BaseResolver

Source: src/resolvers/base/BaseResolver.sol

Overview

BaseResolver is the root abstract contract in the resolver inheritance hierarchy. Every concrete resolver -- whether behavioral, gatekeeper, automation, or observer -- inherits from BaseResolver to get a consistent set of infrastructure capabilities:

• Access control via OpenZeppelin AccessControl with a GOVERNOR_ROLE for administrative operations
• Meta-transaction support via ERC2771Context so gasless transactions work transparently through all resolver functions
• Pausability for emergency stops
• Reentrancy protection via ReentrancyGuardTransient (transient storage variant for lower gas)
• Party detection that unifies owner, executor, and token holder checks into a single _isRecordParty function
• Record validation helpers that delegate to the IntegraRecord contract for ownership and existence checks

BaseResolver does not implement any resolver logic itself. It provides the scaffolding that concrete resolvers build on. The two required functions from IResolver -- resolverCategories() and resolverVersion() -- are left abstract for each concrete resolver to implement.

Inheritance Chain

abstract contract BaseResolver is
    IResolver,
    ERC165,
    AccessControl,
    ERC2771Context,
    ReentrancyGuardTransient,
    Pausable,
    ResolverEvents

Key Concepts

Roles

BaseResolver defines two roles via OpenZeppelin AccessControl:

Both roles are granted to the deployer (_msgSender()) in the constructor. Concrete resolvers may define additional roles.

Modifiers

The onlyRecord modifier is used by concrete resolvers for callback functions that should only be invoked by the IntegraRecord contract during record lifecycle operations.

Party Detection with ITokenParty

The _isRecordParty function provides a unified check for whether an address has any relationship to a record. A "record party" is defined as any of:

1. The record owner -- checked via IIntegraRecord.getOwner()
2. An authorized executor -- checked via IIntegraRecord.isAuthorizedExecutor()
3. A token holder on the record's tokenizer -- checked via ITokenParty.isTokenHolder()

The token holder check uses ITokenParty, a minimal interface (src/interfaces/ITokenParty.sol) that all tokenizers implement regardless of their underlying ERC standard (ERC-20, ERC-721, ERC-1155). This provides cross-standard token holder detection without the resolver needing to know which token standard is in use.

The external call to isTokenHolder is bounded to _TOKEN_HOLDER_GAS_LIMIT (100,000 gas) to prevent denial-of-service from malicious or expensive tokenizer implementations. If the call runs out of gas or the tokenizer does not implement ITokenParty, the try/catch returns false as a safe default.

function _isRecordParty(bytes32 integraHash, address account) internal view virtual returns (bool) {
    if (account == IIntegraRecord(INTEGRA_RECORD).getOwner(integraHash)) return true;
    if (IIntegraRecord(INTEGRA_RECORD).isAuthorizedExecutor(integraHash, account)) return true;
    address tokenizer = IIntegraRecord(INTEGRA_RECORD).getTokenizer(integraHash);
    if (tokenizer != address(0)) {
        try ITokenParty(tokenizer).isTokenHolder{gas: _TOKEN_HOLDER_GAS_LIMIT}(account) returns (bool holds) {
            return holds;
        } catch {}
    }
    return false;
}

ERC-2771 Meta-Transaction Support

BaseResolver inherits ERC2771Context for gasless meta-transaction support. Both AccessControl and Pausable also inherit from Context, creating a diamond inheritance pattern. BaseResolver resolves this by overriding _msgSender(), _msgData(), and _contextSuffixLength() to always delegate to ERC2771Context:

• _msgSender() -- resolves to ERC2771Context._msgSender()
• _msgData() -- resolves to ERC2771Context._msgData()
• _contextSuffixLength() -- resolves to ERC2771Context._contextSuffixLength()

This means all _msgSender() calls throughout the resolver hierarchy -- including those in AccessControl role checks and Pausable modifiers -- correctly extract the original sender from meta-transactions forwarded by the trusted forwarder.

Pause / Unpause

The pause() and unpause() functions are restricted to GOVERNOR_ROLE. When paused, concrete resolvers use the inherited whenNotPaused modifier to block state-changing operations. The pause() / unpause() functions themselves do not use whenNotPaused -- you can always unpause a paused contract.

Contract Details

Constructor Parameters

constructor(address integraRecord, address trustedForwarder)
    ERC2771Context(trustedForwarder)

The constructor grants both DEFAULT_ADMIN_ROLE and GOVERNOR_ROLE to _msgSender().

Constants

Why _TOKEN_HOLDER_GAS_LIMIT is 100,000: ERC-1155 isTokenHolder implementations may iterate up to 100 storage slots (~210k gas cold). 100k is intentionally conservative -- if the call runs out of gas, the try/catch returns false (safe default). Higher limits would increase DoS exposure from malicious tokenizers.

Immutables

Modifiers

Functions

External Functions

Public View Functions

Internal View Functions

Internal Context Overrides (Diamond Resolution)

Shared Errors

Source: src/resolvers/ResolverErrors.sol

The ResolverErrors library defines errors shared across all resolvers. BaseResolver uses these errors directly; concrete resolvers may use them as well.

Shared Events

Source: src/resolvers/ResolverEvents.sol

ResolverEvents is an abstract contract inherited by BaseResolver. All resolvers receive these events through the inheritance chain.

Resolver Constants

Source: src/resolvers/ResolverConstants.sol

File-level constants used by resolvers to declare their category via resolverCategories(). Categories are composable bitmasks -- a resolver can declare multiple categories (e.g., CATEGORY_BEHAVIORAL | CATEGORY_GATEKEEPER). Used by IntegraLens and off-chain indexers for resolver classification.

AuthorizedActors

Source: src/resolvers/lib/AuthorizedActors.sol

AuthorizedActors is an abstract contract (not a library) that provides per-record, per-role actor authorization with optional delegation. It is inherited by concrete resolvers that need to manage authorized parties such as providers, agents, or arbitrators on a per-record basis.

Authorization Model

The authorization model is three-dimensional: role x record x actor. Each actor can optionally have a principal (delegation), tracking who they represent.

role (bytes32) => integraHash (bytes32) => actor (address) => authorized (bool)
role (bytes32) => integraHash (bytes32) => actor (address) => Delegation { principal, authorizedAt }

Delegation Struct

struct Delegation {
    address principal;      // The address the actor represents (address(0) if not a delegate)
    uint64  authorizedAt;   // Timestamp when the actor was authorized
}

Functions

Events

Errors

IResolver Interface

Source: src/resolvers/interfaces/IResolver.sol

The minimal interface that every resolver implements. BaseResolver provides the supportsInterface implementation; the remaining two functions are left abstract for concrete resolvers.

interface IResolver {
    function resolverCategories() external pure returns (uint256);
    function resolverVersion() external pure returns (uint256);
    function supportsInterface(bytes4 interfaceId) external view returns (bool);
}

Resolver Library Contracts

The src/resolvers/lib/ directory contains reusable libraries and abstract contracts that provide composable building blocks for concrete resolvers. See the ADR Resolver documentation for detailed usage of these libraries in a production resolver.

Usage: Creating a Custom Resolver

To create a new resolver, extend BaseResolver and implement the two abstract functions from IResolver:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.28;

import {BaseResolver} from "../base/BaseResolver.sol";
import {ResolverErrors} from "../ResolverErrors.sol";
import {CATEGORY_BEHAVIORAL} from "../ResolverConstants.sol";

contract MyResolver is BaseResolver {
    constructor(address integraRecord, address trustedForwarder)
        BaseResolver(integraRecord, trustedForwarder)
    {}

    /// @notice Declare this resolver as behavioral
    function resolverCategories() external pure override returns (uint256) {
        return CATEGORY_BEHAVIORAL;
    }

    /// @notice Version 1.0.0 encoded as (1 << 32 | 0 << 16 | 0)
    function resolverVersion() external pure override returns (uint256) {
        return (1 << 32);
    }

    /// @notice Example state-changing function restricted to record owner
    function doSomething(bytes32 integraHash)
        external
        whenNotPaused
        nonReentrant
    {
        _requireRecordExists(integraHash);
        _requireOwner(integraHash);
        // resolver-specific logic here
    }

    /// @notice Example function using party detection
    function viewAsParty(bytes32 integraHash) external view returns (bool) {
        return _isRecordParty(integraHash, _msgSender());
    }
}

Key patterns when extending BaseResolver:

• Use whenNotPaused on all state-changing functions to respect the emergency pause mechanism
• Use nonReentrant on functions that make external calls or modify state
• Use _requireOwner or _requireOwnerOrExecutor for authorization checks
• Use _isRecordParty when broader access is appropriate (e.g., view functions or party-restricted actions)
• Use onlyRecord for callback functions that should only be called by IntegraRecord
• Declare resolver categories as a bitmask of CATEGORY_* constants from ResolverConstants.sol

Security Considerations

Reentrancy. BaseResolver inherits ReentrancyGuardTransient but does not apply nonReentrant to any of its own functions. Concrete resolvers must add nonReentrant to state-changing functions that perform external calls.

Gas-Limited External Calls. The _isRecordParty function makes an external call to the tokenizer's isTokenHolder with a 100,000 gas limit. This prevents a malicious tokenizer from consuming unbounded gas, but it also means that tokenizers with expensive isTokenHolder implementations may return false even when the account holds tokens. This is a safe default -- false negatives are acceptable; false positives are not.

Meta-Transaction Sender. All _msgSender() calls resolve through ERC2771Context. If the trusted forwarder is compromised, an attacker could impersonate any address. The trusted forwarder address is immutable (set at construction time via ERC2771Context) and cannot be changed after deployment.

Pause Scope. The pause() / unpause() functions affect only the concrete resolver that inherits BaseResolver. Each resolver instance has its own pause state. Pausing one resolver does not affect other resolvers attached to the same record.

Zero-Address Validation. The constructor validates both integraRecord and trustedForwarder are non-zero. However, it does not verify that these addresses are actually contracts implementing the expected interfaces. Deployers must ensure correct addresses are provided.

Role Administration. The deployer receives DEFAULT_ADMIN_ROLE, which can grant and revoke any role including itself. If the admin role is renounced without transferring it, the GOVERNOR_ROLE can no longer be managed. Concrete resolvers that define additional roles should document their admin hierarchy.