Modules

Returns the authorized signer for the specified account.

Sets up the module's initial configuration when installed by an account. The data parameter should contain the signer address (20 bytes minimum).

If the account doesn't already have a signer configured, the first 20 bytes of data will be used as the authorized signer address. See ERC7579ECDSA._extractSigner for more details about the encoding.

Requirements:

• The data must be at least 20 bytes. Reverts with ERC7579ECDSA.ERC7579ECDSAInvalidSignerLength if not.
• The data must contain a valid signer address. Reverts with ERC7579ECDSA.ERC7579ECDSAInvalidSigner if not.
• The account must have no signer installed. Reverts with ERC7579ECDSA.ERC7579ECDSAAlreadyInstalled if not.

Emits a ERC7579ECDSA.ERC7579ECDSASignerSet event if the signer is set.

Cleans up the module's configuration when uninstalled from an account. Removes the authorized signer for the calling account.

If the account has a configured signer, it will be cleared. If no signer is configured, this function will behave as a no-op.

Emits a ERC7579ECDSA.ERC7579ECDSASignerSet event if the signer is cleared.

Sets the signer for the specified account.

Requirements:

• The newSigner must not be the zero address.
• The caller must be the specified account.

Emits a ERC7579ECDSA.ERC7579ECDSASignerSet event.

Internal version of ERC7579ECDSA.setSigner without access control.

Requirements:

• The newSigner must not be the zero address.

Emits a ERC7579ECDSA.ERC7579ECDSASignerSet event.

Extracts the signer address from the provided data for onInstall.

Validates an ECDSA signature against the configured signer for the account.

This function recovers the signer address from the provided signature and hash, then compares it against the authorized signer for the given account.

Emitted when the signer is set.

The provided signer data is too short (must be at least 20 bytes for an address).

The caller is not authorized to set the signer for the specified account.

The provided signer address is invalid.

The account has already installed the module.

Sets up the module's initial configuration when installed by an account. See IERC7579Module-onInstall. The initData encodes signers and threshold.

See ERC7579Multisig._decodeMultisigInitData for the encoding details.

Requirements:

• The account must have no signers installed. Reverts with ERC7579Multisig.ERC7579MultisigAlreadyInstalled if not.
• The signers array must be non-empty. Reverts with ERC7579Multisig.ERC7579MultisigInvalidInitData if not.
• Those of ERC7579Multisig._decodeMultisigInitData for the decoding requirements.
• Those of ERC7579Multisig._addSigners and ERC7579Multisig._setThreshold for signer configuration requirements.

Cleans up module's configuration when uninstalled from an account. Clears all signers and resets the threshold.

See IERC7579Module-onUninstall.

Returns a slice of the set of authorized signers for the specified account.

Using start = 0 and end = type(uint64).max will return the entire set of signers.

Returns the number of authorized signers for the specified account.

Returns whether the signer is an authorized signer for the specified account.

Returns the minimum number of signers required to approve a multisignature operation for the specified account.

Adds new signers to the authorized set for the calling account. Can only be called by the account itself.

Requirements:

• Each of newSigners must be at least 20 bytes long.
• Each of newSigners must not be already authorized.

Removes signers from the authorized set for the calling account. Can only be called by the account itself.

Requirements:

• Each of oldSigners must be authorized.
• After removal, the threshold must still be reachable.

Sets the threshold for the calling account. Can only be called by the account itself.

Requirements:

• The threshold must be reachable with the current number of signers.

Adds the newSigners to those allowed to sign on behalf of the account.

Requirements:

• Each of newSigners must be at least 20 bytes long. Reverts with ERC7579Multisig.ERC7579MultisigInvalidSigner if not.
• Each of newSigners must not be authorized. Reverts with ERC7579Multisig.ERC7579MultisigAlreadyExists if it already exists.

Removes the oldSigners from the authorized signers for the account.

Requirements:

• Each of oldSigners must be authorized. Reverts with ERC7579Multisig.ERC7579MultisigNonexistentSigner if not.
• The threshold must remain reachable after removal. See ERC7579Multisig._validateReachableThreshold for details.

Sets the signatures threshold required to approve a multisignature operation.

Requirements:

• The threshold must be greater than 0. Reverts with ERC7579Multisig.ERC7579MultisigZeroThreshold if not.
• The threshold must be reachable with the current number of signers. See ERC7579Multisig._validateReachableThreshold for details.

Validates the current threshold is reachable with the number of signers.

Requirements:

• The number of signers must be >= the threshold. Reverts with ERC7579Multisig.ERC7579MultisigUnreachableThreshold if not.

Validates the multisignature operation by checking the threshold and the signatures.

Where signingSigners are the authorized signers and signatures are their corresponding signatures of the operation hash.

Validates the signatures using the signers and their corresponding signatures. Returns whether the signers are authorized, are not duplicated and the signatures are valid for the given hash.

Validates that the number of signers meets the ERC7579Multisig.threshold requirement. Assumes the signers were already validated. See ERC7579Multisig._validateSignatures for more details.

Decodes multisig initialization data from calldata without memory allocation.

The initData should be encoded as: abi.encode(bytes[] signers, uint64 threshold)

Requirements:

• The initData must be at least 96 bytes long to contain the minimum ABI-encoded structure.
• The signers array offset must be properly aligned and within bounds.
• The array length field must be accessible within the provided data.

Emitted when signers are added.

Emitted when signers are removed.

Emitted when the threshold is updated.

The initData is invalid.

The signers array is empty.

The signer already exists.

The signer does not exist.

The signer is less than 20 bytes long.

The threshold is zero.

The threshold is unreachable given the number of signers.

The account has already installed the module.

Sets up the module's initial configuration when installed by an account. See IERC7579Module-onInstall. The initData encodes externally encrypted signerIds and threshold. See ERC7579Multisig._decodeMultisigInitData for the encoding details.

Requirements:

• The account must have no signers installed. Reverts with ERC7579Multisig.ERC7579MultisigAlreadyInstalled if not.
• The signerIds array must be non-empty. Reverts with ERC7579Multisig.ERC7579MultisigEmptySigners if not.
• Those of ERC7579Multisig._decodeMultisigInitData for the decoding requirements.
• Those of ERC7579Multisig.addSigners for encrypted signers configuration requirements.

Cleans up module's configuration when uninstalled from an account. Clears all signerIds and resets the threshold.

See IERC7579Module-onUninstall.

Returns a slice of the set of authorized encrypted signers for the specified account.

The returned signers are encrypted uint256 values (euint256). Using start = 0 and end = type(uint32).max will return the entire set of signerIds.

Returns the number of authorized encrypted signers for the specified account.

Returns whether the encrypted signerId is an authorized signer for the specified account.

Returns the encrypted minimum number of signers required to approve a multisignature operation for the specified account.

Returns whether the multisignature validation result for an operation (hash) is requested for disclosure under the account's current configuration nonce.

Returns whether the multisignature validation result for an operation (hash) is disclosed under the account's current configuration nonce.

Adds new encrypted signerIds to the authorized set for the calling account. Can only be called by the account itself. See ERC7579Multisig._addSigners.

Increments the account's configuration nonce, invalidating any outstanding disclosure entries made under the previous nonce.

The signerIds are provided as externally encrypted uint256 values. Each signerId represents either an address (cast to uint256) or an ERC-7913 key (hashed with keccak256(verifier || key) and cast to uint256). The caller must encrypt the signerId off-chain before calling this function.

Requirements:

• Those of ERC7579Multisig._addSigners for additional requirements.

Removes encrypted signerIds from the authorized set for the calling account. Can only be called by the account itself. See ERC7579Multisig._removeSigners.

Increments the account's configuration nonce, invalidating any outstanding disclosure entries made under the previous nonce.

Sets the encrypted threshold for the calling account. Can only be called by the account itself. See ERC7579Multisig._setThreshold.

Increments the account's configuration nonce, invalidating any outstanding disclosure entries made under the previous nonce.

Requests disclosure of the multisignature validation result for an operation (hash).

This function validates the multisignature using encrypted values and makes the result publicly decryptable. Applications that require using the validation result must call this function off-chain first to enable the decryption proof to be included in a subsequent call to discloseOperation to verify the proof.

Emits a ERC7579MultisigConfidential.ERC7579MultisigOperationDiscloseRequested event.

Verifies the decryption proof for a disclosed operation (hash).

Requirements:

• The decryption proof must be cryptographically valid. Reverts if invalid.

Emits a ERC7579MultisigConfidential.ERC7579MultisigOperationDisclosed event.

Same as ERC7579MultisigConfidential.discloseOperation but with the relayer set to msg.sender.

Consumes the caller's configuration nonce, invalidating all outstanding disclosure entries. Useful when an ERC-1271 signer's validity changes and the account needs to revoke previously snapshotted authorization results.

Adds the encrypted newSignerIds to those allowed to sign on behalf of the account.

Requirements:

• The number of signers must not exceed type(uint32).max. Reverts with ERC7579MultisigConfidential.ERC7579MultisigTooManySigners if exceeded.

Emits ERC7579MultisigConfidential.ERC7579MultisigSignerAdded for each new signer.

Removes the encrypted oldSignerIds from the authorized signerIds for the account.

Requirements:

• Each of oldSignerIds must be authorized. Reverts with ERC7579Multisig.ERC7579MultisigNonexistentSigner if not.
• After removal, at least one signer must remain. Reverts with ERC7579Multisig.ERC7579MultisigEmptySigners if not.

Emits ERC7579MultisigConfidential.ERC7579MultisigSignerRemoved for each removed signer.

Sets the encrypted signatures threshold required to approve a multisignature operation.

Emits ERC7579MultisigConfidential.ERC7579MultisigThresholdSet with the final threshold value.

Returns the maximum threshold for the specified account.

Requests disclosure of the multisignature validation result for an operation (hash).

Verifies the decryption proof for a disclosed operation (hash).

Validates the multisignature operation by checking the threshold and the signatures.

The validation is performed using encrypted values to maintain confidentiality. The function verifies that the number of valid signatures meets or exceeds the encrypted threshold.

Where signingSigners are the plaintext signers (addresses or ERC-7913 keys as bytes), signerIdHandles are their corresponding encrypted id handles, and signatures are their signatures of the operation hash.

Validates the signatures using the signers and their corresponding signatures. Returns the number of valid signatures as an encrypted value.

To count towards the threshold, for each signer:

1. The handle must exist in the authorized set
2. The handle must match the corresponding plaintext signer (address cast to uint256 or keccak256 hash for ERC-7913 keys)
3. The signature must be valid for the given hash
4. The signer must not be a duplicate of a previous signer in the array

The signers should be ordered by their uint256 representation to ensure efficient duplication check. Unordered signers are supported, but the uniqueness check will be more expensive. See ERC7579MultisigConfidential._toId.

Requirements:

• The signingSigners, signerIdHandles, and signatures arrays must have the same length. Reverts with ERC7579MultisigConfidential.ERC7579MultisigMismatchedValidationLength if not.

Returns the encrypted weight of an encrypted signerId towards the threshold of the account (0 or 1).

Validates that the encrypted reachedThreshold meets or exceeds the encrypted threshold set for the account.

Decodes multisig initialization data from calldata without memory allocation.

The initData should be encoded as: abi.encode(bytes inputProof, externalEuint256[] signerIds, externalEuint32 threshold)

Requirements:

• The initData must be at least 160 bytes long to contain the minimum structure.
• All offsets must be properly aligned and within bounds.
• All array length fields must be accessible within the provided data.
• The proof data must be fully contained within the provided data.

Emitted when an encrypted signerId is added to the authorized set.

Emitted when an encrypted signerId is removed from the authorized set.

Emitted when the encrypted threshold is updated.

Emitted when a disclosure request is made for an operation.

Emitted when an operation is disclosed with its decryption proof verified.

The initData is invalid or improperly formatted.

The validation arrays have mismatched lengths.

The number of signers exceeds type(uint32).max.

The signers array is empty.

The encrypted signerId does not exist in the authorized set.

The account has already installed the module.

The encrypted signerId is a duplicate handle.

The operation (hash) is not requested for disclosure.

Sets up the module's initial configuration when installed by an account. Besides the standard delay and signer configuration, this can also include signer weights.

The initData should be encoded as: abi.encode(bytes[] signers, uint64 threshold, uint64[] weights)

Requirements:

• The account must have no signers installed. Reverts with ERC7579Multisig.ERC7579MultisigAlreadyInstalled if not.
• Those of ERC7579MultisigWeighted._decodeMultisigWeightedInitData for the decoding requirements.

Cleans up module's configuration when uninstalled from an account. Clears all signers, weights, and total weights.

See ERC7579Multisig.onUninstall.

Gets the weight of a signer for a specific account. Returns 0 if the signer is not authorized.

Gets the total weight of all signers for a specific account.

Sets weights for signers for the calling account. Can only be called by the account itself.

Decodes weighted multisig initialization data from calldata without memory allocation.

