hashmesan / harmony-totp

SmartVault is a smart contract wallet designed with worry-free recovery using your Google Authenticator (no worry about secret, key phrases, device loss, email phishing, sms hijacking), and with many advanced wallet features.
https://sefwallet.one
21 stars 18 forks source link

Add guardian sessions with payment limit enforcement #60

Closed hashmesan closed 3 years ago

hashmesan commented 3 years ago

Motivation

Add session feature (like a sudo / super user mode) when user wants unrestricted access to their account for a period of time. This simplifies the need to approve a bunch of individual transactions.

Design

createSession(duration) clearSession() multiCallWithSession([txs]) -- allows unrestricted access

hashmesan commented 3 years ago

Notes from recent changes

In addition to feature, we are hitting ceiling of bytecode very often so a lot of these changes are motivated to reduce size.

  1. Removed unneeded imports
  2. Shortened various messages to save bytecode
  3. Moved dailyLimit into struct to allow for Session struct variable
  4. Removed redudant onlyModule which is same as onlySelf
  5. Moved onlyValidTOTP to Recovery module to save bytecode
  6. isRestrictedMethod is used in 2 place, saved good size.
  7. getRequiredSignatures: no guardian is unrestricted, with guardian restricted to session, and multiCallWithSession
  8. multiCall needs to enforce limits in guardian mode, and block restricted methods
  9. multiCallWithSession, no restrictions
  10. startSession
  11. setDailyLimit and setDrainAddress and upgradeMasterCopy can only be called by itself (via multicall)
  12. removed cancel/isrecovering, finalze, which are old delayed recovery methods
  13. invoke and functionPrefix moved to library to save bytecode

MetaTX:

  1. Handle of session signature, verify expiration, and signing address to be owner (future may allow others to call it)
  2. functionPrefix, and invoke

Test cases

  1. Introduced commons.executeMetaTx for better reusability and readability
  2. Daily limit test now tests for guardian and no guardian daily limit set, enforcement.
  3. Daily Limit test also validate security of how startSession, and multiCalLSession can be called.