Minimal interface for modular smart accounts so validators, executors, fallback handlers, and hooks can be swapped between account vendors (Safe, Kernel, Nexus, etc.) without lock-in. Status: Draft (Standards Track / ERC, Interface).
- 01vendor-agnostic smart accounts
- 02pluggable validation modules (passkey, multisig, session keys)
- 03executor modules (auto-pay, recurring transfers)
- 04hook modules (spend limits, MEV protection)
- 05interoperable module marketplaces
- pnpm add @rhinestone/module-sdk
- pnpm add @rhinestone/sdk
- # reference accounts: Safe7579, Kernel v3, Biconomy Nexus
Use ERC-7579 to build modules that plug into any compliant smart account. Modules MUST implement `onInstall(bytes)`, `onUninstall(bytes)`, `isModuleType(uint256)` where the type is one of: 1=Validator, 2=Executor, 3=Fallback, 4=Hook. Accounts expose `installModule(uint256 moduleTypeId, address module, bytes initData)`, `uninstallModule(...)`, `isModuleInstalled(...)`, plus `execute(bytes32 mode, bytes executionCalldata)` where `mode` packs callType (single/batch/delegatecall), execType (revert/try), and a 4-byte selector. Validators implement `validateUserOp(PackedUserOperation, bytes32) -> uint256` (1271-compatible) and `isValidSignatureWithSender(address, bytes32, bytes) -> bytes4`. Combine with ERC-4337 (UserOps) or ERC-7702 (delegated EOA) — 7579 is signing/account-shape agnostic. Use Rhinestone's `module-sdk` to scaffold compliant modules.
- ⚑The validator-selection scheme (which validator signs a given UserOp) is NOT in the standard — Kernel uses a leading nonce key, Safe7579 uses calldata prefix, Nexus uses a dedicated field. Modules must be tested per-account.
- ⚑`onInstall` runs via `delegatecall` from the account — writes go to the ACCOUNT's storage slots; pick collision-resistant slots (ERC-7201 namespaced storage) or you will brick installs.
- ⚑Hooks run on every execute; a reverting hook locks the account out of all executions until uninstalled by another path. Always provide a fallback validator that can uninstall a broken hook.
- ⚑Fallback modules occupy a function-selector slot — only one module per selector. Re-installing without uninstall reverts.
- ⚑Module type IDs are per-installation; the same module address can be installed under multiple type IDs (validator AND hook) — track each independently in `isModuleInstalled`.