Skip to content

A monorepo containing a community-managed dynamic JSON-RPC relay proxy that routes Ethereum requests to different backend servers based on contract addresses. The system uses Hedera Consensus Service for secure route registration and includes cryptographic verification of contract ownership.

License

InternetOfPeers/hiero-json-rpc-relay-proxy

Repository files navigation

Community Managed Hiero JSON-RPC Relay Proxy

A monorepo containing a community-managed dynamic JSON-RPC relay proxy that routes Ethereum requests to different backend servers based on contract addresses. The system uses Hedera Consensus Service for secure route registration and includes cryptographic verification of contract ownership. It consists of three main packages: a common utilities package, a proxy server that acts as a JSON-RPC relay with dynamic routing, and a prover client that establishes secure route registration.

Project full presentation.

image

Flow Overview

Normal Proxy Operations

  1. JSON-RPC Request: dApps/wallets send requests to the proxy
  2. Address Extraction: Proxy extracts "to" address from eth_sendRawTransaction
  3. Route Lookup: Check if address exists in verified route database
  4. Routing Decision: Route to custom relay if found, otherwise default to hashio.io

Route Registration Process

  1. Contract Address Generation: Owner generates deterministic address using either CREATE (deployer + nonce) or CREATE2 (deployer + salt + init code hash)
  2. Cryptographic Proof: Signs route data with ECDSA to prove ownership
  3. Secure Submission: Encrypts and submits route data to Hedera Consensus Service
  4. Message Processing: Proxy decrypts, verifies signatures, and validates ownership
  5. Challenge-Response: Proxy challenges the claimed JSON-RPC endpoint URL
  6. Verification: Prover responds with ECDSA signature to prove control of endpoint
  7. Route Activation: Successful verification adds route to database and sends confirmation

πŸš€ Quick Start

Prerequisites

  • Node.js: 18.0.0 or higher (required by all packages)
  • npm: Latest version recommended
  • Hedera testnet account with HBAR balance:
    • Proxy Account: Minimum 25 HBAR (for HIP-991 topic creation)
    • Prover Account: Minimum 1 HBAR (for $0.50 submission fees)
  • Ethereum JSON-RPC endpoint (optional, for testing)

Installation

# Clone the repository
git clone https://github.com/your-username/hiero-json-rpc-relay-proxy.git
cd hiero-json-rpc-relay-proxy

# Install all dependencies for all packages
npm install

# Install pre-commit hooks (recommended for contributors)
npm run install:hooks

# Alternative: Install for specific packages only
npm install --workspace=packages/common
npm install --workspace=packages/proxy
npm install --workspace=packages/prover

Configuration

  1. Configure the Proxy (required):

    cd packages/proxy
    cp .env.example .env
    # Edit .env with your Hedera credentials
    # Ensure account has β‰₯25 HBAR for topic creation
  2. Configure the Prover (optional for demo):

    cd packages/prover
    cp .env.example .env
    # Edit .env with your Hedera credentials
    # Ensure account has β‰₯1 HBAR for submission fees

    Advanced Topic Configuration: The prover supports flexible topic ID configuration:

    • Use Proxy's Topic (default): Don't set PROVER_HEDERA_TOPIC_ID - the prover will fetch and use whatever topic the proxy is configured to use
    • Override with Specific Topic: Set PROVER_HEDERA_TOPIC_ID=0.0.1234567 to use a specific topic regardless of what the proxy advertises

    This allows testing with different topics while still maintaining compatibility with the proxy's RSA public key.

  3. Common Package: The @hiero-json-rpc-relay/common package is automatically installed as a dependency for both proxy and prover packages. It provides shared utilities for:

    • Cryptographic operations (RSA+AES encryption, ECDSA signing)
    • HTTP request/response handling
    • Route signature validation
    • Environment variable loading
    • Hedera integration utilities

Running the System

  1. Start the Proxy Server:

    # From workspace root
    npm run proxy
    
    # Or from proxy package directory
    cd packages/proxy
    npm start
    
    # Development mode with auto-restart
    npm run proxy:dev
  2. Run the Prover (in another terminal):

    # From workspace root
    npm run prover
    
    # Or from prover package directory
    cd packages/prover
    npm start
  3. Test the Proxy:

    # Check status
    curl http://localhost:3000/status
    
    # Test JSON-RPC
    curl -X POST http://localhost:3000 \
      -H "Content-Type: application/json" \
      -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'

πŸ“¦ Packages

Version: 1.0.0
Description: Ethereum transaction routing proxy with Hedera Consensus Service integration and RSA key management

The main JSON-RPC relay proxy server that:

  • Acts as a JSON-RPC relay proxy routing Ethereum requests to appropriate backend servers
  • Analyzes transaction "to" addresses from eth_sendRawTransaction calls to determine routing
  • Maintains dynamic routing table mapping contract addresses to specific JSON-RPC relay endpoints
  • Provides fallback routing to default JSON-RPC relay (e.g., hashio.io) for unregistered addresses
  • Manages secure route registration via verified Hedera Consensus Service messages
  • Creates and manages HIP-991 paid topics with $0.50 submission fee to prevent spam
  • Handles RSA hybrid encryption for secure message communication on Hedera topics
  • Verifies contract ownership through deterministic address computation and ECDSA signatures for both CREATE and CREATE2 deployments
  • Implements challenge-response verification for URL reachability and endpoint validation
  • Sends direct HTTP confirmation to provers upon successful route verification
  • Provides status and management endpoints for monitoring and configuration

Key Features:

  • Dynamic address-based routing for Ethereum JSON-RPC requests
  • Secure route registration through Hedera Consensus Service
  • Cryptographic proof of contract ownership required for route updates
  • HTTP route update endpoints removed for security (all updates via Hedera only)

Security: Route updates can only be done through verified Hedera messages with cryptographic proof of contract ownership and challenge-response verification. HTTP route update endpoints have been removed for security.

Version: 1.0.0
Description: Hedera prover component for sending encrypted messages to Hedera Consensus Service

A demonstration client that shows the complete route registration flow for JSON-RPC relay endpoints:

  • Fetches proxy configuration and RSA public keys from proxy status endpoints
  • Creates route registration payloads mapping contract addresses to JSON-RPC relay endpoints
  • Generates deterministic contract addresses using CREATE deployment parameters (deployer + nonce) or CREATE2 parameters (deployer + salt + init code hash)
  • Signs route data with ECDSA for ownership verification (signs addr+proofType+nonce+url for CREATE or addr+proofType+salt+url for CREATE2)
  • Encrypts messages using RSA hybrid encryption (RSA + AES) for secure Hedera transmission
  • Submits encrypted route data to Hedera topics for proxy processing
  • Pays HIP-991 topic submission fees automatically (0.5 HBAR per registration)
  • Starts HTTP challenge server to respond to proxy verification requests
  • Handles challenge-response verification automatically with ECDSA signature responses
  • Receives direct confirmation from proxy upon successful route verification
  • Saves comprehensive results to timestamped JSON files and exits automatically

Purpose: Demonstrates how contract owners can securely register their preferred JSON-RPC relay endpoints with the proxy, enabling custom routing for their contract interactions.

Version: 1.0.0
Description: Common utilities and shared code for the Hiero JSON-RPC Relay system

A shared utility package providing common functionality used by both proxy and prover packages:

  • RSA key management for key generation, validation, and metadata handling
  • Cryptographic utilities for RSA/AES encryption, decryption, and ECDSA signature verification
  • Database utilities for persistent storage, migration, and route management
  • Environment variable management with validation and secure configuration loading
  • Route signature validation with comprehensive error reporting and batch validation
  • HTTP utilities for request parsing, CORS handling, and server creation helpers
  • Hedera utilities for client initialization, ID validation, and timestamp conversion
  • Message utilities for parsing, chunking, and validation of Hedera topic messages
  • Ethereum utilities for transaction decoding and address validation
  • Validation functions for contract addresses, configuration, and data integrity checks

Key Components:

  • cryptoUtils: RSA key generation, AES encryption/decryption, signature verification
  • databaseUtils: Database path management, migration, and persistence
  • envLoader: Environment variable loading with validation and defaults
  • validation: Route signature validation and error handling
  • httpUtils: HTTP request parsing, CORS, and server utilities
  • hederaUtils: Hedera client setup and utility functions
  • messageUtils: Message parsing, chunking, and validation
  • ethUtils: Ethereum transaction decoding and address utilities

Benefits: Centralizes common functionality, reduces code duplication, ensures consistent behavior across packages, and provides comprehensive test coverage for all shared utilities.

Package Diagram

β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”    β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚   Proxy     β”‚    β”‚   Prover    β”‚
β”‚  Package    β”‚    β”‚  Package    β”‚
β””β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”˜    β””β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”˜
       β”‚                  β”‚
       β”‚                  β”‚
       β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                β”‚
         β”Œβ”€β”€β”€β”€β”€β”€β–Όβ”€β”€β”€β”€β”€β”€β”
         β”‚   Common    β”‚
         β”‚  Package    β”‚
         β”‚ (utilities) β”‚
         β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜

πŸ—οΈ Architecture

Flow 1: Normal JSON-RPC Routing Operations

β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”    β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”     β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚ Ethereum β”‚    β”‚              JSON-RPC Relay PROXY                β”‚     β”‚   JSON-RPC     β”‚
β”‚ dApps/   │───►│                                                  │────►│   Relay        β”‚
β”‚ Wallets  β”‚    β”‚  1. Receive JSON-RPC Request                     β”‚     β”‚   Servers      β”‚
β”‚ Clients  β”‚    β”‚  2. Extract `to` from `eth_sendRawTransaction`   β”‚     β”‚                β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜    β”‚  3. Lookup address in routes database            β”‚     β”‚                β”‚
                β”‚                                                  β”‚     β”‚                β”‚
                β”‚  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”       β”‚     β”‚                β”‚
                β”‚  β”‚ Address Lookup  β”‚  β”‚  Routes Database β”‚       β”‚     β”‚                β”‚
                β”‚  β”‚                 β”‚  β”‚   (Verified)     β”‚       β”‚     β”‚                β”‚
                β”‚  β”‚ 0x123... ──────►│  β”‚                  β”‚       β”‚     β”‚                β”‚
                β”‚  β”‚                 β”‚  β”‚ 0x123 β†’ relay-a  β”‚       β”‚     β”‚                β”‚
                β”‚  β”‚                 β”‚  β”‚ 0x456 β†’ relay-b  β”‚       β”‚     β”‚                β”‚
                β”‚  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β”‚ 0x789 β†’ relay-c  β”‚       β”‚     β”‚                β”‚
                β”‚                       β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜       β”‚     β”‚                β”‚
                β”‚                                                  β”‚     β”‚ β€’ hashio.io    β”‚
                |  IF FOUND: Route to custom JSON-RPC Relay        β”‚     β”‚ β€’ example.com  |
                |                                                  β”‚     | β€’ acme.org     |
                β”‚  IF NOT FOUND: Route to Default (hashio.io)      β”‚     β”‚ β€’ ...          β”‚
                β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜     β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜

Flow 2: Route Registration & Verification

Sequence Diagram

Click here if you don't see the graphical Mermaid flow

sequenceDiagram
  participant Prover as Prover (Contract Owner)
  participant Proxy as Proxy
  participant HCS as HCS

  autonumber
  rect rgb(191, 223, 255)
    Note right of Proxy: Setup
    Proxy ->> Proxy: πŸ”‘ Generate RSA key pair
    Proxy ->> HCS: Create new HIP-991 Paid Topic ($1 submission fee)
    Proxy ->> HCS: Publish RSA Public Key (proxy exempt from fees)
    Proxy -->> HCS: ⏳ Subscribe to messages
  end
  Prover ->> Proxy: Fetch /status
  Proxy -->> Prover: Answer with Topic ID & RSA Public Key
  Prover ->> Prover: πŸ”‘ Generate AES shared secret key
  Prover ->> HCS: πŸ” Submit Route Data (RSA+AES Encrypted, ECDSA signed), πŸ’° Pay $1 Topic Fee
  Prover ->> Prover: ⏳ Listen for Challenge Requests
  HCS -->> Proxy: Deliver Encrypted Message
  Proxy ->> Proxy: Decrypt Message (RSA+AES), Extract AES key
  Proxy ->> Proxy: Verify Signature, Extract Address (ECDSA)
  Proxy ->> Proxy: βœ… Confirm Smart Contract's ownership (Address + Nonce)
  Proxy ->> Prover: πŸ” Send Challenge Request (RSA Signed, AES Encrypted)
  Prover -->> Proxy: πŸ” Respond to Challenge (ECDSA Signed, AES Encrypted)
  Proxy ->> Proxy: Verify Challenge Response, Prover is accessible
  Proxy ->> Proxy: Update Verified Routes Database
  Proxy ->> Prover: πŸŽ‰ Confirm Route Registration Success (AES Encrypted)
  rect rgb(255, 191, 191)
    Note over Prover, Proxy: Security Cleanup
    Prover ->> Prover: πŸ—‘οΈ Remove AES key from memory
    Proxy ->> Proxy: πŸ—‘οΈ Remove AES key from memory
  end
Loading

Detailed Description

  1. Contract Owner (Prover):

    • Generates route data, including the contract address and relay information.
    • Creates a shared AES secret key for secure communication with the Proxy.
    • Signs the data using ECDSA and encrypts it using hybrid encryption (RSA for AES key + AES for payload).
    • Submits the encrypted message to the Hedera topic.
    • Maintains the AES key in memory for subsequent encrypted communications.
  2. Hedera Consensus Service:

    • Acts as a secure message relay, delivering the encrypted message to the Proxy.
    • HIP-991 Paid Topics: Implements $0.50 USD equivalent submission fee (0.5 HBAR) to prevent spam.
    • Fee Collection: Proxy collects submission fees as topic creator and fee collector.
    • Fee Exemption: Proxy is exempt from submission fees via fee exempt key.
  3. JSON-RPC Relay Proxy:

    • Decrypts the message using its RSA private key to extract the AES key.
    • Uses the AES key to decrypt the route data payload.
    • Verifies the ECDSA signature to ensure authenticity.
    • Validates the route data and updates the verified route database.
    • Sends encrypted challenge requests to the Prover using the shared AES key.
    • Verifies encrypted challenge responses from the Prover.
    • Sends encrypted confirmation of successful route registration.
    • Removes the AES key from memory after successful completion.
  4. Security Features:

    • Hybrid Encryption: RSA encrypts the AES key, AES encrypts all communication payloads.
    • Shared Secret: AES key enables secure bidirectional communication.
    • Memory Cleanup: Both Proxy and Prover remove the AES key after completion.
    • Forward Secrecy: Each registration session uses a unique AES key.
    • Verifies the ECDSA signature to ensure authenticity.
    • Validates the route data and updates the verified route database.
    • Sends a challenge request to the Prover to verify its availability.
    • Verifies the Prover's challenge response.
    • Confirms the successful route registration to the Prover.

πŸ’° HIP-991 Paid Topic Implementation

The system implements HIP-991 Paid Topics to prevent spam and ensure quality route registrations. This provides economic security while maintaining decentralized access.