The initData should be encoded as: abi.encode(bytes[] signers, uint64 threshold, uint64[] weights)

Requirements:

• The initData must be at least 160 bytes long to contain the minimum ABI-encoded structure.
• The signers array offset must be properly aligned and within bounds.
• The weights array offset must be properly aligned and within bounds.
• The array length fields must be accessible within the provided data.

Sets weights for multiple signers at once. Internal version without access control.

Requirements:

• signers and weights arrays must have the same length. Reverts with ERC7579MultisigWeighted.ERC7579MultisigMismatchedLength on mismatch.
• Each signer must exist in the set of authorized signers. Reverts with ERC7579Multisig.ERC7579MultisigNonexistentSigner if not.
• Each weight must be greater than 0. Reverts with ERC7579MultisigWeighted.ERC7579MultisigInvalidWeight if not.
• See ERC7579Multisig._validateReachableThreshold for the threshold validation.

Emits ERC7579MultisigWeighted.ERC7579MultisigWeightChanged for each signer.

Override to add weight tracking. See ERC7579Multisig._addSigners. Each new signer has a default weight of 1.

In cases where ERC7579MultisigWeighted.totalWeight is almost type(uint64).max (due to a large _totalExtraWeight), adding new signers could cause the ERC7579MultisigWeighted.totalWeight computation to overflow. Adding a ERC7579MultisigWeighted.totalWeight call after the new signers are added ensures no such overflow happens.

Override to handle weight tracking during removal. See ERC7579Multisig._removeSigners.

Just like ERC7579Multisig._addSigners, this function does not emit ERC7579MultisigWeighted.ERC7579MultisigWeightChanged events. The ERC7579Multisig.ERC7913SignerRemoved event emitted by ERC7579Multisig._removeSigners is enough to track weights here.

Override to validate threshold against total weight instead of signer count.

Validates that the total weight of signers meets the ERC7579Multisig.threshold requirement. Overrides the base implementation to use weights instead of count.

Emitted when a signer's weight is changed.

Thrown when a signer's weight is invalid.

Thrown when the arrays lengths don't match.

Sets up the module's initial configuration when installed by an account. Besides the standard signer and threshold configuration, this can also include encrypted signer weights.

See ERC7579MultisigWeighted._decodeMultisigWeightedInitData for the initData encoding details.

Requirements:

• The account must have no signers installed. Reverts with ERC7579Multisig.ERC7579MultisigAlreadyInstalled if not.
• The signers array must be non-empty. Reverts with ERC7579Multisig.ERC7579MultisigEmptySigners if not.
• Those of ERC7579MultisigWeighted._decodeMultisigWeightedInitData for the decoding requirements.
• Those of ERC7579Multisig.addSigners and ERC7579MultisigWeighted.setSignerWeights for signer and weight configuration requirements.

Cleans up module's configuration when uninstalled from an account. Clears all signers, weights, and total weights.

See ERC7579MultisigConfidential.onUninstall.

Returns the encrypted extra weight of an encrypted signer for the specified account.

Returns the encrypted total extra weight of all signers for the specified account.

Returns the encrypted weight of an encrypted signer for the specified account.

Returns the encrypted total weight of all signers for the specified account.

Sets encrypted weights for signers for the calling account. Can only be called by the account itself.

Increments the account's configuration nonce, invalidating any outstanding disclosure entries made under the previous nonce.

Requirements:

• Those of ERC7579MultisigWeighted._setSignerWeights for additional requirements.

Decodes weighted multisig initialization data from calldata without memory allocation.

The initData should be encoded as: abi.encode(bytes inputProof, externalEuint256[] signers, externalEuint32 threshold, externalEuint16[] weights)

Requirements:

• The initData must be at least 224 bytes long to contain the minimum structure.
• All offsets must be properly aligned and within bounds.
• All array length fields must be accessible within the provided data.
• The proof data must be fully contained within the provided data.

Override to add weight tracking and restrict signer count. See ERC7579MultisigConfidential._addSigners. Each new signer has a default weight of 1.

Requirements:

• The number of signers must not exceed type(uint16).max. Reverts with ERC7579MultisigConfidential.ERC7579MultisigTooManySigners if exceeded.

Sets encrypted weights for multiple signers at once. Internal version without access control.

Requirements:

• signers and weights arrays must have the same length. Reverts with ERC7579MultisigWeightedConfidential.ERC7579MultisigMismatchedSignerWeights on mismatch.
• Each signer must exist in the set of authorized signers. Reverts with ERC7579Multisig.ERC7579MultisigNonexistentSigner if not.

Emits ERC7579MultisigWeighted.ERC7579MultisigWeightChanged for each signer.

Override to handle weight tracking during removal. See ERC7579MultisigConfidential._removeSigners.

Cleans up weights for removed signers and updates the total extra weight accordingly.

Sets the total extra weight for the specified account.

Sets the extra weight for a signer for the specified account.

Override to return the maximum threshold based on total weight instead of signer count. See ERC7579MultisigConfidential._maxThreshold.

Override to return the encrypted weight of a signer instead of a fixed weight of 1. See ERC7579MultisigConfidential._signerWeight.

Returns 0 if the signer is not authorized, otherwise returns 1 plus the signer's extra weight.

Returns the encrypted total weight of all signers for the specified account.

Emitted when an encrypted signer's weight is changed.

The signers and weights arrays have mismatched lengths.

Returns the authorized P256 signer for the specified account.

Sets up the module's initial configuration when installed by an account. The data parameter should contain the P256 public key coordinates (64 bytes minimum).

If the account doesn't already have a signer configured, the first 64 bytes of data will be used as the authorized P256 signer (qx, qy). See ERC7579ECDSA._extractSigner for more details about the encoding.

Requirements:

• The data must be at least 64 bytes. Reverts with ERC7579P256.ERC7579P256InvalidSignerLength if not.
• The account must have no signer installed. Reverts with ERC7579P256.ERC7579P256AlreadyInstalled if not.
• Decode data into abi.encode(bytes32 qx, bytes32 qy).
• The data must contain valid P256 public key coordinates. Reverts with ERC7579P256.ERC7579P256InvalidPublicKey if not.

Emits a ERC7579P256.ERC7579P256SignerSet event if the signer is set.

Cleans up the module's configuration when uninstalled from an account. Removes the authorized P256 signer for the calling account.

If the account has a configured signer, it will be cleared. If no signer is configured, this function will behave as a no-op.

Emits a ERC7579P256.ERC7579P256SignerSet event if the signer is cleared.

Sets the P256 signer for the specified account.

Requirements:

• The qx and qy coordinates must not be zero.
• The qx and qy coordinates must be valid P256 public key coordinates.
• The caller must be the specified account.

Emits a ERC7579P256.ERC7579P256SignerSet event.

Internal version of ERC7579ECDSA.setSigner without access control.

Requirements:

• The qx and qy coordinates must not be zero.
• The qx and qy coordinates must be valid P256 public key coordinates.

Emits a ERC7579P256.ERC7579P256SignerSet event.

Extracts the P256 public key coordinates from the provided data for onInstall.

Validates a P256 signature against the configured signer for the account.

This function extracts the r and s components from the signature and verifies them against the P256 public key stored for the given account.

The signature is expected to be at least 64 bytes containing the P256 signature components (r, s) as 32-byte values.

Emitted when the signer is set.

The provided signer data is too short (must be at least 64 bytes for P256 coordinates).

The caller is not authorized to set the signer for the specified account.

The provided P256 public key is invalid.

The account has already installed the module.

Clock used for flagging validity ranges. Defaults to timestamp but can be overridden to use block numbers if needed.

Machine-readable description of the clock as specified in ERC-6372. Can be overridden to return "mode=blocknumber&from=default" if using block numbers.

Returns the installation nonce for an account. See ERC7579ECDSA.onUninstall.

Returns whether key is a registered session key for account.

Returns the validity range (from, until) for a key on an account.

Returns whether a key is valid for an account at the current timepoint.

Returns a slice of the registered session keys for an account.

Using startIdx = 0 and endIdx = type(uint256).max will return all keys.

Returns the number of registered session keys for an account.

Sets up the module's initial configuration when installed by an account. See IERC7579Module-onInstall. The initData encodes arrays of keys and their corresponding validity ranges.

See ERC7579SessionKeys._decodeKeysInitData for the encoding details.

Requirements:

• Those from ERC7579SessionKeys._decodeKeysInitData for the decoding requirements.
• Those from ERC7579SessionKeys._addKeys for the key configuration requirements.

Cleans up the module's configuration when uninstalled from an account. Increments the account's nonce to invalidate all registered session keys.

See IERC7579Module-onUninstall.

Adds new session keys to the module for the calling account. Can only be called by the account itself.

Requirements:

• Those from ERC7579SessionKeys._addKeys for the key configuration requirements.

Removes session keys from the module for the calling account. Can only be called by the account itself.

Requirements:

• Those from ERC7579SessionKeys._removeKeys for the key configuration requirements.

Internal version of ERC7579SessionKeys.isKey that receives an installation_ nonce.

Internal version of ERC7579SessionKeys.validity that receives an installation_ nonce.

Internal version of ERC7579SessionKeys.isValid that receives an installation_ nonce.

Internal version of ERC7579SessionKeys.keys that receives an installation_ nonce.

Internal version of ERC7579SessionKeys.keyCount that receives an installation_ nonce.

Internal function to register session keys for an account.

For each key, stores the ERC-7913 key bytes in the enumerable set and records its validity range. Keys are identified by keccak256(key) in the validity mapping.

Requirements:

• All arrays must have equal length. Reverts with ERC7579SessionKeys.ERC7579SessionKeysMismatchedInitDataLengths if not.
• Each of keys_ must not be registered. Reverts with ERC7579SessionKeys.ERC7579SessionKeysAlreadyRegisteredKey if it is.

Emits an ERC7579SessionKeys.ERC7579SessionKeysERC7913KeySet event for each key.

Internal function to remove session keys from an account.

Removes the key from the enumerable set and clears its validity range in storage.

Requirements:

• Each of keys_ must be registered. Reverts with ERC7579SessionKeys.ERC7579SessionKeysNonexistentKey if not.

Emits an ERC7579SessionKeys.ERC7579SessionKeysERC7913KeyUnset event for each key.

Validates an ERC-7913 session key signature against the registered keys for the account.

Decodes the ERC-7913 key and its cryptographic signature from the encoded signature field, then checks that the key is registered and that the cryptographic signature is valid. Does not validate the ERC7579SessionKeys.validity range.

See ERC7579SessionKeys._tryDecodeSignature for the encoding details.

Variant of ERC7579SessionKeys._validateSessionKey that receives an installation_ nonce.

Returns the storage key used to identify a session key in the validity mapping.

Decodes a session key signature into its ERC-7913 key and cryptographic keySignature components.

The signature must be ABI-encoded as abi.encode(bytes key, bytes keySignature).

Returns (false, emptyBytes, emptyBytes) without reverting if the encoding is invalid or if any offset or length would read out of bounds.

Decodes the initialization data for the session keys module.

The initData must be ABI-encoded as abi.encode(bytes[] keys, uint48[] starts, uint48[] ends) where each array has the same length.

Requirements:

• initData must be at least 192 bytes (6 × 32 bytes for the 3 ABI offsets and 3 array lengths).
• All offsets must point within the initData bounds.

Reverts with ERC7579SessionKeys.ERC7579SessionKeysInvalidInitData if the encoding is invalid.

Emitted when all session keys are cleared for an account on uninstall.

Emitted when a session key is registered or updated for an account.

Emitted when a session key is removed from an account.

The keys, starts, and ends arrays passed to ERC7579ECDSA.onInstall have different lengths.

The provided initData is invalid or malformed.

The provided key is already registered.

The provided key is not registered.

Validates a WebAuthn authentication assertion against the configured signer for the account.

Returns false if the signature is not a valid WebAuthn authentication assertion.

The signature is expected to be an abi-encoded WebAuthn-WebAuthnAuth struct.

Current state of an operation.

Same as ERC7579DelayedExecutor.state, but for a specific operation id.

Maximum transition period applied when ERC7579DelayedExecutor.setDelay increases the delay, which takes effect after min(newDelay, delayChangeWindow()). Delay decreases are unaffected and take effect after currentDelay - newDelay. Also used as the default delay if not provided during ERC7579ECDSA.onInstall.

Delay for a specific account.

Expiration delay for account operations.

Schedule for an operation. Returns default values if not set (i.e. uint48(0), uint48(0), uint48(0)).

Same as ERC7579DelayedExecutor.getSchedule but with the operation id.

Returns the operation id.

Default expiration for account operations. Set if not provided during ERC7579ECDSA.onInstall.

Sets up the module's initial configuration when installed by an account. The account calling this function becomes registered with the module.

The initData must be abi.encodePacked(uint32(initialDelay), uint32(initialExpiration)). Otherwise, the delay will be set to ERC7579DelayedExecutor.delayChangeWindow and ERC7579DelayedExecutor.defaultExpiration respectively.

If a previous delay is still active (e.g. from a prior installation that was uninstalled before its delay reset completed), the same asymmetric transition rules as ERC7579DelayedExecutor.setDelay apply to the new delay, preventing an uninstall/reinstall cycle from being used to bypass the security window.

Requirements:

• The module must not be already installed on the account. Reverts with ERC7579DelayedExecutor.ERC7579DelayedExecutorAlreadyInstalled if not.
• initData must be empty or decode correctly to (uint32, uint32).

Allows an account to update its execution delay (see ERC7579DelayedExecutor.getDelay).

The transition period before the new delay takes effect depends on the direction of the change:

• When increasing the delay, the new value takes effect after min(newDelay, delayChangeWindow()). For example, increasing from 1 day to 3 days takes effect after 3 days. Increasing from 1 day to 10 days takes effect after ERC7579DelayedExecutor.delayChangeWindow (5 days). This cap prevents the account from being locked out by an accidental large increase (e.g. using milliseconds instead of seconds).
• When decreasing the delay, the new value takes effect after currentDelay - newDelay. This guarantees that a recovery operation cannot execute faster than the delay that was active at the moment the change was scheduled. For example, decreasing from 10 days to 3 days takes effect after 7 days.

Can only be called by the account itself.

Allows an account to update its execution expiration (see ERC7579DelayedExecutor.getExpiration).

Cleans up the ERC7579DelayedExecutor.getDelay and ERC7579DelayedExecutor.getExpiration values by scheduling them to 0 and respecting the previous delay and expiration values.

Internal implementation for setting an account's delay. See ERC7579DelayedExecutor.getDelay.

Emits an ERC7579DelayedExecutor.ERC7579ExecutorDelayUpdated event.

Internal implementation for setting an account's expiration. See ERC7579DelayedExecutor.getExpiration.

Emits an ERC7579DelayedExecutor.ERC7579ExecutorExpirationUpdated event.

Schedules an operation to be executed after the account's delay period (see ERC7579DelayedExecutor.getDelay). Operations are uniquely identified by the combination of account, salt, mode, and data. This should be called by derived contracts after performing their custom validation logic.

Requirements:

• The module must be installed on the account. Reverts with ERC7579DelayedExecutor.ERC7579ExecutorModuleNotInstalled if not.

Internal function to schedule an operation at a specific timepoint with a custom delay. The operation starts its security window at timepoint and becomes executable after delay.

Requirements:

• The operation must be Unknown.

Emits an ERC7579DelayedExecutor.ERC7579ExecutorOperationScheduled event.

See ERC7579Executor._execute.

Requirements:

• The operation must be Ready.

Internal function to cancel a scheduled operation. This should be called by derived contracts after performing their custom validation logic.

Requirements:

• The operation must be Scheduled or Ready.

Canceled operations can't be rescheduled. Emits an ERC7579DelayedExecutor.ERC7579ExecutorOperationCanceled event.

Decodes the init data into a delay and expiration.

Check that the current state of an operation matches the requirements described by the allowedStates bitmap. This bitmap should be built using ERC7579DelayedExecutor._encodeStateBitmap.

If requirements are not met, reverts with a ERC7579DelayedExecutor.ERC7579ExecutorUnexpectedOperationState error.

Encodes a OperationState into a bytes32 representation where each bit enabled corresponds to the underlying position in the OperationState enum. For example:

0x00...100000
  ^^^^^^------ ...
       ^------ Canceled
        ^----- Executed
         ^---- Expired
          ^--- Ready
           ^-- Scheduled
            ^- Unknown

Emitted when a new operation is scheduled.

Emitted when a new operation is canceled.

Emitted when the execution delay is updated.

Emitted when the expiration delay is updated.

The current state of an operation is not the expected. The allowedStates is a bitmap with the bits enabled for each OperationState enum position counting from right to left. See ERC7579DelayedExecutor._encodeStateBitmap.

The module is not installed on the account.

Returns boolean value if module is a certain type

Returns whether the module's first-install step has completed for account.

Returns the number of tokens with at least one spending config for account.

Returns a paginated slice of tokens with at least one spending config for account.

Returns the renewal period for the (key, token) config on account.

Returns the spending limit per period for the (key, token) config on account.

Returns the amount spent by key for token during period, anchored at the key's from.

Same as ERC7579ERC20Spender.spent but reads from an explicit start timepoint.

Returns (spending, available) for (key, token) at period.

Returns (start, period) for (key, token) at timepoint.

Requirements:

• timepoint must be >= the key's from. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpendingConfigNotStarted otherwise.
• The spending config must be set. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpendingConfigNotSet otherwise.

Sets up the module's initial configuration when installed by an account.

This module is installed under BOTH module types and onInstall is called twice. The shape of initData differs between the two calls:

• First call (validator install, installed(msg.sender) == false): abi.encode(bytes[] keys, uint48[] starts, uint48[] ends).
• Second call (executor install, installed(msg.sender) == true): abi.encode(bytes[] keys, address[] tokens, uint160[] limits, uint48[] renewPeriods).

First call requirements:

• The keys array must be non-empty. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderEmptyKeys otherwise.
• Those from the parent's ERC7579SessionKeys.onInstall (key registration).

Second call requirements:

• No (key, token) config has been written yet under this installation. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderAlreadyInstalled otherwise.
• initData.length must be at least 256 bytes (4 ABI offsets + 4 array lengths). Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderInvalidInitData otherwise. All offsets must point within bounds.
• All four arrays must have equal length.
• The keys array must be non-empty.
• Each keys[i] must already be registered. Reverts with ERC7579SessionKeys.ERC7579SessionKeysNonexistentKey otherwise.
• Those from ERC7579ERC20Spender._setConfig for the spending config requirements.

Emits ERC7579SessionKeys.ERC7579SessionKeysERC7913KeySet on the first call and ERC7579ERC20Spender.ERC7579ERC20SpendingConfigSet for each row on the second call.

Adds new session keys with one spending configuration each, in a single call. Can only be called by the account itself.

Requirements:

• All six arrays must have equal length.
• Those from ERC7579SessionKeys._addKeys (and the ERC7579SessionKeys._addKeys override's past-start ban).
• Those from ERC7579ERC20Spender._setConfig for each row.

Transfers token from account to to on behalf of key.

Tracks the spending limit for the (key, token) pair on account, updates the spent amount for the current period, and executes the transfer through the account's IERC7579Execution-executeFromExecutor.

Two authorization paths are accepted:

1. Executor flow: msg.sender == account. The validator has already verified the session key's signature and the calldata shape, so no further checks are performed here.
2. EOA self-call: key.length == 20 and address(bytes20(key)) == msg.sender. The key's validity range is enforced manually.

Requirements:

• The caller is authorized via one of the two paths above. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderUnauthorized otherwise.
• amount must not exceed the available limit for the current period. Reverts with ERC7579ERC20Spender.ERC7579ERC20InsufficientAvailable otherwise.
• The token's transfer must return true or have no return value. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderFailedTransfer otherwise.
• Those from ERC7579ERC20Spender._periodAt for the current timepoint.

Transfers token from account to multiple recipients in a single batch.

Same authorization paths as ERC7579ERC20Spender.transferFrom. The available limit check is performed once against the total of amounts.

Requirements:

• tos.length == amounts.length. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderMismatchedBatchLengths otherwise.
• The caller is authorized via one of the two paths described in ERC7579ERC20Spender.transferFrom.
• The sum of amounts must not exceed the available limit.
• Each ERC20 transfer must succeed (return value handled identically to ERC7579ERC20Spender.transferFrom).

Disables ERC-1271 signing by session keys. See ERC7579NativeSpender.isValidSignatureWithSender for rationale.

Validates a user operation. Adds a callData shape gate on top of session-key validation:

userOp.callData MUST call IERC7579Execution.execute(mode, executionCalldata) where:

• mode is CALLTYPE_SINGLE.
• executionCalldata decodes to (target=address(this), value=0, data).
• data calls ERC7579ERC20Spender.transferFrom or ERC7579ERC20Spender.batchTransferFrom.
• The key parameter inside data matches the key in userOp.signature.

Returns ERC4337Utils.SIG_VALIDATION_FAILED for any shape or key mismatch, otherwise delegates to the parent for cryptographic verification and validity-range packing.

Override of ERC7579SessionKeys._addKeys that disallows registering a key with a past start timepoint. See ERC7579NativeSpender._addKeys for the full rationale.

Requirements:

• Each starts[i] must be either 0 or >= clock(). Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderInvalidStart otherwise.
• Those from ERC7579SessionKeys._addKeys.

Internal version of ERC7579ERC20Spender.installed.

Internal version of ERC7579ERC20Spender.tokensCount.

Internal version of ERC7579ERC20Spender.renewPeriod.

Internal version of ERC7579ERC20Spender.limit.

Internal version of ERC7579ERC20Spender.spent with explicit start.

Internal version of ERC7579ERC20Spender.spendingAt with explicit start.

Internal version of ERC7579ERC20Spender.periodAt with explicit installation_.

Requirements:

• timepoint must be >= the key's from. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpendingConfigNotStarted otherwise.
• The spending config must be set. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpendingConfigNotSet otherwise.

Authorizes a ERC7579ERC20Spender.transferFrom / ERC7579ERC20Spender.batchTransferFrom call.

Accepts msg.sender as the account itself (executor flow, validator already verified) or as a 20-byte EOA matching key (EOA self-call, validity is checked manually).

Internal version of ERC7579ERC20Spender.transferFrom without access control.

Internal version of ERC7579ERC20Spender.batchTransferFrom without access control.

Writes a spending config for (keyId, token) and adds the token to the per-installation token set.

Requirements:

• newRenewPeriod > 0. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderInvalidRenewPeriod otherwise.
• newLimit > 0. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderInvalidLimit otherwise.
• token must be a contract. Reverts with ERC7579ERC20Spender.ERC7579ERC20SpenderInvalidToken otherwise.

Emits ERC7579ERC20Spender.ERC7579ERC20SpendingConfigSet.

Returns whether userOp.callData is a permitted call into ERC7579ERC20Spender.transferFrom or ERC7579ERC20Spender.batchTransferFrom on this module, and whether its key argument matches the one decoded from userOp.signature.

See ERC7579NativeSpender._validateSingleExecutionCalldata.

See ERC7579NativeSpender._validateTransferKey. The key argument is the second parameter of both ERC7579ERC20Spender.transferFrom and ERC7579ERC20Spender.batchTransferFrom, so the offset slot lies at a fixed position regardless of which selector is used.

Emitted when the spending configuration is set or updated for a (key, token) pair.

The account already has a spending configuration installed.

The requested amount exceeds the available spending limit for (key, token).

The provided initData is invalid or malformed.

The spending config is not set for (keyId, token).

The arrays in the executor initData have mismatched lengths.

The first install registered zero session keys, or the second install's keys array is empty.

The tos and amounts arrays have mismatched lengths in batch transfer.

The renewPeriod is invalid (must be greater than zero).

The limit is invalid (must be greater than zero).

The token address is not a contract.

The spending config has not started yet for (keyId, token) at timepoint.

The caller is not authorized to spend on behalf of key.

The start time is invalid (cannot reuse a past start time).

The ERC20 transfer call on token returned false.

Returns boolean value if module is a certain type

Internal function to execute an operation through the account's executor interface.

Emits ERC7579Executor.ERC7579ExecutorOperationExecuted event.

Requirements:

• The account must implement the IERC7579Execution-executeFromExecutor function.

Emitted when an operation is executed.

Returns boolean value if module is a certain type

Returns whether the module's first-install step has completed for account.

Returns the renewal period for key's spending config on account.

Returns the spending limit per period for key on account.

Returns the amount spent by key during period on account, anchored at the key's from.

Same as ERC7579ERC20Spender.spent but reads from an explicit start timepoint (useful for inspecting history).

Returns (spending, available) for key at period on account.

Returns (start, period) for key on account at timepoint.

Requirements:

• timepoint must be >= the key's from. Reverts with ERC7579NativeSpender.ERC7579NativeSpendingConfigNotStarted otherwise.
• The spending config must be set. Reverts with ERC7579NativeSpender.ERC7579NativeSpendingConfigNotSet otherwise.

Sets up the module's initial configuration when installed by an account.

This module is installed under BOTH module types and onInstall is called twice. The shape of initData differs between the two calls:

• First call (validator install, installed(msg.sender) == false): abi.encode(bytes[] keys, uint48[] starts, uint48[] ends).
• Second call (executor install, installed(msg.sender) == true): abi.encode(bytes[] keys, uint160[] limits, uint48[] renewPeriods).

First call requirements:

• The keys array must be non-empty. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderEmptyKeys otherwise.
• Those from the parent's ERC7579SessionKeys.onInstall (key registration).

Second call requirements:

• The account must not have configured the keys yet. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderAlreadyInstalled otherwise.
• Those of ERC7579NativeSpender._decodeKeyConfigsInitData for the decoding requirements.
• All arrays must have equal length. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderMismatchedInitDataLengths if not.
• The keys array must be non-empty. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderEmptyKeys otherwise.
• Each key must be registered. Reverts with ERC7579SessionKeys.ERC7579SessionKeysNonexistentKey otherwise.
• Those from ERC7579ERC20Spender._setConfig for the spending config requirements.

