Add EVM support to the export-and-sign signing flow by t-vila · Pull Request #122 · tkhq/frames

t-vila · 2026-07-06T11:23:30Z

Extends the export-and-sign iframe to sign EVM transactions and messages with an injected private key, alongside the existing Solana support. Signing happens entirely in-memory inside the iframe; key material never reaches the parent page.

onSignTransaction — new ETHEREUM branch. Takes a 0x-prefixed serialized unsigned transaction, signs it, and returns the broadcast-ready serialized signed transaction (via viem parseTransaction → account.signTransaction).
onSignMessage — new ETHEREUM branch. EIP-191 personal_sign over the UTF-8 message, matching how the Solana path treats messages.
New helpers getOrCreateEthereumAccount (lazy + cached, mirrors getOrCreateKeypair) and signEthereumTransaction.
Adds viem@2.45.0.

Design note — contract is symmetric with Solana

The EVM path deliberately mirrors the Solana contract: the caller builds and serializes the unsigned transaction with whatever library it likes (ethers/viem/web3/…) and hands the iframe serialized hex; the iframe returns serialized signed hex. This keeps the iframe build-agnostic rather than coupling callers to a specific transaction-object shape.

// EVM
signTransaction(
  { transaction: serializedUnsignedTxHex, type: TransactionType.Ethereum },
  address,
);
// Solana (unchanged)
signTransaction(
  { transaction: serializedTxHex, type: TransactionType.Solana },
  address,
);

A JSON tx-object input form can be added later as a superset (branch on 0x vs {) if we want the ergonomic alternative — not needed now.

No changes to @turnkey/iframe-stamper required: TransactionType.Ethereum / MessageType.Ethereum already exist. loadKeyIntoMemory is untouched — the viem account is derived lazily at sign time, so no keyFormat → curve coupling.

Tests

New EVM Signing suite in index.test.js

signs an EVM transaction and asserts the result recovers to the injected key's address
signs an EVM message (EIP-191) and asserts it recovers to the injected key's address
rejects an unsupported transaction type

Full suite: 39/39 passing, lint clean.

Manual testing using the updated example in tkhq/sdk#1432

Closes REQ-418

socket-security · 2026-07-06T11:24:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	viem@2.45.0

View full report

…r emulation

andrewkmin · 2026-07-10T16:49:18Z

qq -- what prompted the changes to this file? I don't see any changes that would necessitate updating this dockerfile. If there are fixes to be made that aren't specific to this feature (enabling EVM support), then I'd recommend taking this out of the current PR and ticketing/tackling in a separate PR, just to decouple and reduce rollout risk

It was actually required by this change, not sure if there's a better solution tho ?

Enabling EVM adds viem, and the docker job builds linux/amd64,linux/arm64 via buildx, so the arm64 leg runs under QEMU emulation.
The old Dockerfile built export-and-sign in-container (RUN cd export-and-sign && npm ci && npm run build), and under emulation that step dies pulling viem's dependency tree:

npm error network read ECONNRESET (errno -104) ERROR: failed to solve: process "/dev/.buildkit_qemu_emulator /bin/sh -c cd export-and-sign && npm ci && npm run build" did not complete successfully: exit code: 152

The fix switches export-and-sign to copy its committed dist/ — identical to how the export frame is already handled (COPY export …) — and integrity is enforced by the existing build-check (export-and-sign) job, which rebuilds and diffs against the committed dist/ on every run.

I wonder if we could just have the original Dockerfile and then have

FROM --platform=$BUILDPLATFORM node:18-bullseye-slim AS builder

for compatibility

cc @janjakubnanista

Yeah lemme see what's up there

@t-vila take a look at #124 and lmk if that fixes your problem - there was a bit of an issue with the docker build context (it would only affect local builds though)

Copilot

Pull request overview

Extends the export-and-sign iframe signing flow to support EVM (Ethereum) transactions and messages in addition to the existing Solana signing, using an injected private key that remains in-memory within the iframe.

Changes:

Adds ETHEREUM branches to onSignTransaction and onSignMessage, implemented via viem (parseTransaction, privateKeyToAccount, account.signTransaction, account.signMessage).
Introduces a cached, lazily-derived Ethereum account helper (getOrCreateEthereumAccount) and a transaction signing helper (signEthereumTransaction).
Updates dependencies (adds viem) and refreshes committed dist/ artifacts; Docker build now uses the committed export-and-sign/dist directly.

