Merge pull request #458 from pimlicolabs/kernerl-webauthn-fix

Kernel webauthn fix

Author: plusminushalf

.changeset/small-hands-mate.md

@@ -0,0 +1,5 @@
+---
+"permissionless": minor
+---
+
+fix: upgraded kernel validator to patch vulnerabile in previous version (was unsafe to use)

.github/workflows/on-pull-request.yml

@@ -16,7 +16,7 @@ jobs:
   docker-e2e:
     name: E2E-Coverage
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 60
 
     steps:
       - name: Checkout

.size-limit.json

@@ -8,6 +8,6 @@
     {
         "name": "permissionless (cjs)",
         "path": "./packages/permissionless/_cjs/index.js",
-        "limit": "280 kB"
+        "limit": "300 kB"
     }
 ]

packages/permissionless-test/mock-aa-infra/alto/constants/accounts/kernel.ts

@@ -751,7 +751,7 @@ export const setupContracts = async (rpc: string) => {
         "0x845ADb2C711129d4f3966735eD98a9F09fC4cE57", // Kernel v0.3.1 ECDSA Validator
         "0xBAC849bB641841b44E965fB01A4Bf5F074f84b4D", // Kernel v0.3.1 Account Logic
         "0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419", // Kernel v0.3.1 Factory
-        "0xbA45a2BFb8De3D24cA9D7F1B551E14dFF5d690Fd", // Kernel v0.3.1 WebAuthn Validator
+        "0x7ab16Ff354AcB328452F1D445b3Ddee9a91e9e69", // Kernel v0.3.1 WebAuthn Validator
         "0xD830D15D3dc0C269F3dBAa0F3e8626d33CFdaBe1", // Kernel v0.3.2 Account Logic
         "0x7a1dBAB750f12a90EB1B60D2Ae3aD17D4D81EfFe", // Kernel v0.3.2 Factory
         "0xd6CEDDe84be40893d153Be9d467CD6aD37875b28", // Kernel v0.3.3 Account Logic

packages/permissionless-test/mock-aa-infra/alto/index.ts

@@ -136,14 +136,14 @@ export const KERNEL_VERSION_TO_ADDRESSES_MAP: {
         ACCOUNT_LOGIC: "0x94F097E1ebEB4ecA3AAE54cabb08905B239A7D27",
         FACTORY_ADDRESS: "0x6723b44Abeec4E71eBE3232BD5B455805baDD22f",
         META_FACTORY_ADDRESS: "0xd703aaE79538628d27099B8c4f621bE4CCd142d5",
-        WEB_AUTHN_VALIDATOR: "0xbA45a2BFb8De3D24cA9D7F1B551E14dFF5d690Fd"
+        WEB_AUTHN_VALIDATOR: "0x7ab16Ff354AcB328452F1D445b3Ddee9a91e9e69"
     },
     "0.3.1": {
         ECDSA_VALIDATOR: "0x845ADb2C711129d4f3966735eD98a9F09fC4cE57",
         ACCOUNT_LOGIC: "0xBAC849bB641841b44E965fB01A4Bf5F074f84b4D",
         FACTORY_ADDRESS: "0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419",
         META_FACTORY_ADDRESS: "0xd703aaE79538628d27099B8c4f621bE4CCd142d5",
-        WEB_AUTHN_VALIDATOR: "0xbA45a2BFb8De3D24cA9D7F1B551E14dFF5d690Fd"
+        WEB_AUTHN_VALIDATOR: "0x7ab16Ff354AcB328452F1D445b3Ddee9a91e9e69"
     },
     "0.3.2": {
         ECDSA_VALIDATOR: "0x845ADb2C711129d4f3966735eD98a9F09fC4cE57",

packages/permissionless/accounts/kernel/toKernelSmartAccount.ts

@@ -155,9 +155,15 @@ function KernelSmartAccountDemo() {
         })
         setUserOpHash(hash as Hex)
 
-        const receipt = await smartAccountClient.getCallsStatus({
+        let receipt = await smartAccountClient.getCallsStatus({
             id: hash
         })
+        while (receipt.status === "pending") {
+            await new Promise((resolve) => setTimeout(resolve, 1000))
+            receipt = await smartAccountClient.getCallsStatus({
+                id: hash
+            })
+        }
         setHash(receipt.receipts?.[0].transactionHash)
     }