fix: use dynamic typehash with raw userOpHashes for smart session signatures

Author: fichiokaku

src/modules/quotes/constants.ts

@@ -1,3 +1,5 @@
+import { keccak256, toHex } from "viem";
+
 export enum MeeSignatureType {
   OFF_CHAIN = "0x177eee00",
   ON_CHAIN = "0x177eee01",
@@ -42,3 +44,25 @@ export const SUPERTX_MEEUSEROP_STRUCT_TYPEHASH =
 // keccak256("MeeUserOp(bytes32 userOpHash,uint256 lowerBoundTimestamp,uint256 upperBoundTimestamp)");
 export const MEE_USER_OP_TYPEHASH =
   "0x15a3822da13714219f4ba907e3daf8f006f6903616b4e7918e84eb2b8faf733d";
+
+/**
+ * Builds a dynamic SuperTx typehash for smart sessions.
+ *
+ * Smart sessions go through validateSignatureForOwner which receives the raw
+ * userOpHash from SmartSession (no timestamp wrapping). Using the MeeUserOp[]
+ * array typehash would cause compareAndGetFinalHash to fail because:
+ *   raw userOpHash ≠ keccak256(MEE_USER_OP_TYPEHASH || userOpHash || lower || upper)
+ *
+ * Instead we build a generic struct typehash with plain bytes32 fields:
+ *   "SuperTx(bytes32 op0,bytes32 op1,...,bytes32 opN)"
+ *
+ * This takes the `else` branch in HashLib.compareAndGetFinalHash which does:
+ *   structHash = keccak256(abi.encodePacked(outerTypeHash, itemHashes))
+ */
+export function buildSessionSuperTxTypeHash(opCount: number): `0x${string}` {
+  const fields = Array.from(
+    { length: opCount },
+    (_, i) => `bytes32 op${i}`,
+  ).join(",");
+  return keccak256(toHex(`SuperTx(${fields})`));
+}

src/modules/quotes/quotes.service.ts

@@ -68,6 +68,7 @@ import {
   MEE_SIGNATURE_TYPE_OFFSET,
   MeeSignatureType,
   SUPERTX_MEEUSEROP_STRUCT_TYPEHASH,
+  buildSessionSuperTxTypeHash,
 } from "./constants";
 import {
   type ExecuteQuoteOptions,
@@ -858,6 +859,20 @@ export class QuotesService {
       ({ meeUserOpHash }) => meeUserOpHash,
     );
 
+    // For smart sessions: use raw userOpHashes (without timestamp wrapping).
+    // The SmartSession module passes raw userOpHash to validateSignatureForOwner,
+    // so itemHashes must contain raw hashes to match at HashLib.compareAndGetFinalHash.
+    const sessionItemHashes = packedMeeUserOps.map(
+      ({ userOpHash }) => userOpHash,
+    );
+    const sessionSuperTxTypeHash = isSessionExists
+      ? buildSessionSuperTxTypeHash(
+          isEIP712TrustedSponsorshipSupported && isTrustedSponsorship
+            ? sessionItemHashes.length - 1
+            : sessionItemHashes.length,
+        )
+      : undefined;
+
     const signedPackedMeeUserOps: SignedPackedMeeUserOp[] =
       packedMeeUserOps.map((packedMeeUserOp, index) => {
         const { lowerBoundTimestamp, upperBoundTimestamp, userOp } =
@@ -894,28 +909,29 @@ export class QuotesService {
           case "simple": {
             if (isSessionExists) {
               if (isEIP712SupportedMeeVersion) {
+                // Smart sessions: use dynamic generic typehash with raw userOpHashes.
+                // validateSignatureForOwner receives raw userOpHash from SmartSession,
+                // so we must use raw hashes (not MeeUserOp EIP-712 hashes with timestamps).
+                const sessionHashes =
+                  isEIP712TrustedSponsorshipSupported && isTrustedSponsorship
+                    ? sessionItemHashes.slice(1)
+                    : sessionItemHashes;
                 signature = concatHex([
                   signatureType, // Simple signature type
                   encodeAbiParameters(
                     [
-                      { type: "bytes32" }, // stxStructTypeHash
+                      { type: "bytes32" }, // stxStructTypeHash (dynamic, session-specific)
                       { type: "uint256" }, // userOp index
-                      { type: "bytes32[]" }, // meeUserOpHashes - array of hashes
+                      { type: "bytes32[]" }, // raw userOpHashes
                       { type: "bytes" }, // superTxSignature
                     ],
                     [
-                      SUPERTX_MEEUSEROP_STRUCT_TYPEHASH,
-                      // For trusted sponsorship, as we're ignoring the payment userOp, index should be sub by 1 to account for that
-                      // The index will be always greater than 1 if its sponsorship mode so sub by 1 is not a problem
+                      sessionSuperTxTypeHash!,
                       isEIP712TrustedSponsorshipSupported &&
                       isTrustedSponsorship
                         ? BigInt(index - 1)
                         : BigInt(index),
-                      // If it is a trusted sponsorship, the payment userop can be skipped because it is not going to be executed at all.
-                      isEIP712TrustedSponsorshipSupported &&
-                      isTrustedSponsorship
-                        ? meeUserOpHashes.slice(1)
-                        : meeUserOpHashes,
+                      sessionHashes,
                       signatureData,
                     ],
                   ),

src/modules/simulator/simulation.service.ts

@@ -63,7 +63,10 @@ import {
 import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
 import { multicall } from "viem/actions";
 // Don't import this from "@quotes" alone, it is causing the circular dependency issue
-import { SUPERTX_MEEUSEROP_STRUCT_TYPEHASH } from "../quotes/constants";
+import {
+  SUPERTX_MEEUSEROP_STRUCT_TYPEHASH,
+  buildSessionSuperTxTypeHash,
+} from "../quotes/constants";
 import {
   type CustomOverride,
   type EIP712DomainReturn,
@@ -106,6 +109,7 @@ export class SimulationService {
       sessionDetails: GrantPermissionResponseType;
       smartSessionMode: "ENABLE_AND_USE" | "USE";
     },
+    rawUserOpHashes?: Hex[],
   ) {
     // For trusted sponsorship, as we're ignoring the payment userOp, index should be sub by 1 to account for that
     // for all the userOps except the payment userOp itself
@@ -121,20 +125,29 @@ export class SimulationService {
       "0xcae0d1955b99d4832aef73ed0a2237045fad91a738ee5b96ba76b9a12ffc6f824ab2ecaeeeb903b50704fdf4a5d64216adf7d6aaaca0ed2a67b86d8525c4b4bb1c" as Hex;
 
     if (sessionInfo?.sessionDetails) {
+      // Smart sessions: use dynamic generic typehash with raw userOpHashes.
+      // validateSignatureForOwner receives raw userOpHash from SmartSession,
+      // so we must use raw hashes (not MeeUserOp EIP-712 hashes with timestamps).
+      const sessionHashes = rawUserOpHashes
+        ? (isTrustedSponsorship ? rawUserOpHashes.slice(1) : rawUserOpHashes)
+        : (isTrustedSponsorship ? meeUserOpHashes.slice(1) : meeUserOpHashes);
+      const sessionTypeHash = rawUserOpHashes
+        ? buildSessionSuperTxTypeHash(sessionHashes.length)
+        : SUPERTX_MEEUSEROP_STRUCT_TYPEHASH;
+
       const dummySignature = concatHex([
         "0x177eee00", // Simple signature type
         encodeAbiParameters(
           [
-            { type: "bytes32" }, // stxStructTypeHash
+            { type: "bytes32" }, // stxStructTypeHash (dynamic, session-specific)
             { type: "uint256" }, // userOp index
-            { type: "bytes32[]" }, // meeUserOpHashes - array of hashes
+            { type: "bytes32[]" }, // raw userOpHashes
             { type: "bytes" }, // superTxSignature
           ],
           [
-            SUPERTX_MEEUSEROP_STRUCT_TYPEHASH,
+            sessionTypeHash,
             BigInt(index),
-            // If it is a trusted sponsorship, the payment userop can be skipped because it is not going to be executed at all.
-            isTrustedSponsorship ? meeUserOpHashes.slice(1) : meeUserOpHashes,
+            sessionHashes,
             dummyStxSig,
           ],
         ),
@@ -537,6 +550,7 @@ export class SimulationService {
     const upperBoundTimestamp = Math.floor(Date.now() / 1000) + 300; // 5 mins
 
     const meeUserOpHashes: Hex[] = [];
+    const rawUserOpHashes: Hex[] = [];
 
     for (const {
       packedUserOp,
@@ -558,6 +572,8 @@ export class SimulationService {
         { generateRandomHash: isTrustedPaymentUserOp },
       );
 
+      rawUserOpHashes.push(userOpHash);
+
       const meeUserOpHash = getMeeUserOpHashEip712(
         userOpHash,
         lowerBoundTimestamp,
@@ -660,6 +676,7 @@ export class SimulationService {
             isTrustedSponsorship,
             userOpIndex,
             sessionDetails ? { sessionDetails, smartSessionMode } : undefined,
+            sessionDetails ? rawUserOpHashes : undefined,
           );
         }