Repository navigation
fix: keep the EIP-7702 initCode marker in UserOperation.toPacked - #574
Closed
erkancamli wants to merge 1 commit into
Closed
erkancamli wants to merge 1 commit into
erkancamli wants to merge 1 commit into
Conversation
`toInitCode` always replaced the `0x7702` factory with the authorization's delegate address, and `toPacked` used it for the packed user operation sent to the EntryPoint. EntryPoint 0.8 and 0.9 only treat an operation as EIP-7702 when the first 20 bytes of `initCode` are the `0x7702` marker; the delegate address belongs only in the hashed form (`_getEip7702InitCodeHashOverride`). With the delegate in place, 0.8 reverts with "AA10 sender already constructed" and 0.9 ignores the initCode, skipping `factoryData`. `toInitCode` now takes a `forHash` option, as viem's `getInitCode` does: without it the init code is the padded marker followed by `factoryData`, with it the delegate form used for hashing. `toPacked` passes its own `forHash` on, so `hash` is unchanged.
|
@erkancamli is attempting to deploy a commit to the Wevm Team on Vercel. A member of the Team first needs to authorize it. |
This was referenced Nov 8, 2026
Member
|
Thanks @erkancamli, the fix is correct. Superseded by #593 (main, which keeps your commit) and #594 (0.x backport), with small follow-ups to the changeset and tests. |
jxom
added a commit
that referenced
this pull request
Nov 8, 2026
) Backports #574 to 0.x. `toInitCode` replaced the `0x7702` factory with the authorization's delegate address, so `toPacked` produced an initCode that EntryPoint 0.8 does not recognise as EIP-7702 and rejects with "AA10 sender already constructed". `toInitCode` and `toPacked` now take a `forHash` option: by default the init code is the padded `0x7702` marker followed by `factoryData`; with `forHash` it is the delegate form the EntryPoint hashes. `toTypedData` (and so `hash`) packs with `forHash`, so hashes are unchanged. Amp-Thread-ID: https://ampcode.com/threads/T-01a1bc8e-ad8f-7187-b41f-f8092b65ad6b Co-authored-by: Amp <amp@ampcode.com> Co-authored-by: ecamli <107792368+erkancamli@users.noreply.github.com> Co-authored-by: jxom <jake@tempo.xyz>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
UserOperation.toInitCodealways replaces a0x7702factory with the authorization's delegate address:and
toPackeduses it for the packed user operation, the form the AA guide passes to the EntryPoint. EntryPoint 0.8 and 0.9 (Eip7702Support) only treat an operation as EIP-7702 when the first 20 bytes ofinitCodeequalbytes20(0x7702), the marker padded with zeros; the delegate address is substituted only for hashing, in_getEip7702InitCodeHashOverride. With the delegate ininitCode, the operation is not recognised as 7702: on 0.8handleOpsreverts withAA10 sender already constructed(the delegated sender already has code), and on 0.9 the init code is ignored, sofactoryDatanever runs. The hash is unaffected, so the signature still verifies and nothing fails until the op is on chain.fromPacked(toPacked(op)).factoryalso comes back as the delegate rather than0x7702.viem fixed the same thing in 892ebea1 by giving
getInitCodeaforHashoption. ox already hasforHashontoPacked, but it only reaches the paymaster signature.This adds
forHashtotoInitCode:0x7702marker followed byfactoryData(the short'0x7702'form is padded too, so the EntryPoint check matches);forHash: true: the delegate form used for hashing, as today.toPackedpasses itsforHashon, sohash(which packs withforHash: true) gives the same 0.8 and 0.9 hashes as before, matching viem.Tests:
toPacked > eip7702covers the default packedinitCodeand the round trip throughfromPacked, plus theforHashform; the existing delegate-formtoInitCodecases now pass{ forHash: true }. Onmainthe new default cases fail with the delegate address in place of the marker; with this change thesrc/erc4337tests pass.vp checkis clean on the changed files. A changeset is included.Note that this changes the default output of the public
toInitCodefor EIP-7702 operations, the same change viem made forgetInitCode.