Add ERC7739 and ERC7739Utils

.changeset/sweet-grapes-raise.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ERC7739Utils`: Add a library that implements a defensive rehashing mechanism to prevent replayability of smart contract signatures based on the ERC-7739.

.changeset/tidy-yaks-bake.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ERC7739Signer`: An abstract contract to validate signatures following the rehashing scheme from `ERC7739Utils`.

contracts/mocks/ERC7739SignerECDSAMock.sol

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.20;
+
+import {ERC7739Signer} from "../utils/cryptography/draft-ERC7739Signer.sol";
+import {EIP712} from "../utils/cryptography/EIP712.sol";
+import {ECDSA} from "../utils/cryptography/ECDSA.sol";
+
+contract ERC7739SignerECDSAMock is ERC7739Signer {
+    address private immutable _signer;
+
+    constructor(address signerAddr) EIP712("ERC7739SignerECDSA", "1") {
+        _signer = signerAddr;
+    }
+
+    function _validateSignature(bytes32 hash, bytes calldata signature) internal view virtual override returns (bool) {
+        (address recovered, ECDSA.RecoverError err, ) = ECDSA.tryRecover(hash, signature);
+        return _signer == recovered && err == ECDSA.RecoverError.NoError;
+    }
+}

contracts/mocks/ERC7739SignerP256Mock.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.20;
+
+import {ERC7739Signer} from "../utils/cryptography/draft-ERC7739Signer.sol";
+import {EIP712} from "../utils/cryptography/EIP712.sol";
+import {P256} from "../utils/cryptography/P256.sol";
+
+contract ERC7739SignerP256Mock is ERC7739Signer {
+    bytes32 private immutable _qx;
+    bytes32 private immutable _qy;
+
+    constructor(bytes32 qx, bytes32 qy) EIP712("ERC7739SignerP256", "1") {
+        _qx = qx;
+        _qy = qy;
+    }
+
+    function _validateSignature(bytes32 hash, bytes calldata signature) internal view virtual override returns (bool) {
+        bytes32 r = bytes32(signature[0x00:0x20]);
+        bytes32 s = bytes32(signature[0x20:0x40]);
+        return P256.verify(hash, r, s, _qx, _qy);
+    }
+}

contracts/mocks/ERC7739SignerRSAMock.sol

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.20;
+
+import {ERC7739Signer} from "../utils/cryptography/draft-ERC7739Signer.sol";
+import {EIP712} from "../utils/cryptography/EIP712.sol";
+import {RSA} from "../utils/cryptography/RSA.sol";
+
+contract ERC7739SignerRSAMock is ERC7739Signer {
+    bytes private _e;
+    bytes private _n;
+
+    constructor(bytes memory e, bytes memory n) EIP712("ERC7739SignerRSA", "1") {
+        _e = e;
+        _n = n;
+    }
+
+    function _validateSignature(bytes32 hash, bytes calldata signature) internal view virtual override returns (bool) {
+        return RSA.pkcs1Sha256(hash, signature, _e, _n);
+    }
+}

contracts/utils/README.adoc

@@ -14,6 +14,8 @@ Miscellaneous contracts and libraries containing utility functions you can use t
  * {Hashes}: Commonly used hash functions.
  * {MerkleProof}: Functions for verifying https://en.wikipedia.org/wiki/Merkle_tree[Merkle Tree] proofs.
  * {EIP712}: Contract with functions to allow processing signed typed structure data according to https://eips.ethereum.org/EIPS/eip-712[EIP-712].
+ * {ERC7739Utils}: Utilities to support ERC-7739, a defensive rehashing scheme that prevents replayability of smart contract signatures.
+ * {ERC7739Signer}: A base contract to implement ERC-1271 signatures using {ERC7739Utils}.
  * {ReentrancyGuard}: A modifier that can prevent reentrancy during certain functions.
  * {ReentrancyGuardTransient}: Variant of {ReentrancyGuard} that uses transient storage (https://eips.ethereum.org/EIPS/eip-1153[EIP-1153]).
  * {Pausable}: A common emergency response mechanism that can pause functionality while a remediation is pending.
@@ -67,6 +69,10 @@ Because Solidity does not support generic types, {EnumerableMap} and {Enumerable
 
