What are Delegates?
Delegates are addresses authorized to submit attestations on behalf of an authority. The authority signs attestation data off-chain using BLS keys, and the delegate submits the transaction on-chain.The authority can also act as their own delegate. This is useful when you want to use BLS signing for your own submissions, bear gas fees directly, or keep the workflow simple without involving third parties.
Attester vs Subject
When an attestation is created through delegation, two key fields are set:The subject always remains the individual or entity the attestation describes, regardless of who submits the transaction.
Why Use Delegates?
Scalability
Issue thousands of attestations without the authority signing each transaction. The authority pre-signs batches; delegates handle submission.Security
Keep authority keys in cold storage or HSMs. Only BLS signatures leave the secure environment, never private keys.Cost Efficiency
Delegates pay transaction fees. Authorities don’t need to hold tokens for gas.Flexibility
Multiple delegates can submit on behalf of one authority. Useful for geographic distribution or redundancy.Self-Delegation
An authority can submit their own delegated attestations. This pattern is useful for:- Gas management — Authority pays fees directly from their wallet
- Simplicity — No need to coordinate with separate delegate infrastructure
- Testing — Validate the delegation flow before involving third parties
BLS Keys
AttestProtocol uses BLS12-381 signatures for delegation. BLS offers:- Aggregation: Multiple signatures can be combined into one
- Deterministic: Same message + key always produces same signature
- Compact: 48-byte signatures (compressed)
Key Generation
Key Registration
Before using delegation, register your BLS public key on-chain:Delegated Attestation Flow
1. Authority: Create and Sign Request
2. Delegate: Submit On-chain
Delegated Revocation
Same pattern for revoking attestations:Security Considerations
Nonce Management
Each delegation request includes a nonce to prevent replay attacks. The contract tracks used nonces per authority.Deadline Enforcement
Requests include a deadline timestamp. Submissions after the deadline are rejected.Domain Separation
Different operations (attest, revoke) use different domain separation tags (DST), preventing signature reuse across operations.Architecture Patterns
Batch Issuance
Authority pre-signs many attestations, sends signatures to a queue. Workers pull and submit.Event-Driven
Authority runs a signing service. When events occur (user completes KYC), sign and queue for submission.Multi-Region
Deploy delegates in multiple regions. Authority in one secure location, delegates distributed globally for lower latency.Complete Example
Next Steps
Authorities
Schema ownership and trust management
Examples
Real-world integration examples