Support EIP-7702 Delegations in Forge

crates/cheatcodes/spec/src/vm.rs

@@ -308,6 +308,22 @@ interface Vm {
         bool success;
     }
 
+    /// Holds a signed EIP-7702 authorization for an authority account to delegate to an implementation.    
+    struct SignedDelegation {
+        /// The y-parity of the recovered secp256k1 signature (0 or 1).
+        uint8 v;
+        /// First 32 bytes of the signature.
+        bytes32 r;
+        /// Second 32 bytes of the signature.
+        bytes32 s;
+        /// The current nonce of the authority account at signing time.
+        /// Used to ensure signature can't be replayed after account nonce changes.
+        uint64 nonce;
+        /// Address of the contract implementation that will be delegated to.
+        /// Gets encoded into delegation code: 0xef0100 || implementation.
+        address implementation;
+    }
+
     // ======== EVM ========
 
     /// Gets the address for a given private key.
@@ -2002,6 +2018,18 @@ interface Vm {
     #[cheatcode(group = Scripting)]
     function broadcastRawTransaction(bytes calldata data) external;
 
+    /// Sign an EIP-7702 authorization for delegation
+    #[cheatcode(group = Scripting)]
+    function signDelegation(address implementation, uint256 privateKey) external returns (SignedDelegation memory signedDelegation);
+
+    /// Designate the next call as an EIP-7702 transaction
+    #[cheatcode(group = Scripting)]
+    function attachDelegation(SignedDelegation memory signedDelegation) external;
+
+    /// Sign an EIP-7702 authorization and designate the next call as an EIP-7702 transaction
+    #[cheatcode(group = Scripting)]
+    function signAndAttachDelegation(address implementation, uint256 privateKey) external returns (SignedDelegation memory signedDelegation);
+
     /// Returns addresses of available unlocked wallets in the script environment.
     #[cheatcode(group = Scripting)]
     function getWallets() external returns (address[] memory wallets);

crates/cheatcodes/src/inspector.rs

@@ -46,7 +46,10 @@ use revm::{
         EOFCreateInputs, EOFCreateKind, Gas, InstructionResult, Interpreter, InterpreterAction,
         InterpreterResult,
     },
-    primitives::{BlockEnv, CreateScheme, EVMError, EvmStorageSlot, SpecId, EOF_MAGIC_BYTES},
+    primitives::{
+        BlockEnv, CreateScheme, EVMError, EvmStorageSlot, SignedAuthorization, SpecId,
+        EOF_MAGIC_BYTES,
+    },
     EvmContext, InnerEvmContext, Inspector,
 };
 use serde_json::Value;
@@ -373,6 +376,11 @@ pub struct Cheatcodes {
     /// execution block environment.
     pub block: Option<BlockEnv>,
 
+    /// Currently active EIP-7702 delegation that will be consumed when building the next
+    /// transaction. Set by `vm.attachDelegation()` and consumed via `.take()` during
+    /// transaction construction.
+    pub active_delegation: Option<SignedAuthorization>,
+
     /// The gas price.
     ///
     /// Used in the cheatcode handler to overwrite the gas price separately from the gas price
@@ -497,6 +505,7 @@ impl Cheatcodes {
             labels: config.labels.clone(),
             config,
             block: Default::default(),
+            active_delegation: Default::default(),
             gas_price: Default::default(),
             prank: Default::default(),
             expected_revert: Default::default(),
@@ -1001,18 +1010,26 @@ where {
                     let account =
                         ecx.journaled_state.state().get_mut(&broadcast.new_origin).unwrap();
 