Topic Economics

  • Submission Fee: $0.50 USD equivalent (0.5 HBAR) per message submission
  • Fee Purpose: Prevents spam attacks and ensures serious route registration attempts
  • Fee Collection: Proxy collects all submission fees as the topic creator
  • Fee Exemption: Proxy is exempt from fees via fee exempt key for operational messages

Technical Implementation

Proxy (Topic Creator)

  • Creates HIP-991 topic with custom fixed fee of 0.5 HBAR per submission
  • Exempt from fees via fee exempt key for publishing RSA public key and confirmations
  • Collects all fees paid by provers for route registration attempts
  • Sets fee schedule key to allow future fee adjustments if needed

Prover (Message Submitter)

  • Pays 0.5 HBAR fee automatically when submitting route registration messages
  • Sets custom fee limit to maximum 0.6 HBAR to account for network fee variations
  • Must have sufficient balance before attempting route registration
  • Receives route verification and confirmation after successful payment and validation

Economic Benefits

  1. Spam Prevention: 0.5 HBAR cost makes spam attacks economically unfeasible
  2. Quality Assurance: Only serious projects with genuine intent will pay for registration
  3. Network Sustainability: Fees support proxy operation and maintenance
  4. Fair Access: No central gatekeeping - anyone can register by paying the transparent fee
  5. Scalable Economics: Fee collection scales with usage without additional infrastructure

Configuration Requirements

# Proxy must have sufficient balance for topic creation (β‰₯25 HBAR recommended)
PROXY_HEDERA_ACCOUNT_ID=0.0.123456
PROXY_HEDERA_PRIVATE_KEY=302e020100300506032b65700...

# Prover must have sufficient balance for submissions (β‰₯1 HBAR recommended)
PROVER_HEDERA_ACCOUNT_ID=0.0.789012
PROVER_HEDERA_PRIVATE_KEY=0x48b52aba58f4b8dd4cd0e527...

πŸ“ Project Structure

hiero-json-rpc-relay-proxy/
β”œβ”€β”€ packages/
β”‚   β”œβ”€β”€ common/                     # πŸ“¦ Shared utilities and components
β”‚   β”‚   β”œβ”€β”€ src/
β”‚   β”‚   β”‚   β”œβ”€β”€ cryptoUtils.js      # RSA+AES encryption, ECDSA signing
β”‚   β”‚   β”‚   β”œβ”€β”€ envLoader.js        # Environment variable loading
β”‚   β”‚   β”‚   β”œβ”€β”€ hederaUtils.js      # Hedera SDK utilities
β”‚   β”‚   β”‚   β”œβ”€β”€ httpUtils.js        # HTTP request/response handling
β”‚   β”‚   β”‚   β”œβ”€β”€ validation.js       # Route signature validation
β”‚   β”‚   β”‚   └── index.js            # Main exports
β”‚   β”‚   └── test/                   # Unit tests for common utilities
β”‚   β”œβ”€β”€ proxy/                      # πŸ”€ JSON-RPC relay proxy server
β”‚   β”‚   β”œβ”€β”€ src/
β”‚   β”‚   β”‚   β”œβ”€β”€ proxy.js            # Main proxy server
β”‚   β”‚   β”‚   β”œβ”€β”€ hederaManager.js    # Hedera integration
β”‚   β”‚   β”‚   β”œβ”€β”€ dbManager.js        # Route database management
β”‚   β”‚   β”‚   └── ethTxDecoder.js     # Ethereum transaction parsing
β”‚   β”‚   └── test/                   # Proxy-specific tests
β”‚   └── prover/                     # πŸ” Route registration client
β”‚       β”œβ”€β”€ src/
β”‚       β”‚   β”œβ”€β”€ prover.js           # Main prover client
β”‚       β”‚   └── hederaManager.js    # Hedera integration for prover
β”‚       └── test/                   # Prover-specific tests
β”œβ”€β”€ docs/                           # πŸ“š Documentation
β”œβ”€β”€ test/                           # πŸ§ͺ Integration tests
└── scripts/                       # πŸ› οΈ Utility scripts

πŸ§ͺ Testing

Run All Tests

# All packages + integration tests (from workspace root)
npm test

# Individual package tests
npm run test:common
npm run test:proxy
npm run test:prover

# Integration tests only
npm run test:integration

# Test individual packages from their directories
cd packages/common && npm test
cd packages/proxy && npm test
cd packages/prover && npm test

Test Coverage

# Coverage for individual packages
npm run test:coverage --workspace=packages/common
npm run test:coverage --workspace=packages/proxy
npm run test:coverage --workspace=packages/prover

# Run coverage from package directories
cd packages/common && npm run test:coverage
cd packages/proxy && npm run test:coverage
cd packages/prover && npm run test:coverage

πŸ“‹ Available Scripts

Workspace Scripts (from root)

Script Description
npm run proxy Start the proxy server
npm run proxy:dev Start proxy in development mode
npm run prover Run the prover client
npm run prover:dev Run prover in development mode
npm test Run all package tests + integration
npm run test:common Run common utilities tests only
npm run test:proxy Run proxy tests only
npm run test:prover Run prover tests only
npm run test:integration Run integration tests only
npm run test:workspaces Run all workspace package tests
npm run clean Clean databases and node_modules
npm run clean:db Clean routing databases only
npm run format Format all code with Prettier
npm run format:check Check code formatting
npm run install:hooks Install git pre-commit hooks

Package-Specific Scripts

Common Package (packages/common)

Script Description
npm test Run unit tests
npm run test:watch Run tests in watch mode
npm run test:coverage Run tests with coverage report

Proxy Package (packages/proxy)

Script Description
npm start Start the proxy server
npm run dev Start in development mode (watch)
npm test Run all proxy tests
npm run test:unit Run unit tests only (skip integration)
npm run test:integration Run integration tests only
npm run test:watch Run tests in watch mode
npm run test:coverage Run tests with coverage report
npm run clean-db Clean proxy database

Prover Package (packages/prover)

Script Description
npm start Run the prover client
npm test Run all prover tests
npm run test:watch Run tests in watch mode
npm run test:coverage Run tests with coverage report

πŸ”§ Development

Project Structure

hiero-json-rpc-relay-proxy/
β”œβ”€β”€ packages/
β”‚   β”œβ”€β”€ common/                    # πŸ“¦ Shared utilities and components
β”‚   β”‚   β”œβ”€β”€ src/
β”‚   β”‚   β”‚   β”œβ”€β”€ cryptoUtils.js     # RSA+AES encryption, ECDSA signing
β”‚   β”‚   β”‚   β”œβ”€β”€ databaseUtils.js   # Database management utilities
β”‚   β”‚   β”‚   β”œβ”€β”€ envLoader.js       # Environment variable loading
β”‚   β”‚   β”‚   β”œβ”€β”€ ethUtils.js        # Ethereum transaction utilities
β”‚   β”‚   β”‚   β”œβ”€β”€ hederaUtils.js     # Hedera SDK utilities
β”‚   β”‚   β”‚   β”œβ”€β”€ httpUtils.js       # HTTP request/response handling
β”‚   β”‚   β”‚   β”œβ”€β”€ messageUtils.js    # Message parsing and chunking
β”‚   β”‚   β”‚   β”œβ”€β”€ validation.js      # Route signature validation
β”‚   β”‚   β”‚   └── index.js           # Main exports
β”‚   β”‚   β”œβ”€β”€ test/                  # Unit tests for common utilities
β”‚   β”‚   └── package.json           # Package configuration
β”‚   β”œβ”€β”€ proxy/                     # πŸ”€ JSON-RPC relay proxy server
β”‚   β”‚   β”œβ”€β”€ src/
β”‚   β”‚   β”‚   β”œβ”€β”€ proxy.js           # Main proxy server
β”‚   β”‚   β”‚   β”œβ”€β”€ hederaManager.js   # Hedera integration
β”‚   β”‚   β”‚   β”œβ”€β”€ dbManager.js       # Route database management
β”‚   β”‚   β”‚   └── ethTxDecoder.js    # Ethereum transaction parsing
β”‚   β”‚   β”œβ”€β”€ test/                  # Proxy-specific tests
β”‚   β”‚   β”œβ”€β”€ data/                  # Database storage
β”‚   β”‚   └── package.json           # Package configuration
β”‚   └── prover/                    # πŸ” Route registration client
β”‚       β”œβ”€β”€ src/
β”‚       β”‚   β”œβ”€β”€ prover.js          # Main prover client
β”‚       β”‚   └── hederaManager.js   # Hedera integration for prover
β”‚       β”œβ”€β”€ test/                  # Prover-specific tests
β”‚       β”œβ”€β”€ data/                  # Result storage
β”‚       └── package.json           # Package configuration
β”œβ”€β”€ docs/                          # πŸ“š Documentation
β”œβ”€β”€ test/                          # πŸ§ͺ Integration tests
β”œβ”€β”€ scripts/                       # πŸ› οΈ Utility scripts
β”œβ”€β”€ wasteland/                     # πŸ—‘οΈ Experimental/demo code
└── package.json                   # Workspace configuration

Adding New Features

  1. For Common Utilities:

    cd packages/common
    # Add your utility to src/
    # Add tests to test/
    # Update exports in src/index.js
    npm test
  2. For Proxy Features:

    cd packages/proxy
    # Add your feature to src/
    # Add tests to test/
    npm test
  3. For Prover Features:

    cd packages/prover
    # Add your feature to src/
    # Add tests to test/
    npm test
  4. For Integration Features:

    # Add tests to test/
    npm run test:integration

πŸ” Security Considerations

RSA Key Management

  • Private keys are generated automatically and stored securely
  • Public keys are exposed via the status endpoint
  • Key rotation is supported but requires manual intervention

Message Validation

  • All routing messages must be signed with valid ECDSA signatures
  • Encryption ensures message confidentiality
  • Replay protection through timestamp validation

πŸ” Security Features

Contract Ownership Verification

The proxy now includes robust security features to ensure only legitimate contract owners can register routing endpoints:

1. Deterministic Address Computation

  • CREATE deployment: Uses deployer_address + nonce pattern with ethers.getCreateAddress()
  • CREATE2 deployment: Uses deployer_address + salt + init_code_hash pattern with ethers.getCreate2Address()
  • Computes expected contract addresses and verifies they match the provided address

2. ECDSA Signature Verification

  • Route registrations must be signed by the contract deployer
  • CREATE signature: Covers addr + proofType + nonce + url
  • CREATE2 signature: Covers addr + proofType + salt + url
  • Uses ethers.verifyMessage() for signature recovery and validation

3. Enhanced Payload Format

The proxy supports both CREATE and CREATE2 deployment proofs:

{
  "routes": [
    {
      "addr": "0x3ed660420aa9bc674e8f80f744f8062603da385e",
      "proofType": "create",
      "nonce": 33,
      "url": "http://localhost:7546",
      "sig": "0x1234567890abcdef..."
    },
    {
      "addr": "0x8ba1f109551bd432803012645hac136c5edf4aef",
      "proofType": "create2",
      "salt": "0x0000000000000000000000000000000000000000000000000000000000000001",
      "initCodeHash": "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef",
      "url": "http://localhost:7546",
      "sig": "0x9876543210fedcba..."
    }
  ]
}

4. Supported Proof Types

  • CREATE: Standard contract deployment using deployer address and nonce
  • CREATE2: Deterministic deployment using deployer address, salt, and init code hash
  • Both proof types ensure cryptographic verification of contract ownership

