@nodpay/core

The crypto. Nothing else.

Identity-agnostic protocol primitives for NodPay — verifiable Safe + ERC-4337 operations.

This package deals with owners, signers, and cryptography — not agent/human/recovery roles. Role assignment is the application layer's job (nodpay CLI and web app).

What's Inside

| Module | What it does | |--------|-------------| | constants | Contract addresses, EIP-712 type hashes, ABIs | | hash | Derive safeOpHash (EIP-712) and userOpHash (ERC-4337) from a UserOperation | | decode | Extract real to/value/data from UserOperation calldata | | verify | Recover signers from ECDSA signatures, verify P-256 passkey assertions, recover reject signers | | networks | Chain configs (RPC, explorer, currency) for all supported networks |

Install

npm install @nodpay/core

Usage

import {
  computeSafeOpHash,
  computeUserOpHash,
  decodeCallData,
  recoverEcdsaSigner,
} from '@nodpay/core';

// Decode what a UserOperation actually does
const tx = decodeCallData(userOp.callData);
console.log(`Sending ${tx.value} wei to ${tx.to}`);

// Verify the hash matches the UserOperation
const hash = computeSafeOpHash(userOp, chainId);

// Recover who signed it
const signer = recoverEcdsaSigner(hash, signature);
console.log(`Signed by: ${signer}`);

Zero Trust Verification Chain

Every step in a NodPay operation is independently verifiable:

1. What am I signing? → decodeCallData() extracts the real transaction from raw bytecode
2. Is the hash correct? → computeSafeOpHash() re-derives the hash from first principles
3. Who signed it? → recoverEcdsaSigner() recovers the signer address
4. Did it execute? → computeUserOpHash() matches the bundler's receipt

If any check fails, something is wrong. The code is small enough to audit in one sitting.

Contract Stack

| Component | Address | Purpose | |-----------|---------|---------| | EntryPoint v0.6 | 0x5FF1...2789 | ERC-4337 UserOperation executor | | Safe v1.4.1 | 0x29fc...c762 | Multisig logic (singleton) | | SafeProxyFactory | 0x4e1D...ec67 | Deploys Safe proxies (CREATE2) | | Safe 4337 Module | 0xa581...0037 | Connects Safe to EntryPoint | | SharedSigner | 0x94a4...55c2 | Routes passkey verification | | FCLP256Verifier | 0x445a...e765 | On-chain P-256 signature check |

All addresses are deterministic — same on every EVM chain.

Related

| Package | Description | |---------|-------------| | nodpay | Agent CLI — keygen, propose, txs | | nodpay.ai | Web app — wallet creation & approval |

License

MIT