Dargon789 legion rouge

[Dargon789]

Summary by Sourcery

Add Merkle tree–based wrapped signature support to IthacaAccount and update tests and CI to accommodate the new signature format and test focus.

New Features:

• Introduce Merkle tree–based wrapped signature verification for IthacaAccount signatures.

Enhancements:

• Extend wrapped signature format to include flags for prehashing and Merkle-based verification and update all helper signatures accordingly.
• Simplify EIP-712 domain usage in tests to only rely on the verifying contract address.
• Bump IthacaAccount EIP-712 version to 0.5.11.

CI:

• Adjust CI test command to skip UpgradeTests during standard test runs.

Tests:

• Add fuzz test coverage for Merkle-based signatures, including valid proofs, invalid digests, tampered proofs, and incorrect roots.
• Update existing tests and test utilities to use the extended wrapped signature format with the new Merkle flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
legion	Canceled		Apr 11, 2026 0:45am

[sourcery-ai]

Reviewer's Guide

Adds Merkle tree–based signature wrapping/verification support to IthacaAccount, updates the wrapped signature format to include a new merkle flag, and extends tests and CI to cover and accommodate the new behavior.

Sequence diagram for wrapped and Merkle-based signature verification in IthacaAccount

sequenceDiagram
    actor ExternalCaller
    participant IthacaAccount
    participant MerkleProofLib
    participant EfficientHashLib
    participant ECDSA

    ExternalCaller->>IthacaAccount: unwrapAndValidateSignature(digest, signature)
    alt signature.length == 65
        IthacaAccount->>ECDSA: recoverCalldata(digest, signature)
        ECDSA-->>IthacaAccount: signer
        IthacaAccount-->>ExternalCaller: (signer == IthacaAccount, 0)
    else wrapped_signature
        IthacaAccount->>IthacaAccount: parse keyHash, prehashFlag, merkleFlag
        alt prehashFlag != 0
            IthacaAccount->>EfficientHashLib: sha2(digest)
            EfficientHashLib-->>IthacaAccount: prehashedDigest
        end
        alt merkleFlag != 0
            IthacaAccount->>IthacaAccount: _verifyMerkleSig(digest, innerSignature)
            IthacaAccount->>MerkleProofLib: verifyCalldata(proof, root, digest)
            MerkleProofLib-->>IthacaAccount: isMerkleValid
            alt isMerkleValid
                IthacaAccount->>IthacaAccount: unwrapAndValidateSignature(root, rootSig)
                IthacaAccount-->>ExternalCaller: (isValid, keyHashFromRoot)
            else invalid_merkle
                IthacaAccount-->>ExternalCaller: (false, 0x0)
            end
        else non_merkle_wrapped
            IthacaAccount->>IthacaAccount: getKey(keyHash)
            IthacaAccount-->>ExternalCaller: (isValid, keyHash)
        end
    end

Loading

Class diagram for IthacaAccount signature handling with Merkle support

classDiagram
    class IthacaAccount {
        +unwrapAndValidateSignature(bytes32 digest, bytes signature) bool isValid
        +unwrapAndValidateSignature(bytes32 digest, bytes signature) bytes32 keyHash
        -_verifyMerkleSig(bytes32 digest, bytes signature) bool isValid
        -_verifyMerkleSig(bytes32 digest, bytes signature) bytes32 keyHash
        +getKey(bytes32 keyHash) Key
        +DOMAIN_SEPARATOR() bytes32
        +eip712Domain() (string name, string version)
        -version : string = 0.5.11
    }

    class MerkleProofLib {
        +verifyCalldata(bytes32[] proof, bytes32 root, bytes32 leaf) bool
    }

    class EfficientHashLib {
        +sha2(bytes32 input) bytes32
    }

    class LibBytes {
        +loadCalldata(bytes data, uint256 index) bytes32
        +truncatedCalldata(bytes data, uint256 newLen) bytes
    }

    class ECDSA {
        +recoverCalldata(bytes32 hash, bytes signature) address
    }

    class Key {
        +address signer
        +bool active
        +uint256 nonce
    }

    IthacaAccount ..> MerkleProofLib : uses
    IthacaAccount ..> EfficientHashLib : uses
    IthacaAccount ..> LibBytes : uses
    IthacaAccount ..> ECDSA : uses
    IthacaAccount --> Key : returns

Loading

File-Level Changes

Change	Details	Files
Add Merkle proof–backed signature verification path in IthacaAccount and integrate it into unwrapAndValidateSignature.	Import MerkleProofLib from Solady for calldata Merkle proof verification. Implement internal _verifyMerkleSig that ABI-decodes (via calldata assembly) a Merkle proof, root, and root signature, verifies the leaf against the root using MerkleProofLib.verifyCalldata, then validates the root signature via unwrapAndValidateSignature. Extend unwrapAndValidateSignature to understand a new wrapped signature layout that appends two flag bytes (prehash, merkle), derive and branch on the merkle flag to delegate to _verifyMerkleSig when set. Adjust the default/digest-only branch to account for the extra flag byte when computing offsets for keyHash and inner signature. Bump the IthacaAccount EIP712 version string from 0.5.10 to 0.5.11 to reflect the new behavior.	src/IthacaAccount.sol
Update all test helpers and call sites to the new wrapped signature encoding that includes a merkle flag, and add focused tests for Merkle-based signatures.	Modify Base.t.sol helper functions (_secp256r1Sig, _secp256k1Sig, _multiSig, and intent-signature helpers) so they encode wrapped signatures as abi.encode(innerSignature), keyHash, uint8(prehash), uint8(0) where the final byte is the new merkle flag (set to 0 in existing tests). Propagate the new encoding to tests that fabricate junk or dummy signatures for gas estimation, orchestrator, and simulation tests by appending an extra uint8(0) merkle flag. Add Account.t.sol::testMerkleSignature, which builds a random Merkle tree using murky/Merkle, generates a valid proof for a random leaf, wraps a root signature with the new merkle flag, and asserts: valid verification for a correct leaf, failure for a digest not in the tree, failure for a tampered proof, and failure for a wrong root. Simplify the eip712Domain destructuring in Account.t.sol::testSignatureCheckerApproval to only extract verifyingContract now that the domain type hash is hard-coded.	test/Base.t.sol test/Account.t.sol test/Orchestrator.t.sol test/SimulateExecute.t.sol
Adjust CI to skip long-running upgrade tests on default test runs.	Change the CI forge test command to run forge test --no-match-contract UpgradeTests so that CI excludes the UpgradeTests contract by default.	.github/workflows/ci.yaml
Repository/configuration housekeeping.	Add a CNAME file at the repository root (likely for GitHub Pages configuration). Update vendored /lib dependencies (LayerZero-v2, forge-std) without visible in-PR content changes in the provided diff snippet.	CNAME lib/LayerZero-v2 lib/forge-std

Possibly linked issues

• Legion rouge #41: They match exactly: Merkle verification in IthacaAccount, new wrapped-signature format, updated tests, CI exclusion, and CNAME file.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sourcery-ai]

Hey - I've found 3 issues, and left some high level feedback:

• The manual calldata decoding in _verifyMerkleSig does not appear to follow the ABI layout of abi.encode(bytes32[] proof, bytes32 root, bytes rootSig) (e.g. root is read from signature.offset + 0x20, which is the first head word, not the actual root value), so it would be safer and clearer to either use abi.decode or re-derive the offsets from the three head words rather than hardcoding them.
• In unwrapAndValidateSignature, the layout and size assumptions around the last two flag bytes (prehash/merkle) are encoded via magic numbers (0x22, n + 1, n + 2); consider introducing named constants or a small helper to centralize this layout so future changes to the wrapped signature format are less error-prone.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The manual calldata decoding in `_verifyMerkleSig` does not appear to follow the ABI layout of `abi.encode(bytes32[] proof, bytes32 root, bytes rootSig)` (e.g. `root` is read from `signature.offset + 0x20`, which is the first head word, not the actual root value), so it would be safer and clearer to either use `abi.decode` or re-derive the offsets from the three head words rather than hardcoding them.
- In `unwrapAndValidateSignature`, the layout and size assumptions around the last two flag bytes (`prehash`/`merkle`) are encoded via magic numbers (`0x22`, `n + 1`, `n + 2`); consider introducing named constants or a small helper to centralize this layout so future changes to the wrapped signature format are less error-prone.

## Individual Comments

### Comment 1
<location path="src/IthacaAccount.sol" line_range="493-502" />
<code_context>
+    /// - Note: Each leaf of the merkle tree should be a standard digest.
+    /// - The signature for using merkle verification is encoded as:
+    /// - bytes signature = abi.encode(bytes32[] proof, bytes32 root, bytes rootSig)
+    function _verifyMerkleSig(bytes32 digest, bytes calldata signature)
+        internal
+        view
+        returns (bool isValid, bytes32 keyHash)
+    {
+        bytes32[] calldata proof;
+        bytes32 root;
+        bytes calldata rootSig;
+
+        assembly ("memory-safe") {
+            let proofOffset := add(signature.offset, calldataload(signature.offset))
+            proof.length := calldataload(proofOffset)
+            proof.offset := add(proofOffset, 0x20)
</code_context>
<issue_to_address>
**issue (bug_risk):** Calldata decoding inside `_verifyMerkleSig` does not match the ABI layout of `bytes signature = abi.encode(bytes32[] proof, bytes32 root, bytes rootSig)`.

In calldata, `signature.offset` first points to the length word, so the ABI head for `abi.encode(bytes32[] proof, bytes32 root, bytes rootSig)` actually starts at `base := add(signature.offset, 0x20)`. At that `base`:
- `base + 0x00` = offset to `proof` (relative to `base`)
- `base + 0x20` = `root`
- `base + 0x40` = offset to `rootSig` (relative to `base`)
- `proof` and `rootSig` then each start with a length word followed by data.

Your current code:
```solidity
let proofOffset := add(signature.offset, calldataload(signature.offset))
root := calldataload(add(signature.offset, 0x20))
let rootSigOffset := add(signature.offset, calldataload(add(signature.offset, 0x40)))
```
uses the length at `signature.offset` as if it were a head pointer, loads `root` from the wrong slot, and bases both offsets off `signature.offset` instead of `base`. This will read incorrect calldata and can invalidate verification. Compute `base := add(signature.offset, 0x20)` once and derive `proofOffset`, `root`, and `rootSigOffset` relative to `base` to match the ABI layout.
</issue_to_address>

### Comment 2
<location path="src/IthacaAccount.sol" line_range="523-525" />
<code_context>
+        return (false, bytes32(0));
+    }
+
     /// @dev Returns if the signature is valid, along with its `keyHash`.
     /// The `signature` is a wrapped signature, given by
-    /// `abi.encodePacked(bytes(innerSignature), bytes32(keyHash), bool(prehash))`.
+    /// `abi.encode(bytes(innerSignature), bytes32(keyHash), bool(prehash), bool(merkle))`.
     function unwrapAndValidateSignature(bytes32 digest, bytes calldata signature)
         public
</code_context>
<issue_to_address>
**issue (bug_risk):** The documented `abi.encode(...)` wrapper format does not align with how `unwrapAndValidateSignature` slices the signature.

The new docstring says the wrapper uses `abi.encode(bytes(innerSignature), bytes32(keyHash), bool(prehash), bool(merkle))`, but `unwrapAndValidateSignature` still decodes as if the data were a raw tail-concatenation with the last 34 bytes equal to `[keyHash][prehash][merkle]`. A true ABI encoding of `(bytes, bytes32, bool, bool)` has a dynamic-bytes head and word-aligned fields, so this slicing will not reliably recover `keyHash` and the flags. Either the wrapper must use a packed/custom layout matching this slicing (and the comment updated), or the decoding should be changed to actual ABI decoding.
</issue_to_address>

### Comment 3
<location path=".github/workflows/ci.yaml" line_range="36" />
<code_context>
           UPGRADE_TEST_OLD_VERSION: ${{ secrets.UPGRADE_TEST_OLD_VERSION }}
         run: |
-          forge test -vvv
+          forge test --no-match-contract UpgradeTests

       - name: Format contracts and generate snapshots
</code_context>
<issue_to_address>
**question (testing):** Excluding `UpgradeTests` from CI may hide regressions specific to upgrades.

This change causes all `UpgradeTests` contracts to be skipped in CI, which can allow upgrade-related regressions to go unnoticed. If these tests are too slow or flaky for the main job, consider moving them to a separate scheduled/nightly workflow instead of disabling them entirely so upgrade paths remain covered.
</issue_to_address>

Fix all in Cursor

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request introduces Merkle signature verification to the IthacaAccount contract, enabling the validation of digests against a Merkle root signed by an authorized key. The signature format has been updated to include a merkle flag, and the version has been bumped to 0.5.11. Review feedback identifies a lack of bounds checking in the assembly block used for manual ABI decoding, which could lead to out-of-bounds reads, and notes a discrepancy in the documentation regarding whether the signature is encoded using abi.encode or abi.encodePacked.