Module signing 

Derive self-custodial action signing.

Derive signs every state-changing request with an EIP-712 typed-data signature over secp256k1. V3 domains use Ethereum chain 1 or Sepolia chain 11155111, with the same Trade module on both networks. The pipeline is:

action_hash = keccak256(abi.encode(
    [bytes32, uint, uint, address, bytes32, uint, address, address],
    [ACTION_TYPEHASH, subaccount_id, nonce, module_address,
     keccak256(module_data_abi_encoded), signature_expiry_sec, owner, signer],
))
typed_data_hash = keccak256(0x1901 || DOMAIN_SEPARATOR || action_hash)
signature = secp256k1_sign(typed_data_hash, signer_key)

Per-action module_data ABI encodings live under modules. REST and WebSocket session authentication use the simpler eth_sign(timestamp_ms) pattern in auth. Per-(wallet, subaccount) nonce allocation lives in nonce.

The byte-equivalence oracle is test_data/common/signing_trade_action_vectors.json, generated by scripts/oracle-py/derive/generate_oracle.py from the upstream Python SDK at a revision and source hashes pinned in the fixture metadata, replayed against this implementation in eip712 tests. The generator uses derive-py 0.1.4 and independently checks the domain and Action typehash formulas. Attribution is recorded in licenses/THIRD_PARTY_LICENSES.md.

Protocol constants (DOMAIN_SEPARATOR, ACTION_TYPEHASH, Trade module address) are sourced from https://docs.derive.xyz/authentication/action-signing. Financial inputs allow at most 12 fractional digits, but the canonical trade ABI still scales them by 1e18. Nonces are nanoseconds encoded as strings; login timestamps are milliseconds and signature expiry is seconds.

Modules

auth

Derive REST/WebSocket session authentication.

context

Execution signing context resolution for Derive.

eip712

EIP-712 typed-data hashing and signing for Derive self-custodial actions.

encoding

Shared signing utilities.

modules

Per-action module_data ABI encoders.

nonce

Process-wide (wallet, subaccount) nonce manager for Derive self-custodial requests.