 {{EIP712}}
 
+{{ERC7739Utils}}
+
+{{ERC7739Signer}}
+
 {{MessageHashUtils}}
 
 {{SignatureChecker}}

contracts/utils/cryptography/draft-ERC7739Signer.sol

@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.20;
+
+import {IERC1271} from "../../interfaces/IERC1271.sol";
+import {EIP712} from "./EIP712.sol";
+import {MessageHashUtils} from "./MessageHashUtils.sol";
+import {ERC7739Utils} from "./draft-ERC7739Utils.sol";
+import {ShortStrings} from "../ShortStrings.sol";
+
+/**
+ * @dev Validates signatures wrapping the message hash in a nested EIP712 type. See {ERC7739Utils}.
+ *
+ * Linking the signature to the EIP-712 domain separator is a security measure to prevent signature replay across different
+ * EIP-712 domains (e.g. a single offchain owner of multiple contracts).
+ *
+ * This contract requires implementing the {_validateSignature} function, which passes the wrapped message hash,
+ * which may be either an typed data or a personal sign nested type.
+ *
+ * NOTE: {EIP712} uses {ShortStrings} to optimize gas costs for short strings (up to 31 characters).
+ * Consider that strings longer than that will use storage, which may limit the ability of the signer to
+ * be used within the ERC-4337 validation phase (due to ERC-7562 storage access rules).
+ */
+abstract contract ERC7739Signer is EIP712, IERC1271 {
+    using ERC7739Utils for *;
+
+    /**
+     * @dev Attempts validating the signature in a nested EIP-712 type.
+     *
+     * A nested EIP-712 type might be presented in 2 different ways:
+     *
+     * - As a nested EIP-712 typed data
+     * - As a _personal_ signature (an EIP-712 mimic of the `eth_personalSign` for a smart contract)
+     */
+    function isValidSignature(bytes32 hash, bytes calldata signature) public view virtual returns (bytes4 result) {
+        return _isValidSignature(hash, signature) ? IERC1271.isValidSignature.selector : bytes4(0xffffffff);
+    }
+
+    /**
+     * @dev Internal version of {isValidSignature} that returns a boolean.
+     */
+    function _isValidSignature(bytes32 hash, bytes calldata signature) internal view virtual returns (bool) {
+        return
+            _isValidNestedPersonalSignSignature(hash, signature) || _isValidNestedTypedDataSignature(hash, signature);
+    }
+
+    /**
+     * @dev Nested personal signature verification.
+     */
+    function _isValidNestedPersonalSignSignature(
+        bytes32 hash,
+        bytes calldata signature
+    ) internal view virtual returns (bool) {
+        return _validateSignature(_domainSeparatorV4().toNestedPersonalSignHash(hash), signature);
+    }
+
+    /**
+     * @dev Nested EIP-712 typed data verification.
+     */
+    function _isValidNestedTypedDataSignature(
+        bytes32 hash,
+        bytes calldata signature
+    ) internal view virtual returns (bool) {
+        // decode signature
+        (bytes calldata nestedSignature, bytes32 separator, bytes32 contents, bytes calldata contentsType) = signature
+            .decodeSignature();
+
+        // fetch domain details
+        (
+            ,
+            string memory name,
+            string memory version,
+            ,
+            address verifyingContract,
+            bytes32 salt,
+            uint256[] memory extensions
+        ) = eip712Domain();
+
+        // Check that hash is the correct nested typed data hash, and that the nested signature is valid.
+        return
+            hash ==
+            ERC7739Utils.toNestedTypedDataHash(
+                separator,
+                ERC7739Utils.typedDataNestedStructHash(
+                    contentsType,
+                    contents,
+                    name,
+                    version,
+                    verifyingContract,
+                    salt,
+                    extensions
+                )
+            ) &&
+            _validateSignature(hash, nestedSignature);
+    }
+
+    /**
+     * @dev Signature validation algorithm.
+     *
+     * WARNING: Implementing a signature validation algorithm is a security-sensitive operation as it involves
+     * cryptographic verification. It is important to review and test thoroughly before deployment. Consider
+     * using one of the signature verification libraries ({ECDSA}, {P256} or {RSA}).
+     */
+    function _validateSignature(bytes32 hash, bytes calldata signature) internal view virtual returns (bool);
+}