Key Management (Cast)
Relevant source files
The following files were used as context for generating this wiki page:
Key management within the Canon Guard ecosystem is handled through the cast command-line tool, which is part of the Foundry toolkit. This system allows developers and deployers to securely manage private keys using an encrypted keystore, facilitating safe deployments and interactions with the Canon Guard smart contracts on various networks like Ethereum and Optimism.
The project relies on cast for importing accounts and signing transactions during the deployment of core components like the SafeEntrypoint, ActionHub, and specific action builders such as SimpleActions or CappedTokenTransfers.
Sources: CLAUDE.md:1-15, README.md:68-85
Keystore Integration
Canon Guard utilizes Foundry's encrypted keystore to avoid storing sensitive private keys in plain text or environment variables. This is a critical security practice for managing the deployer accounts required for high-stakes multisig infrastructure.
Wallet Import Process
Deployers must import their private keys into the local machine's encrypted storage before executing deployment scripts. The process uses interactive prompts to ensure the key is encrypted with a password.
# Example for Ethereum and Optimism deployers
cast wallet import $ETHEREUM_DEPLOYER_NAME --interactive
cast wallet import $OPTIMISM_DEPLOYER_NAME --interactive
Sources: README.md:73-81
Deployment Workflow
When executing deployment scripts via forge script, the --account flag is used to reference the key stored in the keystore. This allows the script to sign transactions without exposing the raw private key.
| Environment Variable | Description | Use Case |
|---|---|---|
$ETHEREUM_DEPLOYER_NAME | Alias for the Ethereum deployer key | Mainnet deployments |
$OPTIMISM_DEPLOYER_NAME | Alias for the Optimism deployer key | L2 deployments |
Sources: package.json:16-17, README.md:73-81
Key Usage in Deployment
The deployment logic uses these managed keys to broadcast transactions to the network. The package.json defines specific scripts that combine cast managed accounts with forge to deploy the CanonGuard system.
The diagram above illustrates how the cast keystore provides the necessary authentication for the deployment pipeline to interact with blockchain networks and verification services.
Sources: README.md:73-81, package.json:16-17
Scripted Deployments
The project provides pre-configured commands for deploying the system, which automatically handle the account reference and network parameters.
- Ethereum Deployment:
yarn deploy:ethereum:canon-guard - Optimism Deployment:
yarn deploy:optimism:canon-guard
These scripts utilize forge script with the --account parameter to pull signatures from the cast keystore.
Sources: package.json:16-17, CLAUDE.md:38-41
Security and Invariants
Key management is fundamental to the security of the SafeEntrypoint. The system includes invariants to ensure that even with valid keys, transactions must follow strict timing and approval rules.
| Security Property | Description |
|---|---|
| Valid Approvals | Queued transactions only exist for approved action builders with valid expiries. |
| Timing Constraints | Transactions must respect executableAt and expiresAt timestamps. |
| Pre-approval Logic | Pre-approved transactions must use SHORT_TX_EXECUTION_DELAY. |
The management of keys is the first step in a chain of security that includes EmergencyModeHook for pausing operations and OnlyEntrypointGuard for transaction validation.
Sources: test/invariants/PROPERTIES.md:19-27, CLAUDE.md:20-25
Summary
Key management in Canon Guard is centered on the Foundry cast tool, providing a secure, encrypted workflow for handling deployment and administrative keys. By integrating keystore management directly into the deployment scripts, the project ensures that sensitive credentials remain protected while enabling seamless multi-chain deployments and contract management.