[fengtality]

Summary

Adds Privy server wallets as the privy signer backend on the signer seam (#673, base feat/signer-seam). Privy holds the key and signs; Gateway builds and sends. Every execute route works for a privy wallet with no connector change, because the seam's chokepoints get the signer from the registry.

Replaces the closed #649 and #618, using Privy's current REST API (@privy-io/node 0.36 was read as the spec).

What changes

• src/wallet/privy/privy-client.ts is a small REST client for GET /v1/wallets/{id}, POST /v1/wallets and POST /v1/wallets/{id}/rpc (signTransaction, eth_signTransaction).

  • Credentials come only from PRIVY_APP_ID, PRIVY_APP_SECRET and PRIVY_AUTHORIZATION_KEY in the environment. There is nothing in conf, the templates or request bodies.

  • The privy-authorization-signature matches the SDK. The payload is RFC 8785 {version, method, url, body, headers}, signed with ECDSA P-256 / SHA-256, low-S, DER. It was checked byte for byte against formatRequestForAuthorizationSignature, and the signatures verify with noble's lowS check. A privy-request-expiry (15 min) is signed in.

  • The wallet id must match ^[a-z0-9]{16,64}$ before it reaches a URL, and it is still encodeURIComponent-ed. This is the SSRF fix from feat / Add execute-tx endpoint with Privy wallet integration #618.

  • Privy errors map to clear Gateway errors:

    Privy result	Gateway status
    policy violation	403
    missing or wrong authorization signature	403, with a hint to set PRIVY_AUTHORIZATION_KEY
    unknown wallet	404
    rate limit	429
    other 4xx	400
    5xx, or unreachable	502
    missing credentials	503

    Privy's error text is not returned and is logged only at debug level.

  • canonicalize (CJS, about 40 lines) is the only new dependency. The SDK itself is not used: it loads ESM-only jose, which Jest cannot load.

• src/wallet/signers/privy.ts registers in signerBackends as privy.
  • Solana: it wraps the seam's message in a transaction with empty signature slots and has Privy sign it. It checks that Privy returned the same message bytes, then returns only the wallet's signature, which the seam places and verifies. Partial signing next to ephemeral co-signers works.
  • Ethereum: the populated transaction goes to eth_signTransaction with minimal hex quantities (0x3). The chokepoint checks the sender and fields before it broadcasts.
  • No caip2 or chain id is hard-coded.
• Routes:
  • POST /wallet/add-privy {chain, privyWalletId, setDefault?} reads the wallet from Privy, checks its chain type and address, and stores {address, privyWalletId, addedAt} in conf/wallets/{chain}/privy-wallets.json.
  • POST /wallet/create-privy {chain, setDefault?} creates a wallet owned by the authorization key's public key, then adds it.
  • GET /wallet lists Privy wallets with signer: 'privy', and DELETE /wallet/remove removes the record. The wallet itself stays in Privy.
• docs/signer-seam.md has a new Privy section. Operation ids, the route list and openapi.json are updated.

Scope

One authorization key per Gateway, for Gateway and Hummingbot API users. Wallets that another app signs with its own Privy session signers are not designed for here.

Tests

Privy is stubbed at the HTTP edge only (global.fetch). The stub checks the Basic auth header and verifies the authorization signature against the generated key.

• privy-seam.test.ts: a privy wallet record goes through the real registry and the real Solana and Ethereum chokepoints. Privy signs, the result is broadcast, and the sent transaction verifies. A policy denial is a 403 and nothing is sent.
• privy-signer.test.ts: co-signer signing, a message changed by Privy is rejected, a non-signer wallet is refused without a Privy call, and EVM field mapping.
• privy-client.test.ts: request shape, request signature, wallet id validation (no request is made), the error mapping, and missing credentials.
• privy-wallet.routes.test.ts: add, list, sign-kind, remove; wrong chain; 404; malformed id; address already local; create.

Local evidence (stacked PR, so the ci workflow does not run). Each check ran on the final commit:

• pnpm build passes.
• pnpm lint: 0 errors. The 36 warnings are all in files this PR does not touch.
• pnpm test -w 3: 204 suites and 1916 tests pass.
• pnpm generate:openapi was run.

Not run live: Privy credentials were not given, so no live Privy swap was run.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new actionable issues remain.

Summary

Adds Privy-backed signing for Solana and Ethereum, plus routes to add and create Privy wallets.

• Privy wallets can sign Gateway transactions on Solana and Ethereum.
• Callers can add existing Privy wallets or create new ones through Gateway.
• Wallet list updates keep concurrent changes instead of overwriting them.

Diagram

sequenceDiagram
  participant Client
  participant Gateway
  participant Privy
  participant Chain
  Client->>Gateway: Execute using a registered Privy wallet
  Gateway->>Gateway: Build transaction
  Gateway->>Privy: Request signature
  Privy-->>Gateway: Signed transaction
  Gateway->>Gateway: Check message, fields, and signature
  Gateway->>Chain: Broadcast transaction
  Chain-->>Gateway: Transaction result
  Gateway-->>Client: Result

Loading

_{Reviews (4) · Last reviewed commit: "fix(wallet): every wallet list store cha..." · Reviewed by Greptile}

[fengtality]

Consolidated into the single draft build-and-submit PR #734.