safe-magnetar/contracts/SafeMagnetarCoSigner.sol

// SPDX-License-Identifier: GPL-3.0-only
pragma solidity =0.8.29;

import {Magnetar} from "./Magnetar.sol";
import {ISafe} from "./interfaces/ISafe.sol";
import {IERC165, ISafeTransactionGuard} from "./interfaces/ISafeTransactionGuard.sol";

/// @title Safe Magnetar Co-Signer
/// @notice A Safe transaction guard that additionally requires every Safe
/// transaction to be co-signed by a committed Magnetar MPC-threshold SLH-DSA
/// key. Add it with `setGuard`; thereafter `execTransaction` reverts unless the
/// appended Magnetar co-signature verifies over the Safe-tx hash.
///
/// @dev DECOMPLECTION: the guard enforces ONE policy — "a valid Magnetar
/// co-signature for this owner's key must be present". The cryptographic verify
/// is delegated wholly to {Magnetar}.
///
/// CO-SIGNATURE LAYOUT. The Magnetar signature is variable length, so it is
/// appended to the Safe `signatures` bytes as a self-describing, ABI-encoded
/// `(bytes pubkey, bytes magnetarSignature)` tuple whose total length is
/// `coSignatureLength`. The guard slices exactly the trailing
/// `coSignatureLength` bytes and `abi.decode`s them, failing closed on a
/// malformed tail before any precompile call.
contract SafeMagnetarCoSigner is ISafeTransactionGuard {
    /// @notice The Magnetar parameter-set byte this co-signer verifies under.
    uint8 private immutable _MODE;
    /// @notice keccak256 of the committed Magnetar group public key.
    bytes32 private immutable _PUBKEY_HASH;
    /// @notice The exact byte length of the appended co-signature tuple.
    uint256 private immutable _COSIG_LEN;

    /// @notice The transaction was not co-signed by the committed Magnetar key.
    error Unauthorized();
    /// @notice The mode is not a recognised Magnetar parameter set.
    error InvalidMode();
    /// @notice The supplied public key length is wrong for the mode.
    error InvalidPublicKey();

    /// @param mode The Magnetar parameter-set byte (FIPS 205 parameter set).
    /// @param pubkey The full FIPS 205 group public key to bind this co-signer to.
    constructor(uint8 mode, bytes memory pubkey) {
        require(Magnetar.isValidMode(mode), InvalidMode());
        (uint256 pkLen, uint256 sigLen) = Magnetar.sizes(mode);
        require(pubkey.length == pkLen, InvalidPublicKey());
        _MODE = mode;
        _PUBKEY_HASH = keccak256(pubkey);
        _COSIG_LEN = 0x40 + 0x20 + _ceil32(pkLen) + 0x20 + _ceil32(sigLen);
    }

    /// @inheritdoc IERC165
    function supportsInterface(bytes4 interfaceId) external view virtual override returns (bool) {
        return interfaceId == type(ISafeTransactionGuard).interfaceId || interfaceId == type(IERC165).interfaceId;
    }

    /// @notice The expected length of the appended Magnetar co-signature tuple.
    function coSignatureLength() external view returns (uint256) {
        return _COSIG_LEN;
    }

    /// @inheritdoc ISafeTransactionGuard
    function checkTransaction(
        address to,
        uint256 value,
        bytes calldata data,
        uint8 operation,
        uint256 safeTxGas,
        uint256 baseGas,
        uint256 gasPrice,
        address gasToken,
        address payable refundReceiver,
        bytes calldata signatures,
        address
    ) external view {
        bytes32 safeTxHash;
        unchecked {
            uint256 nonce = ISafe(msg.sender).nonce() - 1;
            safeTxHash = ISafe(msg.sender).getTransactionHash(
                to, value, data, operation, safeTxGas, baseGas, gasPrice, gasToken, refundReceiver, nonce
            );
        }

        require(signatures.length >= _COSIG_LEN, Unauthorized());
        bytes calldata coSignature = signatures[signatures.length - _COSIG_LEN:];
        (bytes memory pubkey, bytes memory magnetarSignature) = abi.decode(coSignature, (bytes, bytes));

        require(keccak256(pubkey) == _PUBKEY_HASH, Unauthorized());
        require(Magnetar.verify(safeTxHash, _MODE, pubkey, magnetarSignature), Unauthorized());
    }

    /// @inheritdoc ISafeTransactionGuard
    function checkAfterExecution(bytes32, bool) external pure {}

    /// @notice Rounds `n` up to the next 32-byte boundary.
    function _ceil32(uint256 n) private pure returns (uint256) {
        return (n + 31) & ~uint256(31);
    }
}