feat: add ApprovalRevocationEnforcer

[jeffsmale90]

What?

This enforcer grants the authority to revoke allowances granted by either:

• ERC20 approve(spender,amount)
• ERC721 approve(to,tokenId)
• ERC721 setApprovalForAll(operator,approved)

This covers approvals set for ERC20, ERC721 and ERC1155 tokens.

Why?

The enforcer now verifies that the target implements the expected token standard, by first invoking the standard-specific function to check the allowance being revoked.

Advanced Permissions currently has an erc20-token-revocation permission that grants the authority to revoke only ERC20 approvals. NFT approvals are also required.

By combining these revocations into a single enforcer, we get a number of benefits:

• user must sign only a single permission to revoke all allowances across multiple token types
• reduced gas cost to invoke a revocation (single caveat, rather than composition of multiple caveats)

How?

The enforcer accepts no terms.

The beforeHook first performs general verification - no native value is being sent, execution calldata is the expected length.

setApprovalForAll and approve are distinguished by selector. The different approve signatures are distinguished by the spender / to parameter - if it is the zero address, it is presumed to be the ERC721 style approve(to, tokenId).

---

Note

Medium Risk
Adds a new enforcer that gates token approval revocations (ERC-20/721/1155) and performs on-chain allowance/approval pre-checks; mistakes could unintentionally block valid revocations or cause unexpected reverts, especially in redelegation chains due to link-local _delegator semantics.

Overview
Introduces ApprovalRevocationEnforcer, a new caveat enforcer that permits delegates to only revoke existing approvals via tightly-scoped calls: ERC-20 approve(spender, 0), ERC-721 approve(address(0), tokenId), and ERC-721/1155 setApprovalForAll(operator, false), controlled by a 1-byte terms bitmask.

beforeHook now enforces single/default mode, zero native value, exact calldata shape, and verifies the target’s current approval state (allowance, getApproved, isApprovedForAll) before allowing the revocation; extensive unit/integration tests and docs were added, and deployment/verification scripts were updated to include the new enforcer.

^{Reviewed by Cursor Bugbot for commit 9583d15. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 84896cd. Configure here.}