[macjayz]

What

Adds AirnodeHub's dRPC listing as an attesting peer in cross-provider verification (D2). Every answer it gives carries an EIP-191 signature, so a disagreement incident comes with evidence that anyone can re-verify offline, without trusting Heightproof.

verify: {
  endpoints: [airnodeDrpcEndpoint({ network: "base", fetchImpl: payingFetch })]
}

How it works

• SDK (@heightproof/web3): reads responses as text, so the signed bytes survive. It checks the signature against the exact bytes received (signatureValid), and checks that the signed request hash matches the one derived from the exact request sent (requestBound), so an answer to a different request can't be replayed. Each endpoint can take its own fetchImpl, for example one wrapped with @x402/fetch to pay the $0.01-per-call charge.
• Worker (the trust boundary): re-recovers the signer from the kept body and confirms the body holds the very result whose hash was compared. It never trusts the SDK's verdict.
• D2: the reason cites the verified signer. A signature is attribution, not truth, so it changes no weight.
• Storage: migration 003 adds evm_attestation (jsonb, including the signed body, capped at 64 KiB) and evm_attested_by, which is set only after the worker's re-check passes.
• Dashboard: the request explorer shows the verified signer.
• Refusals: a non-JSON-RPC HTTP refusal, such as an unpaid 402, is now recorded as a failed observation instead of being parsed as an answer.

shared uses @noble/curves and @noble/hashes for keccak and secp256k1 recovery. It does not depend on viem.

Testing

• Fixtures: unit tests use a real signed response captured from the live dRPC Airnode. They cover request-hash derivation, signer recovery, a tampered body, a re-serialized body, a replayed request hash and malformed headers.
• SDK tests: a stand-in Airnode signs with a fresh key, covering a valid and bound answer, a wrong request hash, an unpaid 402, and per-endpoint fetch routing.
• Worker tests: they overrule a forged SDK verdict and a verdict that has no body to check.
• Integration (real Postgres and Redis): a real signature goes through stream → worker → Postgres, and the D2 reason names the signer.
• Live: an unpaid eth_getBalance against the real Airnode is recorded as a failed observation.
• npm run build, typecheck, lint and test all pass, and test:integration passes with 14 tests.

Not yet exercised: a paid call end to end. It needs a wallet funded with aUSD on Base Sepolia.

Docs: docs/airnode.md

🤖 Generated with Claude Code