Nonceworks
MenuClose

Hosting, key moves and release checks for OpenZeppelin Relayer and Monitor

For small onchain teams that send transactions from OpenZeppelin Relayer, or from a raw key on a server: we run the stack for you, move the key into your own KMS, or check each new release against your configuration if you run it yourself.

Whenever we sign for you, it is through your AWS KMS, Google Cloud KMS or Turnkey account, and you can revoke the grant yourself.

Latest note, 4 November 2026: Node 'latest' now installs a Node 27 alpha

$49 a month to run it, first month free. $300 to move a key, invoiced after the move. Release checks are quoted.

There is no signup page: write to us with what you run. For hosting, send the config, and we reply with the validation report and the grant to create on your key.

Send your config or validate it first
Nonces the relayer handed out that the chain had not accepted, run 2 of relayer-843-repro t+30 s: 0; t+60 s: 10; t+90 s: 25; t+120 s: 33; t+150 s: 33; t+180 s: 33; t+210 s: 33; t+240 s: 33; t+270 s: 33; t+300 s: 33; t+330 s: 33; t+360 s: 39; t+390 s: 40; t+420 s: 45; t+450 s: 45; t+480 s: 45; t+510 s: 46; t+540 s: 51; t+570 s: 51; t+600 s: 57; t+630 s: 58; t+660 s: 58; t+690 s: 60; t+724 s: 69 RPC errors 0 6 min 12 min 30 60 33 69
Fig. 1. Relayer 1.8.0, run 2 of relayer-843-repro, 6 October 2026. One minute of RPC errors near the start, and the relayer's nonce counter never came back to the chain. Each column is a 30-second sample of the nonces it had handed out that the chain had not yet accepted, one slot for every three: the gap holds at 33, then climbs, and 69 transactions were stuck as Sent when the run ended. The write-up and the files.

The offers

Run it for you
Monitor 1.6.0 and up to three Relayer 1.8.0 instances for one team, on OpenZeppelin's published images, signing through your AWS KMS, Google Cloud KMS or Turnkey account. $49 a month, first month free. How it works.
Move your key
For a relayer or bot that signs with a raw key from an environment variable or a secret store: a new key in your own KMS or Turnkey account, OpenZeppelin Relayer in front of it, the role changes as one Safe batch, and the old key retired. It is $300 fixed. A whole Defender stack, up to three relayers and ten monitors with the SDK swap as a pull request, is $400 (Defender migration guide). The order of a key move.
Check each release
If you run the stack yourself: each new Relayer release is run against your configuration on a local chain, with a test key in place of yours, before you upgrade, and you get an answer on any failure within a business day. Quoted when you ask (pricing).
Watch your images
upgrade-canary, our open-source tool, builds your image the way a fresh release runner would, checks that every executable in it can load its libraries, starts it, and previews the next node:lts, ubuntu:latest and python:3. Run it yourself for free, or we build every image you ship each week against the next version of its base tag and send the fix as a pull request: $299 a month per organisation for up to 20 images. A build fix in a private repository is $300, invoiced after you merge it, and in a public repository it is free.
Scheduled calls
For an upkeep Chainlink Automation left behind: a runner that calls checkUpkeep and performUpkeep on your contract at a fixed interval from your own address, logs every run, and alerts when a run fails or when the upkeep stays due with nothing performed. It has run our own hourly job on Ethereum Sepolia since 2026-10-11, with the count and its limits below, and has not run on mainnet yet; it will be part of hosting. What stopped this year.

