = parseDerP256Signature(derSig);

  // qx, qy come from the stored credential public key (registered at account creation)
  const { qx, qy } = await getStoredPublicKey(credentialId);

  return { r, s, qx, qy };
}

// Encode as EIP-8141 P256 signature bytes: r||s||qx||qy = 128 bytes
function encodeP256Signature(sig: P256Signature): Uint8Array {
  return concatBytes([sig.r, sig.s, sig.qx, sig.qy]); // 128 bytes total
}

// Derive the P256 "signer address" (matches what protocol computes)
function deriveP256SignerAddress(qx: Uint8Array, qy: Uint8Array): `0x${string}` {
  const combined = concatBytes([qx, qy]); // 64 bytes
  const hash = keccak256(combined);
  // Take last 20 bytes
  return `0x${hash.slice(-40)}` as `0x${string}`;
}

import { createPublicClient, http } from 'viem';
import { mainnet } from 'viem/chains';

interface FrameGasEstimate {
  frameIndex: number;
  executionGas: bigint;
  stateGas: bigint;
}

interface TxGasEstimate {
  frames: FrameGasEstimate[];
  totalExecutionGas: bigint;
  totalStateGas: bigint;
  // max_cost in ETH = (totalExecutionGas * max_fee_per_gas)
  //                 + (totalStateGas * max_state_fee_per_gas) [EIP-8037]
  maxCostWei: bigint;
}

// Estimate 2D gas for a Frame Transaction
// EIP-8141 nodes will expose eth_estimateFrameTxGas (hypothetical)
async function estimateFrameTxGas(
  tx: FrameTx,
  rpcUrl: string,
): Promise<TxGasEstimate> {
  const client = createPublicClient({ transport: http(rpcUrl) });

  // In practice: call eth_estimateFrameTxGas (EIP-8141 new RPC method)
  // For now, simulate by estimating each frame separately

  const estimates: FrameGasEstimate[] = [];
  let totalExec = 0n;
  let totalState = 0n;

  for (let i = 0; i < tx.frames.length; i++) {
    const frame = tx.frames[i];

    // Classify opcodes into execution vs state costs
    // State gas: SLOAD=2100, SSTORE=20000 (warm), etc.
    // Execution gas: everything else

    // Simplified heuristic (replace with actual simulation):
    const exec = await estimateExecutionGas(client, frame);
    const state = await estimateStateGas(client, frame);

    estimates.push({ frameIndex: i, executionGas: exec, stateGas: state });
    totalExec += exec;
    totalState += state;
  }

  // Mempool constraints check
  // Validation prefix frames (VERIFY frames) must fit within limits
  const verifyFrames = tx.frames.filter(f => f.mode === 1);
  const verifyExecTotal = verifyFrames.reduce((sum, _, i) => sum + estimates.filter(e => tx.frames[e.frameIndex].mode === 1)[i]?.executionGas ?? 0n, 0n);
  if (verifyExecTotal > 100_000n) {
    console.warn(`WARNING: VERIFY frames exec gas ${verifyExecTotal} exceeds mempool limit 100,000 — tx will not propagate via public mempool`);
  }

  // Compute max_cost
  // max_cost = exec_gas * max_fee_per_gas + state_gas * max_state_fee_per_gas
  const maxFeePerGas = tx.maxFeePerGas;
  const maxStateFeePerGas = 1_000_000n; // example: 0.001 gwei per state gas unit
  const maxCostWei = totalExec * maxFeePerGas + totalState * maxStateFeePerGas;

  return { frames: estimates, totalExecutionGas: totalExec, totalStateGas: totalState, maxCostWei };
}

async function estimateExecutionGas(client: any, frame: Frame): Promise<bigint> {
  // Simulate with eth_call for the frame target
  // State gas ops are excluded from execution gas in 2D model
  return 21_000n; // baseline + estimated compute
}

async function estimateStateGas(client: any, frame: Frame): Promise<bigint> {
  // Count storage operations in frame.data (ABI decode calldata, trace SLOADs/SSTOREs)
  // SLOAD = 2100 state gas, SSTORE (set) = 20000 state gas, etc.
  return 5_000n; // example
}

