# @ambire/signature-validator

> Signature validation library aiming to verify all different signature types for Ethereum and other EVM chains, including smart contract signatures (EIP 1271) and typed data (EIP 712)

Latest version **1.5.0** (published 2025-09-12) · MIT license · 0 weekly downloads

## Install

```sh
npm install @ambire/signature-validator
pnpm add @ambire/signature-validator
yarn add @ambire/signature-validator
bun add @ambire/signature-validator
```

## Health

**Score 35/100 (D)** — status: maintenance-mode.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: stale; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.5.0 |
| Published | 2025-09-12 |
| First published | 2022-05-05 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 3 |
| Unpacked size | 550.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 68 |
| Author | AmbireTech |
| Maintainers | ivogeorgiev, 0xstojnovsky, 0xdex18, borislav.itskov, cmihaylov_dev, gergana95, superkalo |
| Keywords | ethereum, smart-contracts, evm, signature-validation, ethers, ethersjs, cryptographic-signatures, ethereum-signer, eip712, eip1271, signtypeddata |

## Links

- npm: https://www.npmjs.com/package/@ambire/signature-validator
- Repository: https://github.com/AmbireTech/signature-validator
- Homepage: https://github.com/AmbireTech/signature-validator#readme
- Issues: https://github.com/AmbireTech/signature-validator/issues
- npm.io page: https://npm.io/package/@ambire/signature-validator

## Dependencies (3)

- [tape](https://npm.io/package/tape.md) ^5.5.3
- [ethers](https://npm.io/package/ethers.md) ^5.6.5
- [tap-spec](https://npm.io/package/tap-spec.md) ^5.0.0

## Alternatives

- [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads
- [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads
- [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads
- [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads
- [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads

## Recent versions

- 1.5.0 (latest) — 2025-09-12
- 1.4.1 — 2024-09-08
- 1.4.0 — 2024-09-08
- 1.3.1 — 2023-06-13
- 1.3.0 — 2023-03-16
- 1.1.0 — 2022-11-05
- 1.0.3 — 2022-05-16
- 1.0.2 — 2022-05-10
- 1.0.1 — 2022-05-07
- 1.0.0 — 2022-05-05

## README

# Signature Validator library

As signatures can be daunting at times, this is a library aiming to implement universal signature verification, supporting: 

- Standard message verification (`eth_sign`)
- EIP-712 Typed data verification (`eth_signTypedData_v*`)
- ERC-1271 Smart contract on-chain verification (`isValidSignature`)
- [ERC-6492](https://eips.ethereum.org/EIPS/eip-6492): Signature verification for pre-deploy counterfactual contracts

### Usage

---

Simple `eth_sign` verification
```ts
import ethers from 'ethers';
import { verifyMessage } from '@ambire/signature-validator';

const provider = new ethers.providers.JsonRpcProvider('https://polygon-rpc.com')

async function run() {
	// Replace `ethers.verifyMessage(message, signature) === signer` with this:
	const isValidSig = await verifyMessage({
	    signer: '0xaC39b311DCEb2A4b2f5d8461c1cdaF756F4F7Ae9',
	    message: 'My funds are SAFU with Ambire Wallet',
	    signature: '0x9863d84f3119ac01d9e3bf9294e6c0c3572a07780fc7c49e8dc913806f4b1dbd4cc075462dc84422a9b981b2556f9c9197d76da7ba3603e53e9300869c574d821c',
	    // this is needed so that smart contract signatures can be verified; this property can also be a viem PublicClient
	    provider,
	})
	console.log('is the sig valid: ', isValidSig)
}
run().catch(e => console.error(e))
```

For more examples, you can check the /tests folder

### viem support
The `provider` property can also be a `viem` `PublicClient`, as shown in the tests (`testConfig.js`).

### On-chain usage
For on-chain usage, we've deployed a singleton here: https://etherscan.io/address/0x7dd271fa79df3a5feb99f73bebfa4395b2e4f4be#code

And it can be deployed at the same address on every othe EVM network thanks to EIP-2470. If you wish to deploy it yourself, just use the [singleton factory](https://etherscan.io/address/0xce0042B868300000d44A59004Da54A005ffdcf9f) (use the target network's explorer) and use the bytecode resulted from compiling `UniversalSigValidator` from [EIP-6492](https://eips.ethereum.org/EIPS/eip-6492) with Solidity 0.8.28 and salt `0x0`.

Please note that onchain use cases are rare, but they do exist. For example, if you have a DEX that stores the user's orders in the form of signed messages that can be applied on-chain by anyone at any time, you may reason that sometimes an account that isn't deployed yet might want to submit such an order.

### Porting the library to other languages (eg Golang, Rust)
Porting can be done very easily because the library is now essentially just a single `eth_call`, thanks to the univeresal signature verifier being implemented in Solidity [here](https://github.com/AmbireTech/signature-validator/blob/main/contracts/EIP6492Full.sol).

### Debugging utility / user interface
To test signatures in an easier manner, you can use the signature-validator UI here: https://sigtool.ambire.com/

### Security
A formal audit was done on the ERC-6492 reference implementation used here, and all remarks were resolved. You can find the audit [here](./ERC6492-Hunter-Security-Audit-Report-V1.0.pdf). This repo uses a [simplified variant of that reference implementation](./contracts/EIP6492.sol) that the audit also applies to (except all of the issues related to `prepare` which is not used here).

Furthermore, you can self-audit the library quite easily as it's only ~80 lines of code (index.js).

### Testing

```
npm i --development
npm test
```

---
_Source: https://npm.io/package/@ambire/signature-validator · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._