feat(server): initial EVM functionality impl

server/crates/arbiter-server/src/evm/mod.rs

@@ -0,0 +1,132 @@
+pub mod safe_signer;
+
+use alloy::{
+    consensus::TxEip1559,
+    primitives::TxKind,
+};
+use diesel::insert_into;
+use diesel_async::{AsyncConnection, RunQueryDsl};
+
+use crate::{
+    db::{
+        self,
+        models::{EvmBasicGrant, NewEvmBasicGrant, SqliteTimestamp}, schema,
+    },
+    evm::policies::{
+        EvalContext, FullGrant, Policy, SpecificMeaning, ether_transfer::EtherTransfer
+    },
+};
+
+pub mod policies;
+mod utils;
+
+#[derive(Debug, thiserror::Error, miette::Diagnostic)]
+pub enum AnalyzeError {
+    #[error("Engine doesn't support granting permissions for contract creation")]
+    #[diagnostic(code(arbiter_server::evm::analyze_error::contract_creation_not_supported))]
+    ContractCreationNotSupported,
+
+    #[error("Unsupported transaction type")]
+    #[diagnostic(code(arbiter_server::evm::analyze_error::unsupported_transaction_type))]
+    UnsupportedTransactionType,
+}
+
+#[derive(Debug, thiserror::Error, miette::Diagnostic)]
+pub enum CreationError {
+    #[error("Database connection pool error")]
+    #[diagnostic(code(arbiter_server::evm::creation_error::database_error))]
+    Pool(#[from] db::PoolError),
+
+    #[error("Database returned error")]
+    #[diagnostic(code(arbiter_server::evm::creation_error::database_error))]
+    Database(#[from] diesel::result::Error),
+}
+
+// Supporting only EIP-1559 transactions for now, but we can easily extend this to support legacy transactions if needed
+pub struct Engine {
+    db: db::DatabasePool,
+}
+
+impl Engine {
+    pub fn new(db: db::DatabasePool) -> Self {
+        Self { db }
+    }
+
+    pub async fn create_grant<P: Policy>(
+        &self,
+        client_id: i32,
+        full_grant: FullGrant<P::Grant>,
+    ) -> Result<i32, CreationError> {
+        let mut conn = self.db.get().await?;
+
+        let id = conn.transaction(|conn| {
+            Box::pin(async move {
+                use schema::evm_basic_grant;
+
+                let basic_grant: EvmBasicGrant = insert_into(evm_basic_grant::table)
+                    .values(&NewEvmBasicGrant {
+                        wallet_id: full_grant.basic.wallet_id,
+                        chain_id: full_grant.basic.chain as i32,
+                        client_id: client_id,
+                        valid_from: full_grant.basic.valid_from.map(SqliteTimestamp),
+                        valid_until: full_grant.basic.valid_until.map(SqliteTimestamp),
+                        max_gas_fee_per_gas: full_grant
+                            .basic
+                            .max_gas_fee_per_gas
+                            .map(|fee| utils::u256_to_bytes(fee).to_vec()),
+                        max_priority_fee_per_gas: full_grant
+                            .basic
+                            .max_priority_fee_per_gas
+                            .map(|fee| utils::u256_to_bytes(fee).to_vec()),
+                        rate_limit_count: full_grant
+                            .basic
+                            .rate_limit
+                            .as_ref()
+                            .map(|rl| rl.count as i32),
+                        rate_limit_window_secs: full_grant
+                            .basic
+                            .rate_limit
+                            .as_ref()
+                            .map(|rl| rl.window.num_seconds() as i32),
+                        revoked_at: None,
+                    })
+                    .returning(evm_basic_grant::all_columns)
+                    .get_result(conn)
+                    .await?;
+
+                P::create_grant(&basic_grant, &full_grant.specific, conn).await
+            })
+        })
+        .await?;
+
+        Ok(id)
+    }
+
+    async fn perform_transaction<P: Policy>(&self, _context: EvalContext, _meaning: &P::Meaning) {
+    }
+
+    pub async fn analyze_transaction(
+        &self,
+        wallet_id: i32,
+        client_id: i32,
+        transaction: TxEip1559,
+    ) -> Result<SpecificMeaning, AnalyzeError> {
+        let TxKind::Call(to) = transaction.to else {
+            return Err(AnalyzeError::ContractCreationNotSupported);
+        };
+        let context = policies::EvalContext {
+            wallet_id,
+            client_id,
+            chain: transaction.chain_id,
+            to: to,
+            value: transaction.value,
+            calldata: transaction.input.clone(),
+        };
+
+       
+        if let Some(meaning) = EtherTransfer::analyze(&context) {
+            return Ok(SpecificMeaning::EtherTransfer(meaning));
+        }
+        Err(AnalyzeError::UnsupportedTransactionType)
+    }
+}

server/crates/arbiter-server/src/evm/policies.rs

@@ -0,0 +1,129 @@
+use std::fmt::Display;
+
+use alloy::primitives::{Address, Bytes, ChainId, U256};
+use chrono::{DateTime, Duration, Utc};
+use diesel::{result::QueryResult, sqlite::Sqlite};
+use diesel_async::AsyncConnection;
+use miette::Diagnostic;
+use thiserror::Error;
+
+use crate::db::models;
+
+pub mod ether_transfer;
+
+pub struct EvalContext {
+    // Which wallet is this transaction for
+    pub client_id: i32,
+    pub wallet_id: i32,
+
+    // The transaction data
+    pub chain: ChainId,
+    pub to: Address,
+    pub value: U256,
+    pub calldata: Bytes,
+}
+
+#[derive(Debug, Error, Diagnostic)]
+pub enum EvalViolation {
+    #[error("This grant doesn't allow transactions to the target address {target}")]
+    #[diagnostic(code(arbiter_server::evm::eval_violation::invalid_target))]
+    InvalidTarget { target: Address },
+
+    #[error("Gas limit exceeded for this grant")]
+    #[diagnostic(code(arbiter_server::evm::eval_violation::gas_limit_exceeded))]
+    GasLimitExceeded {
+        max_gas_fee_per_gas: Option<U256>,
+        max_priority_fee_per_gas: Option<U256>,
+    },
+
+    #[error("Rate limit exceeded for this grant")]
+    #[diagnostic(code(arbiter_server::evm::eval_violation::rate_limit_exceeded))]
+    RateLimitExceeded,
+
+    #[error("Transaction exceeds volumetric limits of the grant")]
+    #[diagnostic(code(arbiter_server::evm::eval_violation::volumetric_limit_exceeded))]
+    VolumetricLimitExceeded,
+
+    #[error("Transaction is outside of the grant's validity period")]
+    #[diagnostic(code(arbiter_server::evm::eval_violation::invalid_time))]
+    InvalidTime,
+}
+
+pub type DatabaseID = i32;
+
+pub struct GrantMetadata {
+    pub basic_grant_id: DatabaseID,
+    pub policy_grant_id: DatabaseID,
+}
+
+pub trait Policy: Sized {
+    type Grant: Send + 'static + Into<SpecificGrant>;
+    type Meaning: Display + Send + 'static + Into<SpecificMeaning>;
+
+    fn analyze(context: &EvalContext) -> Option<Self::Meaning>;
+
+    // Evaluate whether a transaction with the given meaning complies with the provided grant, and return any violations if not
+    // Empty vector means transaction is compliant with the grant
+    fn evaluate(
+        meaning: &Self::Meaning,
+        grant: &Self::Grant,
+        meta: &GrantMetadata,
+        db: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> impl Future<Output = QueryResult<Vec<EvalViolation>>> + Send;
+
+    // Create a new grant in the database based on the provided grant details, and return its ID
+    fn create_grant(
+        basic: &models::EvmBasicGrant,
+        grant: &Self::Grant,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> impl std::future::Future<Output = QueryResult<DatabaseID>> + Send;
+
+    // Try to find an existing grant that matches the transaction context, and return its details if found
+    // Additionally, return ID of basic grant for shared-logic checks like rate limits and validity periods
+    fn try_find_grant(
+        context: &EvalContext,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> impl Future<Output = QueryResult<Option<(Self::Grant, GrantMetadata)>>>;
+
+    // Records, updates or deletes rate limits
+    // In other words, records grant-specific things after transaction is executed
+    fn record_transaction(
+        context: &EvalContext,
+        grant: &GrantMetadata,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> impl Future<Output = QueryResult<()>>;
+}
+
+// Classification of what transaction does
+pub enum SpecificMeaning {
+    EtherTransfer(ether_transfer::Meaning),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct TransactionRateLimit {
+    pub count: u32,
+    pub window: Duration,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct BasicGrant {
+    pub wallet_id: i32,
+    pub chain: ChainId,
+
+    pub valid_from: Option<DateTime<Utc>>,
+    pub valid_until: Option<DateTime<Utc>>,
+
+    pub max_gas_fee_per_gas: Option<U256>,
+    pub max_priority_fee_per_gas: Option<U256>,
+
+    pub rate_limit: Option<TransactionRateLimit>,
+}
+
+pub enum SpecificGrant {
+    EtherTransfer(ether_transfer::Grant),
+}
+
+pub struct FullGrant<PolicyGrant> {
+    pub basic: BasicGrant,
+    pub specific: PolicyGrant,
+}

server/crates/arbiter-server/src/evm/policies/ether_transfer.rs

@@ -0,0 +1,310 @@
+use std::{fmt::Display, time::Duration};
+
+use alloy::primitives::{Address, U256};
+use chrono::{DateTime, Utc};
+use diesel::dsl::insert_into;
+use diesel::sqlite::Sqlite;
+use diesel::{ExpressionMethods, JoinOnDsl, prelude::*};
+use diesel_async::{AsyncConnection, RunQueryDsl};
+
+use crate::db::models::{
+    EvmEtherTransferGrant, EvmEtherTransferGrantTarget, EvmEtherTransferVolumeLimit, SqliteTimestamp,
+};
+use crate::evm::policies::{GrantMetadata, SpecificGrant, SpecificMeaning};
+use crate::{
+    db::{
+        models::{
+            self, NewEvmEtherTransferGrant, NewEvmEtherTransferGrantTarget,
+            NewEvmEtherTransferVolumeLimit,
+        },
+        schema::{
+            evm_ether_transfer_grant, evm_ether_transfer_grant_target,
+            evm_ether_transfer_volume_limit,
+        },
+    },
+    evm::{policies::Policy, utils},
+};
+
+use super::{DatabaseID, EvalContext, EvalViolation};
+
+// Plain ether transfer
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct Meaning {
+    to: Address,
+    value: U256,
+}
+impl Display for Meaning {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "Ether transfer of {} to {}",
+            self.value,
+            self.to.to_string()
+        )
+    }
+}
+impl Into<SpecificMeaning> for Meaning {
+    fn into(self) -> SpecificMeaning {
+        SpecificMeaning::EtherTransfer(self)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct VolumeLimit {
+    window: Duration,
+    max_volume: U256,
+}
+
+// A grant for ether transfers, which can be scoped to specific target addresses and volume limits
+pub struct Grant {
+    target: Vec<Address>,
+    limits: Vec<VolumeLimit>,
+}
+
+impl Into<SpecificGrant> for Grant {
+    fn into(self) -> SpecificGrant {
+        SpecificGrant::EtherTransfer(self)
+    }
+}
+
+async fn query_relevant_past_transaction(
+    grant_id: i32,
+    longest_window: Duration,
+    db: &mut impl AsyncConnection<Backend = Sqlite>,
+) -> QueryResult<Vec<(U256, DateTime<Utc>)>> {
+    use crate::db::schema::evm_ether_transfer_log;
+    let past_transactions: Vec<(Vec<u8>, SqliteTimestamp)> =
+        evm_ether_transfer_log::table
+            .filter(evm_ether_transfer_log::grant_id.eq(grant_id))
+            .filter(
+                evm_ether_transfer_log::created_at
+                    .ge(SqliteTimestamp(chrono::Utc::now() - longest_window)),
+            )
+            .select((
+                evm_ether_transfer_log::value,
+                evm_ether_transfer_log::created_at,
+            ))
+            .load(db)
+            .await?;
+    let past_transaction: Vec<(U256, DateTime<Utc>)> = past_transactions
+        .into_iter()
+        .filter_map(|(value_bytes, timestamp)| {
+            let value = utils::bytes_to_u256(&value_bytes)?;
+            Some((value, timestamp.0))
+        })
+        .collect();
+    Ok(past_transaction)
+}
+
+async fn check_rate_limits(
+    grant: &Grant,
+    meta: &GrantMetadata,
+    db: &mut impl AsyncConnection<Backend = Sqlite>,
+) -> QueryResult<Vec<EvalViolation>> {
+    let mut violations = Vec::new();
+    // This has double meaning: checks for limit presence, and finds biggest window
+    // to extract all needed historical transactions in one go later
+    let longest_window = grant.limits.iter().map(|limit| limit.window).max();
+
+    if let Some(longest_window) = longest_window {
+        let _past_transaction = query_relevant_past_transaction(meta.policy_grant_id, longest_window, db).await?;
+
+        for limit in &grant.limits {
+            let window_start = chrono::Utc::now() - limit.window;
+            let cumulative_volume: U256 = _past_transaction
+                .iter()
+                .filter(|(_, timestamp)| timestamp >= &window_start)
+                .fold(U256::default(), |acc, (value, _)| acc + *value);
+
+            if cumulative_volume > limit.max_volume {
+                violations.push(EvalViolation::VolumetricLimitExceeded);
+            }
+        }
+        // TODO: Implement actual rate limit checking logic
+    }
+
+    Ok(violations)
+}
+
+pub struct EtherTransfer;
+impl Policy for EtherTransfer {
+    type Grant = Grant;
+
+    type Meaning = Meaning;
+
+    fn analyze(context: &EvalContext) -> Option<Self::Meaning> {
+        if !context.calldata.is_empty() {
+            return None;
+        }
+
+        Some(Meaning {
+            to: context.to,
+            value: context.value,
+        })
+    }
+
+    async fn evaluate(
+        meaning: &Self::Meaning,
+        grant: &Self::Grant,
+        meta: &GrantMetadata,
+        db: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> QueryResult<Vec<EvalViolation>> {
+        let mut violations = Vec::new();
+
+        // Check if the target address is within the grant's allowed targets
+        if !grant.target.contains(&meaning.to) {
+            violations.push(EvalViolation::InvalidTarget { target: meaning.to });
+        }
+
+        let rate_violations = check_rate_limits(grant, meta, db).await?;
+        violations.extend(rate_violations);
+
+        Ok(violations)
+    }
+
+    async fn create_grant(
+        basic: &models::EvmBasicGrant,
+        grant: &Self::Grant,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> diesel::result::QueryResult<DatabaseID> {
+        let grant_id: i32 = insert_into(evm_ether_transfer_grant::table)
+            .values(&NewEvmEtherTransferGrant {
+                basic_grant_id: basic.id,
+            })
+            .returning(evm_ether_transfer_grant::id)
+            .get_result(conn)
+            .await?;
+
+        for target in &grant.target {
+            insert_into(evm_ether_transfer_grant_target::table)
+                .values(NewEvmEtherTransferGrantTarget {
+                    grant_id,
+                    address: target.to_vec(),
+                })
+                .execute(conn)
+                .await?;
+        }
+
+        for limit in &grant.limits {
+            insert_into(evm_ether_transfer_volume_limit::table)
+                .values(NewEvmEtherTransferVolumeLimit {
+                    grant_id,
+                    window_secs: limit.window.as_secs() as i32,
+                    max_volume: utils::u256_to_bytes(limit.max_volume).to_vec(),
+                })
+                .execute(conn)
+                .await?;
+        }
+
+        Ok(grant_id)
+    }
+
+    async fn try_find_grant(
+        context: &EvalContext,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> diesel::result::QueryResult<Option<(Self::Grant, GrantMetadata)>> {
+        use crate::db::schema::{
+            evm_basic_grant, evm_ether_transfer_grant, evm_ether_transfer_grant_target,
+        };
+
+        let target_bytes = context.to.to_vec();
+
+        // Find a grant where:
+        // 1. The basic grant's wallet_id and client_id match the context
+        // 2. Any of the grant's targets match the context's `to` address
+        let grant: Option<EvmEtherTransferGrant> = evm_ether_transfer_grant::table
+            .inner_join(
+                evm_basic_grant::table
+                    .on(evm_ether_transfer_grant::basic_grant_id.eq(evm_basic_grant::id)),
+            )
+            .inner_join(
+                evm_ether_transfer_grant_target::table
+                    .on(evm_ether_transfer_grant::id.eq(evm_ether_transfer_grant_target::grant_id)),
+            )
+            .filter(evm_basic_grant::wallet_id.eq(context.wallet_id))
+            .filter(evm_basic_grant::client_id.eq(context.client_id))
+            .filter(evm_ether_transfer_grant_target::address.eq(&target_bytes))
+            .select(EvmEtherTransferGrant::as_select())
+            .first::<EvmEtherTransferGrant>(conn)
+            .await
+            .optional()?;
+
+        let Some(grant) = grant else {
+            return Ok(None);
+        };
+
+        use crate::db::schema::evm_ether_transfer_volume_limit;
+
+        // Load grant targets
+        let target_bytes: Vec<EvmEtherTransferGrantTarget> = evm_ether_transfer_grant_target::table
+            .select(EvmEtherTransferGrantTarget::as_select())
+            .filter(evm_ether_transfer_grant_target::grant_id.eq(grant.id))
+            .load(conn)
+            .await?;
+
+        // Load volume limits
+        let limit_rows: Vec<EvmEtherTransferVolumeLimit> = evm_ether_transfer_volume_limit::table
+            .filter(evm_ether_transfer_volume_limit::grant_id.eq(grant.id))
+            .select(EvmEtherTransferVolumeLimit::as_select())
+            .load(conn)
+            .await?;
+
+        // Convert bytes back to Address
+        let targets: Vec<Address> = target_bytes
+            .into_iter()
+            .filter_map(|target| {
+                // TODO: Handle invalid addresses more gracefully
+                let arr: [u8; 20] = target.address.try_into().ok()?;
+                Some(Address::from(arr))
+            })
+            .collect();
+
+        // Convert database rows to VolumeLimit
+        let limits: Vec<VolumeLimit> = limit_rows
+            .into_iter()
+            .filter_map(|limit| {
+                // TODO: Handle invalid volumes more gracefully
+                let max_volume = utils::bytes_to_u256(&limit.max_volume)?;
+                Some(VolumeLimit {
+                    window: Duration::from_secs(limit.window_secs as u64),
+                    max_volume,
+                })
+            })
+            .collect();
+
+        let domain_grant = Grant {
+            target: targets,
+            limits,
+        };
+
+        Ok(Some((
+            domain_grant,
+            GrantMetadata {
+                basic_grant_id: grant.basic_grant_id,
+                policy_grant_id: grant.id,
+            },
+        )))
+    }
+
+    async fn record_transaction(
+        context: &EvalContext,
+        grant: &GrantMetadata,
+        conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    ) -> diesel::result::QueryResult<()> {
+        use crate::db::schema::evm_ether_transfer_log;
+
+        insert_into(evm_ether_transfer_log::table)
+            .values(models::NewEvmEtherTransferLog {
+                grant_id: grant.policy_grant_id,
+                value: utils::u256_to_bytes(context.value).to_vec(),
+                client_id: context.client_id,
+                wallet_id: context.wallet_id,
+                chain_id: context.chain as i32,
+                recipient_address: context.to.to_vec(),
+            })
+            .execute(conn)
+            .await?;
+
+        Ok(())
+    }
+}

server/crates/arbiter-server/src/evm/safe_signer.rs

@@ -0,0 +1,184 @@
+use std::sync::Mutex;
+
+use alloy::{
+    consensus::SignableTransaction,
+    network::{TxSigner, TxSignerSync},
+    primitives::{Address, ChainId, Signature, B256},
+    signers::{Error, Result, Signer, SignerSync, utils::secret_key_to_address},
+};
+use async_trait::async_trait;
+use k256::ecdsa::{self, signature::hazmat::PrehashSigner, RecoveryId, SigningKey};
+use memsafe::MemSafe;
+
+/// An Ethereum signer that stores its secp256k1 secret key inside a
+/// hardware-protected [`MemSafe`] cell.
+///
+/// The underlying memory page is kept non-readable/non-writable at rest.
+/// Access is temporarily elevated only for the duration of each signing
+/// operation, then immediately revoked.
+///
+/// Because [`MemSafe::read`] requires `&mut self` while the [`Signer`] trait
+/// requires `&self`, the cell is wrapped in a [`Mutex`].
+pub struct SafeSigner {
+    key: Mutex<MemSafe<SigningKey>>,
+    address: Address,
+    chain_id: Option<ChainId>,
+}
+
+impl std::fmt::Debug for SafeSigner {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("SafeSigner")
+            .field("address", &self.address)
+            .field("chain_id", &self.chain_id)
+            .finish()
+    }
+}
+
+/// Generates a secp256k1 secret key directly inside a [`MemSafe`] cell.
+///
+/// Random bytes are written in-place into protected memory, then validated
+/// as a legal scalar on the secp256k1 curve (the scalar must be in
+/// `[1, n)` where `n` is the curve order — roughly 1-in-2^128 chance of
+/// rejection, but we retry to be correct).
+///
+/// Returns the protected key bytes and the derived Ethereum address.
+pub fn generate(rng: &mut impl rand::Rng) -> (MemSafe<[u8; 32]>, Address) {
+    loop {
+        let mut cell = MemSafe::new([0u8; 32]).expect("MemSafe allocation");
+        {
+            let mut w = cell.write().expect("MemSafe write");
+            rng.fill_bytes(w.as_mut());
+        }
+        let reader = cell.read().expect("MemSafe read");
+        if let Ok(sk) = SigningKey::from_slice(reader.as_ref()) {
+            let address = secret_key_to_address(&sk);
+            drop(reader);
+            return (cell, address);
+        }
+    }
+}
+
+impl SafeSigner {
+    /// Creates a new `SafeSigner` by moving the signing key into a protected
+    /// memory region.
+    pub fn new(key: SigningKey) -> Result<Self> {
+        let address = secret_key_to_address(&key);
+        let cell = MemSafe::new(key).map_err(Error::other)?;
+        Ok(Self {
+            key: Mutex::new(cell),
+            address,
+            chain_id: None,
+        })
+    }
+
+    fn sign_hash_inner(&self, hash: &B256) -> Result<Signature> {
+        let mut cell = self.key.lock().expect("SafeSigner mutex poisoned");
+        let reader = cell.read().map_err(Error::other)?;
+        let sig: (ecdsa::Signature, RecoveryId) = reader.sign_prehash(hash.as_ref())?;
+        Ok(sig.into())
+    }
+
+    fn sign_tx_inner(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
+        if let Some(chain_id) = self.chain_id {
+            if !tx.set_chain_id_checked(chain_id) {
+                return Err(Error::TransactionChainIdMismatch {
+                    signer: chain_id,
+                    tx: tx.chain_id().unwrap(),
+                });
+            }
+        }
+        self.sign_hash_inner(&tx.signature_hash()).map_err(Error::other)
+    }
+}
+
+#[async_trait]
+impl Signer for SafeSigner {
+    #[inline]
+    async fn sign_hash(&self, hash: &B256) -> Result<Signature> {
+        self.sign_hash_inner(hash)
+    }
+
+    #[inline]
+    fn address(&self) -> Address {
+        self.address
+    }
+
+    #[inline]
+    fn chain_id(&self) -> Option<ChainId> {
+        self.chain_id
+    }
+
+    #[inline]
+    fn set_chain_id(&mut self, chain_id: Option<ChainId>) {
+        self.chain_id = chain_id;
+    }
+}
+
+impl SignerSync for SafeSigner {
+    #[inline]
+    fn sign_hash_sync(&self, hash: &B256) -> Result<Signature> {
+        self.sign_hash_inner(hash)
+    }
+
+    #[inline]
+    fn chain_id_sync(&self) -> Option<ChainId> {
+        self.chain_id
+    }
+}
+
+#[async_trait]
+impl TxSigner<Signature> for SafeSigner {
+    fn address(&self) -> Address {
+        self.address
+    }
+
+    async fn sign_transaction(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
+        self.sign_tx_inner(tx)
+    }
+}
+
+impl TxSignerSync<Signature> for SafeSigner {
+    fn address(&self) -> Address {
+        self.address
+    }
+
+    fn sign_transaction_sync(
+        &self,
+        tx: &mut dyn SignableTransaction<Signature>,
+    ) -> Result<Signature> {
+        self.sign_tx_inner(tx)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use alloy::signers::local::PrivateKeySigner;
+
+    #[test]
+    fn sign_and_recover() {
+        let pk = PrivateKeySigner::random();
+        let key = pk.into_credential();
+        let signer = SafeSigner::new(key).unwrap();
+        let message = b"hello arbiter";
+        let sig = signer.sign_message_sync(message).unwrap();
+        let recovered = sig.recover_address_from_msg(message).unwrap();
+        assert_eq!(recovered, Signer::address(&signer));
+    }
+
+    #[test]
+    fn chain_id_roundtrip() {
+        let pk = PrivateKeySigner::random();
+        let key = pk.into_credential();
+        let mut signer = SafeSigner::new(key).unwrap();
+        assert_eq!(Signer::chain_id(&signer), None);
+        signer.set_chain_id(Some(1337));
+        assert_eq!(Signer::chain_id(&signer), Some(1337));
+    }
+}

server/crates/arbiter-server/src/evm/utils.rs

@@ -0,0 +1,9 @@
+use alloy::primitives::U256;
+
+pub fn u256_to_bytes(value: U256) -> [u8; 32] {
+    value.to_le_bytes()
+}
+pub fn bytes_to_u256(bytes: &[u8]) -> Option<U256> {
+    let bytes: [u8; 32] = bytes.try_into().ok()?;
+    Some(U256::from_le_bytes(bytes))
+}