Skip to content

test(tempo): fuzz sponsorship signing - #4978

Draft
brendanjryan wants to merge 5 commits into
wevm:mainfrom
brendanjryan:brendanjryan/tempo-sponsorship-fuzz
Draft

test(tempo): fuzz sponsorship signing#4978
brendanjryan wants to merge 5 commits into
wevm:mainfrom
brendanjryan:brendanjryan/tempo-sponsorship-fuzz

Conversation

@brendanjryan

Copy link
Copy Markdown
Collaborator

Motivation

Tempo sponsorship supports sender-first and payer-first signing flows with distinct signing domains. Fee-token selection and sender identity must remain excluded from or committed to the correct signature as envelopes move between partial 0x78 and final 0x76 forms. This change is stacked on #4977.

Summary

  • add state-machine properties for sender-first and payer-first sponsorship
  • exercise partial 0x78 handoffs and final 0x76 envelopes
  • recover and verify both sender and fee-payer identities
  • verify fee-token selection is excluded from the sender domain and bound to the payer domain
  • verify the payer domain binds the sender and final envelopes remain canonical

Key design considerations

  • keep sponsorship properties node-independent by using real local signatures and protocol recovery
  • generate only valid fee, nonce, call, and account combinations
  • model both supported signing orders in one invariant set

@changeset-bot

changeset-bot Bot commented Aug 6, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 9ff0ef5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@vercel

vercel Bot commented Aug 6, 2026

Copy link
Copy Markdown

@brendanjryan is attempting to deploy a commit to the Wevm Team on Vercel.

A member of the Team first needs to authorize it.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​fast-check/​vitest@​0.4.110010010086100
Addedprool@​0.2.148810010095100
Addedfast-check@​4.9.010010010089100

View full report

@pkg-pr-new

pkg-pr-new Bot commented Aug 6, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/viem@4978

commit: 9ff0ef5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant