feat(wallet): eip712 variant

[frol-ai]

Depends on #319 — this branch is stacked on top of it, so the diff below also contains #319's commits until it merges. Only the last commit (feat(wallet): eip712 variant) belongs to this PR.

Re-implementation of #256 on top of #319, adapted to the current wallet-contract architecture (per-variant crates + the SignatureSchema refactor) and extended to cover NEP-641 authorizations.

Adds an EIP-712 (eth_signTypedData_v4) wallet-contract variant, so any Ethereum wallet (MetaMask, WalletConnect, Ledger) can be the sole key of a NEAR wallet-contract account — with clear signing preserved: the wallet displays the structure being authorized, never an opaque digest.

Typed data

Both types live under the same domain and are separated by their primary type:

EIP712Domain(string name,string version)
  name = "NEAR Wallet Contract", version = "1"

WalletRequest(bool payForGas,string chainId,string signerId,uint32 nonce,string createdAt,uint32 timeoutSecs,string internal,string external)
WalletAuth(string chainId,string signer,string purpose,string recipient,string payload,string createdAt,uint32 timeoutSecs)

internal/external are the JSON-serialized wallet operations and promises of the request; signer is the JSON-serialized NEP-641 signer binding.

{
  "primaryType": "WalletRequest",
  "domain": { "name": "NEAR Wallet Contract", "version": "1" },
  "message": {
    "payForGas": false,
    "chainId": "mainnet",
    "signerId": "0se5eba21e8f191e1880e453794bc551dfa50a3419",
    "nonce": 42,
    "createdAt": "2026-07-16T12:34:56.789Z",
    "timeoutSecs": 300,
    "internal": "[{\"op\":\"add_extension\",\"payload\":{\"account_id\":\"extension.near\"}}]",
    "external": "[]"
  }
}

How the display is enforced

The contract does not trust what the client claims to have displayed: it checks every member of the signed typed data against the message it is about to act upon (Eip712RequestMessage::matches() / Eip712AuthMessage::matches()), so a proof whose typed data says anything other than the message is rejected. Members carrying nested structures (internal, external, signer) are compared semantically — parsed, then compared as values — so clients are free to pretty-print that JSON for display without breaking verification.

Tests cover this per field: tampering with any one of payForGas, chainId, signerId, nonce, createdAt, timeoutSecs, internal, external (and the auth analogues) makes the proof fail.

payForGas (#320) matters especially here: hash-based schemas bind it for free via the canonical digest, but a clear-signing schema compares fields explicitly, so it has to be a member of the typed data — otherwise a proof signed with payForGas: false would verify against a request that flips it on, and the wallet would pay for gas the signer never authorized.

verify_auth() on SignatureSchema

#319 hands schemas only the 32-byte digest (verify_hash), which is enough for blind-signing schemas but leaves nothing to display for w_resolve_auth(). This PR adds a verify_auth(public_key, msg: &AuthMessage, proof) provided method that defaults to verify_hash(&msg.hash(), proof) — every existing variant is unaffected — and w_resolve_auth() now calls it. WalletEip712 overrides both verify() and verify_auth(); its verify_hash() always returns false, since an opaque digest carries no message to show the signer.

Identity: 0x address in state

The contract stores the signer's Ethereum address (EthAddress = keccak256(public_key)[12..32], rendered as 0x<hex> by w_public_key()) instead of the public key, and derives it from the public key it recovers from each proof — so the proof still binds the key.

Ethereum wallets expose the address without any signing ceremony (eth_requestAccounts), while the public key can only be recovered from a signature. Since the NEP-616 deterministic AccountId commits to the initial state, a client that only knows the address can already derive which NEAR account it controls — one roundtrip less than a public-key-in-state design (test: account_id_derivable_from_address_alone). It also frees 44 bytes of the ZBA budget.

Address derivation is checked against an independent secp256k1 + keccak256 implementation, so wallets end up controlled by exactly the key behind the user's existing Ethereum address.

Proof

proof is a JSON-serialized SignedEip712: the typed data message plus a recoverable 65-byte secp256k1 signature (r ‖ s ‖ v, v ∈ {0,1}) as secp256k1:<base58> — the same signature encoding used elsewhere in this repo. Ethereum wallets return v as 27/28, so clients normalize by subtracting 27. Verification is a single ecrecover host call (malleable signatures rejected), compared against the public key in state.

Changes

• New crate defuse-eip712 (crates/signatures/eip712): EIP-712 hashing primitives (type_hash, hash_struct, encode_bytes, encode_uint, 0x19 0x01 prehash, secp256k1 recover), following defuse-erc191/defuse-tip191. Domain is name+version only (NEAR has no EVM chain id and account ids don't fit address; network and account are bound by the message itself).
• New contract variant defuse-wallet-eip712 (contracts/wallet/signatures/eip712): WalletEip712 schema, wallet-eip712 contract standard, typed-data types, EthAddress, and WalletEip712Signer (incl. sign_auth_msg()) for the SDK.
• defuse-wallet: SignatureSchema::verify_auth() + w_resolve_auth() wiring.
• Workspace members/deps, Makefile CONTRACT_CRATES, wallet README.

Tests

• defuse-eip712: domain-separator, type-hash and uint-encoding known-answer vectors, sign/recover round-trip.
• defuse-wallet-eip712: type-hash vectors for both primary types, EthAddress derivation/parsing vectors, account id derivable from the address alone, sign→verify round-trips for w_execute_signed and w_resolve_auth, 14 per-field tamper cases, cross-type replay (a request proof must not resolve an authorization and vice versa), wrong address, malformed/bare/other-curve proofs, and verify_hash() failing closed.
• Shared JSON fixtures tests/fixtures/eip712-wallet-message.json (3 request + 2 auth vectors, each with the canonical message, the eth_signTypedData_v4 message, its prehash and the on-chain proof) pinning the wire format for cross-implementation clients.

Checked: cargo clippy --workspace --all-targets --all-features, cargo fmt --all --check, taplo format --check, make check-contracts/defuse-wallet-eip712/all, cargo test -p defuse-eip712 -p defuse-wallet -p defuse-wallet-eip712. No sandbox test added: the shared w_execute_signed/w_resolve_auth paths are already covered by #319's suite, and this variant only swaps signature verification.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PKxr8pX5kL97LHNZjHvPXR

[coderabbitai]

📝 Walkthrough

Walkthrough

The wallet gains NEP-641 authorization resolution and digest-based signature verification. New EIP-712 hashing, recovery, wallet contract, signer, and fixture crates are added. Existing WebAuthn schemas require user verification, and the wallet SDK exposes the authorization-resolution view call.

Changes

Wallet authorization and signature support

Layer / File(s)	Summary
NEP-641 authorization data model contracts/wallet/src/auth.rs, contracts/wallet/src/lib.rs, contracts/wallet/tests/*, contracts/wallet/Cargo.toml	Adds authorization messages, signer bindings, resolution results, errors, canonical hashing, crate exports, and shared fixture validation.
Digest-based signature verification contracts/wallet/src/schema.rs, contracts/wallet/signatures/{ed25519,no-sign,webauthn}/*, contracts/wallet/src/contract.rs	Adds SignatureSchema::verify_hash, updates existing schema implementations, and changes WebAuthn configurations to require user verification.
EIP-712 primitives and wallet schema crates/signatures/eip712/*, contracts/wallet/signatures/eip712/*, Cargo.toml, Makefile, contracts/wallet/README.md	Adds EIP-712 hashing and recovery utilities, the wallet schema and signer, contract wiring, test vectors, and workspace/build integration.
Authorization resolution entrypoints contracts/wallet/src/contract.rs, crates/wallet/sdk/src/client.rs	Adds w_resolve_auth, validates signed authorization payloads and bindings, verifies hashes, and exposes the corresponding SDK request type and result.
Estimated code review effort: 5 (Critical)	~120 minutes

Possibly related PRs

• near/intents#270: Adds another wallet SignatureSchema implementation using the hash-based verification surface.
• near/intents#319: Related NEP-641 authorization-resolution and wallet signature API changes.
• near/intents#321: Related WalletSigner::sign_wallet_msg SDK method changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately points to the main change: adding an EIP-712 wallet variant.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

contracts/wallet/src/contract.rs (1)

292-298: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated validity-window formula.

This re-implements the same now - effective_timeout <= created_at <= now window check as Nonces::commit() (per the comment, "sans bitmap"). Consider factoring the window check itself into a shared helper (e.g. on Nonces or Timestamp) that both execute_signed's nonce commit and resolve_auth call, so the two authorization paths can't silently diverge if the window semantics change later.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@contracts/wallet/src/contract.rs` around lines 292 - 298, Factor the
validity-window condition from resolve_auth into a shared helper on the
appropriate nonce or timestamp type, then reuse that helper from both
resolve_auth and Nonces::commit(). Preserve the existing effective-timeout
calculation and ExpiredOrFuture behavior while ensuring both authorization paths
use identical window semantics.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@contracts/wallet/src/contract.rs`:
- Around line 292-298: Factor the validity-window condition from resolve_auth
into a shared helper on the appropriate nonce or timestamp type, then reuse that
helper from both resolve_auth and Nonces::commit(). Preserve the existing
effective-timeout calculation and ExpiredOrFuture behavior while ensuring both
authorization paths use identical window semantics.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 32782069-86f3-47d7-b5d7-6bf36bc462a9

📥 Commits

Reviewing files that changed from the base of the PR and between 3b72cfd and d822edc.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (24)

• Cargo.toml
• Makefile
• contracts/wallet/Cargo.toml
• contracts/wallet/README.md
• contracts/wallet/signatures/ed25519/src/lib.rs
• contracts/wallet/signatures/eip712/Cargo.toml
• contracts/wallet/signatures/eip712/src/contract.rs
• contracts/wallet/signatures/eip712/src/lib.rs
• contracts/wallet/signatures/eip712/src/signer.rs
• contracts/wallet/signatures/eip712/tests/fixtures.rs
• contracts/wallet/signatures/eip712/tests/fixtures/eip712-wallet-message.json
• contracts/wallet/signatures/no-sign/src/lib.rs
• contracts/wallet/signatures/webauthn/ed25519/src/lib.rs
• contracts/wallet/signatures/webauthn/p256/src/lib.rs
• contracts/wallet/signatures/webauthn/src/lib.rs
• contracts/wallet/src/auth.rs
• contracts/wallet/src/contract.rs
• contracts/wallet/src/lib.rs
• contracts/wallet/src/schema.rs
• contracts/wallet/tests/fixtures/nep641-auth.json
• contracts/wallet/tests/nep641_fixtures.rs
• crates/signatures/eip712/Cargo.toml
• crates/signatures/eip712/src/lib.rs
• crates/wallet/sdk/src/client.rs