ethereum-local-wallet

name	ethereum-local-wallet
description	Execute Ethereum transactions NOW — send ETH, approve tokens, call contracts, sign messages. Uses the in-cluster remote-signer (agents never touch private keys). Use this skill whenever the user wants to DO something onchain, not just learn about wallets.
metadata	{"openclaw":{"emoji":"💳","requires":{"bins":["python3"]}}}

Ethereum Wallet

Sign and send Ethereum transactions through the local remote-signer service. The agent never accesses private keys directly — all signing is done via HTTP API calls to the remote-signer, which holds encrypted keystores.

When to Use

• Sending ETH or ERC-20 tokens
• Signing messages (EIP-191) or typed data (EIP-712)
• Interacting with smart contracts that modify state (write operations)
• Approving token allowances
• Any operation that requires a transaction signature

When NOT to Use

• Read-only queries — use the ethereum-networks skill instead (rpc.sh)
• Key generation — keys are managed by the obol CLI, not by the agent
• Cross-chain bridges — not supported in this skill

Quick Start

# List your signing addresses
python3 scripts/signer.py accounts

# Check remote-signer health
python3 scripts/signer.py health

# Sign a message
python3 scripts/signer.py sign-msg 0xYOUR_ADDRESS "Hello, Ethereum!"

# Sign a transaction (returns raw signed tx hex, does NOT broadcast)
python3 scripts/signer.py sign-tx \
  --from 0xYOUR_ADDRESS --to 0xRECIPIENT \
  --value 1000000000000000000 --network mainnet

# Sign AND broadcast a transaction via eRPC
python3 scripts/signer.py send-tx \
  --from 0xYOUR_ADDRESS --to 0xRECIPIENT \
  --value 1000000000000000000 --network mainnet

Available Commands

Command	Description
accounts	List all signing addresses from the remote-signer
health	Check remote-signer /healthz endpoint
sign <address> <hex-data>	Sign a raw 32-byte hash
sign-msg <address> <message>	Sign a message with EIP-191 prefix
sign-tx --from --to [--value] [--data] [--gas] [--nonce] [--network]	Sign an EIP-1559 transaction
send-tx --from --to [--value] [--data] [--network]	Sign AND broadcast a transaction via eRPC
sign-typed <address> <json>	Sign EIP-712 typed data
gas-info [--network]	Print recommended base/tip/max fees from eth_feeHistory

Transaction Submission Flow

1. Agent decides to send a transaction
2. signer.py: GET /api/v1/keys → list available signing addresses
3. signer.py: eth_getTransactionCount → eRPC (nonce)
4. signer.py: eth_gasPrice + eth_maxPriorityFeePerGas → eRPC (fees)
5. signer.py: eth_estimateGas → eRPC (gas limit)
6. signer.py: POST /api/v1/sign/{address}/transaction → remote-signer
   → Returns RLP-encoded signed transaction hex
7. signer.py: eth_sendRawTransaction → eRPC (broadcast)
8. signer.py: eth_getTransactionReceipt → eRPC (confirmation)

Multi-Network Support

The same signing key works on any EVM chain. Specify the network via --network:

python3 scripts/signer.py send-tx --network hoodi \
  --from 0x... --to 0x... --value 1000000000000000000

Supported networks: mainnet, base, base-sepolia, hoodi, sepolia, arbitrum, robinhood (depends on eRPC configuration). The aliases ethereum, arb, arbitrum-one, robinhood-chain, and eip155:<id> resolve to the canonical name. Unknown values fail with an explicit error rather than silently signing against chain id 1.

Note: arbitrum and robinhood require the stack operator to have registered an eRPC upstream under that alias (obol network add — ChainList has both). If ${ERPC_URL}/arbitrum or ${ERPC_URL}/robinhood returns 404, the upstream isn't registered — ask the operator.

Gas & Tip Selection

sign-tx and send-tx auto-fill maxPriorityFeePerGas and maxFeePerGas using eth_feeHistory(20, latest, [50]) — the median 50th-percentile tip across the last 20 blocks, plus a base-fee headroom of 2*baseFee. Per-chain bounds clip the tip so quiet mainnet stays at ~0.05 gwei (instead of overpaying 1 gwei) and L2 stays sub-gwei.

To inspect what the oracle would choose without signing:

python3 scripts/signer.py gas-info --network mainnet
python3 scripts/signer.py gas-info --network base

If eth_feeHistory is unavailable, the oracle falls back to per-chain safe defaults rather than failing the transaction outright. Override with --max-fee and --max-priority only when you have a specific reason (e.g. cancelling a stuck tx).

Environment Variables

Variable	Default	Description
REMOTE_SIGNER_URL	http://remote-signer:9000	Remote-signer REST API base URL
ERPC_URL	http://erpc.erpc.svc.cluster.local/rpc	eRPC gateway for RPC calls
ERPC_NETWORK	mainnet	Default network for RPC routing

Security Model

• Agent never touches keys: All signing via HTTP to the remote-signer
• ClusterIP isolation: Remote-signer is only reachable within the cluster
• Encrypted keystores: V3 Web3 Secret Storage format with scrypt KDF
• Values in wei: No automatic unit conversion — always specify amounts in wei

Important Notes

• Always confirm with the user before sending transactions
• Never sign calldata you can't explain — decode it first with the inspect skill's decode.py
• Values are in wei (1 ETH = 1000000000000000000 wei)
• Use ethereum-networks skill (rpc.sh balance <address>) to check balances before sending
• The send-tx command will broadcast the transaction immediately after signing

See Also

• ethereum-networks — read-only blockchain queries via eRPC
• references/remote-signer-api.md — full remote-signer REST API reference