Add support for Cosmos EVM (#1932)

* feat: add support for EthSecp256k1 public keys and signatures

- Implemented encoding for EthSecp256k1 public keys in amino format.
- Added functions to encode and decode EthSecp256k1 signatures.
- Updated pubkey type definitions to include EthSecp256k1.
- Enhanced signing clients to handle EthSecp256k1 accounts.
- Created DirectEthSecp256k1HdWallet for managing EthSecp256k1 keypairs.
- Added tests for DirectEthSecp256k1HdWallet and DirectEthSecp256k1Wallet functionalities.

* feat: add DirectEthSecp256k1 wallet exports to index

* feat: add EthSecp256k1Pubkey to pubkeyToRawAddress function

* feat: support both eth_secp256k1 and ethsecp256k1 algorithms in pubkey encoding

* feat: support ethsecp256k1 algorithm in SigningStargateClient for pubkey encoding

* refactor: consolidate crypto imports in addresses.ts

* feat: add utility functions for Ethereum secp256k1 account handling and update pubkey encoding in clients

* feat: add ethsecp256k1 to supported pubkey types in isSinglePubkey function

* feat: add support for ethsecp256k1 pubkey type in encoding

* chore: Specific getAminoPubkey return type instead of any

* test: add encoding and decoding functions for EthSecp256k1 signatures in tests

* refactor: remove eslint disable for naming convention in signingcosmwasmclient.ts

* fix: add missing 'ethsecp256k1' algorithm type in Algo definition

* fix: update ethsecp256k1 references and class name in wallet documentation

* doc: Add comments for the code block

* rollback .pnp.cjs

* chore: lint fix

* fix: update getAminoPubkey return type and import missing pubkey types

* [autofix.ci] apply automated fixes

* Adapt to changes from main

* Remove serialization/deserialization of DirectEthSecp256k1HdWallet

See #1796

* Imrpve some comments and organize decodeSignature tests

* Add CHANGELOG entry

---------

Co-authored-by: allthatjazzleo <leo.pang@mantra.finance>
Co-authored-by: Chiu Lam <happylam23@gmail.com>
Co-authored-by: BigtoC <taitocdt@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: 5 people

CHANGELOG.md

@@ -23,11 +23,13 @@ and this project adheres to
   price from the chain. ([#1926])
 - @cosmjs/cosmwasm-stargate: Add the ability to specify a custom account parser
   for `CosmWasmClient`. ([#1928])
+- Add support for Cosmos EVM key handling and signing. ([#1932])
 
 [#1883]: https://github.com/cosmos/cosmjs/issues/1883
 [#1916]: https://github.com/cosmos/cosmjs/pull/1916
 [#1926]: https://github.com/cosmos/cosmjs/pull/1926
 [#1928]: https://github.com/cosmos/cosmjs/pull/1928
+[#1932]: https://github.com/cosmos/cosmjs/pull/1932
 
 ### Changed
 

packages/amino/src/addresses.ts

@@ -1,10 +1,16 @@
 // See https://github.com/tendermint/tendermint/blob/f2ada0a604b4c0763bda2f64fac53d506d3beca7/docs/spec/blockchain/encoding.md#public-key-cryptography
 
-import { ripemd160, sha256 } from "@cosmjs/crypto";
+import { keccak256, ripemd160, Secp256k1, sha256 } from "@cosmjs/crypto";
 import { fromBase64, toBech32 } from "@cosmjs/encoding";
 
 import { encodeAminoPubkey } from "./encoding";
-import { isEd25519Pubkey, isMultisigThresholdPubkey, isSecp256k1Pubkey, Pubkey } from "./pubkeys";
+import {
+  isEd25519Pubkey,
+  isEthSecp256k1Pubkey,
+  isMultisigThresholdPubkey,
+  isSecp256k1Pubkey,
+  Pubkey,
+} from "./pubkeys";
 
 export function rawEd25519PubkeyToRawAddress(pubkeyData: Uint8Array): Uint8Array<ArrayBuffer> {
   if (pubkeyData.length !== 32) {
@@ -20,11 +26,24 @@ export function rawSecp256k1PubkeyToRawAddress(pubkeyData: Uint8Array): Uint8Arr
   return ripemd160(sha256(pubkeyData));
 }
 
