Document the signing change for EIP-7702 senders

[Amxx]

Stacked on top of docs/paymaster-signer-eip7702-note (OpenZeppelin#6673). Docs + changeset only — no contract or test changes.

Why

PaymasterSigner._signableUserOpHash now substitutes the effective EIP-7702 delegate for the initCode component of the digest. The typed-data struct still declares bytes initCode, so nothing about this surfaces at compile time — but the value a signer must put in that field changed. docs/modules/ROOT/pages/paymasters.adoc still told integrators to sign initCode: userOp.initCode, which for an EIP-7702 sender now yields a digest the paymaster rejects. Every existing signing service that sponsors EIP-7702 senders breaks at runtime, silently.

Changes

• docs/modules/ROOT/pages/paymasters.adoc — new === Signing for EIP-7702 senders subsection with an effectiveInitCode helper, and the signing example now calls it instead of passing userOp.initCode. Includes a warning that a sponsorship signature stops being valid once the delegate is replaced (deliberate), so signing services must read sender.code at signing time rather than caching a digest.
• .changeset/paymaster-signer-eip7702-delegate-binding.md — patch → minor, plus an explicit note that signing services must be updated in lockstep.

The GuaranteedUserOperation example further down the same page is deliberately left alone: it is a separate custom paymaster with its own typehash that hashes keccak256(userOp.initCode) in Solidity and signs the raw initCode in TS. It is internally consistent and not obliged to mirror PaymasterSigner.

Verification

The helper was checked against the contract rather than written from reading it. The same logic was ported to ethers and keccak256(effectiveInitCode(...)) compared against PaymasterSigner._effectiveInitCodeHash for six inputs — 0x, 0x77, 0x7702, 0x770200, marker + deadbeef, and a nonzero-tail factory address (0x7702aabb…). All six match, including the empty and 1-byte edges where the marker comparison relies on zero-padding.

Caveat: the snippet in the docs is viem, matching the rest of the file, and is not executed by CI. The viem and ethers forms are structurally identical (size/slice/padHex vs dataLength/dataSlice/zeroPadBytes), so the translation is mechanical, but it is worth a careful read.

Open question for the maintainer

The minor bump is a judgement call and yours to make. There is no Solidity signature or storage-layout change, so it is not a major by the usual test, but it does break working offchain integrations with no compile-time signal. Revert to patch if the project treats digest changes differently.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 399253a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes changesets to release 1 package

Name	Type
openzeppelin-solidity	Minor

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR