Module signing 

Derive self-custodial action signing.

Derive signs every state-changing request with an EIP-712 typed-data signature over secp256k1, against per-action module contracts on the Derive Chain. The pipeline (matching derive_action_signing/signed_action.py from the upstream Python SDK derivexyz/v2-action-signing-python) is:

action_hash = keccak256(abi.encode(
    [bytes32, uint, uint, address, bytes32, uint, address, address],
    [ACTION_TYPEHASH, subaccount_id, nonce, module_address,
     keccak256(module_data_abi_encoded), signature_expiry_sec, owner, signer],
))
typed_data_hash = keccak256(0x1901 || DOMAIN_SEPARATOR || action_hash)
signature = secp256k1_sign(typed_data_hash, signer_key)

Per-action module_data ABI encodings live under modules. REST and WebSocket session authentication use the simpler eth_sign(timestamp_ms) pattern in auth. Per-(wallet, subaccount) nonce allocation lives in nonce.

The byte-equivalence oracle is test_data/common/signing_trade_action_vectors.json, generated by tests/oracle-py/generate_oracle.py from the upstream Python SDK at a revision pinned in the fixture metadata and replayed against this implementation in eip712 tests. A future re-pin (for example a V3 signer) regenerates the fixture through the generator; the Rust test structure stays unchanged. Third-party attribution for the oracle is recorded in licenses/THIRD_PARTY_LICENSES.md.

Protocol constants (DOMAIN_SEPARATOR, ACTION_TYPEHASH, module addresses) are sourced from the Protocol Constants reference at https://docs.derive.xyz.

Modules

auth

Derive REST/WebSocket session authentication.

context

Execution signing context resolution for Derive.

eip712

EIP-712 typed-data hashing and signing for Derive self-custodial actions.

encoding

Shared signing utilities.

modules

Per-action module_data ABI encoders.

nonce

Process-wide (wallet, subaccount) nonce manager for Derive self-custodial requests.