Network Security

  • Use HTTPS in production environments
  • Implement proper firewall rules
  • Monitor Hedera topic access patterns

πŸ“¦ Chunked Message Handling

Large Message Support

When the prover sends messages larger than 1024 KB to Hedera, the messages are automatically split into multiple chunks. The proxy now supports seamless handling of these chunked messages:

Key Features

  • βœ… Automatic Detection: Identifies chunked messages using chunk_info field
  • βœ… Order Independence: Assembles chunks correctly regardless of arrival order
  • βœ… Group Management: Uses transaction_valid_start to group related chunks
  • βœ… Error Handling: Validates chunk totals and handles mismatched chunks
  • βœ… Automatic Cleanup: Expires old chunk groups to prevent memory leaks
  • βœ… Backward Compatibility: Works seamlessly with existing message processing

How It Works

  1. Detection: Proxy detects chunked messages by checking for chunk_info field
  2. Grouping: Messages are grouped by transaction_valid_start timestamp
  3. Assembly: When all chunks are received, they are combined in correct order
  4. Processing: Combined message is processed normally (decryption, verification, etc.)

Example Chunk Structure

{
  "chunk_info": {
    "initial_transaction_id": {
      "transaction_valid_start": "1749506740.674505590"
    },
    "number": 1,
    "total": 2
  },
  "message": "base64-encoded-chunk-content",
  "sequence_number": 2
}

For detailed implementation information, see docs/chunked-messages.md.

πŸ› Troubleshooting

Common Issues

  1. Proxy won't start:

    • Check Hedera credentials in .env
    • Verify account has β‰₯25 HBAR for topic creation
    • Verify network connectivity
    • Ensure port 3000 is available
  2. Prover can't connect:

    • Verify proxy is running (curl http://localhost:3000/status)
    • Check prover .env configuration
    • Confirm Hedera credentials are valid
  3. HIP-991 Topic Issues:

    • Insufficient Balance: Ensure proxy account has β‰₯25 HBAR for topic creation
    • Submission Failed: Ensure prover account has β‰₯1 HBAR for submission fees
    • Fee Limit Exceeded: Check account balance and increase HBAR if needed
    • Topic Not Found: Verify topic ID in configuration matches created topic
  4. Route Submission Failures:

    • Payment Required: Verify prover account has sufficient HBAR balance
    • Custom Fee Error: Check network status and retry with higher fee limit
    • Balance Too Low: Add HBAR to prover account for submission fees
  5. Tests failing:

    • Run npm run clean:all and reinstall
    • Check Node.js version (requires 18+)
    • Verify test environment variables

Debug Mode

Enable detailed logging:

DEBUG=* npm start        # All debug logs
DEBUG=proxy:* npm start  # Proxy logs only
DEBUG=prover:* npm run prover  # Prover logs only

πŸ“„ License

Apache-2.0 - See LICENSE file for details.

🀝 Contributing

  1. Fork the repository

  2. Create a feature branch

  3. Set up pre-commit hooks (recommended):

    npm run install:hooks

    This ensures your code is automatically formatted before each commit.

  4. Add tests for new functionality

  5. Ensure all tests pass

  6. Submit a pull request

Code Formatting

This project uses Prettier for code formatting. The pre-commit hook will automatically format your code, but you can also run formatting manually:

# Format all files
npm run format

# Check formatting without making changes
npm run format:check

πŸ“ž Support

For issues and questions:

  • Create an issue on GitHub
  • Check the troubleshooting section
  • Review package-specific READMEs

About

A monorepo containing a community-managed dynamic JSON-RPC relay proxy that routes Ethereum requests to different backend servers based on contract addresses. The system uses Hedera Consensus Service for secure route registration and includes cryptographic verification of contract ownership.

Resources

License

Stars

Watchers

Forks

Packages

No packages published