Legion

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "restricted",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.env.example

@@ -4,7 +4,7 @@
 # ============================================
 # UPGRADE TESTS
 # ============================================
-UPGRADE_TEST_RPC_URL=https://base-mainnet.g.alchemy.com/v2/YOUR_API_KEY # Base
+UPGRADE_TEST_RPC_URL=https://base-mainnet.g.alchemy.com/v2/YOUR_API_KEY# Base
 UPGRADE_TEST_OLD_PROXY=0x7C27e3AEcbF42879B64d76f604dC3430F4886462
 UPGRADE_TEST_OLD_VERSION=0.5.10
 
@@ -16,10 +16,10 @@ PRIVATE_KEY=
 # Format: RPC_{chainId}
 
 # Mainnet chains
-RPC_1=https://eth-mainnet.g.alchemy.com/v2/YOUR_API_KEY         # Ethereum
+RPC_1=https://eth-mainnet.g.alchemy.com/v2/YOUR_API_KEY# Ethereum
 
 # Testnet chains
-RPC_11155111=https://eth-sepolia.g.alchemy.com/v2/YOUR_API_KEY  # Sepolia
+RPC_11155111=https://eth-sepolia.g.alchemy.com/v2/YOUR_API_KEY# Sepolia
 
 # Test mnemonic for funding script
 GAS_SIGNER_MNEMONIC="dash between kangaroo vacant gaze glass way sudden retire output retire evil"

.github/workflows/version-check.yaml

@@ -57,22 +57,31 @@ jobs:
       - name: Bump version if needed
         if: steps.check.outputs.needs_version_bump == 'true'
         run: |
+          # Configure git
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+
           # Get the contracts that need bumping
           CONTRACTS_TO_BUMP="${{ steps.check.outputs.contracts_to_bump }}"
-
+          
           echo "Bumping versions for contracts: $CONTRACTS_TO_BUMP"
-
+          
           # Update Solidity files using the upgrade script with specific contracts
           CONTRACTS_TO_BUMP="$CONTRACTS_TO_BUMP" node prep/update-version.js
-
-      - name: Commit version bump changes
-        if: steps.check.outputs.needs_version_bump == 'true'
-        uses: stefanzweifel/git-auto-commit-action@v5
-        with:
-          commit_message: "chore: bump contract versions due to bytecode changes - Contracts updated: ${{ steps.check.outputs.contracts_to_bump }}"
-          file_pattern: "src/*.sol"
-          commit_user_name: github-actions[bot]
-          commit_user_email: github-actions[bot]@users.noreply.github.com
+
+          # Commit changes (only Solidity files, not package.json)
+          git add src/*.sol
+          git commit -m "chore: bump contract versions due to bytecode changes - Contracts updated: $CONTRACTS_TO_BUMP"
+
+          # Pull latest changes and rebase
+          # Pull latest changes and rebase
+          if ! git pull origin ${{ github.event.pull_request.head.ref }} --rebase; then
+            echo "Failed to rebase version bump changes. Manual intervention required."
+            exit 1
+          fi
+
+          # Push to the PR branch
+          git push origin HEAD:${{ github.event.pull_request.head.ref }}
 
       - name: Create PR comment
         if: steps.check.outputs.needs_version_bump == 'true'

.gitmodules

@@ -7,6 +7,9 @@
 [submodule "lib/LayerZero-v2"]
 	path = lib/LayerZero-v2
 	url = https://github.com/LayerZero-Labs/LayerZero-v2
+[submodule "lib/devtools"]
+	path = lib/devtools
+	url = https://github.com/LayerZero-Labs/devtools
 [submodule "lib/openzeppelin-contracts"]
 	path = lib/openzeppelin-contracts
 	url = https://github.com/OpenZeppelin/openzeppelin-contracts

CHANGELOG.md

@@ -1,24 +1,5 @@
 # porto-account
 
-> Note: After v0.5.5, all changelogs will be published along with the release notes.   
-> From here on, this file is deprecated.
-
-## 0.5.5
-
-### Patch Changes
-- Update foundry config, to not include metadata in the bytecode. This ensures that the contract bytecode doesn't change because of some other change in the repository.
-
-
-## 0.5.4
-
-### Patch Changes
-
-- SimpleFunder supports multiple orchestrators instead of single immutable orchestrator
-  - Replaced immutable `ORCHESTRATOR` with `orchestrators` mapping and `setOrchestrators()` function
-  - Maintained backward compatibility with old `fund()` signature
-  - Added `supported_orchestrators` config field for deployment
-  - Version bumped to "0.1.5"
-
 ## 0.5.0
 
 ### Minor Changes
@@ -113,7 +94,7 @@
 - All fill related functions removed from EP.
 - EP is now completely stateless, also does not have a constructor.
 - PreCall with `nonce = type(uint256).max` is not replayable anymore.
-- `OpDataTooShort` error, udpated to `OpDataError`, to enforce tighter validation of opdata.
+- `OpDataTooShort` error, updated to `OpDataError`, to enforce tighter validation of opdata.
 - `checkAndIncrementNonce` function added to account. Can only be called by EP.
 - 6b3294a: Optimize `_isSuperAdmin`
 
@@ -150,7 +131,7 @@
 
   - Add back the INSUFFICIENT_GAS check, which prevents the relay from setting up the `execute` call on the
     account, in such a way causing it to intentionally fail.
-    For the relay, gExecute now has to be set atleast as `gExecute > (gCombined + 100_000) * 64/63)`
+    For the relay, gExecute now has to be set at least as `gExecute > (gCombined + 100_000) * 64/63)`
 
 ### Patch Changes
 

README.md

@@ -2,6 +2,10 @@
 
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/ithacaxyz/account)
 
+> 🚧 **Work In Progress**  
+> This repository is under active development. Contracts are **unaudited**, and the codebase may have **breaking changes** without notice.  
+> A bug bounty is live on Base Mainnet — [details here](docs/bug-bounty.md).
+
 **All-in-one EIP-7702 powered account contract, coupled with [Porto](https://github.com/ithacaxyz/porto)**
 
 Every app needs an account, traditionally requiring separate services for auth, payments, and recovery. Doing this in a way that empowers users with control over their funds and their data is the core challenge of the crypto space. While crypto wallets have made great strides, users still face a fragmented experience - juggling private keys, managing account balances across networks,
@@ -19,24 +23,17 @@ We believe that unstoppable crypto-powered accounts should be excellent througho
 
 # Features out of the box
 
-- Secure Login: Using WebAuthN-compatible credentials like PassKeys.
-- Call Batching: Send multiple calls in 1.
-- Gas Sponsorship: Allow anyone to pay for your fees in any ERC20 or ETH.
-- Access Control: Whitelist receivers, function selectors and arguments.
-- Session Keys: Allow transactions without confirmations if they pass low-security access control policies.
-- Multi-sig Support: If a call is outside of a certain access control policy, require multiple signatures.
-- Interop: Transaction on any chain invisibly. 
-
-## Benchmarks
-
-![Benchmarks](docs/benchmarks.jpeg)
-
-Gas benchmark implementations are in the [test repository](test/Benchmark.t.sol). We currently benchmark against leading ERC-4337 accounts. To generate the benchmarks, use `forge snapshot --isolate`. 
-
-## Security
-Contracts were audited in a 2 week engagement by @MiloTruck @rholterhus @kadenzipfel
-
-We also maintain an active bug bounty program, you can find more details about it [here](https://porto.sh/contracts/security-and-bug-bounty)
+- [x] Secure Login: Using WebAuthN-compatible credentials like PassKeys.
+- [x] Call Batching: Send multiple calls in 1.
+- [x] Gas Sponsorship: Allow anyone to pay for your fees in any ERC20 or ETH.
+- [x] Access Control: Whitelist receivers, function selectors and arguments.
+- [x] Session Keys: Allow transactions without confirmations if they pass low-security access control policies.
+- [x] Multi-sig Support: If a call is outside of a certain access control policy, require multiple signatures.
+- [x] Interop: Transaction on any chain invisibly. 
+- [ ] Timelocks: Add a time delay between transaction verification and execution, for additional safety.
+- [ ] Optimized for L2: Using BLS signatures.
+- [ ] Privacy: Using stealth addresses, confidential ERC20 tokens, and privacy pool integrations.
+- [ ] Account Recovery & Identity: Using ZK {Email, OAUth, Passport} and more.
 
 ## Getting Help