Skip to content

chore: removes LogicalOrWrapperEnforcer decoding for payee rule#8709

Merged
mj-kiwi merged 2 commits intofeat/payee-rulefrom
feat/payee-rule-remove-logical-or
May 5, 2026
Merged

chore: removes LogicalOrWrapperEnforcer decoding for payee rule#8709
mj-kiwi merged 2 commits intofeat/payee-rulefrom
feat/payee-rule-remove-logical-or

Conversation

@jeffsmale90
Copy link
Copy Markdown
Contributor

@jeffsmale90 jeffsmale90 commented May 5, 2026

Explanation

Updates permission decoding logic, disallowing multiple payee addresses for erc20 token type permissions.

The LogicalOrEnforcer implementation requires the caveatGroupIndex to be passed as an argument at redemption time. This means that the enforcer is not EIP-7710 compliant - the redeemer must be able to decode, and understand the permissionContext.

This PR removes LogicalOrEnforcer decoding logic, and allows only a single payee address to be specified via the AllowedCalldataEnforcer.

References

MetaMask/snap-7715-permissions#313

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Changes permission decoding semantics for payee rules (removing multi-payee support and tightening caveat validation), which could affect clients relying on previously accepted caveat shapes. Risk is mitigated by updated unit tests covering new acceptance/rejection cases.

Overview
Updates gator-permissions-controller permission decoding to remove LogicalOrWrapperEnforcer support when extracting payee rules, effectively limiting ERC-20 payee decoding to a single address via AllowedCalldataEnforcer and simplifying payee rule documentation.

makePermissionRule now enforces stricter payee caveat rules (e.g., rejects multiple single-payee caveats and disallows configuring the single-payee enforcer as required) and temporarily suppresses emitting payee rules for erc20-token-revocation. Tests are rewritten/added to reflect the new decoding behavior and error messages, and LogicalOrWrapperEnforcer is removed from enforcer/type plumbing.

Reviewed by Cursor Bugbot for commit b1369e5. Bugbot is set up for automated code reviews on this repo. Configure here.

@jeffsmale90 jeffsmale90 requested a review from a team as a code owner May 5, 2026 22:33
- Only allow a single allowedCalldata caveat to encode a single payee for erc20 token permissions
- Disallow payee rule decoding for erc20-token-revocation
- Removes tests related to logical OR enforcer, but does not add any additional coverage
@jeffsmale90 jeffsmale90 force-pushed the feat/payee-rule-remove-logical-or branch from 80c7922 to b1369e5 Compare May 5, 2026 22:35
Copy link
Copy Markdown
Contributor

@mj-kiwi mj-kiwi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mj-kiwi mj-kiwi merged commit 7758013 into feat/payee-rule May 5, 2026
363 of 368 checks passed
@mj-kiwi mj-kiwi deleted the feat/payee-rule-remove-logical-or branch May 5, 2026 22:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants