Ethereum (EVM)

Note: see the language section for more details.

Allow ABI-specific contract call parameters

For contract interactions, use Smart Contract Interfaces (ABI upload) rather than raw calldata slicing. ABI-based policies use named arguments (eth.tx.contract_call_args['arg_name']) instead of byte offsets — they’re more readable, less error-prone, and won’t silently break if the contract encoding changes. Raw eth.tx.data[...] slicing is a fallback for contracts where no ABI is available. Restrict a transfer call to a maximum amount and a specific recipient:

{
  "policyName": "Limit WETH transfers",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.contract_call_args['wad'] < 1000000000000000000 && eth.tx.contract_call_args['dst'] == '0x08d2b0a37F869FF76BACB5Bab3278E26ab7067B7'"
}

Restrict by function name or selector (also requires an ABI upload):

{
  "policyName": "Allow only transfer calls to a contract",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.to == '<CONTRACT_ADDRESS>' && eth.tx.function_name == 'transfer'"
}

Iterating over contract call arguments

When a contract function takes an array parameter, use .count(), .all(), and .any() to enforce conditions across every element, rather than checking a single index. Syntax:

Array element count: eth.tx.contract_call_args['arrayArg'].count()
All elements match: eth.tx.contract_call_args['arrayArg'].all(item, <condition>)
Any element matches: eth.tx.contract_call_args['arrayArg'].any(item, <condition>)

For functions that take a tuple array (e.g. executeBatch((address,uint256,bytes)[] calls)), tuple fields are currently accessed by position rather than name: call[0] (first field), call[1] (second field), and so on. The positions correspond to the order of fields as defined in your ABI — substitute the correct indices for your own struct. Named access such as call['target'] is not yet supported and produces OUTCOME_ERROR.

Enforce exact batch size Restrict signing to transactions containing exactly two calls:

{
  "policyName": "Allow executeBatch with exactly 2 calls",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.function_name == 'executeBatch' && eth.tx.contract_call_args['calls'].count() == 2"
}

Whitelist all call targets in a batch Allow signing only when every call targets a specific contract and sends zero ETH. call[0] is the target address and call[1] is the value, based on the field order in the executeBatch ABI:

{
  "policyName": "Allow executeBatch to whitelisted contract only",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.function_name == 'executeBatch' && eth.tx.contract_call_args['calls'].all(call, call[0] == '<CONTRACT_ADDRESS>' && call[1] == 0)"
}

Combine batch size and target restrictions

{
  "policyName": "Allow executeBatch — max 2 calls to whitelisted contract",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.function_name == 'executeBatch' && eth.tx.contract_call_args['calls'].count() <= 2 && eth.tx.contract_call_args['calls'].all(call, call[0] == '<CONTRACT_ADDRESS>' && call[1] == 0)"
}

Whitelist recipients in a flat address array For functions that take a plain address[] parameter — such as a disperse-style multi-send contract — use in to restrict signing to a known set of addresses:

{
  "policyName": "Allow disperse to whitelisted recipients only",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.function_name == 'disperse' && eth.tx.contract_call_args['recipients'].all(addr, addr in ['<ADDRESS_1>', '<ADDRESS_2>', '<ADDRESS_3>'])"
}

See Smart Contract Interfaces for the full upload walkthrough and Solana IDL support.

Allow ERC-20 transfers for a specific token smart contract (raw calldata fallback)

Use this pattern only when an ABI is unavailable. The selector 0xa9059cbb is the 4-byte keccak256 hash of transfer(address,uint256).

{
  "policyName": "Enable ERC-20 transfers for <CONTRACT_ADDRESS>",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.to == '<CONTRACT_ADDRESS>' && eth.tx.data[0..10] == '0xa9059cbb'"
}

Allow anyone to sign transactions for testnet (Sepolia)

{
  "policyName": "Allow signing ethereum sepolia transactions",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.chain_id == 11155111"
}

Allow ETH transactions with a specific nonce range

{
  "policyName": "Allow signing Ethereum transactions with an early nonce",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.tx.nonce <= 3"
}

Allow signing of EIP-712 payloads for Hyperliquid `ApproveAgent` operations

{
  "policyName": "Allow signing of EIP-712 Payloads for Hyperliquid `ApproveAgent` operations",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.eip_712.domain.name == 'HyperliquidSignTransaction' && eth.eip_712.primary_type == 'HyperliquidTransaction:ApproveAgent' && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'"
}

Inspect nested fields in EIP-712 message payloads

The eth.eip_712.message map supports nested field access using bracket notation and array iteration operators, allowing policies to inspect and enforce conditions across typed data contents, beyond just the domain and primary type. Syntax:

Nested struct fields: eth.eip_712.message['outerField']['innerField']
Array element fields: eth.eip_712.message['arrayField'][0]['innerField']
Array iteration: eth.eip_712.message['arrayField'].all(item, <condition>)
Array length: eth.eip_712.message['arrayField'].count()

Example: Restrict Permit2 batch token approvals by token address Uniswap’s Permit2 PermitBatchTransferFrom type lets users sign a single message authorizing multiple token transfers. The message contains a permitted array of TokenPermissions structs, each with a token address and an amount.

{
  "primaryType": "PermitBatchTransferFrom",
  "domain": { "name": "Permit2", "chainId": 1, "verifyingContract": "0x000000000022D473030F116dDEE9F6B43aC78BA3" },
  "message": {
    "permitted": [
      { "token": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "amount": "1000000000" }
    ],
    "spender": "0x<SPENDER_ADDRESS>",
    "nonce": 0,
    "deadline": 1234567890
  }
}

To allow signing only when the first permitted token is USDC:

{
  "policyName": "Allow Permit2 batch only if first token is USDC",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.eip_712.domain.name == 'Permit2' && eth.eip_712.primary_type == 'PermitBatchTransferFrom' && eth.eip_712.message['permitted'][0]['token'] == '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48' && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'"
}

Array elements can be accessed by index ([0], [1], etc.). The condition message['permitted'][0]['token'] == '0xA0b8...' checks the first entry. You can also check specific positions explicitly (for example, message['permitted'][0]['token'] == '0xA0b8...' && message['permitted'][1]['token'] == '0xA0b8...'). Use .all() when you want to apply the same token check across the entire permitted array. A .all() example is included below.

Iterating over array fields

Whitelist a specific token across all approvals with .all():

{
  "policyName": "Allow Permit2 batch only for USDC",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.eip_712.domain.name == 'Permit2' && eth.eip_712.primary_type == 'PermitBatchTransferFrom' && eth.eip_712.message['permitted'].all(p, p['token'] == '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48') && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'"
}

Allow Permit2 batches with two or fewer token permissions:

{
  "policyName": "Allow Permit2 batches with <= 2 token permissions",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.eip_712.domain.name == 'Permit2' && eth.eip_712.primary_type == 'PermitBatchTransferFrom' && eth.eip_712.message['permitted'].count() <= 2 && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'"
}

Allow token permissions below 100 USDC:

{
  "policyName": "Allow USDC token permissions below 100 USDC",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.eip_712.domain.name == 'Permit2' && eth.eip_712.primary_type == 'PermitBatchTransferFrom' && eth.eip_712.message['permitted'].any(p, p['token'] == '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48' && p['amount'] < 100000000) && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'"
}

in works for integer fields. For string fields such as token addresses, use || instead.

Deny signing of `NO_OP` keccak256 payloads

{
  "policyName": "Deny NO_OP hash signing",
  "notes": "",
  "effect": "EFFECT_DENY",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.hash_function == 'HASH_FUNCTION_NO_OP' && activity.params.encoding != 'PAYLOAD_ENCODING_EIP712'"
}

Allow signing of EIP-712 payloads for EIP-3009 transfers

{
  "policyName": "Allow signing of EIP-712 payloads for EIP-3009 Transfers for USD Coin",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.eip_712.domain.name == 'USD Coin' && eth.eip_712.primary_type == 'TransferWithAuthorization' && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'"
}

Allow signing of EIP-712 payloads for EIP-2612 permits for USD Coin

{
  "policyName": "Allow signing of EIP-712 payloads for EIP-2612 Permits for USD Coin",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "eth.eip_712.domain.name == 'USD Coin' && eth.eip_712.primary_type == 'Permit' && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'"
}

Allow signing of EIP-7702 authorizations

Allow only the delegate contracts that you trust, on your specific chains:

{
  "policyName": "Allow signing of EIP-7702 Authorizations",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.encoding == 'PAYLOAD_ENCODING_EIP7702_AUTHORIZATION' && eth.eip_7702_authorization.address in ['<CHECKSUMMED_ADDRESS_1>', '<CHECKSUMMED_ADDRESS_2>'] && eth.eip_7702_authorization.chain_id == <CHAIN_ID>"
}

To allow one authorization only, also set the nonce:

{
  "policyName": "Allow signing of one EIP-7702 Authorization",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.encoding == 'PAYLOAD_ENCODING_EIP7702_AUTHORIZATION' && eth.eip_7702_authorization.address == '<CHECKSUMMED_ADDRESS>' && eth.eip_7702_authorization.chain_id == <CHAIN_ID> && eth.eip_7702_authorization.nonce == <NONCE>"
}

Notes:

Write each address in the EIP-55 checksummed (mixed-case) form, because the comparison is case-sensitive.
Write chain_id and nonce as numbers (without quotes). Turnkey rejects a policy that compares a number to a quoted value.
To also allow ACTIVITY_TYPE_SIGN_RAW_PAYLOAD, use activity.type in ['ACTIVITY_TYPE_SIGN_RAW_PAYLOAD', 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'].
For the activities that populate eth.eip_7702_authorization, see EIP-7702.

Deny signing of EIP-7702 authorizations for all chains

An authorization with chain_id 0 is valid on all EVM chains. To deny these authorizations in the activities that populate eth.eip_7702_authorization, you can use a policy like the following:

{
  "policyName": "Deny signing of EIP-7702 Authorizations for all chains",
  "notes": "",
  "effect": "EFFECT_DENY",
  "condition": "eth.eip_7702_authorization.chain_id == 0"
}

Deny batch signing of EIP-7702 authorizations

ACTIVITY_TYPE_SIGN_RAW_PAYLOADS does not populate eth.eip_7702_authorization. To deny EIP-7702 authorizations in this activity, use the encoding. This policy blocks only PAYLOAD_ENCODING_EIP7702_AUTHORIZATION. A hexadecimal or UTF-8 payload can also be an authorization, so if a key must not sign authorizations, allow raw payload signing only with PAYLOAD_ENCODING_EIP712 (see EIP-7702).

{
  "policyName": "Deny batch signing of EIP-7702 Authorizations",
  "notes": "",
  "effect": "EFFECT_DENY",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOADS' && activity.params.encoding == 'PAYLOAD_ENCODING_EIP7702_AUTHORIZATION'"
}

Deny signing of Type 4 transactions

The policy engine does not expose the authorization list of a Type 4 (EIP-7702) transaction. To block Type 4 transactions, deny them by type. This policy covers the transactions that you sign with ACTIVITY_TYPE_SIGN_TRANSACTION and ACTIVITY_TYPE_SIGN_TRANSACTION_V2.

{
  "policyName": "Deny signing of Type 4 transactions",
  "notes": "",
  "effect": "EFFECT_DENY",
  "condition": "activity.kind == 'SIGN_TRANSACTION' && eth.tx.type == 'TYPE_4'"
}

Side note: Type 4 transactions that Turnkey builds for ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2 and ACTIVITY_TYPE_ETH_UNDELEGATE_7702 have a different eth.tx.type, so this policy does not apply to them.

Get started

Features

Reference

Allow ABI-specific contract call parameters

Iterating over contract call arguments

Allow ERC-20 transfers for a specific token smart contract (raw calldata fallback)

Allow anyone to sign transactions for testnet (Sepolia)

Allow ETH transactions with a specific nonce range

Allow signing of EIP-712 payloads for Hyperliquid `ApproveAgent` operations

Inspect nested fields in EIP-712 message payloads

Iterating over array fields

Deny signing of `NO_OP` keccak256 payloads

Allow signing of EIP-712 payloads for EIP-3009 transfers

Allow signing of EIP-712 payloads for EIP-2612 permits for USD Coin

Allow signing of EIP-7702 authorizations

Deny signing of EIP-7702 authorizations for all chains

Deny batch signing of EIP-7702 authorizations

Deny signing of Type 4 transactions

​Allow ABI-specific contract call parameters

​Iterating over contract call arguments

​Allow ERC-20 transfers for a specific token smart contract (raw calldata fallback)

​Allow anyone to sign transactions for testnet (Sepolia)

​Allow ETH transactions with a specific nonce range

​Allow signing of EIP-712 payloads for Hyperliquid ApproveAgent operations

​Inspect nested fields in EIP-712 message payloads

​Iterating over array fields

​Deny signing of NO_OP keccak256 payloads

​Allow signing of EIP-712 payloads for EIP-3009 transfers

​Allow signing of EIP-712 payloads for EIP-2612 permits for USD Coin

​Allow signing of EIP-7702 authorizations

​Deny signing of EIP-7702 authorizations for all chains

​Deny batch signing of EIP-7702 authorizations

​Deny signing of Type 4 transactions

Allow ABI-specific contract call parameters

Iterating over contract call arguments

Allow ERC-20 transfers for a specific token smart contract (raw calldata fallback)

Allow anyone to sign transactions for testnet (Sepolia)

Allow ETH transactions with a specific nonce range

Allow signing of EIP-712 payloads for Hyperliquid `ApproveAgent` operations

Inspect nested fields in EIP-712 message payloads

Iterating over array fields

Deny signing of `NO_OP` keccak256 payloads

Allow signing of EIP-712 payloads for EIP-3009 transfers

Allow signing of EIP-712 payloads for EIP-2612 permits for USD Coin

Allow signing of EIP-7702 authorizations

Deny signing of EIP-7702 authorizations for all chains

Deny batch signing of EIP-7702 authorizations

Deny signing of Type 4 transactions