shared-configs

Reusable configuration files for Rhinestone services

Usage

Installation

bun install viem @rhinestone/shared-configs

Making changes

Source-of-truth lives in Yeet Jsonnet config:

1. Update Yeet config (for example yeet/config/chains.jsonnet, yeet/config/providers.jsonnet, or yeet/config/oft.jsonnet)
2. Regenerate configs with bun run generate from this directory (requires Go)
3. Merge to main to publish @rhinestone/shared-configs

Token authorizations

An EVM token with verified token-native signed authorization support carries an optional authorization object in chainRegistry[chainId].tokens[]:

{
  standards: ['erc3009', 'erc2612'],
  domain: {
    name: 'USD Coin',
    version: '2',
    chainId: 8453,
    verifyingContract: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
  },
  domainSeparator: '0x02fa7265e7c5d81118673727957699e4d68f74cd74b7db77da710fe8a2c7834f',
  eoaOnly: false,
}

The domain contains every EIP-712 signing field. Most deployments use the canonical chainId layout; legacy Polygon USDT0 instead carries a bytes32 salt and omits chainId. domainSeparator pins the exact live contract value. Consumers should derive the separator from domain, compare it with the pinned value and the token's live DOMAIN_SEPARATOR(), and fail closed before requesting a signature if either differs.

eoaOnly: false means the verified implementation also exposes bytes-signature overloads backed by ERC-1271-aware signature checking. Consumers using only the legacy v/r/s overloads may still impose their own EOA-only restriction.

Absence means no token-native capability has been verified. It says nothing about Permit2, which is an external contract and is available only when the owner has granted it sufficient token allowance.

Run bun run audit:token-authorizations to revalidate every direct EVM token at a single recent block per chain. The audit resolves EIP-1967, legacy Zeppelin, and facet-routed implementations; checks exact selectors, state readers, EIP type hashes, signature overloads, and the live domain separator; and fails when the result differs from the registry. Use TOKEN_AUTH_AUDIT_RPC_<chainId> to override a rate-limited public RPC.

Vendor drift

bun run check:vendor-drift diffs the RHINO, NEAR and CCTP claims in configs/chains.json against what each vendor serves right now — Rhino's /bridge/configs, 1Click's /v0/tokens, and, since Circle publishes no enumeration endpoint, an on-chain TokenMessengerV2 sweep of every EVM chain in the registry.

It reports and never gates: the Vendor Drift Check workflow runs it daily and always succeeds, deliberately not wired into the release path. The CCTP sweep falls back to each chain's publicRpcUrl when ALCHEMY_API_KEY / DRPC_API_KEY are unset, so it runs with no credentials; override one chain with VENDOR_DRIFT_RPC_<chainId>. --strict exits non-zero on drift, for a human running it locally.