Emits ERC7579SessionKeys.ERC7579SessionKeysERC7913KeySet on the first call and ERC7579NativeSpender.ERC7579NativeSpendingConfigSet for each entry on the second call.

Adds new session keys with their spending configurations in a single call. Can only be called by the account itself. See ERC7579NativeSpender._addKeysWithConfig for requirements.

Transfers native tokens from account to to on behalf of key.

This function tracks the spending limit for the key on the account and updates the spent amount for the current period before executing the transfer through the account's IERC7579Execution-executeFromExecutor function.

Two authorization paths are accepted:

1. Executor flow: msg.sender == account. The validator has already verified the session key's signature and the calldata shape, so no further checks are performed here.
2. EOA self-call: key.length == 20 and address(bytes20(key)) == msg.sender. The key's validity range is enforced manually.

Requirements:

• The caller is authorized via one of the two paths above. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderUnauthorized otherwise.
• amount must not exceed the available limit for the current period. Reverts with ERC7579NativeSpender.ERC7579NativeInsufficientAvailable otherwise.
• Those from ERC7579ERC20Spender._periodAt for the current timepoint.

Transfers native tokens from account to multiple recipients in a single batch.

Same authorization paths as ERC7579ERC20Spender.transferFrom. The available limit check is performed once against the total of amounts.

Requirements:

• tos.length == amounts.length. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderMismatchedBatchLengths otherwise.
• The caller is authorized via one of the two paths described in ERC7579ERC20Spender.transferFrom.
• The sum of amounts must not exceed the available limit.
• Those from ERC7579ERC20Spender._periodAt for the current timepoint.

Disables ERC-1271 signing by session keys.

A spending session key is scoped to authorize ERC7579ERC20Spender.transferFrom / ERC7579ERC20Spender.batchTransferFrom user operations on this module. Letting it sign arbitrary ERC-1271 digests (e.g. EIP-2612 permits) would let a compromised key bypass the spending bound entirely.

Validates a user operation. Adds a callData shape gate on top of session-key validation:

userOp.callData MUST call IERC7579Execution.execute(mode, executionCalldata) where:

• mode is CALLTYPE_SINGLE (other call types are rejected).
• executionCalldata decodes to (target=address(this), value=0, data).
• data calls ERC7579ERC20Spender.transferFrom or ERC7579ERC20Spender.batchTransferFrom.
• The key parameter inside data matches the key in userOp.signature (prevents one key's signature from charging another key's allowance).

Returns ERC4337Utils.SIG_VALIDATION_FAILED for any shape or key mismatch, otherwise delegates to the parent for cryptographic verification and validity-range packing.

Override of ERC7579SessionKeys._addKeys that disallows registering a key with a past start timepoint.

The spending bookkeeping in ERC7579ERC20Spender._spentFor is indexed by (keyId, start, period). Letting a removed-then-re-registered key pick a past start would let it inherit _spentFor slots written under a previous validity range, which (combined with a different renewPeriod) can collide with previously-used period slots. Strictly incremental start values keep each registration's accounting in its own slot space.

Requirements:

• Each starts[i] must be either 0 or >= clock(). Reverts with ERC7579NativeSpender.ERC7579NativeSpenderInvalidStart otherwise.
• Those from ERC7579SessionKeys._addKeys.

Removes session keys from the calling account. Also clears the spending configuration for each key.

Emits ERC7579SessionKeys.ERC7579SessionKeysERC7913KeyUnset (via the parent) and ERC7579NativeSpender.ERC7579NativeSpendingConfigUnset for each key.

Internal version of ERC7579ERC20Spender.installed.

Internal version of ERC7579ERC20Spender.renewPeriod.

Internal version of ERC7579ERC20Spender.limit.

Internal version of ERC7579ERC20Spender.spent with explicit start.

Internal version of ERC7579ERC20Spender.spendingAt with explicit start.

Internal version of ERC7579ERC20Spender.periodAt with explicit installation_.

Requirements:

• timepoint must be >= the key's from. Reverts with ERC7579NativeSpender.ERC7579NativeSpendingConfigNotStarted otherwise.
• The spending config must be set. Reverts with ERC7579NativeSpender.ERC7579NativeSpendingConfigNotSet otherwise.

Authorizes a ERC7579ERC20Spender.transferFrom / ERC7579ERC20Spender.batchTransferFrom call.

Accepts msg.sender as the account itself (executor flow, validator already verified) or as a 20-byte EOA matching key (EOA self-call, validity is checked manually).

Internal version of ERC7579ERC20Spender.transferFrom without access control.

Internal version of ERC7579ERC20Spender.batchTransferFrom without access control.

Internal function to set the spending configuration for a key.

Reconfiguration is banned at the ERC7579ECDSA.onInstall level, so this function is only ever invoked with a freshly-registered (or freshly-reinstalled) key whose existing config slot is zero.

Requirements:

• Renewal periods must be greater than zero. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderInvalidRenewPeriod if not.
• Limits must be greater than zero. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderInvalidLimit if not.

Emits a ERC7579NativeSpender.ERC7579NativeSpendingConfigSet event.

Registers keys with validity range AND spending config in one pass.

Requirements:

• newKeys.length == limits.length == renewPeriods.length. Reverts with ERC7579NativeSpender.ERC7579NativeSpenderMismatchedInitDataLengths otherwise.
• Those from the parent's ERC7579SessionKeys._addKeys (key registration).
• Those from ERC7579ERC20Spender._setConfig for the spending config requirements.

Emits ERC7579SessionKeys.ERC7579SessionKeysERC7913KeySet and ERC7579NativeSpender.ERC7579NativeSpendingConfigSet for each key.

Returns whether userOp.callData is a permitted call into ERC7579ERC20Spender.transferFrom or ERC7579ERC20Spender.batchTransferFrom on this module, and whether its key argument matches the one decoded from userOp.signature.

Decodes the outer IERC7579Execution.execute(SINGLE, executionCalldata) call.

Returns (false, "") if the call doesn't match the expected shape.

Verifies the inner single execution targets this module with zero value, calls ERC7579ERC20Spender.transferFrom or ERC7579ERC20Spender.batchTransferFrom, and returns the key argument extracted from the inner calldata.

Returns (false, "") if any check fails.

Decodes the initialization data for the second install of the module.

The initData must be ABI-encoded as abi.encode(bytes[] keys, uint160[] limits, uint48[] renewPeriods) where each array has the same length.

