feat(hive): sponsor-backed account onboarding + ETH anti-drain gate#300
Merged
Conversation
Hive receive/onboarding panel (HiveAccountPanel) on the Hive asset page: resolves the device's active key to an account via Pioneer, or runs the in-app sponsor onboarding wizard (live username availability, device-derived SLIP-0048 role keys, @keepkey-sponsored on-chain creation; keys never leave the device). Backend RPCs: hiveGetRoleKeys, hiveGetAccount, hiveUsernameAvailable, hiveCreateAccount (device owner-signed account_create attestation -> Pioneer sponsor endpoint). hiveSignTx/hiveSignAccountCreate route through emuSigningOp on the emulator for the interactive confirm gate. ETH anti-drain gate: hiveCreateAccount signs a fixed EIP-191 message bound to username+ownerKey with the device ETH key (m/44'/60'/0'/0/0) and sends ethAddress+ethSignature. The server requires the address to hold mainnet ETH (one sponsored account per funded address) to keep the free service from being drained. 403 surfaces a dedicated 'fund your ETH address' screen. Bumps hdwallet 91a9e9d -> d51727e4 (master) for the Hive account-lifecycle wallet methods (keepkey/hdwallet#50).
…username race - P1: after a successful create, poll hiveGetAccount (backing off, 90s cap) and only hand off to the parent once the account resolves, instead of a single 4.5s refresh that could bounce a real success back to the wizard when the pubkey->account lookup lagged. Poll halts on unmount. - P2: surface address-derivation failures instead of an infinite spinner — the panel now takes loading/deriveError/onRetryDerive; a null activeKey with an error (or no in-flight derive) shows an actionable Retry. - P2: ignore stale username-availability responses (tag avail with its name + latest-name guard) so a late 'available' can't enable creation for a different, unchecked name. create() guard hardened to match.
The auto-poll already waited for hiveGetAccount to resolve before handing off, but the manual 'View account' button still called onCreated blind — a click before Pioneer resolved the pubkey would refresh()->noAccount->wizard, unmounting the celebration. Both paths now share a guarded resolveToAccount(): the button does the same lookup, keeps the success screen on noAccount, and shows a 'still finalizing' hint instead of bouncing.
BitHighlander
added a commit
that referenced
this pull request
Jul 1, 2026
) Adds a Hive entry to the 7.15.0 features in firmware-versions.ts so the firmware upgrade preview advertises Hive (chain logo + brand color from chains.ts). Vault-side Hive support already shipped (#300). Consistent with the other deferred-firmware 7.15.0 entries (Zcash, Transaction Insight) — the firmware Hive batch stages separately. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Hive sponsor-backed account onboarding to the vault, with an ETH anti-drain gate.
Onboarding panel (
HiveAccountPanel, on the Hive asset page):@keepkey-sponsored on-chain creation. Keys never leave the device; the user pays nothing.Backend RPCs (
bun/index.ts):hiveGetRoleKeys,hiveGetAccount,hiveUsernameAvailable,hiveCreateAccount.hiveCreateAccountderives the four role keys, gets a device owner-signedaccount_createattestation (op 9), and POSTs to Pioneer's sponsor endpoint. Signing ops route throughemuSigningOpon the emulator for the interactive confirm gate.ETH anti-drain gate: the Hive attestation only proves control of the submitted owner key — not a genuine KeepKey — so a software client could loop fresh keys and drain the sponsor.
hiveCreateAccountnow also signs a fixed EIP-191 message bound tousername+ownerKeywith the device ETH key (m/44'/60'/0'/0/0) and sendsethAddress+ethSignature. The server requires the address to hold mainnet ETH (one sponsored account per funded address). A403surfaces a dedicated "fund your ETH address" screen rather than a generic error;409is disambiguated (name-taken vs address-already-used).Submodule
91a9e9d → d51727e4(master) for the Hive account-lifecycle wallet methods — feat(hive): account lifecycle wallet methods (multi-key, account_create/update) hdwallet#50 (merged).98ca1e2/master already carries the Hive messages). A doc-only clarification thatHiveSignAccountCreateis an attestation is in docs(hive): clarify HiveSignAccountCreate is an attestation BitHighlander/device-protocol#35 (independent, comment-only).alpha) already has theaccount_createhandler. The separatecustom_json(Hive-Engine) firmware work is intentionally not part of this PR.Test plan
tsc --noEmitclean.HIVE_ETH_GATE+ETHEREUM_RPC_URL.