Developers · Chain attestation signers
Rotate and revoke chain attestation signers
Abraxas stops issuing with a retiring or revoked attestation signer. Partners update their own gate. A compromised private key cannot be recovered. Verifying a signature is not a grant.
What this is
Abraxas issues EVM secp256k1 and Solana Ed25519 chain attestations only to verified partner-owned deployments. Dedicated environment keys sign those attestations. Receipt private keys are never reused. Partners keep ownership of their gate contract or program.
Abraxas stops issuance when a signer is retiring or revoked. You update your own gate. Nobody can recover a compromised private key. Verifying a signature is not a grant.
Architecture
active key -> issue new EVM/Solana attestations retiring key -> verify existing short-lived attestations only revoked/unknown/wrong-env/wrong-network/schema -> fail closed Abraxas never broadcasts a partner signer-update transaction
Operator steps
- Publish the new signer public verifier and opaque key ID in the chain-attestation signer registry as active.
- Configure the matching environment-only private key. Never reuse a receipt signing key.
- Issue new attestations only with the active in-window key that matches environment, network, gate type, and schema.
- Mark the previous key retiring so existing short-lived attestations still verify until historical_verify_until.
- Partners apply an owner/admin signer-update transaction on their own contract or program. Abraxas never broadcasts it.
- After overlap, retire the old key. Revoke only for compromise. Revoked keys never issue or verify.
Public verifier material
const evm = await fetch("https://abraxasworld.xyz/api/chain-attestations/verification-keys/evm");
const solana = await fetch("https://abraxasworld.xyz/api/chain-attestations/verification-keys/solana");
const keys = await evm.json();
// keys contain opaque key IDs and public verifier material only.
// Signature verification is not a grant. Abraxas does not update your contract.
Owner-only EVM entry points are addTrustedSigner, retireTrustedSigner, and revokeTrustedSigner. Solana uses add_trusted_signer, retire_trusted_signer, and revoke_trusted_signer on GateConfig authority. Abraxas never broadcasts those transactions.
Related
EVM gate · Solana gate · Verified deployments · Receipt key lifecycle