{"id":19419825,"url":"https://github.com/destiner/module-frame","last_synced_at":"2025-04-14T14:43:52.275Z","repository":{"id":223698423,"uuid":"760482063","full_name":"Destiner/module-frame","owner":"Destiner","description":"FC frames + ERC7579 modules","archived":false,"fork":false,"pushed_at":"2024-02-28T11:41:54.000Z","size":184,"stargazers_count":6,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-28T03:41:25.480Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Solidity","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Destiner.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-20T14:00:40.000Z","updated_at":"2024-06-14T17:07:59.000Z","dependencies_parsed_at":"2024-02-21T16:45:39.918Z","dependency_job_id":"2beda3b9-d908-4d63-88f1-6bd142caf9f3","html_url":"https://github.com/Destiner/module-frame","commit_stats":null,"previous_names":["destiner/module-frame"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Destiner%2Fmodule-frame","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Destiner%2Fmodule-frame/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Destiner%2Fmodule-frame/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Destiner%2Fmodule-frame/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Destiner","download_url":"https://codeload.github.com/Destiner/module-frame/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248898771,"owners_count":21179836,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-10T13:19:15.363Z","updated_at":"2025-04-14T14:43:52.244Z","avatar_url":"https://github.com/Destiner.png","language":"Solidity","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Frame Validator Module\n\nAn ERC7579-compatible validator module to validate UserOps using Farcaster Frame signatures.\n\nCompatible with `Entrypoint 0.6` and `Entrypoint 0.7`.\n\nBuilt using ModuleKit 0.3.0.\n\n\u003e [!WARNING]\n\u003e Not audited, not tested enough, not production-ready\n\n## Usage\n\n### Install dependencies\n\n```shell\npnpm install\n```\n\n### Building the module\n\n```shell\nforge build\n```\n\n### Testing the module\n\n```shell\nforge test\n```\n\n### Deploying the module\n\n\u003e [!NOTE]\n\u003e For security, the module expects the frame URL to be coming from a trusted base URL. For a custom deployment, you can provide your own URL using the `BASE_URL` variable.\n\nCreate the `.env` file and provide the environment variables.\n\n```shell\nsource .env \u0026\u0026 forge script script/[SCRIPT_NAME].s.sol:[CONTRACT_NAME] --rpc-url $RPC_URL --sender $SENDER_ADDRESS --broadcast\n```\n\n## Example\n\n### Polygon Mumbai\n\n\u003e [!NOTE]\n\u003e The deployed version is based on the [`biconomy-v2-compat`](https://github.com/Destiner/module-frame/tree/biconomy-v2-compat) tag and is slightly different, to provide the compatibility with Biconomy Account V2.\n\n```\nbaseUrl = \"https://frame-validator.vercel.app/execute/\"\n```\n\n- Address: `0x2007dB9DB73AD549439A2ADEe17e74083A275A72` ([explorer](https://mumbai.polygonscan.com/address/0x2007dB9DB73AD549439A2ADEe17e74083A275A72))\n- Deployment tx: `0xac8b9a15e98294021c297481789dcb1c69a77364c24411cf8337f47d18709915` ([explorer](https://mumbai.polygonscan.com/tx/0xac8b9a15e98294021c297481789dcb1c69a77364c24411cf8337f47d18709915))\n- Installation tx: `0x4a9f4f42bf9f02b6b4a4ee0c1efc664d0a43386036cd966a527af556147e6e60` ([explorer](https://mumbai.polygonscan.com/tx/0x4a9f4f42bf9f02b6b4a4ee0c1efc664d0a43386036cd966a527af556147e6e60))\n- Usage tx: `0x3f033d7f14756de0ce822fa69cb3126e224fa0522470b5426ee41f766a7596a7` ([explorer](https://mumbai.polygonscan.com/tx/0x3f033d7f14756de0ce822fa69cb3126e224fa0522470b5426ee41f766a7596a7))\n\n## Design Notes\n\nUses [`frame-verifier`](https://github.com/wilsoncusack/frame-verifier).\n\nThe URL schema is `BASE_URL` + `CHAIN/CALLDATA_HASH`, where `BASE_URL` is the module-defined trusted base URL, `CHAIN` is the chain where the tx will be executed, and `CALLDATA_HASH` is a URL-friendly base64-encoded keccak256 hash of the UserOp calldata.\n\nThe frame message data gets passed via UserOp signature.\n\nThe replay attack protection is implemented via storing the last frame timestamp for each account.\n\nThe best way to understand how to craft the FC frame message and the UserOp payload is to go through the tests.\n\n## Gotchas\n\nThere are some limitations and possible attack vectors with the current degisn.\n\n- The frame hoster (owner of the BASE_URL) can censor and omit UserOps signed via the frame\n- The frame hoster can spoof the transaction data, showing one calldata in the frame image but providing another one to sign. This can technically be circumvented by users manually comparing the shown calldata with the URL. In practice, some level of trust between the frame user and the frame hoster is assumed.\n- The frame hoster has to know the preimage calldata of the hash to render the tx properly for users. The exchange between the frame hoster and the frame publisher could be done offchain or even onchain. This is a non-issue if the hoster and publisher is the same party\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdestiner%2Fmodule-frame","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdestiner%2Fmodule-frame","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdestiner%2Fmodule-frame/lists"}