+export function rawEthSecp256k1PubkeyToRawAddress(pubkeyData: Uint8Array): Uint8Array<ArrayBuffer> {
+  if (pubkeyData.length !== 33) {
+    throw new Error(`Invalid Secp256k1 pubkey length (compressed): ${pubkeyData.length}`);
+  }
+  const uncompressed = Secp256k1.uncompressPubkey(pubkeyData);
+  const pubkeyWithoutPrefix = uncompressed.slice(1);
+  const hash = keccak256(pubkeyWithoutPrefix);
+  return hash.slice(-20);
+}
+
 // For secp256k1 this assumes we already have a compressed pubkey.
 export function pubkeyToRawAddress(pubkey: Pubkey): Uint8Array<ArrayBuffer> {
   if (isSecp256k1Pubkey(pubkey)) {
     const pubkeyData = fromBase64(pubkey.value);
     return rawSecp256k1PubkeyToRawAddress(pubkeyData);
+  } else if (isEthSecp256k1Pubkey(pubkey)) {
+    const pubkeyData = fromBase64(pubkey.value);
+    return rawEthSecp256k1PubkeyToRawAddress(pubkeyData);
   } else if (isEd25519Pubkey(pubkey)) {
     const pubkeyData = fromBase64(pubkey.value);
     return rawEd25519PubkeyToRawAddress(pubkeyData);

packages/amino/src/encoding.ts

@@ -4,7 +4,9 @@ import { arrayContentStartsWith } from "@cosmjs/utils";
 
 import {
   Ed25519Pubkey,
+  EthSecp256k1Pubkey,
   isEd25519Pubkey,
+  isEthSecp256k1Pubkey,
   isMultisigThresholdPubkey,
   isSecp256k1Pubkey,
   MultisigThresholdPubkey,
@@ -41,10 +43,27 @@ export function encodeEd25519Pubkey(pubkey: Uint8Array): Ed25519Pubkey {
   };
 }
 
+/**
+ * Takes a EthSecp256k1 public key as raw bytes and returns the Amino JSON
+ * representation of it (the type/value wrapper object).
+ */
+export function encodeEthSecp256k1Pubkey(pubkey: Uint8Array): EthSecp256k1Pubkey {
+  if (pubkey.length !== 33 || (pubkey[0] !== 0x02 && pubkey[0] !== 0x03)) {
+    throw new Error("Public key must be compressed secp256k1, i.e. 33 bytes starting with 0x02 or 0x03");
+  }
+  return {
+    type: pubkeyType.ethsecp256k1,
+    value: toBase64(pubkey),
+  };
+}
+
 // As discussed in https://github.com/binance-chain/javascript-sdk/issues/163
 // Prefixes listed here: https://github.com/tendermint/tendermint/blob/d419fffe18531317c28c29a292ad7d253f6cafdf/docs/spec/blockchain/encoding.md#public-key-cryptography
 // Last bytes is varint-encoded length prefix
 const pubkeyAminoPrefixSecp256k1 = fromHex("eb5ae987" + "21" /* fixed length */);
+// See https://github.com/tendermint/go-amino/blob/8e779b71f40d175cd1302d3cd41a75b005225a7a/README.md#computing-the-prefix-and-disambiguation-bytes
+// for how this is computed
+const pubkeyAminoPrefixEthSecp256k1 = fromHex("5D7423DF" + "21" /* fixed length */);
 const pubkeyAminoPrefixEd25519 = fromHex("1624de64" + "20" /* fixed length */);
 const pubkeyAminoPrefixSr25519 = fromHex("0dfb1005" + "20" /* fixed length */);
 /** See https://github.com/tendermint/tendermint/commit/38b401657e4ad7a7eeb3c30a3cbf512037df3740 */
@@ -207,6 +226,8 @@ export function encodeAminoPubkey(pubkey: Pubkey): Uint8Array<ArrayBuffer> {
     return new Uint8Array([...pubkeyAminoPrefixEd25519, ...fromBase64(pubkey.value)]);
   } else if (isSecp256k1Pubkey(pubkey)) {
     return new Uint8Array([...pubkeyAminoPrefixSecp256k1, ...fromBase64(pubkey.value)]);
+  } else if (isEthSecp256k1Pubkey(pubkey)) {
+    return new Uint8Array([...pubkeyAminoPrefixEthSecp256k1, ...fromBase64(pubkey.value)]);
   } else {
     throw new Error("Unsupported pubkey type");
   }

packages/amino/src/index.ts

@@ -2,6 +2,7 @@ export {
   pubkeyToAddress,
   pubkeyToRawAddress,
   rawEd25519PubkeyToRawAddress,
+  rawEthSecp256k1PubkeyToRawAddress,
   rawSecp256k1PubkeyToRawAddress,
 } from "./addresses";
 export type { Coin } from "./coins";
@@ -12,20 +13,23 @@ export {
   encodeAminoPubkey,
   encodeBech32Pubkey,
   encodeEd25519Pubkey,
+  encodeEthSecp256k1Pubkey,
   encodeSecp256k1Pubkey,
 } from "./encoding";
 export { createMultisigThresholdPubkey } from "./multisig";
 export { omitDefault } from "./omitdefault";
 export { makeCosmoshubPath } from "./paths";
 export type {
   Ed25519Pubkey,
+  EthSecp256k1Pubkey,
   MultisigThresholdPubkey,
   Pubkey,
   Secp256k1Pubkey,
   SinglePubkey,
 } from "./pubkeys";
 export {
   isEd25519Pubkey,
+  isEthSecp256k1Pubkey,
   isMultisigThresholdPubkey,
   isSecp256k1Pubkey,
   isSinglePubkey,
@@ -37,9 +41,15 @@ export {
   Secp256k1HdWallet,
 } from "./secp256k1hdwallet";
 export { Secp256k1Wallet } from "./secp256k1wallet";
-export { type StdSignature, decodeSignature, encodeSecp256k1Signature } from "./signature";
+export {
+  type StdSignature,
+  decodeSignature,
+  encodeEthSecp256k1Signature,
+  encodeSecp256k1Signature,
+} from "./signature";
 export type { AminoMsg, StdFee, StdSignDoc } from "./signdoc";
 export { makeSignDoc, serializeSignDoc } from "./signdoc";
 export type { AccountData, Algo, AminoSignResponse, OfflineAminoSigner } from "./signer";
+export { getAminoPubkey, isEthereumSecp256k1Account } from "./signerutils";
 export { type StdTx, isStdTx, makeStdTx } from "./stdtx";
 export { type KdfConfiguration, executeKdf } from "./wallet";

packages/amino/src/pubkeys.ts

@@ -24,10 +24,22 @@ export function isSecp256k1Pubkey(pubkey: Pubkey): pubkey is Secp256k1Pubkey {
   return (pubkey as Secp256k1Pubkey).type === "tendermint/PubKeySecp256k1";
 }
 
+export interface EthSecp256k1Pubkey extends SinglePubkey {
+  readonly type: "os/PubKeyEthSecp256k1";
+  /** Compressed (33 bytes) secp256k1 public key in base64 encoding */
+  readonly value: string;
+}
+
+export function isEthSecp256k1Pubkey(pubkey: Pubkey): pubkey is EthSecp256k1Pubkey {
+  return (pubkey as EthSecp256k1Pubkey).type === "os/PubKeyEthSecp256k1";
+}
+
 export const pubkeyType = {
-  /** @see https://github.com/tendermint/tendermint/blob/v0.33.0/crypto/ed25519/ed25519.go#L22 */
-  secp256k1: "tendermint/PubKeySecp256k1" as const,
   /** @see https://github.com/tendermint/tendermint/blob/v0.33.0/crypto/secp256k1/secp256k1.go#L23 */
+  secp256k1: "tendermint/PubKeySecp256k1" as const,
+  /** @see https://github.com/cosmos/evm/blob/v1.0.0-rc2/crypto/ethsecp256k1/ethsecp256k1.go#L35-L36 */
+  ethsecp256k1: "os/PubKeyEthSecp256k1" as const,
+  /** @see https://github.com/tendermint/tendermint/blob/v0.33.0/crypto/ed25519/ed25519.go#L22 */
   ed25519: "tendermint/PubKeyEd25519" as const,
   /** @see https://github.com/tendermint/tendermint/blob/v0.33.0/crypto/sr25519/codec.go#L12 */
   sr25519: "tendermint/PubKeySr25519" as const,
@@ -53,7 +65,12 @@ export interface SinglePubkey extends Pubkey {
 }
 
 export function isSinglePubkey(pubkey: Pubkey): pubkey is SinglePubkey {
-  const singPubkeyTypes: string[] = [pubkeyType.ed25519, pubkeyType.secp256k1, pubkeyType.sr25519];
+  const singPubkeyTypes: string[] = [
+    pubkeyType.ed25519,
+    pubkeyType.secp256k1,
+    pubkeyType.ethsecp256k1,
+    pubkeyType.sr25519,
+  ];
   return singPubkeyTypes.includes(pubkey.type);
 }
 

packages/amino/src/signature.spec.ts

@@ -1,6 +1,11 @@
 import { fromBase64 } from "@cosmjs/encoding";
 
-import { decodeSignature, encodeSecp256k1Signature, StdSignature } from "./signature";
+import {
+  decodeSignature,
+  encodeEthSecp256k1Signature,
+  encodeSecp256k1Signature,
+  StdSignature,
+} from "./signature";
 
 describe("signature", () => {
   describe("encodeSecp256k1Signature", () => {
@@ -44,6 +49,47 @@ describe("signature", () => {
     });
   });
 
+  describe("encodeEthSecp256k1Signature", () => {
+    it("encodes a full signature", () => {
+      const pubkey = fromBase64("AywEwHmedyGF0jQ11+SY/dLGn/QwoN+cf09VWFAfUxUs");
+      const signature = fromBase64(
+        "sGcYUlDfO1PDA/Z9NqUBtgSTdRTJ+AJ8tvgw+5qtXalPgh5XqZj4R2eY1b7RXMU1m5and6aOl7YGpk9cZnESmQ==",
+      );
+      expect(encodeEthSecp256k1Signature(pubkey, signature)).toEqual({
+        pub_key: {
+          type: "os/PubKeyEthSecp256k1",
+          value: "AywEwHmedyGF0jQ11+SY/dLGn/QwoN+cf09VWFAfUxUs",
+        },
+        signature: "sGcYUlDfO1PDA/Z9NqUBtgSTdRTJ+AJ8tvgw+5qtXalPgh5XqZj4R2eY1b7RXMU1m5and6aOl7YGpk9cZnESmQ==",
+      });
+    });
+
+    it("throws when getting uncompressed public keys", () => {
+      const pubkey = fromBase64(
+        "BE8EGB7ro1ORuFhjOnZcSgwYlpe0DSFjVNUIkNNQxwKQE7WHpoHoNswYeoFkuYpYSKK4mzFzMV/dB0DVAy4lnNU=",
+      );
+      const signature = fromBase64(
+        "sGcYUlDfO1PDA/Z9NqUBtgSTdRTJ+AJ8tvgw+5qtXalPgh5XqZj4R2eY1b7RXMU1m5and6aOl7YGpk9cZnESmQ==",
+      );
+      expect(() => encodeEthSecp256k1Signature(pubkey, signature)).toThrowError(
+        /public key must be compressed secp256k1/i,
+      );
+    });
+
+    it("throws if signature contains recovery byte", () => {
+      const pubkey = fromBase64("AywEwHmedyGF0jQ11+SY/dLGn/QwoN+cf09VWFAfUxUs");
+      const signature = Uint8Array.from([
+        ...fromBase64(
+          "sGcYUlDfO1PDA/Z9NqUBtgSTdRTJ+AJ8tvgw+5qtXalPgh5XqZj4R2eY1b7RXMU1m5and6aOl7YGpk9cZnESmQ==",
+        ),
+        99,
+      ]);
+      expect(() => encodeEthSecp256k1Signature(pubkey, signature)).toThrowError(
+        /signature must be 64 bytes long/i,
+      );
+    });
+  });
+
   describe("decodeSignature", () => {
     it("works for secp256k1", () => {
       const signature: StdSignature = {
@@ -60,5 +106,21 @@ describe("signature", () => {
         ),
       });
     });
+
+    it("works for ethsecp256k1", () => {
+      const signature: StdSignature = {
+        pub_key: {
+          type: "os/PubKeyEthSecp256k1",
+          value: "AywEwHmedyGF0jQ11+SY/dLGn/QwoN+cf09VWFAfUxUs",
+        },
+        signature: "sGcYUlDfO1PDA/Z9NqUBtgSTdRTJ+AJ8tvgw+5qtXalPgh5XqZj4R2eY1b7RXMU1m5and6aOl7YGpk9cZnESmQ==",
+      };
+      expect(decodeSignature(signature)).toEqual({
+        pubkey: fromBase64("AywEwHmedyGF0jQ11+SY/dLGn/QwoN+cf09VWFAfUxUs"),
+        signature: fromBase64(
+          "sGcYUlDfO1PDA/Z9NqUBtgSTdRTJ+AJ8tvgw+5qtXalPgh5XqZj4R2eY1b7RXMU1m5and6aOl7YGpk9cZnESmQ==",
+        ),
+      });
+    });
   });
 });

