MPC Wallets

Most MPC services (Fordefi, Fireblocks, and similar) can permission over three types of actions:

Smart contract calls — which contract, which function, and often which argument values. Fordefi expresses these as ABI conditions, matching on address, integer, boolean, bytes, array, and tuple arguments.
Personal messages (personal_sign, e.g. EIP-191) — see personal messages and messages on non-EVM chains.
Typed data (EIP-712) — see typed data messages, where you can deny signatures that match certain fields of the EIP-712 domain or message.

Derive uses all three paths for different purposes:

Path	Medium	Scheme	Reaches
`OnchainActionManager`	Onchain	transaction	deposit, withdraw, add/remove session keys
Signed actions	HTTP / WS	EIP-712	all of the above, and trading
Session login	HTTP / WS	EIP-191	read-only — authenticates an HTTP request or WebSocket connection

Because the EIP-712 path can do strictly more than the contract-call path, the tightest setup is to close it entirely and operate through contract calls only.

Recommended policy

Block all EIP-712 signing on the MPC wallet

Every state-changing Derive action taken over the API is an EIP-712 signed action. Denying EIP-712 outright means the MPC wallet can never trade, transfer, or withdraw through the API — no allow-list to maintain and no new action type can slip through later.In Fordefi this is a typed data message rule. Fordefi surfaces an EIP-712 message’s recipient as its verifyingContract, so target the rule at Derive’s action domain:

Domain field	Value
`name`	`Matching`
`version`	`1.0`
`verifyingContract`	`0xeB8d770ec18DB98Db922E9D83260A585b9F0DeAD`
`chainId`	the settlement chain’s id — the only field that varies by network

Every Derive signed action uses this same verifyingContract on every network, so one deny rule on that address covers mainnet and testnet alike.

Whitelist deposits

On OnchainActionManager, allow the two deposit entrypoints:

function deposit(address asset, uint256 amount, uint64 subaccountId, address fallbackRecipient);
function depositToNewSubaccount(address asset, uint256 amount, uint32 managerId, address owner);

Pin owner and fallbackRecipient to the MPC wallet address. owner is what makes the MPC wallet the account owner; fallbackRecipient is where a deposit lands if it cannot be applied to its intended subaccount.

Whitelist session-key registration, with the scopes pinned

Session keys are registered from L1 through the generic entrypoint:

function submit(uint256 actionType, bytes calldata data)

Example (trade and withdraw only session key)

In this example we’re going to create a policy that will only allow your MPC wallet to create Session keys with the trade:orderbook:perp and withdraw protocol scopes. Because only admin scoped keys can withdraw to any recipient, this policy will only allow withdrawals to the MPC wallet’s own subaccounts.Use the TypeScript SDK’s session-key codec, to produce the bytes you’ll use to create an MPC policy.

import { encodeSetSessionKeyActionData } from '@derivexyz/derive-ts/codecs';
import { ProtocolScopeCode } from '@derivexyz/derive-ts';
import { Interface } from 'ethers';

const data = encodeSetSessionKeyActionData({
  sessionKey: '0x9f000000000000000000000000000000000000be',
  expirySec: 1793491200, // the KEY's lifetime; 0 deletes it
  // Exactly two scopes, in this order — the policy pins both.
  scopes: [ProtocolScopeCode.Withdraw, ProtocolScopeCode.TradeOrderbookPerp], // [1, 5]
  subaccountIds: [], // empty = all current and future subaccounts
});

const manager = new Interface([
  'function submit(uint256 actionType, bytes data) payable returns (uint256)',
]);
// 51 = Set Session Key. `data` is the 256 bytes broken down below.
console.log(manager.encodeFunctionData('submit', [51, data]));

Which bytes to pin in your MPC policy

Param	Contents	Pin to
`actionType`	Set Session Key action type	`51`
`data[0:32]`	`sessionKey` address	free — rotates
`data[32:64]`	`expirySec`	free — rotates
`data[64:96]`	offset → `scopes`	from console.log
`data[96:128]`	offset → `subaccountIds`	from console.log
`data[128:160]`	`scopes.length`	from console.log
`data[160:192]`	`scopes[0]` = `withdraw`	from console.log
`data[192:224]`	`scopes[1]` = `trade:orderbook:perp`	from console.log
`data[224:256]`	`subaccountIds.length` = all	from console.log

You can modify what you pin depending on your needs.

Leave personal messages (EIP191) allowed so session login keeps working and the MPC wallet retains read-only account access through UX and API.

Access scopes

The full protocol and off-chain scope catalog.

Session keys

What a session key is and how its lifecycle works.

Withdrawals

The withdrawal action and its recipient semantics.

Get Started

Authentication & Keys

Trading Concepts

Permissionless Vaults

WebSocket

Reference

Recommended policy

Example (trade and withdraw only session key)

Which bytes to pin in your MPC policy

Access scopes

Session keys

Withdrawals

​Recommended policy

​Example (trade and withdraw only session key)

​Which bytes to pin in your MPC policy

​Related

Access scopes

Session keys

Withdrawals

Recommended policy

Example (trade and withdraw only session key)

Which bytes to pin in your MPC policy

Related