For SolversHands-on· 20 min

Custody & Signing#

Any backend producing an ecrecover-compatible EIP-712 signature works - Fireblocks, AWS KMS, hardware wallets, or raw keys.

Escrow Path#

Signature authorizes locking funds in InputSettlerEscrow via open()

Compact Path#

Signature authorizes allocating funds from TheCompact via allocator co-sign

Never expose private keys in client-side code. All signing must happen server-side or in a secure enclave.

Choose Your Provider#

Production MPC signing, institutional-grade.

Configure Fireblocks vault with EVM wallet
Build EIP-712 typed data hash from StandardOrder
Submit to Fireblocks Raw Signing API
MPC nodes co-sign → return signature
Submit signed order to TetraFi

TypeScript

1const fireblocks = new FireblocksSDK(apiSecret, apiKey);
2const hash = hashTypedData(buildEIP712TypedData(order));
3
4const { signedMessages } = await fireblocks.createTransaction({
5  operation: "RAW",
6  assetId: "ETH",
7  source: { type: "VAULT_ACCOUNT", id: vaultId },
8  extraParameters: {
9    rawMessageData: { messages: [{ content: hash }] },
10  },
11});

11 linestypescript

Lock Type Requirements#

Lock Type	Byte	Approval	Gasless	Domain
ResourceLock	`0xff`	Pre-deposit into Compact	check	`OIFCompact`
Permit2Escrow	`0x00`	One-time Permit2 approve	check	`OIFEscrow`
EIP-3009	`0x01`	None	check	`OIFEscrow`

EIP-712 domains: OIFCompact = ResourceLock via The Compact (allocator-released). OIFEscrow = Permit2 / EIP-3009 input-lock (pulled into escrow via open()).

TypeScript

1const domain = {
2  name: lockType ===  ? "OIFCompact" : "OIFEscrow",
3  version: "1",
4  chainId: originChainId,
5  verifyingContract: settlerAddress,
6};

6 linestypescript

Production Key Management#

Rule	Why
Rotate every 90 days	Or sooner on compromise / personnel change
Separate keys per env + service	Limits blast radius on leak
Never embed raw keys	Use KMS / HSM / Fireblocks only
Monitor signing volume	Unexpected spikes = likely compromise
Document revocation runbook	Test quarterly

Custody & Signing#

Escrow Path#

Compact Path#

Choose Your Provider#

Lock Type Requirements#

Production Key Management#

See Also#

Prerequisites

Next Steps

Related topics