shadow-signers: support for EVM

.changeset/cyan-coats-invite.md

@@ -0,0 +1,7 @@
+---
+"@crossmint/wallets-sdk": minor
+"@crossmint/client-sdk-react-native-ui": patch
+"@crossmint/common-sdk-base": patch
+---
+
+Support EVM Shadow Signers

packages/common/base/src/types/signers.ts

@@ -25,3 +25,8 @@ export type SolanaExternalWalletSignerConfig = BaseExternalWalletSignerConfig &
 export type StellarExternalWalletSignerConfig = BaseExternalWalletSignerConfig & {
     onSignStellarTransaction?: (transaction: string) => Promise<string>;
 };
+
+export type P256KeypairSignerConfig = {
+    type: "p256-keypair";
+    address: string;
+};

packages/wallets/src/signers/evm-external-wallet.ts

@@ -2,18 +2,31 @@ import type { Account, EIP1193Provider as ViemEIP1193Provider } from "viem";
 import type { GenericEIP1193Provider, ExternalWalletInternalSignerConfig } from "./types";
 import type { EVMChain } from "@/chains/chains";
 import { ExternalWalletSigner } from "./external-wallet-signer";
+import { EVMShadowSigner, type ShadowSignerStorage } from "./shadow-signer";
 
 export class EVMExternalWalletSigner extends ExternalWalletSigner<EVMChain> {
     provider?: GenericEIP1193Provider | ViemEIP1193Provider;
     viemAccount?: Account;
+    protected shadowSigner?: EVMShadowSigner;
+    protected shadowSignerStorage?: ShadowSignerStorage;
 
-    constructor(config: ExternalWalletInternalSignerConfig<EVMChain>) {
+    constructor(
+        config: ExternalWalletInternalSignerConfig<EVMChain>,
+        walletAddress?: string,
+        shadowSignerEnabled?: boolean,
+        shadowSignerStorage?: ShadowSignerStorage
+    ) {
         super(config);
         this.provider = config.provider;
         this.viemAccount = config.viemAccount;
+        this.shadowSignerStorage = shadowSignerStorage;
+        this.shadowSigner = new EVMShadowSigner(walletAddress, this.shadowSignerStorage, shadowSignerEnabled);
     }
 
     async signMessage(message: string) {
+        if (this.shadowSigner?.hasShadowSigner()) {
+            return await this.shadowSigner.signTransaction(message);
+        }
         if (this.provider != null) {
             const signature = await this.provider.request({
                 method: "personal_sign",
@@ -43,6 +56,9 @@ export class EVMExternalWalletSigner extends ExternalWalletSigner<EVMChain> {
     }
 
     async signTransaction(transaction: string) {
+        if (this.shadowSigner?.hasShadowSigner()) {
+            return await this.shadowSigner.signTransaction(transaction);
+        }
         return await this.signMessage(transaction);
     }
 }

packages/wallets/src/signers/index.ts

@@ -7,6 +7,7 @@ import { SolanaApiKeySigner } from "./solana-api-key";
 import type { Chain } from "../chains/chains";
 import type { InternalSignerConfig, Signer } from "./types";
 import { StellarExternalWalletSigner } from "./stellar-external-wallet";
+import { P256KeypairSigner } from "./p256-keypair";
 import type { ShadowSignerStorage } from "./shadow-signer";
 
 export function assembleSigner<C extends Chain>(
@@ -25,7 +26,7 @@ export function assembleSigner<C extends Chain>(
             if (chain === "stellar") {
                 return new StellarNonCustodialSigner(config, walletAddress, shadowSignerEnabled, shadowSignerStorage);
             }
-            return new EVMNonCustodialSigner(config, shadowSignerStorage);
+            return new EVMNonCustodialSigner(config, walletAddress, shadowSignerEnabled, shadowSignerStorage);
         case "api-key":
             return chain === "solana" ? new SolanaApiKeySigner(config) : new EVMApiKeySigner(config);
 
@@ -36,9 +37,12 @@ export function assembleSigner<C extends Chain>(
             if (chain === "stellar") {
                 return new StellarExternalWalletSigner(config, walletAddress, shadowSignerEnabled, shadowSignerStorage);
             }
-            return new EVMExternalWalletSigner(config);
+            return new EVMExternalWalletSigner(config, walletAddress, shadowSignerEnabled, shadowSignerStorage);
 
+        case "p256-keypair": {
+            return new P256KeypairSigner(config);
+        }
         case "passkey":
-            return new PasskeySigner(config);
+            return new PasskeySigner(config, walletAddress, shadowSignerEnabled, shadowSignerStorage);
     }
 }

packages/wallets/src/signers/non-custodial/ncs-evm-signer.ts

@@ -1,20 +1,18 @@
-import type {
-    EmailInternalSignerConfig,
-    ExternalWalletInternalSignerConfig,
-    PhoneInternalSignerConfig,
-} from "../types";
 import { NonCustodialSigner, DEFAULT_EVENT_OPTIONS } from "./ncs-signer";
 import { PersonalMessage } from "ox";
 import { isHex, toHex, type Hex } from "viem";
-import type { EVMChain } from "../../chains/chains";
-import type { ShadowSignerStorage } from "../shadow-signer";
+import type { EmailInternalSignerConfig, PhoneInternalSignerConfig } from "../types";
+import { EVMShadowSigner, type ShadowSignerStorage } from "../shadow-signer";
 
 export class EVMNonCustodialSigner extends NonCustodialSigner {
     constructor(
         config: EmailInternalSignerConfig | PhoneInternalSignerConfig,
+        walletAddress: string,
+        shadowSignerEnabled: boolean,
         shadowSignerStorage?: ShadowSignerStorage
     ) {
         super(config, shadowSignerStorage);
+        this.shadowSigner = new EVMShadowSigner(walletAddress, this.shadowSignerStorage, shadowSignerEnabled);
     }
 
     async signMessage(message: string) {
@@ -24,6 +22,9 @@ export class EVMNonCustodialSigner extends NonCustodialSigner {
     }
 
     async signTransaction(transaction: string): Promise<{ signature: string }> {
+        if (this.shadowSigner?.hasShadowSigner()) {
+            return await this.shadowSigner.signTransaction(transaction);
+        }
         return await this.sign(transaction);
     }
 
@@ -74,10 +75,6 @@ export class EVMNonCustodialSigner extends NonCustodialSigner {
         }
     }
 
-    protected getShadowSignerConfig(): ExternalWalletInternalSignerConfig<EVMChain> {
-        throw new Error("Shadow signer not implemented for EVM chains");
-    }
-
     protected getChainKeyParams(): { scheme: "secp256k1"; encoding: "hex" } {
         return {
             scheme: "secp256k1",

packages/wallets/src/signers/non-custodial/ncs-signer.ts

@@ -21,7 +21,7 @@ export abstract class NonCustodialSigner implements Signer {
         reject: (error: Error) => void;
     } | null = null;
     private _initializationPromise: Promise<void> | null = null;
-    protected shadowSigner?: ShadowSigner<Chain>;
+    protected shadowSigner?: ShadowSigner<Chain, Signer, any>;
     protected shadowSignerStorage?: ShadowSignerStorage;
 
     constructor(

packages/wallets/src/signers/p256-keypair.ts

@@ -0,0 +1,79 @@
+import type { Signer, P256KeypairInternalSignerConfig } from "./types";
+import { keccak256, sha256, toHex } from "viem";
+
+export class P256KeypairSigner implements Signer {
+    type = "p256-keypair" as const;
+    private _address: string;
+    private _locator: string;
+    private onSignTransaction: (publicKeyBase64: string, data: Uint8Array) => Promise<Uint8Array>;
+    private readonly STUB_ORIGIN = "https://crossmint.com";
+
+    constructor(config: P256KeypairInternalSignerConfig) {
+        this._address = config.address;
+        this._locator = config.locator;
+        this.onSignTransaction = config.onSignTransaction;
+    }
+
+    address() {
+        return this._address;
+    }
+
+    locator() {
+        return this._locator;
+    }
+
+    async signMessage(message: string): Promise<{ signature: string }> {
+        return await this.createWebAuthnSignature(message);
+    }
+
+    async signTransaction(transaction: string): Promise<{ signature: string }> {
+        return await this.createWebAuthnSignature(transaction);
+    }
+
+    private async createWebAuthnSignature(challenge: string): Promise<{ signature: string }> {
+        const STUB_ORIGIN = "https://crossmint.com";
+
+        // 1. Create clientDataJSON with base64url encoded challenge
+        const challengeHex = challenge.replace("0x", "");
+        const challengeBase64 = Buffer.from(challengeHex, "hex").toString("base64");
+        const challengeBase64url = challengeBase64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+
+        const clientDataJSON = JSON.stringify({
+            type: "webauthn.get",
+            challenge: challengeBase64url,
+            origin: STUB_ORIGIN,
+            crossOrigin: false,
+        });
+
+        // 2. Create authenticatorData
+        // IMPORTANT: Use keccak256 for rpIdHash to match backend (line 182 in backend)
+        const originBytes = new TextEncoder().encode(STUB_ORIGIN);
+        const rpIdHash = keccak256(toHex(originBytes));
+
+        // flags: 0x05 = User Present (0x01) + User Verified (0x04)
+        const flags = "05";
+
+        // signCount: 4 bytes, all zeros
+        const signCount = "00000000";
+
+        const authenticatorData = (rpIdHash + flags + signCount) as `0x${string}`;
+
+        // 3. Create signature message: authenticatorData + sha256(clientDataJSON)
+        // This matches what the backend expects and what WebAuthn spec requires
+        const clientDataJSONBytes = new TextEncoder().encode(clientDataJSON);
+        const clientDataHash = sha256(toHex(clientDataJSONBytes));
+
+        const signatureMessage = (authenticatorData + clientDataHash.slice(2)) as `0x${string}`;
+
+        // 4. Sign with P256 private key
+        // Web Crypto API will internally do: sign(sha256(signatureMessage))
+        const signatureMessageBytes = new Uint8Array(Buffer.from(signatureMessage.slice(2), "hex"));
+        const signatureBytes = await this.onSignTransaction(this.address(), signatureMessageBytes);
+
+        // 5. Return r + s as hex string
+        const rHex = Buffer.from(signatureBytes.slice(0, 32)).toString("hex").padStart(64, "0");
+        const sHex = Buffer.from(signatureBytes.slice(32, 64)).toString("hex").padStart(64, "0");
+
+        return { signature: "0x" + rHex + sHex };
+    }
+}

packages/wallets/src/signers/passkey.ts

@@ -1,19 +1,35 @@
 import { WebAuthnP256 } from "ox";
 import type { PasskeyInternalSignerConfig, PasskeySignResult, Signer } from "./types";
+import { EVMShadowSigner, type ShadowSignerStorage } from "./shadow-signer";
 
 export class PasskeySigner implements Signer {
     type = "passkey" as const;
     id: string;
+    protected shadowSigner?: EVMShadowSigner;
+    protected shadowSignerStorage?: ShadowSignerStorage;
 
-    constructor(private config: PasskeyInternalSignerConfig) {
+    constructor(
+        private config: PasskeyInternalSignerConfig,
+        walletAddress?: string,
+        shadowSignerEnabled?: boolean,
+        shadowSignerStorage?: ShadowSignerStorage
+    ) {
         this.id = config.id;
+        this.shadowSignerStorage = shadowSignerStorage;
+        this.shadowSigner = new EVMShadowSigner(walletAddress, this.shadowSignerStorage, shadowSignerEnabled);
     }
 
     locator() {
+        if (this.shadowSigner?.hasShadowSigner()) {
+            return this.shadowSigner.locator();
+        }
         return this.config.locator;
     }
 
