Utils

Verifies an ERC-7964 crosschain signature for a given signer, hash and erc7964Signature. Uses the provided structHash function to compute the main struct hash from the array of chain-specific struct hashes.

This function:

1. Parses the ERC-7964 signature encoding to extract metadata
2. Verifies that the provided hash matches the struct at structIndex in the array
3. Queries the application contract for EIP-712 domain information
4. Reconstructs the full typed hash using the domain and array of struct hashes
5. Validates the signature against the reconstructed hash

Variant of CrossChainSignatureChecker.isValidCrossChainSignatureNow that takes the signature in calldata.

Parses an ERC-7964 encoded crosschain signature into its components:

• success True if parsing succeeded, false if the signature is malformed or the magic value is incorrect
• fields The EIP-712 domain fields byte from ERC-5267
• structIndex The index of the current chain's operation in the array
• application The address of the contract providing EIP-712 domain info
• structsArray The array of struct hashes for all chains
• crossChainSignature The actual signature bytes

Variant of parseCrossChainSignature that takes the signature in calldata.

Computes the EIP-712 struct hash of the InitModules message.

InitModules(uint256[] moduleTypeIds, address[] modules, bytes[] initDatas, uint256 nonce)

nonce is the user operation's nonce; combining it into the signed payload binds the installation authorization to a specific user operation. Callers must wrap the returned struct hash with the account's EIP-712 domain separator (e.g. _hashTypedDataV4) before verifying installationSignature.

Attempts to decode an ERC-8043 init mode payload from data.

data must be the user operation's initCode with the ERC8043Utils.INIT_MODE_MAGIC_VALUE 4-byte prefix already stripped. Callers are expected to detect init mode themselves — typically by comparing initCode[:4] against ERC8043Utils.INIT_MODE_MAGIC_VALUE — before invoking this function.

valid is true when the payload decodes into four consistent, non-empty arrays: moduleTypeIds.length == modules.length == initDatas.length > 0. When valid is false the returned slices should not be relied on; individual fields whose sub-decoder failed are returned as empty slices, but fields that decoded before the inconsistency was detected may be populated. Callers that want strict init-mode semantics should reject the user operation in that case.

The decoding never reverts on malformed input: length and offset checks are performed inline before any calldata slice is materialized.

Decodes a multisignature data from calldata without memory allocation.

The multisignature should be encoded as: abi.encode(bytes[] signingSigners, bytes[] signatures)

Where signingSigners are the authorized signers and signatures are their corresponding signatures of the operation hash. This function is equivalent to abi.decode(multisignature, (bytes[], bytes[])) but operates directly on calldata to avoid memory allocation, improving gas efficiency during multisignature validation.

Same as Multisig.tryDecodeMultisignatureCalldata, but reverts if the multisignature is invalid.

Requirements:

• The multisignature must be at least 64 bytes long to contain the two offset words.
• Both array offsets must be properly aligned and within bounds.
• Both array length fields must be accessible within the provided data.
• The arrays should have the same length for proper signature validation.

The multisignature format is invalid.

Returns the address of the ERC7579Multisig module associated with account. Returns address(0) if no multisig has been registered.

Registers or updates the ERC7579Multisig module address for the calling account.

This should be called by the account itself, typically via a UserOperation's execute call, so that MultisigCoordinator.allowHandle can verify signer authority.

Requirements:

• multisig_ must not be the zero address.

Verifies an externally-encrypted handle input proof and registers ACL permissions.

The proof is validated by FHE-fromExternal, after which both this coordinator (address(this)) and the target account are permanently allowed to use the resulting handle.

The returned handle can be cast to the appropriate type using with ebool.wrap(externalHandle) for ebool, eaddress.wrap(externalHandle) for eaddress, euint8.wrap(externalHandle) for euint8 and so on.

Internal version of MultisigCoordinator.fromExternal

Grants ACL permission over an encrypted handle to address to.

msg.sender must be account itself or a registered signer EOA. See allowHandle-address-bytes-bytes-bytes32-address- for the full authorization rules and requirements.

Grants a permanent ACL permission over an encrypted handle to address to, verified against the account's registered ERC7579Multisig.

See MultisigCoordinator._validateAccess for the full authorization rules.

Once authorization is confirmed, the handle is permanently allowed to to via the FHE ACL. This enables to (typically an EOA) to request off-chain decryption of the value.

Requirements:

• account must have a multisig registered via MultisigCoordinator.setERC7579Multisig and installed as a validator.
• account must implement IERC5267.
• The EIP-712 domain returned by account must not set the extensions flag (bit 0x20 of fields),

Validates that signer is authorized to act for account over the given hash.

First confirms that the registered multisig module is actually installed as a validator on the account (via IERC7579ModuleConfig-isModuleInstalled), then applies the following authorization rules:

• If signer is empty: msg.sender must be account itself or a registered signer EOA.
• If signer is exactly 20 bytes: treated as an EOA; must be a registered signer and signature must be a valid EIP-712 signature over hash.
• If signer is more than 20 bytes: treated as an ERC-7913 signer (verifier || key); must be a registered signer and signature is forwarded to the verifier via IERC7913SignatureVerifier-verify.

Requirements:

• account must have a multisig registered via MultisigCoordinator.setERC7579Multisig and installed as a validator.

Emitted when an account updates its associated multisig address.

The provided signer is not authorized for the account.

The provided signature is not valid for the given signer.

The provided multisig address is the zero address.

The provided multisig module is not installed in the account.

The provided account is not allowed to use the handle.