Comparison with Foundry
Audience: Users choosing between Foundry and Hardhat for KMS signing.
Compared with Foundry at commit 336712c, foundry-core 6228965 and alloy c6a2f8c, and with the Azure signer proposed in foundry#17120, all read from source on 2026-09-30 (Signing prior art). Later Foundry releases may differ.
Differences from Foundry
What hardhat-kms adds over Foundry's KMS signers:
- GCP CRC32C integrity checks. Foundry has none.
- Post-sign verification of every signature. Foundry's Turnkey signer has none.
- Per-call timeouts on every provider.
- Multiple keys for every provider. Foundry allows one GCP key and one Turnkey key.
- An account listing that checks access.
- A
public-keycommand. - A chain-id guard on typed data.
- Protection against double broadcast when a client retries a send.
Credentials
Neither tool keeps secrets in its config: both hand the key to the cloud's own SDK, which finds credentials in the environment. Cloud credentials for KMS signing explains the plugin's side.
| Cloud | Foundry | hardhat-kms |
|---|---|---|
| AWS | The AWS SDK for Rust's default chain: environment keys, profile, web identity, container, instance role | The AWS SDK for JavaScript's default chain: the same sources in the same order |
| AWS, profile and access keys set | The access keys in the environment win, even with AWS_PROFILE set | The profile wins: with the key's profile or AWS_PROFILE set, the access keys in the environment are ignored, with a warning |
| AWS, per key | One AWS_PROFILE and one AWS_REGION for the whole run | Each key can set its own profile, region and endpoint |
| Google Cloud | Application Default Credentials: GOOGLE_APPLICATION_CREDENTIALS, then the gcloud ADC file in ~/.config/gcloud, then the metadata server | The same three sources in the same order. CLOUDSDK_CONFIG moves the gcloud ADC file, and GOOGLE_CLOUD_QUOTA_PROJECT sets the quota project |
| Azure | No released signer. The one proposed in foundry-rs/foundry#17120 picks one source from the variables that are set: a client secret, else a federated token file, else az then azd, then a managed identity with 10 s for a token | The same order, as one chain that skips the sources that are not set up. It also takes a certificate instead of a secret, and refuses username and password sign-in |
The AWS row with a profile and access keys is the one that changes which identity signs. A Foundry job that exports access keys and also sets AWS_PROFILE signs with the keys; the same environment under hardhat-kms signs with the profile. Set one or the other, never both (Never set a profile and environment keys together).
Other comparisons
- Compared with other KMS signers: the Hardhat 2
hardhat-kms-signerpackages and their forks. - A KMS key or a private key in .env: the setup most Hardhat and Foundry projects start from.
- A KMS key or a Ledger: a device prompt for each signature, and both in one project.