// Usage
const estimate = await estimateFrameTxGas(myFrameTx, 'https://eth-mainnet.rpc.url');
console.log('Total exec gas:', estimate.totalExecutionGas);
console.log('Total state gas:', estimate.totalStateGas);
console.log('Max cost:', estimate.maxCostWei, 'wei');

// Set limits in frames with safety margin
for (let i = 0; i < myFrameTx.frames.length; i++) {
  myFrameTx.frames[i].executionGas = estimate.frames[i].executionGas * 120n / 100n; // 20% buffer
  myFrameTx.frames[i].stateGas = estimate.frames[i].stateGas * 120n / 100n;
}

// EXPIRY_VERIFIER precompile at address(0x8141)
// Input: 8 bytes = uint64 Unix timestamp
// Output: nothing (reverts if expired)
// Gas: 6 gas

// ── Solidity usage ────────────────────────────────────────────────────
contract ExpiringSmartAccount {
    address constant EXPIRY_VERIFIER = address(0x8141);

    fallback() external {
        if (_frameMode() != 1) return;

        // 1. Read expiry from frame calldata (first 8 bytes)
        uint64 expiry;
        assembly {
            // FRAMEDATALOAD reads 32 bytes from frame data at offset 0
            mstore(0, 0)
            staticcall(gas(), 0xb1, 0, 0x20, 0, 0x20)
            // expiry is in the first 8 bytes (big-endian)
            expiry := shr(192, mload(0))  // shift right 192 bits to get uint64
        }

        // 2. Call EXPIRY_VERIFIER precompile
        //    Input: 8-byte expiry timestamp
        bytes memory input = abi.encodePacked(expiry);
        (bool ok,) = EXPIRY_VERIFIER.staticcall(input);
        require(ok, "Transaction expired");

        // 3. Verify signature
        bytes32 hash = _txParam(4);
        require(_verifyOwnerSig(hash), "Bad sig");

        // 4. Approve
        _approve(0x3);
    }

    // ── TypeScript: building expiring transaction ─────────────────────
    // On the client side, encode expiry in frame calldata:
    // const expiry = BigInt(Math.floor(Date.now() / 1000) + 3600); // 1 hour
    // const frameData = new Uint8Array(8);
    // new DataView(frameData.buffer).setBigUint64(0, expiry, false); // big-endian

    function _txParam(uint256 idx) internal view returns (bytes32 h) {
        assembly {
            mstore(0, idx)
            staticcall(gas(), 0xb0, 0, 0x20, 0, 0x20)
            h := mload(0)
        }
    }

    function _frameMode() internal view returns (uint8 m) {
        assembly {
            mstore(0, 0)
            staticcall(gas(), 0xb3, 0, 0x20, 0, 0x20)
            m := and(mload(0), 0xff)
        }
    }

    function _approve(uint8 scope) internal {
        assembly { pop(call(gas(), 0xaa, 0, 0, 0, 0, 0)) }
    }

    function _verifyOwnerSig(bytes32) internal view returns (bool) {
        return true; // placeholder
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.30;

/// @notice Session key policy smart account
/// Allows a game/DApp to execute limited actions on behalf of the user
contract SessionKeyAccount {
    address public owner;
    address constant EXPIRY_VERIFIER = address(0x8141);

    struct SessionKey {
        address key;           // temporary key address
        uint64 expiry;         // Unix timestamp
        address allowedTarget; // only this contract can be called in SENDER frames
        uint256 maxValuePerTx; // max ETH per transaction
        bool active;
    }

    // owner-authorized session keys
    mapping(address => SessionKey) public sessions;

    // ── Owner functions ───────────────────────────────────────────────
    function authorizeSessionKey(
        address sessionKey,
        uint64 expiry,
        address allowedTarget,
        uint256 maxValue
    ) external {
        require(msg.sender == address(this), "Must call via SENDER frame");
        sessions[sessionKey] = SessionKey({
            key: sessionKey,
            expiry: expiry,
            allowedTarget: allowedTarget,
            maxValuePerTx: maxValue,
            active: true
        });
    }

    function revokeSessionKey(address sessionKey) external {
        require(msg.sender == address(this), "Must call via SENDER frame");
        sessions[sessionKey].active = false;
    }

    // ── VERIFY frame handler ─────────────────────────────────────────
    fallback() external {
        if (_frameMode() != 1) return;

        bytes32 sigHash = bytes32(_txParam(4));

        // Try owner signature first (full permission)
        if (_tryOwnerVerify(sigHash)) {
            _approve(0x3);
            return;
        }

        // Try session key verification (limited permission)
        _sessionKeyVerify(sigHash);
    }

    function _tryOwnerVerify(bytes32 hash) internal view returns (bool) {
        // SECP256K1 sig at index 0
        address recovered = _ecrecoverFromSig(hash, 0);
        return recovered == owner;
    }

    function _sessionKeyVerify(bytes32 hash) internal {
        // Session key sig at index 0 (or index 1 if owner sig index is 0)
        address sessionKeyAddr = _ecrecoverFromSig(hash, 0);
        SessionKey storage session = sessions[sessionKeyAddr];

        require(session.active, "Session key not active");

        // Check expiry via EXPIRY_VERIFIER precompile
        bytes memory expiryInput = abi.encodePacked(session.expiry);
        (bool ok,) = EXPIRY_VERIFIER.staticcall(expiryInput);
        require(ok, "Session key expired");

        // Check frame target matches allowed target
        // Read frame target via FRAMEPARAM
        address frameTarget;
        assembly {
            mstore(0, 2) // FRAMEPARAM index 2 = target address
            staticcall(gas(), 0xb3, 0, 0x20, 0, 0x20)
            frameTarget := mload(0)
        }
        // For VERIFY frames target = self; check next SENDER frame target
        // (In practice: read next frame via FRAMEPARAM)

        // Check max value
        uint256 txValue;
        assembly {
            mstore(0, 2) // TXPARAM index 2 = max_cost (simplified; use frame value)
            staticcall(gas(), 0xb0, 0, 0x20, 0, 0x20)
            txValue := mload(0)
        }
        require(txValue <= session.maxValuePerTx, "Exceeds session value limit");

        // Session key can only approve execution (not payment — owner pays gas)
        _approve(0x2); // APPROVE_EXECUTION only
    }

    function _ecrecoverFromSig(bytes32 hash, uint256 sigIdx) internal view returns (address) {
        // Use SIGDATACOPY to get v, r, s from signature at sigIdx
        // Simplified: return address(0) as placeholder
        return address(0);
    }

    function _txParam(uint256 idx) internal view returns (uint256 v) {
        assembly {
            mstore(0, idx)
            staticcall(gas(), 0xb0, 0, 0x20, 0, 0x20)
            v := mload(0)
        }
    }

    function _frameMode() internal view returns (uint8 m) {
        assembly {
            mstore(0, 0)
            staticcall(gas(), 0xb3, 0, 0x20, 0, 0x20)
            m := and(mload(0), 0xff)
        }
    }

    function _approve(uint8 scope) internal {
        assembly { pop(call(gas(), 0xaa, 0, 0, 0, 0, 0)) }
    }
}

// test/SmartAccount.t.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.30;

import "forge-std/Test.sol";
import "../src/MinimalSmartAccount.sol";

contract SmartAccountTest is Test {
    MinimalSmartAccount account;
    address owner;
    uint256 ownerPk;

    function setUp() public {
        (owner, ownerPk) = makeAddrAndKey("owner");
        account = new MinimalSmartAccount(owner);
        vm.deal(address(account), 10 ether);
    }

    // ── Mock EIP-8141 opcodes via vm.etch + cheatcodes ──────────────
    // Until a real EIP-8141 EVM exists, we mock:
    // 1. FRAMEPARAM (0xb3) precompile behavior
    // 2. TXPARAM (0xb0) precompile behavior
    // 3. APPROVE (0xaa) call behavior

    function _mockVerifyFrame(bytes32 sigHash) internal {
        // Deploy a mock "FRAMEPARAM" contract at 0xb3
        // Returns mode=1 (VERIFY) for param index 0
        bytes memory frameParamCode = abi.encodePacked(
            hex"6000351460085760005260206000f35b60015260206000f3"
            // simplified: if(input==0) return 1 (VERIFY mode)
        );
        vm.etch(address(0xb3), frameParamCode);

        // Deploy mock "TXPARAM" at 0xb0
        // Returns sigHash for param index 4
        bytes memory txParamCode = abi.encodePacked(
            hex"600435146010576020526020600020f35b",
            sigHash,
            hex"60005260206000f3"
        );
        vm.etch(address(0xb0), txParamCode);

        // Deploy mock "APPROVE" at 0xaa — just succeeds
        vm.etch(address(0xaa), hex"600160005260206000f3");
    }

    function test_verifyWithOwnerSig() public {
        // Build signing hash (what protocol would compute)
        bytes32 txHash = keccak256(abi.encodePacked(
            "FrameTx:", block.chainid, address(account), uint256(0)
        ));

        // Mock EIP-8141 opcodes
        _mockVerifyFrame(txHash);

        // Sign with owner key
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(ownerPk, txHash);

        // Simulate ENTRY_POINT calling account.fallback() in VERIFY mode
        // In real EIP-8141 EVM, this is protocol-driven
        vm.prank(address(0xaa)); // ENTRY_POINT = 0xaa
        (bool success,) = address(account).call(
            abi.encodePacked(v, r, s) // pass sig in calldata (simplified)
        );
        assertTrue(success, "VERIFY frame should succeed with owner sig");
    }

    function test_verifyWithWrongSig() public {
        (, uint256 wrongPk) = makeAddrAndKey("wrong");
        bytes32 txHash = keccak256("test");
        _mockVerifyFrame(txHash);

        (uint8 v, bytes32 r, bytes32 s) = vm.sign(wrongPk, txHash);

        vm.prank(address(0xaa));
        (bool success,) = address(account).call(abi.encodePacked(v, r, s));
        assertFalse(success, "Should reject wrong signature");
    }

    // ── Integration: Full Frame Transaction flow ──────────────────────
    function test_fullFrameTxFlow() public {
        // 1. Simulate VERIFY frame approval
        bytes32 sigHash = keccak256("full_flow_test");
        _mockVerifyFrame(sigHash);
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(ownerPk, sigHash);

        vm.prank(address(0xaa));
        (bool verifyOk,) = address(account).call(abi.encodePacked(v, r, s));
        assertTrue(verifyOk);

        // 2. Simulate SENDER frame execution
        address recipient = makeAddr("recipient");
        uint256 startBalance = recipient.balance;

        vm.prank(address(account)); // msg.sender = tx.sender in SENDER frame
        (bool sendOk,) = recipient.call{value: 0.1 ether}("");
        assertTrue(sendOk);
        assertEq(recipient.balance, startBalance + 0.1 ether);
    }

    // ── Gas measurement ───────────────────────────────────────────────
    function test_verifyGasCost() public {
        bytes32 sigHash = keccak256("gas_test");
        _mockVerifyFrame(sigHash);
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(ownerPk, sigHash);

        uint256 gasBefore = gasleft();
        vm.prank(address(0xaa));
        address(account).call(abi.encodePacked(v, r, s));
        uint256 gasUsed = gasBefore - gasleft();

        // VERIFY frame should stay well under 100,000 gas (mempool limit)
        assertLt(gasUsed, 100_000, "VERIFY frame exceeds mempool gas limit");
        console.log("VERIFY frame gas used:", gasUsed);
    }
}