feat: NEP-641 reference impl

.cargo/audit.toml

@@ -2,3 +2,7 @@
 # https://docs.rs/cargo-audit/latest/cargo_audit/config/
 
 [advisories]
+ignore = [
+  # transitive wasmtime dependency is only currently used for `near-sdk/unit-testing` feature
+  "RUSTSEC-2026-0222", # TODO: remove
+]

Cargo.toml

@@ -52,6 +52,7 @@ members = [
   "crates/signatures/erc191",
   "crates/signatures/nep413",
   "crates/signatures/nep461",
+  "crates/signatures/nep641",
   "crates/signatures/webauthn",
   "crates/signatures/sep53",
   "crates/signatures/tip191",
@@ -125,6 +126,7 @@ defuse-token-id = { path = "crates/primitives/token-id", default-features = fals
 defuse-erc191.path = "crates/signatures/erc191"
 defuse-nep413.path = "crates/signatures/nep413"
 defuse-nep461.path = "crates/signatures/nep461"
+defuse-nep641.path = "crates/signatures/nep641"
 defuse-sep53.path = "crates/signatures/sep53"
 defuse-tip191.path = "crates/signatures/tip191"
 defuse-ton-connect = { path = "crates/signatures/ton-connect", default-features = false }

contracts/defuse/core/src/payload/nep413.rs

@@ -1,4 +1,4 @@
-use defuse_crypto::ed25519::{Ed25519PublicKey, Ed25519Signature};
+use defuse_crypto::ed25519::{Ed25519, Ed25519PublicKey, Ed25519Signature};
 pub use defuse_nep413::{Nep413, Nep413Payload};
 use impl_tools::autoimpl;
 use near_sdk::AccountId;
@@ -75,7 +75,7 @@ impl SignedPayload for SignedNep413Payload {
     type PublicKey = Ed25519PublicKey;
 
     fn verify(&self) -> Option<Self::PublicKey> {
-        Nep413::verify(
+        Nep413::verify::<Ed25519>(
             &self.public_key.try_into().ok()?,
             &self.payload,
             &self.signature.into(),

contracts/wallet/Cargo.toml

@@ -10,6 +10,7 @@ repository.workspace = true
 [dependencies]
 defuse-bitmap.workspace = true
 defuse-near-promise.workspace = true
+defuse-nep641.workspace = true
 defuse-time.workspace = true
 near-account-id.workspace = true
 thiserror.workspace = true
@@ -24,19 +25,21 @@ digest-io = { workspace = true, optional = true }
 impl-tools = { workspace = true, optional = true }
 schemars = { workspace = true, features = ["derive"], optional = true }
 serde = { workspace = true, features = ["derive"], optional = true }
+serde_json = { workspace = true, optional = true }
 serde_with = { workspace = true, optional = true }
 
 near-sdk = { workspace = true, optional = true }
 
 [features]
 default = ["std"]
 
-std = ["defuse-time/std"]
+std = ["defuse-nep641/std", "defuse-time/std"]
 
 abi = ["borsh-schema", "near-sdk?/abi", "schemars-v0_8"]
 arbitrary = [
   "defuse-bitmap/arbitrary",
   "defuse-near-promise/arbitrary",
+  "defuse-nep641/arbitrary",
   "defuse-time/arbitrary",
   "dep:arbitrary",
   "dep:arbitrary_with",
@@ -45,6 +48,7 @@ arbitrary = [
 borsh = [
   "defuse-bitmap/borsh",
   "defuse-near-promise/borsh",
+  "defuse-nep641/borsh",
   "defuse-time/borsh",
   "dep:borsh",
   "dep:defuse-borsh-utils",
@@ -56,21 +60,29 @@ borsh-schema = [
   "defuse-bitmap/borsh-schema",
   "defuse-borsh-utils?/schema",
   "defuse-near-promise/borsh-schema",
+  "defuse-nep641/borsh-schema",
   "defuse-time/borsh-schema",
   "near-account-id/abi",
 ]
-digest = ["dep:defuse-digest", "dep:digest-io"]
-json = ["defuse-near-promise/json", "serde"]
-near-kit = ["defuse-near-promise/near-kit"]
+digest = ["defuse-nep641/digest", "dep:defuse-digest", "dep:digest-io"]
+json = [
+  "defuse-near-promise/json",
+  "defuse-nep641/json",
+  "dep:serde_json",
+  "serde",
+]
+near-kit = ["defuse-near-promise/near-kit", "defuse-nep641/near-kit"]
 schemars-v0_8 = [
   "defuse-near-promise/schemars-v0_8",
+  "defuse-nep641/schemars-v0_8",
   "defuse-time/schemars-v0_8",
   "dep:schemars",
   "near-account-id/schemars-v0_8",
   "serde",
 ]
 serde = [
   "defuse-near-promise/serde",
+  "defuse-nep641/serde",
   "defuse-time/serde",
   "dep:cfg_eval",
   "dep:serde",
@@ -84,6 +96,7 @@ near-contract = [
   "dep:impl-tools",
   "dep:near-sdk",
   "digest",
+  "json",
   "serde",
   "std",
 ]

contracts/wallet/signatures/ed25519/src/lib.rs

@@ -12,16 +12,14 @@ use defuse_crypto::{
     Curve,
     ed25519::{Ed25519, Ed25519PublicKey, Ed25519Signature},
 };
-use defuse_wallet::{RequestMessage, SignatureSchema};
+use defuse_wallet::{RequestMessage, SignatureSchema, offchain::OffchainMessage};
 
 /// Simple [`Ed25519`] wallet [signature schema](SignatureSchema)
 /// over [canonical request hash](RequestMessage::hash).
 pub struct WalletEd25519;
 
-impl SignatureSchema for WalletEd25519 {
-    type PublicKey = Ed25519PublicKey;
-
-    fn verify(public_key: &Self::PublicKey, msg: &RequestMessage, proof: &str) -> bool {
+impl WalletEd25519 {
+    fn verify_hash(public_key: &Ed25519PublicKey, hash: &[u8; 32], proof: &str) -> bool {
         let Ok(signature) = Ed25519Signature::from_str(proof) else {
             return false;
         };
@@ -30,7 +28,24 @@ impl SignatureSchema for WalletEd25519 {
             return false;
         };
 
-        Ed25519::verify(&public_key, &msg.hash(), &signature.into())
+        Ed25519::verify(&public_key, hash, &signature.into())
+    }
+}
+
+impl SignatureSchema for WalletEd25519 {
+    type PublicKey = Ed25519PublicKey;
+
+    #[inline]
+    fn verify_request_msg(public_key: &Self::PublicKey, msg: &RequestMessage, proof: &str) -> bool {
+        Self::verify_hash(public_key, &msg.hash(), proof)
+    }
+
+    fn verify_offchain_msg(
+        public_key: &Self::PublicKey,
+        msg: &OffchainMessage,
+        proof: &str,
+    ) -> bool {
+        Self::verify_hash(public_key, &msg.hash(), proof)
     }
 }
 
@@ -83,7 +98,7 @@ mod tests {
         #[case] proof: impl Into<Ed25519Signature>,
     ) {
         assert!(
-            WalletEd25519::verify(&public_key.into(), &msg, &proof.into().to_string()),
+            WalletEd25519::verify_request_msg(&public_key.into(), &msg, &proof.into().to_string()),
             "signature is invalid"
         );
     }

contracts/wallet/signatures/ed25519/src/signer.rs

@@ -39,6 +39,17 @@ use crate::WalletEd25519;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::From, derive_more::AsRef)]
 pub struct WalletEd25519Signer<S>(pub S);
 
+impl<S> WalletEd25519Signer<S>
+where
+    S: Signer<Ed25519>,
+{
+    async fn sign_hash(&self, hash: &[u8; 32]) -> Result<Proof, S::Error> {
+        let sig = self.0.sign(hash).await?;
+
+        Ok(Ed25519Signature::from(sig).to_string())
+    }
+}
+
 impl<S> WalletSigner<WalletEd25519> for WalletEd25519Signer<S>
 where
     S: Signer<Ed25519>,
@@ -50,10 +61,15 @@ where
         self.0.public_key().into()
     }
 
-    async fn sign_wallet_msg(&self, msg: &RequestMessage) -> Result<Proof, Self::Error> {
-        let sig = self.0.sign(&msg.hash()).await?;
+    async fn sign_request_msg(&self, msg: &RequestMessage) -> Result<Proof, Self::Error> {
+        self.sign_hash(&msg.hash()).await
+    }
 
-        Ok(Ed25519Signature::from(sig).to_string())
+    async fn sign_offchain_msg(
+        &self,
+        msg: &defuse_wallet::offchain::OffchainMessage,
+    ) -> Result<Proof, Self::Error> {
+        self.sign_hash(&msg.hash()).await
     }
 }
 
@@ -81,12 +97,12 @@ mod tests {
             request: Request::new(),
         };
 
-        let proof = WalletSigner::<WalletEd25519>::sign_wallet_msg(&signer, &msg)
+        let proof = WalletSigner::<WalletEd25519>::sign_request_msg(&signer, &msg)
             .await
             .unwrap();
 
         assert!(
-            WalletEd25519::verify(
+            WalletEd25519::verify_request_msg(
                 &WalletSigner::<WalletEd25519>::public_key(&signer),
                 &msg,
                 &proof

contracts/wallet/signatures/no-sign/src/lib.rs

@@ -6,7 +6,7 @@ use core::{
     str::FromStr,
 };
 
-use defuse_wallet::{RequestMessage, SignatureSchema};
+use defuse_wallet::{RequestMessage, SignatureSchema, offchain::OffchainMessage};
 
 /// [`SignatureSchema`] which always rejects the signature.
 ///
@@ -19,7 +19,20 @@ impl SignatureSchema for NoSign {
     type PublicKey = NoPublicKey;
 
     #[inline]
-    fn verify(_public_key: &Self::PublicKey, _msg: &RequestMessage, _proof: &str) -> bool {
+    fn verify_request_msg(
+        _public_key: &Self::PublicKey,
+        _msg: &RequestMessage,
+        _proof: &str,
+    ) -> bool {
+        false
+    }
+
+    #[inline]
+    fn verify_offchain_msg(
+        _public_key: &Self::PublicKey,
+        _msg: &OffchainMessage,
+        _proof: &str,
+    ) -> bool {
         false
     }
 }