Lab · T3 Signing and sending

Sign without money

Sign an action with a brand-new key and send it to testnet. The key has no account, so the exchange always rejects it, but its error names the address it recovered from your signature. If that's your new key, your encoding matches the exchange's byte for byte.

The key is generated in your browser for this one request and then thrown away. The lab only talks to api.hyperliquid-testnet.xyz, and the action is a cancel of an order that doesn't exist, so nothing can take effect. Never paste a real private key into any website, this one included.

Choose what to send

Introduce a mistake, or sign it correctlySign it correctlyThe recipe the SDKs use. The exchange should name your throwaway key.Hash the fields in a different orderSame values, different key order. msgpack keeps order, so the hash changes.Sign for mainnet instead of testnetThe signed message says "a" (mainnet) rather than "b" (testnet).Leave the nonce out of the hashThe request still carries the nonce, but the hash doesn't include it.Hash an extra field set to nullA null is encoded; a missing field isn't.

What happened

A throwaway keyGenerated when you press the button.
The action{"type":"cancel","cancels":[{"a":0,"o":1}]}
Bytes hashed: msgpack of the action, the nonce, then 00 for "no vault"–
keccak-256 of those bytes, signed as an EIP-712 Agent message–
The exchange's reply–

Not run yetPress the button to sign and send.

What to take from this

The error names a different address every time anything about the payload changes. That's why a wrong signature never says what's wrong.
Turn this into a test for your own code: sign one action with a fresh key and check the address in the reply. hyperkeeper does this every time it starts.
The full list of signing traps is in T3 Signing and sending.