Add Protocol 27 (CAP-71) Soroban authorization support#150
Merged
Conversation
Update XDR to stellar-xdr 55a00d9 (#147) and add the SDK-level Protocol 27 changes (#149): - New SorobanCredentials arms ADDRESS_V2 and ADDRESS_WITH_DELEGATES with recursive SorobanDelegateSignature trees and the address-bound ENVELOPE_TYPE_SOROBAN_AUTHORIZATION_WITH_ADDRESS preimage; wrapper layer round-trips all four arms (fromXdr/toXdr/fromTxRep) with fail-fast on unknown arms - Arm-aware signing through a single preimage builder: buildPreimage, SorobanAuthorizationEntry.sign with forAddress routing into delegate nodes, and the withDelegates tree builder (XDR-byte sort, duplicate rejection) - Opt-in authV2 flag on SimulateTransactionRequest and MethodOptions (key omitted when false; old RPCs silently ignore it and return legacy entries) - AssembledTransaction, OpenZeppelin smart-account flows, and SEP-45 handle all credential arms; delegates-only entries pass the send precheck - Bounded recursive XDR decode (depth 128) to prevent stack exhaustion from hostile delegate trees, with fail-closed caps on the tree-walk helpers - TxRep support and tests for the new types; new unit tests incl. byte-exact golden vectors and a testnet integration test that activates on Protocol 27 - Documentation, agent skill, and changelog updates Legacy ADDRESS remains the default and fully valid; the new arms are opt-in and only valid on Protocol 27+.
The authorizeEntryDelegate callback was applied to every auth entry rather than only those the signer is responsible for, so in multi-party flows the delegate overwrote an entry already signed by another party, invalidating that authorization. Gate the delegate handoff on the signer-address match, as the direct-signing path already does. Also strengthen the Protocol 27 auth unit tests: add a multi-party regression test, correct tests that pinned the previous behavior, replace weak assertions with exact checks, and remove no-op skip guards.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #150 +/- ##
==========================================
+ Coverage 89.42% 90.03% +0.60%
==========================================
Files 662 665 +3
Lines 33301 33825 +524
==========================================
+ Hits 29780 30453 +673
+ Misses 3521 3372 -149
🚀 New features to boost your workflow:
|
This was referenced Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Protocol 27 (CAP-71) support: the new Soroban authorization credential types and delegated account authorization. All additions are additive and opt-in; the legacy
SOROBAN_CREDENTIALS_ADDRESScredential remains the default and fully valid.XDR
ADDRESS_V2andADDRESS_WITH_DELEGATESarms onSorobanCredentials, the recursiveSorobanDelegateSignature, andSorobanAddressCredentialsWithDelegates.ENVELOPE_TYPE_SOROBAN_AUTHORIZATION_WITH_ADDRESSpreimage, which binds the signature payload to the top-level credential address.Authorization
SorobanCredentials.forAddressV2,SorobanCredentials.forAddressWithDelegates, and theinnerAddressCredentialsgetter for arm-agnostic access to the inner credentials.SorobanAuthorizationEntry.withDelegatesbuilder,SorobanDelegateDescriptor, andSorobanAuthorizationEntry.buildPreimage. Delegate arrays are sorted by XDR-encoded address bytes and within-array duplicates are rejected.SorobanAuthorizationEntry.signgains aforAddressparameter that routes a signature into matching top-level or delegate nodes.signAuthEntriesandneedsNonInvokerSigningByhandle all credential arms;needsNonInvokerSigningByreports every unsigned delegate node, and a delegates-only entry passes the send precheck with a void top-level signature.Hardening
Defaults and protocol gating
ADDRESSarm remains the default and stays valid on all protocol versions; the new arms are opt-in and only valid on Protocol 27+.Source compatibility
SorobanCredentials,XdrSorobanCredentialsType,XdrEnvelopeType, andXdrHashIDPreimagegain new cases, so code that branches on the credential arm should add handling for them.