feat(bulk): signature domain changes (#3951)

Author: Dewyer

Cargo.lock

@@ -16,7 +16,7 @@ anyhow = "1.0"
 ratatui = "0.29"
 crossterm = "0.28"
 reqwest = { version = "0.12", features = ["json"] }
-bulk-keychain = "0.1.17"
+bulk-keychain = "0.1.22"
 
 [lints]
 workspace = true

apps/pyth-lazer-pusher/bulk-trade-cli/Cargo.toml

@@ -24,7 +24,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 
 # Crypto (for signing)
-bulk-keychain = "0.1.17"
+bulk-keychain = "0.1.22"
 
 # Config
 clap = { version = "4.5", features = ["derive"] }

apps/pyth-lazer-pusher/bulk-trade-pusher/Cargo.toml

@@ -12,10 +12,20 @@ Required settings:
 - `lazer.access_token` - Pyth Lazer API token
 - `bulk.signing_key_path` - Path to Ed25519 key file
 - `bulk.oracle_account_pubkey_base58` - Oracle account (whitelisted on Bulk)
+- `bulk.signature_domain` - BULK network to sign for: `mainnet`, `testnet`, or `devnet`
 - `feeds.subscriptions` - Feed IDs to push
 
 Environment overrides: `BULK_PUSHER__LAZER__ACCESS_TOKEN`, etc.
 
+### Signature domain
+
+`bulk.signature_domain` must match the network the configured `bulk.endpoints` belong
+to. It is committed into the signature preimage but is **not** part of the transaction
+sent over the wire, so a mismatch produces a well-formed transaction whose signature the
+validator rejects — with no indication that the domain was the cause. The field is
+required and has no default so the mistake surfaces at startup instead. The active
+domain is logged in the `initialized signer` startup line.
+
 ## Run
 
 ```bash

apps/pyth-lazer-pusher/bulk-trade-pusher/README.md

@@ -38,18 +38,26 @@ endpoints = [
     "wss://exchange-wss.bulk.trade/ws",
 ]
 
-# Ed25519 signing key (base58 encoded private key)
+# Path to the file holding the Ed25519 signing key (base58 encoded private key)
 # Each pusher instance has its OWN signing key that's approved for the oracle account.
-# Can also be set via BULK_PUSHER__BULK__SIGNING_KEY_BASE58 env var
-# IMPORTANT: Keep this secret! Use env var in production.
-signing_key_base58 = "your-base58-encoded-private-key"
+# Can also be set via BULK_PUSHER__BULK__SIGNING_KEY_PATH env var
+# IMPORTANT: Keep the key file secret and mount it as a secret in production.
+signing_key_path = "/secrets/signing.key"
 
 # Oracle account public key (base58 encoded)
 # This is the "account" field in the transaction - SHARED by all pushers.
 # The signing key must be approved/whitelisted for this account on Bulk's side.
 # Must be a valid base58-encoded Ed25519 public key.
 oracle_account_pubkey_base58 = "your-base58-encoded-oracle-account-pubkey"
 
+# BULK network this pusher signs for: "mainnet", "testnet", or "devnet".
+# REQUIRED - there is no default.
+# Must match the network that the endpoints above belong to. The domain is committed
+# into the signature but is NOT sent over the wire, so a wrong value yields a
+# well-formed transaction that the validator silently rejects as a bad signature.
+# Can also be set via BULK_PUSHER__BULK__SIGNATURE_DOMAIN env var.
+signature_domain = "mainnet"
+
 # Feed Configuration
 [feeds]
 # How often to batch and push prices (should match Bulk's expected interval)

apps/pyth-lazer-pusher/bulk-trade-pusher/config.example.toml

@@ -1,4 +1,5 @@
 use anyhow::Context as _;
+use bulk_keychain::SignatureDomain;
 use config::{Environment, File};
 use pusher_base::BaseConfig;
 use serde::Deserialize;
@@ -41,6 +42,14 @@ pub struct BulkConfig {
     /// This is the "account" field in the transaction - shared by all pushers.
     /// The signing key must be approved/whitelisted for this account.
     pub oracle_account_pubkey_base58: String,
+
+    /// BULK network the transactions are signed for ("mainnet", "testnet", or "devnet").
+    ///
+    /// Required - there is deliberately no default. The domain is committed into the
+    /// signature preimage but is *not* part of the transaction sent over the wire, so a
+    /// wrong value produces a well-formed transaction that the validator silently rejects
+    /// as an invalid signature. Failing at startup is much easier to diagnose than guessing.
+    pub signature_domain: SignatureDomain,
 }
 
 /// Load configuration from a TOML file and validate it.

apps/pyth-lazer-pusher/bulk-trade-pusher/src/config.rs

@@ -19,11 +19,16 @@ pub async fn run(config: Config, runtime: AppRuntime) -> Result<()> {
     info!("initializing bulk-trade-pusher");
 
     let signing_key = load_signing_key(&config.bulk.signing_key_path)?;
-    let signer = BulkSigner::new(&signing_key, &config.bulk.oracle_account_pubkey_base58)
-        .context("failed to initialize signer")?;
+    let signer = BulkSigner::new(
+        &signing_key,
+        &config.bulk.oracle_account_pubkey_base58,
+        config.bulk.signature_domain,
+    )
+    .context("failed to initialize signer")?;
     info!(
         signer_pubkey = signer.pubkey_base58(),
         oracle_account = %config.bulk.oracle_account_pubkey_base58,
+        signature_domain = %config.bulk.signature_domain,
         "initialized signer"
     );
 

apps/pyth-lazer-pusher/bulk-trade-pusher/src/pusher.rs

@@ -6,7 +6,9 @@
 //! the account.
 
 use anyhow::Result;
-use bulk_keychain::{Action, Keypair, Pubkey, PythOraclePrice, SignedTransaction, Signer};
+use bulk_keychain::{
+    Action, Keypair, Pubkey, PythOraclePrice, SignatureDomain, SignedTransaction, Signer,
+};
 
 /// Wrapper for signing keys using bulk-keychain.
 ///
@@ -21,15 +23,23 @@ pub struct BulkSigner {
 
 impl BulkSigner {
     /// Create a new signer from a base58-encoded private key and oracle account.
-    pub fn new(private_key_base58: &str, oracle_account_base58: &str) -> Result<Self> {
+    ///
+    /// `signature_domain` selects the BULK network the signature commits to; it must
+    /// match the network the configured validator endpoints belong to, otherwise the
+    /// signature is rejected (see `BulkConfig::signature_domain`).
+    pub fn new(
+        private_key_base58: &str,
+        oracle_account_base58: &str,
+        signature_domain: SignatureDomain,
+    ) -> Result<Self> {
         let keypair = Keypair::from_base58(private_key_base58)
             .map_err(|e| anyhow::anyhow!("failed to parse keypair: {}", e))?;
 
         let oracle_account = Pubkey::from_base58(oracle_account_base58)
             .map_err(|e| anyhow::anyhow!("failed to parse oracle account pubkey: {}", e))?;
 
         let pubkey_base58 = keypair.pubkey().to_string();
-        let signer = Signer::new(keypair);
+        let signer = Signer::new(keypair, signature_domain);
 
         Ok(Self {
             signer,
@@ -66,33 +76,39 @@ mod tests {
     // Test keypair (generated offline, safe for tests only)