Reviewed changes

Copilot reviewed 4 out of 18 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
export-and-sign/src/event-handlers.js	Adds EVM signing support and Ethereum account/tx signing helpers.
export-and-sign/package.json	Adds `viem` dependency.
export-and-sign/package-lock.json	Locks `viem` and transitive dependencies.
export-and-sign/index.test.js	Adds EVM signing test suite for tx + message signing + unsupported types.
export-and-sign/dist/index.html	Updates bundled asset filenames (rebuilt artifact).
export-and-sign/dist/bundle.c9a8b8d5055f705bd308.js	Updates webpack chunk mapping (rebuilt artifact).
export-and-sign/dist/bundle.6f3ad536a859e78bdbd5.js.LICENSE.txt	Adds license notice (rebuilt artifact).
export-and-sign/dist/bundle.6f3ad536a859e78bdbd5.js	Adds new compiled bundle (rebuilt artifact).
export-and-sign/dist/bundle.539e9a91965e314c7b7e.js	Removes old compiled bundle (rebuilt artifact).
export-and-sign/dist/bundle.52d2885ae469455328a8.js.LICENSE.txt	Updates license attributions (rebuilt artifact).
export-and-sign/dist/bundle.29203a225e88524b9cba.js	Updates webpack chunk mapping (rebuilt artifact).
Dockerfile	Stops building `export-and-sign` in the builder stage; copies committed `dist/` into nginx image.

Files not reviewed (1)

export-and-sign/package-lock.json: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+async function signEthereumTransaction(key, transactionToSign) {
+  const account = await getOrCreateEthereumAccount(key);
+  return await account.signTransaction(parseTransaction(transactionToSign));
+}


Fix dockerignore

Copilot

Pull request overview

Copilot reviewed 4 out of 18 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

export-and-sign/package-lock.json: Generated file

+  // Ethereum keys are exported in HEXADECIMAL format, where privateKey is a
+  // 0x-prefixed hex string — exactly what viem's privateKeyToAccount expects.
+  if (key.format !== "HEXADECIMAL") {
+    throw new Error(
+      `cannot sign Ethereum payload with key format "${key.format}"; expected "HEXADECIMAL"`
+    );
+  }


add evm support

8fca3eb

t-vila added 3 commits July 6, 2026 15:01

rebuild dist

f717c0c

Docker: use committed export-and-sign dist instead of rebuilding unde…

0ed1892

…r emulation

comments

5b3c1d3

andrewkmin reviewed Jul 10, 2026

View reviewed changes

andrewkmin requested a review from Copilot July 10, 2026 16:49

Copilot started reviewing on behalf of andrewkmin July 10, 2026 16:50 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread export-and-sign/src/event-handlers.js

Comment on lines +597 to +600

async function signEthereumTransaction(key, transactionToSign) {

const account = await getOrCreateEthereumAccount(key);

return await account.signTransaction(parseTransaction(transactionToSign));

}

janjakubnanista added 2 commits July 13, 2026 14:03

chore: Ignore local node modules

9f11dea

Merge pull request #124 from tkhq/jan/export-and-sign-evm

43a36db

Fix dockerignore

andrewkmin requested a review from Copilot July 13, 2026 23:20

Copilot started reviewing on behalf of andrewkmin July 13, 2026 23:21 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

janjakubnanista approved these changes Jul 14, 2026

View reviewed changes

andrewkmin approved these changes Jul 14, 2026

View reviewed changes

andrewkmin merged commit 0fb9d5e into main Jul 14, 2026
27 checks passed

andrewkmin deleted the traian/export-and-sign-evm branch July 14, 2026 20:44

Navigation Menu

Uh oh!

Add EVM support to the export-and-sign signing flow - #122

Add EVM support to the export-and-sign signing flow#122
andrewkmin merged 6 commits into
mainfrom
traian/export-and-sign-evm

t-vila commented Jul 6, 2026 •

edited by andrewkmin

Loading

Uh oh!

socket-security Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

andrewkmin Jul 10, 2026

Uh oh!

t-vila Jul 10, 2026

Uh oh!

andrewkmin Jul 10, 2026

Uh oh!

janjakubnanista Jul 13, 2026

Uh oh!

janjakubnanista Jul 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

t-vila commented Jul 6, 2026 • edited by andrewkmin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andrewkmin Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

t-vila Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

andrewkmin Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

janjakubnanista Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

janjakubnanista Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

t-vila commented Jul 6, 2026 •

edited by andrewkmin

Loading

socket-security Bot commented Jul 6, 2026 •

edited

Loading