+                    let mut tx_req = TransactionRequest {
+                        from: Some(broadcast.new_origin),
+                        to: Some(TxKind::from(Some(call.target_address))),
+                        value: call.transfer_value(),
+                        input: TransactionInput::new(call.input.clone()),
+                        nonce: Some(account.info.nonce),
+                        chain_id: Some(ecx.env.cfg.chain_id),
+                        gas: if is_fixed_gas_limit { Some(call.gas_limit) } else { None },
+                        ..Default::default()
+                    };
+
+                    if let Some(auth_list) = self.active_delegation.take() {
+                        tx_req.authorization_list = Some(vec![auth_list]);
+                    } else {
+                        tx_req.authorization_list = None;
+                    }
+
                     self.broadcastable_transactions.push_back(BroadcastableTransaction {
                         rpc: ecx.db.active_fork_url(),
-                        transaction: TransactionRequest {
-                            from: Some(broadcast.new_origin),
-                            to: Some(TxKind::from(Some(call.target_address))),
-                            value: call.transfer_value(),
-                            input: TransactionInput::new(call.input.clone()),
-                            nonce: Some(account.info.nonce),
-                            gas: if is_fixed_gas_limit { Some(call.gas_limit) } else { None },
-                            ..Default::default()
-                        }
-                        .into(),
+                        transaction: tx_req.into(),
                     });
                     debug!(target: "cheatcodes", tx=?self.broadcastable_transactions.back().unwrap(), "broadcastable call");
 

crates/cheatcodes/src/script.rs

@@ -2,10 +2,13 @@
 
 use crate::{Cheatcode, CheatsCtxt, Result, Vm::*};
 use alloy_primitives::{Address, B256, U256};
+use alloy_rpc_types::Authorization;
+use alloy_signer::{Signature, SignerSync};
 use alloy_signer_local::PrivateKeySigner;
 use alloy_sol_types::SolValue;
 use foundry_wallets::{multi_wallet::MultiWallet, WalletSigner};
 use parking_lot::Mutex;
+use revm::primitives::{Bytecode, SignedAuthorization};
 use std::sync::Arc;
 
 impl Cheatcode for broadcast_0Call {
@@ -29,6 +32,92 @@ impl Cheatcode for broadcast_2Call {
     }
 }
 
+impl Cheatcode for attachDelegationCall {
+    fn apply_stateful(&self, ccx: &mut CheatsCtxt) -> Result {
+        let Self { signedDelegation } = self;
+        let SignedDelegation { v, r, s, nonce, implementation } = signedDelegation;
+
+        let auth = Authorization {
+            address: *implementation,
+            nonce: *nonce,
+            chain_id: ccx.ecx.env.cfg.chain_id,
+        };
+        let signed_auth = SignedAuthorization::new_unchecked(
+            auth,
+            *v,
+            U256::from_be_bytes(r.0),
+            U256::from_be_bytes(s.0),
+        );
+        write_delegation(ccx, signed_auth.clone())?;
+        ccx.state.active_delegation = Some(signed_auth);
+        Ok(Default::default())
+    }
+}
+
+impl Cheatcode for signDelegationCall {
+    fn apply_stateful(&self, ccx: &mut CheatsCtxt) -> Result {
+        let Self { implementation, privateKey } = self;
+        let signer = PrivateKeySigner::from_bytes(&B256::from(*privateKey))?;
+        let authority = signer.address();
+        let (auth, nonce) = create_auth(ccx, *implementation, authority)?;
+        let sig = signer.sign_hash_sync(&auth.signature_hash())?;
+        Ok(sig_to_delegation(sig, nonce, *implementation).abi_encode())
+    }
+}
+
+impl Cheatcode for signAndAttachDelegationCall {
+    fn apply_stateful(&self, ccx: &mut CheatsCtxt) -> Result {
+        let Self { implementation, privateKey } = self;
+        let signer = PrivateKeySigner::from_bytes(&B256::from(*privateKey))?;
+        let authority = signer.address();
+        let (auth, nonce) = create_auth(ccx, *implementation, authority)?;
+        let sig = signer.sign_hash_sync(&auth.signature_hash())?;
+        let signed_auth = sig_to_auth(sig, auth);
+        write_delegation(ccx, signed_auth.clone())?;
+        ccx.state.active_delegation = Some(signed_auth);
+        Ok(sig_to_delegation(sig, nonce, *implementation).abi_encode())
+    }
+}
+
+fn create_auth(
+    ccx: &mut CheatsCtxt,
+    implementation: Address,
+    authority: Address,
+) -> Result<(Authorization, u64)> {
+    let authority_acc = ccx.ecx.journaled_state.load_account(authority, &mut ccx.ecx.db)?;
+    let nonce = authority_acc.data.info.nonce;
+    Ok((
+        Authorization { address: implementation, nonce, chain_id: ccx.ecx.env.cfg.chain_id },
+        nonce,
+    ))
+}
+
+fn write_delegation(ccx: &mut CheatsCtxt, auth: SignedAuthorization) -> Result<()> {
+    let authority = auth.recover_authority().map_err(|e| format!("{e}"))?;
+    let authority_acc = ccx.ecx.journaled_state.load_account(authority, &mut ccx.ecx.db)?;
+    if authority_acc.data.info.nonce != auth.nonce {
+        return Err("invalid nonce".into());
+    }
+    authority_acc.data.info.nonce += 1;
+    let bytecode = Bytecode::new_eip7702(*auth.address());
+    ccx.ecx.journaled_state.set_code(authority, bytecode);
+    Ok(())
+}
+
+fn sig_to_delegation(sig: Signature, nonce: u64, implementation: Address) -> SignedDelegation {
+    SignedDelegation {
+        v: sig.v().y_parity() as u8,
+        r: sig.r().into(),
+        s: sig.s().into(),
+        nonce,
+        implementation,
+    }
+}
+
+fn sig_to_auth(sig: Signature, auth: Authorization) -> SignedAuthorization {
+    SignedAuthorization::new_unchecked(auth, sig.v().y_parity() as u8, sig.r(), sig.s())
+}
+
 impl Cheatcode for startBroadcast_0Call {
     fn apply_stateful(&self, ccx: &mut CheatsCtxt) -> Result {
         let Self {} = self;

