What are Smart Session Policies?
Smart Session policies are rules and constraints that govern:- Which contract functions can be called
- What parameters are allowed
- How much value can be transferred
- When the permissions are valid
- Which blockchain networks are authorized
Key Benefits
- Enhanced Security: Grant minimal permissions required for specific operations
- Better UX: Enable seamless interactions without compromising security
- Precise Control: Define exact conditions under which operations can occur
- Time-Bound Access: Automatically expire permissions after a set duration
- Cross-Chain Safety: Specify which networks permissions are valid on
Policy Components
Each policy consists of several potential components:- Contract Address: The target smart contract
- Function Selectors: Specific functions that can be called
- Rules: Parameter-level constraints
- Time Bounds: Valid duration for the permissions
- Value Limits: Maximum amounts that can be transferred
- Network Restrictions: Specific blockchain networks where the policy is valid
Session Creation Parameters
Session Creation Parameters
| Property | Type | Required | Description |
|---|---|---|---|
sessionPublicKey | Hex | Yes | Public key for the session (required for K1 algorithm validators) |
sessionValidatorAddress | Address | No | Address of the session validator |
sessionValidatorType | string | No | Type of the session validator (usually “simple K1 validator”) |
salt | Hex | No | Optional salt for the session |
sessionValidUntil | number | No | Timestamp until which the session is valid |
sessionValidAfter | number | No | Timestamp after which the session becomes valid |
chainIds | bigint[] | No | Chain IDs where the session should be enabled |
actionPoliciesInfo | ActionPolicyInfo[] | Yes | Array of action policy data for the session |
Action Policy Configuration
| Property | Type | Required | Description |
|---|---|---|---|
contractAddress | Address | Yes | The smart contract address this policy applies to |
validUntil | number | No | Timestamp when the session expires |
validAfter | number | No | Timestamp when the session becomes active |
valueLimit | bigint | No | Maximum amount of native tokens (ETH) per transaction |
tokenLimits | Array<TokenLimit> | No | Array of ERC20 token spending limits |
usageLimit | bigint | No | Maximum number of times this policy can be used |
sudo | boolean | No | If true, grants unlimited permissions (not compatible with rules) |
functionSelector | string | One of these required | Specific function to allow |
rules | Rule[] | One of these required | Array of parameter rules |
abi | Abi | One of these required | Full contract ABI |
Parameter Conditions
| Condition | Value | Description |
|---|---|---|
EQUAL | 0 | Exact match comparison |
GREATER_THAN | 1 | Value must be greater than reference |
LESS_THAN | 2 | Value must be less than reference |
GREATER_THAN_OR_EQUAL | 3 | Value must be greater than or equal to reference |
LESS_THAN_OR_EQUAL | 4 | Value must be less than or equal to reference |
NOT_EQUAL | 5 | Value must not match reference |
Rule Configuration
| Property | Type | Required | Description |
|---|---|---|---|
condition | ParamCondition | Yes | Type of comparison to perform |
offsetIndex | number | Yes | Position of parameter in calldata |
isLimited | boolean | Yes | Whether to track usage count |
ref | string | number | bigint | Yes | Value to compare against |
usage | Usage | If isLimited is true | Usage tracking configuration |
Usage Configuration
| Property | Type | Description |
|---|---|---|
limit | bigint | Maximum number of times this rule can be used |
used | bigint | Current usage count (typically starts at 0) |
Token Limit Structure
| Property | Type | Description |
|---|---|---|
token | Address | Token contract address |
limit | bigint | Maximum amount that can be spent |
Best Practices
- Principle of Least Privilege: Always grant the minimum permissions necessary.
- Time Constraints: Consider adding time range policies to limit session duration.
- Combine Policies: Use multiple policies together for enhanced security.