# Fix Web3Signer Error - Complete Guide

**Error**: `Web3Signer error` when sending transaction from `0x71e81eaec98e507f68bbcf5e2005f179db851603`

**Root Cause**: The address is in the allowlist but doesn't have a key in Web3Signer. The translator tries to sign the transaction via Web3Signer, but Web3Signer doesn't have the private key for this address.

## 🚀 Quick Fix

Run the automated fix script:

```bash
cd /home/intlc/projects/proxmox/rpc-translator-138
./scripts/fix-web3signer-allowlist-mismatch.sh
```

## 📋 Manual Fix Steps

### Step 1: Check Web3Signer Keys

```bash
# Get all keys loaded in Web3Signer
curl -s http://192.168.11.111:9000/api/v1/eth1/publicKeys | jq '.'

# Check if your address is in the list
curl -s http://192.168.11.111:9000/api/v1/eth1/publicKeys | jq -r '.[]' | grep -i "71e81eaec98e507f68bbcf5e2005f179db851603"
```

### Step 2: Update Allowlist

**If the address is NOT in Web3Signer** (most likely for a MetaMask wallet):

```bash
cd /home/intlc/projects/proxmox/rpc-translator-138

# Get only the addresses that have keys in Web3Signer
WEB3SIGNER_ADDRESSES=$(curl -s http://192.168.11.111:9000/api/v1/eth1/publicKeys | jq -r '.[]' | tr '\n' ',' | sed 's/,$//')

# Update allowlist to only include Web3Signer keys
if [ -n "$WEB3SIGNER_ADDRESSES" ] && [ "$WEB3SIGNER_ADDRESSES" != "" ]; then
    ./scripts/configure-wallet-allowlist.sh "$WEB3SIGNER_ADDRESSES"
else
    # If no keys, clear allowlist (allows all - not recommended for production)
    ./scripts/configure-wallet-allowlist.sh ""
fi
```

**If the address IS in Web3Signer** (service wallet):

The issue might be with the transaction format. Check the logs:
```bash
ssh -i ~/.ssh/proxmox_translator root@192.168.11.240 "journalctl -u rpc-translator-138.service -n 50 --no-pager | grep -A 10 Web3Signer"
```

### Step 3: Verify Fix

```bash
# Check Web3Signer keys
curl -s http://192.168.11.111:9000/api/v1/eth1/publicKeys | jq -r '.[]'

# Check allowlist
for IP in 192.168.11.240 192.168.11.241 192.168.11.242; do
    echo "=== $IP ==="
    ssh -i ~/.ssh/proxmox_translator root@$IP "grep '^WALLET_ALLOWLIST=' /opt/rpc-translator-138/.env"
done
```

## 🔍 Understanding the Issue

### How It Works

1. **Allowlist**: Controls which addresses can send transactions via `eth_sendTransaction`
2. **Web3Signer**: Must have the private key to sign transactions
3. **The Problem**: Address in allowlist but no key in Web3Signer = error

### Two Types of Wallets

**User Wallets (MetaMask, etc.)**:
- User controls the private key
- User signs transactions locally
- Should NOT be in allowlist
- Transactions are pre-signed and sent as `eth_sendRawTransaction`

**Service Wallets (Hot Wallets)**:
- Private key stored in Web3Signer
- Web3Signer signs transactions
- Should be in allowlist
- Transactions sent as `eth_sendTransaction` (unsigned)

### Solution

- **If `0x71e81eaec98e507f68bbcf5e2005f179db851603` is a MetaMask wallet**: Remove it from allowlist (users sign their own transactions)
- **If it's a service wallet**: Add its keystore file to Web3Signer first, then add to allowlist

## ✅ Expected Result

After fix:
- Allowlist contains only addresses that have keys in Web3Signer
- Service wallets can send transactions via `eth_sendTransaction`
- User wallets (MetaMask) can send pre-signed transactions via `eth_sendRawTransaction` (no allowlist needed)

---

**Run**: `./scripts/fix-web3signer-allowlist-mismatch.sh` to automatically fix the mismatch!
