account-abstraction
starsforks
How to install account-abstraction?
keep-starknet-strange/starknet-agentic/account-abstraction
$npx -y skills add keep-starknet-strange/starknet-agentic --skill account-abstractionStarknet account abstraction correctness and security guidance for validate/execute paths, nonces, signatures, and session policies.
SKILL.md
| 1 | # Account Abstraction |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - Reviewing account contract validation and execution paths. |
| 6 | - Designing session-key policy boundaries. |
| 7 | - Validating nonce and signature semantics. |
| 8 | |
| 9 | ## When NOT to Use |
| 10 | |
| 11 | - General contract authoring not involving account semantics. |
| 12 | |
| 13 | ## Quick Start |
| 14 | |
| 15 | 1. Confirm `__validate__` enforces lightweight, bounded checks. |
| 16 | 2. Confirm `__execute__` enforces policy and selector boundaries. |
| 17 | 3. Verify replay protections (nonce/domain separation) for all signature paths. |
| 18 | 4. Add regression tests for each fixed session-key or policy finding. |
| 19 | 5. Run `cairo-auditor` for final AA/security pass before merge. |
| 20 | |
| 21 | ## Core Focus |
| 22 | |
| 23 | - `__validate__` constraints and DoS resistance. |
| 24 | - `__execute__` policy enforcement correctness. |
| 25 | - Replay protection and domain separation. |
| 26 | - Privileged selector and self-call protection. |
| 27 | |
| 28 | ## Workflow |
| 29 | |
| 30 | - Main account-abstraction workflow: [default workflow](workflows/default.md) |
| 31 | |
| 32 | ## References |
| 33 | |
| 34 | - Module index: [references index](references/README.md) |
| 35 | |
| 36 | ## starknet.js Example |
| 37 | |
| 38 | ```ts |
| 39 | import { Account, CallData, RpcProvider } from "starknet"; |
| 40 | |
| 41 | const provider = new RpcProvider({ nodeUrl: process.env.STARKNET_RPC! }); |
| 42 | const account = new Account(provider, process.env.ACCOUNT_ADDRESS!, process.env.PRIVATE_KEY!); |
| 43 | |
| 44 | // Validate preview (debug-only): inspect __validate__ behavior with the current nonce. |
| 45 | const nonce = await account.getNonce(); |
| 46 | const call = { contractAddress: process.env.TARGET!, entrypoint: "set_limit", calldata: CallData.compile({ value: 7 }) }; |
| 47 | await provider.callContract({ |
| 48 | contractAddress: account.address, |
| 49 | entrypoint: "__validate__", |
| 50 | calldata: CallData.compile({ calls: [call], nonce }), |
| 51 | }); |
| 52 | |
| 53 | // Execute path: real transaction that triggers __execute__ and nonce checks. |
| 54 | const tx = await account.execute([call]); |
| 55 | await provider.waitForTransaction(tx.transaction_hash); |
| 56 | ``` |
| 57 | |
| 58 | ## Error Codes and Recovery |
| 59 | |
| 60 | | Code | Condition | Recovery | |
| 61 | | --- | --- | --- | |
| 62 | | `AA-001` | `__validate__` is too expensive or stateful | Remove heavy logic from validation; add a test that caps validation steps. | |
| 63 | | `AA-002` | `__execute__` allows blocked selectors/self-calls | Enforce selector filters and self-call checks; add authorized/unauthorized regression tests. | |
| 64 | | `AA-003` | Nonce or domain mismatch causes replay risk | Normalize nonce source/hash domain; add replay and cross-domain tests. | |
| 65 | | `AA-999` | Unexpected runtime panic | Capture calldata + caller context, reproduce in unit tests, then escalate to `cairo-auditor`. | |
People who liked this also viewed
6 picksType
- remotion-to-hyperframesPort an existing Remotion (React) composition''s source to HyperFrames HTML. Use ONLY on an explicit ask to port/convert/migrate/translate a Remotion source — one-way, Remotion-only. A passing RemotioSkillsJul 2026
- solana-devUse when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet connection", "test my Solana program", "deploy to devnet", or "explain SSkillsJul 2026
- grimoire-polymarketQueries Polymarket market data and CLOB state, and manages CLOB orders via the Grimoire venue CLI wrapper backed by the official Polymarket CLI.SkillsMay 2026
- shopify-storefront-graphqlUse for custom storefronts requiring direct GraphQL queries/mutations for data fetching and cart operations. Choose this when you need full control over data fetching and rendering your own UI. NOT foSkillsJul 2026
- agentic-walletCrypto wallet operations via the awal CLI — sign in, check balances, send USDC/ETH/POL/SOL, trade tokens, fund the wallet, and use the x402 payment protocol to discover paid services, pay for API callSkillsJun 2026
- quicknode-skillQuicknode blockchain infrastructure for 80+ chains: Core RPC API, Streams, Webhooks, Blazar WSS, Solana gRPC, HyperCore gRPC, SQL Explorer, Metaplex DAS API, Blockbook, Ordinals & Runes API, Swap API,SkillsJul 2026
