nautilus_derive/signing/
mod.rs

1// -------------------------------------------------------------------------------------------------
2//  Copyright (C) 2015-2026 Nautech Systems Pty Ltd. All rights reserved.
3//  https://nautechsystems.io
4//
5//  Licensed under the GNU Lesser General Public License Version 3.0 (the "License");
6//  You may not use this file except in compliance with the License.
7//  You may obtain a copy of the License at https://www.gnu.org/licenses/lgpl-3.0.en.html
8//
9//  Unless required by applicable law or agreed to in writing, software
10//  distributed under the License is distributed on an "AS IS" BASIS,
11//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12//  See the License for the specific language governing permissions and
13//  limitations under the License.
14// -------------------------------------------------------------------------------------------------
15
16//! Derive self-custodial action signing.
17//!
18//! Derive signs every state-changing request with an EIP-712 typed-data
19//! signature over secp256k1, against per-action module contracts on the Derive
20//! Chain. The pipeline (matching `derive_action_signing/signed_action.py` from
21//! the upstream Python SDK [`derivexyz/v2-action-signing-python`]) is:
22//!
23//! ```text
24//! action_hash = keccak256(abi.encode(
25//!     [bytes32, uint, uint, address, bytes32, uint, address, address],
26//!     [ACTION_TYPEHASH, subaccount_id, nonce, module_address,
27//!      keccak256(module_data_abi_encoded), signature_expiry_sec, owner, signer],
28//! ))
29//! typed_data_hash = keccak256(0x1901 || DOMAIN_SEPARATOR || action_hash)
30//! signature = secp256k1_sign(typed_data_hash, signer_key)
31//! ```
32//!
33//! Per-action `module_data` ABI encodings live under [`modules`]. REST and
34//! WebSocket session authentication use the simpler `eth_sign(timestamp_ms)`
35//! pattern in [`auth`]. Per-`(wallet, subaccount)` nonce allocation lives in
36//! [`nonce`].
37//!
38//! Differential testing against the upstream Python SDK is the byte-equivalence
39//! oracle: fixtures are captured from `derive_action_signing` and replayed
40//! against this implementation under `test_data/`.
41//!
42//! Protocol constants (`DOMAIN_SEPARATOR`, `ACTION_TYPEHASH`, module addresses)
43//! are sourced from the Protocol Constants reference at
44//! <https://docs.derive.xyz>.
45//!
46//! [`derivexyz/v2-action-signing-python`]: https://github.com/derivexyz/v2-action-signing-python
47
48pub mod auth;
49pub mod context;
50pub mod eip712;
51pub mod encoding;
52pub mod modules;
53pub mod nonce;
nautilus_derive/signing/mod.rs

nautilus_derive/signing/
mod.rs