     const TEST_PRIVATE_KEY_BASE58: &str = "4wBqpZM9k1k4reVTJezJTqcPYLkuJSYwZYfwJC3xjYw9";
 
+    const TEST_DOMAIN: SignatureDomain = SignatureDomain::Devnet;
+
     fn test_oracle_account() -> String {
         // Use the signer's own pubkey as oracle account for tests
         let keypair = Keypair::from_base58(TEST_PRIVATE_KEY_BASE58).unwrap();
         keypair.pubkey().to_string()
     }
 
+    fn test_signer() -> BulkSigner {
+        BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &test_oracle_account(), TEST_DOMAIN).unwrap()
+    }
+
     #[test]
     fn test_signer_creation() {
-        let signer = BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &test_oracle_account()).unwrap();
+        let signer = test_signer();
         assert!(!signer.pubkey_base58().is_empty());
     }
 
     #[test]
     fn test_signer_invalid_key() {
-        let result = BulkSigner::new("invalid-key", "invalid-account");
+        let result = BulkSigner::new("invalid-key", "invalid-account", TEST_DOMAIN);
         assert!(result.is_err());
     }
 
     #[test]
     fn test_signer_empty_key() {
-        let result = BulkSigner::new("", "");
+        let result = BulkSigner::new("", "", TEST_DOMAIN);
         assert!(result.is_err());
     }
 
     #[test]
     fn test_sign_transaction() {
-        let mut signer = BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &test_oracle_account()).unwrap();
+        let mut signer = test_signer();
 
         let oracles = vec![PythOraclePrice {
             timestamp: 1704067200000,
@@ -112,7 +128,8 @@ mod tests {
     #[test]
     fn test_sign_transaction_multiple_oracles() {
         let oracle_account = test_oracle_account();
-        let mut signer = BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &oracle_account).unwrap();
+        let mut signer =
+            BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &oracle_account, TEST_DOMAIN).unwrap();
 
         let oracles = vec![
             PythOraclePrice {
@@ -149,7 +166,8 @@ mod tests {
     fn test_sign_transaction_uses_oracle_account() {
         // Verify the transaction uses the oracle account, not the signer's own pubkey
         let oracle_account = test_oracle_account();
-        let mut signer = BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &oracle_account).unwrap();
+        let mut signer =
+            BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &oracle_account, TEST_DOMAIN).unwrap();
 
         let oracles = vec![PythOraclePrice {
             timestamp: 1000,
@@ -164,9 +182,42 @@ mod tests {
         assert_eq!(tx.signer, signer.pubkey_base58());
     }
 
+    #[test]
+    fn test_signature_domain_changes_signature() {
+        // The domain is committed into the signature preimage but is not part of the
+        // transaction payload, so a mismatch is only observable as a rejected signature.
+        // Signing identical input under different domains must diverge.
+        let oracle_account = test_oracle_account();
+        let oracles = vec![PythOraclePrice {
+            timestamp: 1000,
+            feed_index: 1,
+            price: 100,
+            exponent: -2,
+        }];
+
+        let sign_with = |domain| {
+            BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &oracle_account, domain)
+                .unwrap()
+                .sign_transaction(oracles.clone(), 42)
+                .unwrap()
+        };
+
+        let mainnet = sign_with(SignatureDomain::Mainnet);
+        let testnet = sign_with(SignatureDomain::Testnet);
+        let devnet = sign_with(SignatureDomain::Devnet);
+
+        assert_ne!(mainnet.signature, testnet.signature);
+        assert_ne!(mainnet.signature, devnet.signature);
+        assert_ne!(testnet.signature, devnet.signature);
+
+        // The domain must not leak into the serialized payload.
+        let json = serde_json::to_string(&mainnet).unwrap();
+        assert!(!json.contains("mainnet"));
+    }
+
     #[test]
     fn test_deterministic_signature() {
-        let mut signer = BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &test_oracle_account()).unwrap();
+        let mut signer = test_signer();
 
         let oracles = vec![PythOraclePrice {
             timestamp: 1000,
@@ -184,7 +235,7 @@ mod tests {
 
     #[test]
     fn test_different_nonce_different_signature() {
-        let mut signer = BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &test_oracle_account()).unwrap();
+        let mut signer = test_signer();
 
         let oracles1 = vec![PythOraclePrice {
             timestamp: 1000,
@@ -202,7 +253,7 @@ mod tests {
 
     #[test]
     fn test_transaction_json_format() {
-        let mut signer = BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &test_oracle_account()).unwrap();
+        let mut signer = test_signer();
 
         let oracles = vec![
             PythOraclePrice {
@@ -249,7 +300,7 @@ mod tests {
         use bulk_keychain::ed25519_dalek::{Signature, Verifier, VerifyingKey};
 
         let keypair = Keypair::from_base58(TEST_PRIVATE_KEY_BASE58).unwrap();
-        let mut signer = BulkSigner::new(TEST_PRIVATE_KEY_BASE58, &test_oracle_account()).unwrap();
+        let mut signer = test_signer();
 
         let oracles = vec![PythOraclePrice {
             timestamp: 1704067200000,

apps/pyth-lazer-pusher/bulk-trade-pusher/src/signing.rs

@@ -19,6 +19,8 @@ endpoints = [
 ]
 signing_key_path = "/secrets/signing.key"
 oracle_account_pubkey_base58 = "gCGUPL8RFfxndjVYrAQL3z28XtQjY2zJcFu7Tk3CT9Z"
+# Local dev targets the mock validator, which does not verify signatures.
+signature_domain = "devnet"
 
 [feeds]
 update_interval = "500ms"