packages/amino/src/signature.ts

@@ -1,7 +1,7 @@
 /* eslint-disable @typescript-eslint/naming-convention */
 import { fromBase64, toBase64 } from "@cosmjs/encoding";
 
-import { encodeSecp256k1Pubkey } from "./encoding";
+import { encodeEthSecp256k1Pubkey, encodeSecp256k1Pubkey } from "./encoding";
 import { Pubkey, pubkeyType } from "./pubkeys";
 
 export interface StdSignature {
@@ -28,6 +28,25 @@ export function encodeSecp256k1Signature(pubkey: Uint8Array, signature: Uint8Arr
   };
 }
 
+/**
+ * Takes a binary pubkey and signature to create a signature object
+ *
+ * @param pubkey a compressed secp256k1 public key
+ * @param signature a 64 byte fixed length representation of secp256k1 signature components r and s
+ */
+export function encodeEthSecp256k1Signature(pubkey: Uint8Array, signature: Uint8Array): StdSignature {
+  if (signature.length !== 64) {
+    throw new Error(
+      "Signature must be 64 bytes long. Cosmos SDK uses a 2x32 byte fixed length encoding for the secp256k1 signature integers r and s.",
+    );
+  }
+
+  return {
+    pub_key: encodeEthSecp256k1Pubkey(pubkey),
+    signature: toBase64(signature),
+  };
+}
+
 export function decodeSignature(signature: StdSignature): {
   readonly pubkey: Uint8Array;
   readonly signature: Uint8Array;
@@ -39,6 +58,11 @@ export function decodeSignature(signature: StdSignature): {
         pubkey: fromBase64(signature.pub_key.value),
         signature: fromBase64(signature.signature),
       };
+    case pubkeyType.ethsecp256k1:
+      return {
+        pubkey: fromBase64(signature.pub_key.value),
+        signature: fromBase64(signature.signature),
+      };
     default:
       throw new Error("Unsupported pubkey type");
   }

packages/amino/src/signer.ts

@@ -1,7 +1,7 @@
 import { StdSignature } from "./signature";
 import { StdSignDoc } from "./signdoc";
 
-export type Algo = "secp256k1" | "ed25519" | "sr25519";
+export type Algo = "secp256k1" | "ed25519" | "sr25519" | "eth_secp256k1" | "ethsecp256k1";
 
 export interface AccountData {
   /** A printable address (typically bech32 encoded) */

packages/amino/src/signerutils.ts

@@ -0,0 +1,40 @@
+/**
+ * Utility functions for working with signer accounts and algorithm detection.
+ */
+
+import { encodeEthSecp256k1Pubkey, encodeSecp256k1Pubkey } from "./encoding";
+import { EthSecp256k1Pubkey, Secp256k1Pubkey } from "./pubkeys";
+import type { AccountData } from "./signer";
+
+/**
+ * Checks if an account uses Ethereum secp256k1 keys by examining the algorithm name.
+ *
+ * Handle Ethereum secp256k1 keys with dual naming convention support:
+ * Different wallets and chains report Ethereum key algorithms inconsistently:
+ * - "eth_secp256k1" (with underscore) - de facto standard used by Keplr wallet, CosmJS, some Cosmos SDK chains
+ * - "ethsecp256k1" (without underscore) - used by Evmos, Cronos, and other EVM-compatible chains
+ * Both represent the same Ethereum-compatible secp256k1 keys that require keccak256 address derivation
+ *
+ * @param account The account data from a signer
+ * @returns true if the account uses Ethereum secp256k1 keys, false otherwise
+ */
+export function isEthereumSecp256k1Account(account: AccountData): boolean {
+  return account.algo === "eth_secp256k1" || account.algo === "ethsecp256k1";
+}
+
+/**
+ * Gets the correctly encoded amino pubkey for an account based on its algorithm.
+ *
+ * This utility automatically selects the appropriate encoding function based on whether
+ * the account uses Ethereum secp256k1 keys or standard secp256k1 keys.
+ *
+ * @param account The account data from a signer
+ * @returns The amino-encoded pubkey (EthSecp256k1Pubkey or Secp256k1Pubkey)
+ */
+export function getAminoPubkey(account: AccountData): EthSecp256k1Pubkey | Secp256k1Pubkey {
+  if (isEthereumSecp256k1Account(account)) {
+    return encodeEthSecp256k1Pubkey(account.pubkey);
+  } else {
+    return encodeSecp256k1Pubkey(account.pubkey);
+  }
+}

packages/cosmwasm/src/signingcosmwasmclient.ts

@@ -1,4 +1,4 @@
-import { encodeSecp256k1Pubkey, makeSignDoc as makeSignDocAmino } from "@cosmjs/amino";
+import { encodeSecp256k1Pubkey, getAminoPubkey, makeSignDoc as makeSignDocAmino } from "@cosmjs/amino";
 import { sha256 } from "@cosmjs/crypto";
 import { fromBase64, toHex, toUtf8 } from "@cosmjs/encoding";
 import { Int53, Uint53 } from "@cosmjs/math";
@@ -772,7 +772,7 @@ export class SigningCosmWasmClient extends CosmWasmClient {
     if (!accountFromSigner) {
       throw new Error("Failed to retrieve account from signer");
     }
-    const pubkey = encodePubkey(encodeSecp256k1Pubkey(accountFromSigner.pubkey));
+    const pubkey = encodePubkey(getAminoPubkey(accountFromSigner));
     const signMode = SignMode.SIGN_MODE_LEGACY_AMINO_JSON;
     const msgs = messages.map((msg) => this.aminoTypes.toAmino(msg));
     const signDoc = makeSignDocAmino(msgs, fee, chainId, memo, accountNumber, sequence, timeoutHeight);
@@ -818,7 +818,7 @@ export class SigningCosmWasmClient extends CosmWasmClient {
     if (!accountFromSigner) {
       throw new Error("Failed to retrieve account from signer");
     }
-    const pubkey = encodePubkey(encodeSecp256k1Pubkey(accountFromSigner.pubkey));
+    const pubkey = encodePubkey(getAminoPubkey(accountFromSigner));
     const txBody: TxBodyEncodeObject = {
       typeUrl: "/cosmos.tx.v1beta1.TxBody",
       value: {