-    async signMessage(message: string): Promise<PasskeySignResult> {
+    async signMessage(message: string): Promise<PasskeySignResult | { signature: string }> {
+        if (this.shadowSigner?.hasShadowSigner()) {
+            return this.shadowSigner.signTransaction(message);
+        }
         if (this.config.onSignWithPasskey) {
             return await this.config.onSignWithPasskey(message);
         }

packages/wallets/src/signers/shadow-signer/evm-shadow-signer.ts

@@ -0,0 +1,26 @@
+import { ShadowSigner } from "./shadow-signer";
+import type { EVMSmartWalletChain } from "@/chains/chains";
+import type { P256KeypairInternalSignerConfig } from "../types";
+import type { ShadowSignerData } from "./utils";
+import { P256KeypairSigner } from "../p256-keypair";
+
+export class EVMShadowSigner extends ShadowSigner<
+    EVMSmartWalletChain,
+    P256KeypairSigner,
+    P256KeypairInternalSignerConfig
+> {
+    protected getWrappedSignerClass() {
+        return P256KeypairSigner;
+    }
+
+    getShadowSignerConfig(shadowData: ShadowSignerData): P256KeypairInternalSignerConfig {
+        return {
+            type: "p256-keypair",
+            address: shadowData.publicKeyBase64,
+            locator: `p256-keypair:${shadowData.publicKeyBase64}`,
+            onSignTransaction: async (pubKey: string, data: Uint8Array) => {
+                return await this.storage.sign(pubKey, data);
+            },
+        };
+    }
+}

packages/wallets/src/signers/shadow-signer/index.ts

@@ -18,3 +18,4 @@ export { ShadowSigner } from "./shadow-signer";
 export type { ShadowSigner as ShadowSignerType } from "./shadow-signer";
 export { SolanaShadowSigner } from "./solana-shadow-signer";
 export { StellarShadowSigner } from "./stellar-shadow-signer";
+export { EVMShadowSigner } from "./evm-shadow-signer";

packages/wallets/src/signers/shadow-signer/shadow-signer-storage-browser.ts

@@ -1,4 +1,5 @@
 import type { ShadowSignerData, ShadowSignerStorage } from "./utils";
+import type { Chain } from "../../chains/chains";
 
 export class BrowserShadowSignerStorage implements ShadowSignerStorage {
     private readonly SHADOW_SIGNER_DB_NAME = "crossmint_shadow_keys";
@@ -19,12 +20,32 @@ export class BrowserShadowSignerStorage implements ShadowSignerStorage {
         });
     }
 
-    async keyGenerator(): Promise<string> {
+    async keyGenerator(chain: Chain): Promise<string> {
+        if (chain === "solana" || chain === "stellar") {
+            const keyPair = (await window.crypto.subtle.generateKey(
+                {
+                    name: "Ed25519",
+                    namedCurve: "Ed25519",
+                } as AlgorithmIdentifier,
+                false,
+                ["sign", "verify"]
+            )) as CryptoKeyPair;
+
+            const publicKeyBuffer = await window.crypto.subtle.exportKey("raw", keyPair.publicKey);
+            const publicKeyBytes = new Uint8Array(publicKeyBuffer);
+            const publicKeyBase64 = Buffer.from(publicKeyBytes).toString("base64");
+
+            await this.storePrivateKeyByPublicKey(publicKeyBase64, keyPair.privateKey);
+
+            return publicKeyBase64;
+        }
+
+        // For EVM chains, use P256 (secp256r1)
         const keyPair = (await window.crypto.subtle.generateKey(
             {
-                name: "Ed25519",
-                namedCurve: "Ed25519",
-            } as AlgorithmIdentifier,
+                name: "ECDSA",
+                namedCurve: "P-256",
+            },
             false,
             ["sign", "verify"]
         )) as CryptoKeyPair;
@@ -44,6 +65,22 @@ export class BrowserShadowSignerStorage implements ShadowSignerStorage {
             throw new Error(`No private key found for public key: ${publicKeyBase64}`);
         }
 
+        const algorithmName = privateKey.algorithm.name;
+
+        if (algorithmName === "ECDSA") {
+            // For P256, use ECDSA with SHA-256
+            const signature = await window.crypto.subtle.sign(
+                {
+                    name: "ECDSA",
+                    hash: { name: "SHA-256" },
+                },
+                privateKey,
+                data as BufferSource
+            );
+            return new Uint8Array(signature);
+        }
+
+        // Default to Ed25519 for Solana/Stellar
         const signature = await window.crypto.subtle.sign({ name: "Ed25519" }, privateKey, data as BufferSource);
 
         return new Uint8Array(signature);