Signer Rotation

Scope

Use when rotating quote signing custody or responding to suspected signer compromise.

Authority Required

Risk policy admin for the target RiskConfig collateral configuration, plus access to update server-only quote signer environment.

Preconditions

• affected collateral list.
• current quoteSigner.
• new signer address.
• quote service deployment or local .env owner.
• canary route and rollback owner.

Procedure

1. Stop or drain quote issuance for affected markets.
2. Read current RiskConfig collateral config.
3. Update quoteSigner to the new signer.
4. Update server-only signer environment.
5. Restart quote service.
6. Issue a dry-run signed quote.
7. Verify EIP-712 domain: CollateralManager, version 1, target chainId, and collateral manager verifying contract.
8. Run canary traffic before widening.

Rollback

If the old key is safe, restore the previous signer. If compromise is possible, set signedQuoteEnabled = false while recovery keys are prepared.