The record

newest first

2026-10-28Monitor PR #518 merged, our fix for #501: on main, --check exits 1 when configuration validation fails, so CI and start scripts can trust its exit code; not in a release yet.merged
2026-10-22Release day for Relayer 1.9.0: the image starts and sends on a local chain; #843, #817 and #808 still reproduce on it.test
2026-10-22Monitor 1.7.0: node and jq run in the published image again (#502), and the #499 fix for Failure conditions (#498) is in the release.test
2026-10-21ethereum.org merged our PR #19501 (opened 2026-10-15 with issue #19500): the developer frameworks page no longer links to the retired Defender SDK docs.merged
2026-10-20The DeFi Developer Road Map merged our PR #176 (opened 2026-10-16): its relayer entry now names OpenZeppelin Relayer instead of Supercool, whose docs no longer resolve.merged
2026-10-18Seven days of our own hourly job on Ethereum Sepolia: 169 performs, 0 missed, Relayer 1.8.0 signing with an AWS KMS key; Monitor 1.6.0 alerted on 167.test
2026-10-17Opened Superfluid protocol-monorepo #2243: on six chains the published metadata still lists TOGA contracts that stopped receiving rewards on 2026-09-10; fix included.issue
2026-10-15Updated relayer PR #918 after the maintainer's review: request URLs are masked in EVM and Solana provider errors too, and dead RPCs still fail over.fix
2026-10-15Ran the maintainers' PR #862 against the #843 reproduction: on an Arbitrum-tagged network it cleared the nonce jam within about a minute in two runs.test
2026-10-13Relayer PR #916 merged: RPC provider URLs are masked in the retry and health logs on main; it ships in the next release.merged
2026-10-13Opened relayer PR #922, the fix for #914: the Google Cloud signer example now names the role that can read the public key.fix
2026-10-12Updated the monitor #498 note: the fix merged on main as #499 and is not in a release yet.note
2026-10-12Opened OWASP SCS PR #44: Handbooks 04, 06 and 07 still sent readers to the retired Defender; the PR names OpenZeppelin Monitor and Relayer instead.fix
2026-10-12Published a note on GitHub's ubuntu-latest moving to Ubuntu 26.04 from 19 October: what breaks, the pins and a check to run now.note
2026-10-12Published a note on node:lts becoming Node 26 on 28 October: no corepack, no yarn, Debian 13.note
2026-10-12Opened x402-rs PR #140, stacked on #138: a retried settle is answered with the transaction already broadcast instead of failing after the buyer has paid.fix
2026-10-11Opened x402-rs PR #138, the fix for #136: when the receipt fetch fails after the broadcast, /settle answers 202 settlement_pending with the transaction hash instead of a 500 with none.fix
2026-10-11Opened monitor #502 with a tested fix: the published v1.6.0 image cannot start node or jq, so Monitor scripts written in JavaScript cannot run in it.issue
2026-10-11Published upgrade-canary: a clean build, a library check of every executable, a start check, a package diff and a preview of the next floating base tag.tool
2026-10-10Opened relayer PR #919: images built from main stopped starting (libssl.so.4 not found) once openssl-dev resolved to OpenSSL 4; the PR pins OpenSSL 3.x.fix
2026-10-09Opened relayer PR #918, the follow-up the maintainer suggested when approving #916: reqwest error messages carry the masked URL, and mask_url hides user:password@.fix
2026-10-09Opened relayer PR #916, the fix for #913: RPC provider URLs are masked in the retry and health logs, with a test that fails without it.fix
2026-10-07Opened relayer #912: the sign and sign-typed-data endpoints skip whitelist_receivers, so the whitelist does not limit what the API key can authorize.source check
2026-10-07Signed through a real AWS KMS key end to end and timed revocation: 33 s to disable the key, 3 min 38 s to remove the IAM policy, one run each.test
2026-10-07Opened relayer #913: RPC URLs, which can carry provider keys, are logged unmasked by the retry code.issue
2026-10-07Opened relayer #914: the Google Cloud example grants a role that cannot read the public key.issue
2026-10-07Opened monitor #501: --check exits 0 when validation fails.issue
2026-10-07Published the configuration validator.tool
2026-10-06Reproduced relayer #843 on 1.8.0: after a minute of RPC errors the nonce counter stayed ahead of the chain for the rest of the run.reproduction
2026-10-06Reproduced relayer #817 on 1.8.0: a mined transaction finalized as Failed after a stale receipt.reproduction
2026-10-06Confirmed monitor #498 in the source: status Failure conditions never match on a busy chain.source check
2026-10-04Reproduced relayer #808: a transaction that reaches gas_price_cap during a spike is never resent.reproduction
2026-10-04Wrote the 1.4 to 1.8 upgrade notes for teams still on 1.4.0.note

Where your key lives

The grant on AWS

Two permissions on one key and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["kms:GetPublicKey", "kms:Sign"],
    "Resource": "arn:aws:kms:REGION:ACCOUNT:key/KEY-ID"
  }]
}

The Google Cloud KMS and Turnkey grants are on the how it works page.

Revoking it

Disable the key33 s
Remove the IAM policy3 min 38 s

One run each on a real AWS key on 7 October 2026, checking every 5 seconds. Google Cloud says role changes can take seven minutes or more.

Your account Revoke here: disable the key or drop the grant Your KMS the key stays here Nonceworks host Your stack Monitor 1.6.0 Relayer 1.8.0 Redis the relayer's queue Your alerts Slack, email Your chain your RPC alerts blocks sign tx
Your account Your KMS the key stays here Revoke here: disable the key or drop the grant Nonceworks host Your stack Relayer 1.8.0 Monitor 1.6.0 Redis Your chain your RPC Your alerts Slack, email sign tx blocks alerts
Fig. 2. The relayer on the Nonceworks host asks your KMS for each signature, and the key never leaves your account. The security page goes through what someone who took over our server could and could not do.

What hosting includes

Monitor 1.6.0
With the monitors and triggers you exported, imported as they are. Before a config goes live, the Monitor's own --check runs on it and is judged by its output, because 1.6.0 exits 0 even when the check fails (monitor #501).
Relayer 1.8.0
Up to three relayers per team. Each team's stack runs in its own Compose project with its own Redis, so a restart keeps pending transactions (architecture).
Releases
Each release is staged against a copy of your configuration before your stack gets it, with an upgrade note like the 1.4 to 1.8 notes.
Bugs
When a bug hits your stack, Nonceworks reproduces it on the release and publishes the files, the way #843, #817 and #808 are in the record above.

If your logs say this

Send us the line and we will send back the matching reproduction or note.

Limits

Nonceworks is not OpenZeppelin and not affiliated with them; Monitor and Relayer are their open-source programs, run here as published.

There is no SLA, no audit and no uptime history yet. OpenZeppelin also sells a managed service.

So far we have tested AWS KMS signing end to end on a real key, Relayer 1.8.0 on Base Sepolia and anvil, and Monitor 1.6.0 against Base mainnet. Google Cloud KMS and Turnkey we have read in the source only, so we test your key on a testnet first.

Our own scheduled job. As of 2026-10-18: 169 hourly performs on Ethereum Sepolia since 2026-10-11 22:00 UTC, 0 missed, sent by OpenZeppelin Relayer 1.8.0 signing with an AWS KMS key, with OpenZeppelin Monitor 1.6.0 alerting on 167 of them (it skipped the other 2 while one of its RPC providers was rate-limiting it and the other was returning errors). Every perform is public: https://sepolia.etherscan.io/address/0x6eE5D2E8E6d3E72C283F9493088602E3F9b65116#events

Limits of that count: Sepolia only, not mainnet; our own counter contract that only our address can call; one home server with no failover; the Monitor alerts on performs, not on failed transactions; alerts reach a local receiver, not yet a person; Sepolia fees are near zero, so no cost figure carries over; the chain shows the transactions, not which software or key made them. Counted from the first perform at 22:00:12 UTC; the 21:30 slot before it was refused by the runner's funds check.