Action-bound authentication

AuthContext

struct AuthContext {
  address target;
  bytes4 selector;
  bytes32 paramsHash;
  bytes32 actionHash;
}

KeyVaultV3 builds this context for every protected operation. The selected IAuthenticator verifies the proof against it.

Canonical action hash

const actionHash = ethers.keccak256(
  ethers.AbiCoder.defaultAbiCoder().encode(
    ["bytes32", "uint256", "address", "address", "bytes4", "bytes32"],
    [
      ethers.id("MONSTERA_AUTH_CONTEXT_V1"),
      chainId,
      keyVaultAddress,
      target,
      selector,
      paramsHash,
    ],
  ),
);

Replay properties

• A proof cannot move between chains because chainId is committed.
• A proof cannot move between vaults because the KeyVault address is committed.
• A proof cannot move between functions because the selector is committed.
• A proof cannot change arguments because paramsHash is committed.
• Some authenticators also enforce deadlines or time buckets.
• API Key Session TOKEN mode intentionally permits bounded reuse within its TTL and scope.