Requirements:

• initData must be at least 192 bytes (6 × 32 bytes for the 3 ABI offsets and 3 array lengths).
• All offsets must point within the initData bounds.

Reverts with ERC7579NativeSpender.ERC7579NativeSpenderInvalidInitData if the encoding is invalid.

Emitted when the spending configuration is set or updated for a key.

Emitted when the spending configuration is removed for a key.

The account already has spenders installed.

The requested amount exceeds the available spending limit for key.

The provided initData is invalid or malformed.

The spending config is not set for key.

The arrays in initData have mismatched lengths.

The first install registered zero session keys.

The tos and amounts arrays have mismatched lengths in batch transfer.

The renewPeriod is invalid (must be greater than zero).

The limit is invalid (must be greater than zero).

The spending config has not started yet for key at timepoint.

The caller is not authorized to spend on behalf of key.

The start time is invalid (cannot reuse a past start time).

Installs the social recovery executor module on an account.

This function configures both the delayed executor and weighted multisig components required for the social recovery mechanism. The installation data must contain configuration for both components in the specified encoding format.

Data encoding format: [uint16(executorArgsLength), executorArgs, uint16(multisigArgsLength), multisigArgs]

Requirements:

• See ERC7579DelayedExecutor.onInstall for delay/expiration requirements
• See ERC7579MultisigWeighted.onInstall for guardian configuration requirements

Uninstalls the social recovery executor module from an account.

This cleans up both the delayed executor configuration and all guardian-related state. After uninstallation, all social recovery capabilities are removed.

See ERC7579DelayedExecutor.onUninstall and ERC7579MultisigWeighted.onUninstall.

Returns a slice of the set of guardians for the specified account. See ERC7579Multisig.getSigners.

Returns the number of guardians for the specified account. See ERC7579Multisig.getSignerCount.

Returns whether the guardian is an authorized guardian for the specified account. See ERC7579Multisig.isSigner.

Adds new guardians to the authorized set for the calling account. See ERC7579Multisig.addSigners.

Removes guardians from the authorized set for the calling account. See ERC7579Multisig.removeSigners.

Schedules a social recovery operation for the specified account.

The recoveryData is the encoded execution that will be sent to the account, and it follows the ERC-7579 standard encoding. The multisignature is a valid authorization from the guardians to schedule the operation and must be signed over the ERC7579SocialRecoveryExecutor.SCHEDULE_RECOVER_TYPEHASH typed data hash of the operation using the account's domain separator.

Requirements:

• The multisignature must be valid and meet the threshold requirements. Reverts with ERC7579SocialRecoveryExecutor.ERC7579SocialRecoveryExecutorInvalidSchedule if not.
• The signature must be encoded properly. See ERC7579MultisigWeighted-_validateMultisig.
• See ERC7579DelayedExecutor._schedule for scheduling requirements.
• The account must implement IERC5267.

Executes a social recovery operation for the specified account.

This function can be called by any account once the operation is ready (i.e., the delay period has elapsed). The operation must be in the Ready state to be executed.

Requirements:

• See ERC7579DelayedExecutor._execute for execution requirements.

Cancels a social recovery operation.

This function allows either the account itself or guardians with a valid multisignature authorization to cancel a scheduled recovery operation. If the caller is not the account, the multisignature must contain valid guardian signatures over the ERC7579SocialRecoveryExecutor.CANCEL_RECOVER_TYPEHASH typed data hash using the account's domain separator.

Uninstalling the module resets the threshold to zero while scheduled operations are retained (see ERC7579DelayedExecutor.onUninstall). Guardian-authorized cancellation is therefore only available while a guardian configuration is active. The account keeps its own cancellation path in either case.

Requirements:

• The caller must be the account or a valid multisignature must be provided.
• A multisignature only authorizes the cancellation while the ERC7579Multisig.threshold is nonzero.
• See ERC7579DelayedExecutor._cancel for cancellation requirements.
• The account must implement IERC5267.

Same as ERC7579SocialRecoveryExecutor.cancelRecovery, but without a multisignature.

The multisignature validation failed.

The caller is not authorized to cancel the operation.

See ERC7579ECDSA._validateECDSA.

Validates the operation by either verifying an inline FHE decryption proof in the signature (relayer address in the first 20 bytes, proof thereafter) or by checking ERC7579MultisigConfidential.disclosed. Does not call ERC7579MultisigConfidential.discloseOperation or set the disclosed flag when the proof is valid; disclosure is implicit in execution.

Returns whether the number of valid signatures meets or exceeds the threshold set for the target account.

See Multisig.tryDecodeMultisignatureCalldata for the encoding details.

Where signingSigners are the authorized signers and signatures are their corresponding signatures of the operation hash.

Sets up the module's initial configuration when installed by an account. Besides the standard signer and threshold configuration, this can also include encrypted signer weights.

See ERC7579MultisigWeighted._decodeMultisigWeightedInitData for the initData encoding details.

Requirements:

• The account must have no signers installed. Reverts with ERC7579Multisig.ERC7579MultisigAlreadyInstalled if not.
• The signers array must be non-empty. Reverts with ERC7579Multisig.ERC7579MultisigEmptySigners if not.
• Those of ERC7579MultisigWeighted._decodeMultisigWeightedInitData for the decoding requirements.
• Those of ERC7579Multisig.addSigners and ERC7579MultisigWeighted.setSignerWeights for signer and weight configuration requirements.

Cleans up module's configuration when uninstalled from an account. Clears all signers, weights, and total weights.

See ERC7579MultisigConfidential.onUninstall.

Override to add weight tracking and restrict signer count. See ERC7579MultisigConfidential._addSigners. Each new signer has a default weight of 1.

Requirements:

• The number of signers must not exceed type(uint16).max. Reverts with ERC7579MultisigConfidential.ERC7579MultisigTooManySigners if exceeded.

Override to handle weight tracking during removal. See ERC7579MultisigConfidential._removeSigners.

Cleans up weights for removed signers and updates the total extra weight accordingly.

Override to return the maximum threshold based on total weight instead of signer count. See ERC7579MultisigConfidential._maxThreshold.

Override to return the encrypted weight of a signer instead of a fixed weight of 1. See ERC7579MultisigConfidential._signerWeight.

Returns 0 if the signer is not authorized, otherwise returns 1 plus the signer's extra weight.

Sets up the module's initial configuration when installed by an account. Besides the standard delay and signer configuration, this can also include signer weights.

The initData should be encoded as: abi.encode(bytes[] signers, uint64 threshold, uint64[] weights)