crates/common/Cargo.toml

@@ -20,6 +20,7 @@ foundry-config.workspace = true
 
 alloy-contract.workspace = true
 alloy-dyn-abi = { workspace = true, features = ["arbitrary", "eip712"] }
+alloy-eips.workspace = true
 alloy-json-abi.workspace = true
 alloy-json-rpc.workspace = true
 alloy-primitives = { workspace = true, features = [

crates/common/src/transactions.rs

@@ -1,6 +1,7 @@
 //! Wrappers for transactions.
 
 use alloy_consensus::{Transaction, TxEnvelope};
+use alloy_eips::eip7702::SignedAuthorization;
 use alloy_primitives::{Address, TxKind, U256};
 use alloy_provider::{
     network::{AnyNetwork, ReceiptResponse, TransactionBuilder},
@@ -226,6 +227,14 @@ impl TransactionMaybeSigned {
             Self::Unsigned(tx) => tx.nonce,
         }
     }
+
+    pub fn authorization_list(&self) -> Option<Vec<SignedAuthorization>> {
+        match self {
+            Self::Signed { tx, .. } => tx.authorization_list().map(|auths| auths.to_vec()),
+            Self::Unsigned(tx) => tx.authorization_list.as_deref().map(|auths| auths.to_vec()),
+        }
+        .filter(|auths| !auths.is_empty())
+    }
 }
 
 impl From<TransactionRequest> for TransactionMaybeSigned {

crates/evm/evm/src/executors/mod.rs

@@ -31,8 +31,8 @@ use revm::{
     db::{DatabaseCommit, DatabaseRef},
     interpreter::{return_ok, InstructionResult},
     primitives::{
-        BlockEnv, Bytecode, Env, EnvWithHandlerCfg, ExecutionResult, Output, ResultAndState,
-        SpecId, TxEnv, TxKind,
+        AuthorizationList, BlockEnv, Bytecode, Env, EnvWithHandlerCfg, ExecutionResult, Output,
+        ResultAndState, SignedAuthorization, SpecId, TxEnv, TxKind,
     },
 };
 use std::borrow::Cow;
@@ -378,6 +378,21 @@ impl Executor {
         self.call_with_env(env)
     }
 
+    /// Performs a raw call to an account on the current state of the VM with an EIP-7702
+    /// authorization list.
+    pub fn call_raw_with_authorization(
+        &mut self,
+        from: Address,
+        to: Address,
+        calldata: Bytes,
+        value: U256,
+        authorization_list: Vec<SignedAuthorization>,
+    ) -> eyre::Result<RawCallResult> {
+        let mut env = self.build_test_env(from, to.into(), calldata, value);
+        env.tx.authorization_list = Some(AuthorizationList::Signed(authorization_list));
+        self.call_with_env(env)
+    }
+
     /// Performs a raw call to an account on the current state of the VM.
     pub fn transact_raw(
         &mut self,