--- name: universal-profile description: Manage LUKSO Universal Profiles — identity, permissions, tokens, blockchain operations. Cross-chain support for Base and Ethereum. version: 0.9.0 author: frozeman ---

Universal Profile Skill

Authorize your bot: create a profile at my.universalprofile.cloud, generate a controller key, authorize via Authorization UI.

Core Concepts

• UP (Universal Profile) = smart contract account (LSP0/ERC725Account). This is the on-chain identity.
• KeyManager (LSP6) = access control. Controllers have permission bitmasks.
• Controller = EOA with permissions to act on behalf of the UP.
• All calls to external contracts MUST route through UP via execute() so msg.sender = UP address.
• Exception: setData()/setDataBatch() can be called directly on UP (checks permissions internally).

Execution Models

Direct (all chains — controller pays gas)

Controller → UP.execute(operation, target, value, data) → Target

The controller calls execute() directly on the UP contract. The UP internally verifies permissions via its KeyManager (LSP20 lsp20VerifyCall). Do NOT call the KeyManager's execute() function directly. Always call the UP.

Gasless Relay (LUKSO ONLY — chains 42/4201)

Controller signs LSP25 → Relay API submits → KeyManager.executeRelayCall() → UP

The controller signs a message, then the LUKSO relay service submits the transaction. Do NOT call executeRelayCall() yourself — the relay API does this.

⚠️ CRITICAL: The relay/gasless option exists ONLY on LUKSO mainnet (42) and testnet (4201). On Base, Ethereum, and all other chains, the controller must hold native ETH and pay gas directly. There is no gasless alternative.

Typical gas costs: LUKSO ~free via relay, Base ~$0.001-0.01/tx, Ethereum ~$0.10-1.00/tx.

Networks

| Chain | ID | RPC | Explorer | Relay | Token | |---|---|---|---|---|---| | LUKSO | 42 | https://42.rpc.thirdweb.com | https://explorer.lukso.network | https://relayer.mainnet.lukso.network/api | LYX | | LUKSO Testnet | 4201 | https://rpc.testnet.lukso.network | https://explorer.testnet.lukso.network | https://relayer.testnet.lukso.network/api | LYXt | | Base | 8453 | https://mainnet.base.org | https://basescan.org | ❌ | ETH | | Ethereum | 1 | https://eth.llamarpc.com | https://etherscan.io | ❌ | ETH |

CLI

up status                                      # Config, keys, connectivity
up profile info [<address>] [--chain <chain>]  # Profile details
up profile configure <address> [--chain lukso]  # Save UP for use
up key generate [--save] [--password <pw>]     # Generate controller keypair
up permissions encode <perm1> [<perm2> ...]    # Encode to bytes32
up permissions decode <hex>                    # Decode to names
up permissions presets                         # List presets
up authorize url [--permissions <preset|hex>]  # Generate auth URL
up quota                                       # Check relay gas quota (LUKSO only)

Presets: read-only 🟢 | token-operator 🟡 | nft-trader 🟡 | defi-trader 🟠 | profile-manager 🟡 | full-access 🔴

Credentials

Config lookup order: UP_CREDENTIALS_PATH env → ~/.openclaw/universal-profile/config.json → ~/.clawdbot/universal-profile/config.json

Key lookup order: UP_KEY_PATH env → ~/.openclaw/credentials/universal-profile-key.json → ~/.clawdbot/credentials/universal-profile-key.json

Canonical path for new credentials: ~/.openclaw/credentials/universal-profile-key.json

Skill config path: ~/.openclaw/skills/universal-profile/config.json

Expected JSON format:

{
  "universalProfile": {
    "address": "0xYourUniversalProfileAddress"
  },
  "controller": {
    "address": "0xYourControllerAddress",
    "privateKey": "0xYourPrivateKey"
  }
}

Key file permissions: chmod 600. Keys loaded only for signing, then cleared. The skill warns if credential files are readable by group/others.

Permissions (bytes32 BitArray)

| Permission | Hex | Risk | Notes | |---|---|---|---| | CHANGEOWNER | 0x01 | 🔴 | | | ADDCONTROLLER | 0x02 | 🟠 | | | EDITPERMISSIONS | 0x04 | 🟠 | | | ADDEXTENSIONS | 0x08 | 🟡 | | | CHANGEEXTENSIONS | 0x10 | 🟡 | | | ADDUNIVERSALRECEIVERDELEGATE | 0x20 | 🟡 | | | CHANGEUNIVERSALRECEIVERDELEGATE | 0x40 | 🟡 | | | REENTRANCY | 0x80 | 🟡 | | | SUPER_TRANSFERVALUE | 0x0100 | 🟠 | Any recipient | | TRANSFERVALUE | 0x0200 | 🟡 | AllowedCalls only | | SUPER_CALL | 0x0400 | 🟠 | Any contract | | CALL | 0x0800 | 🟡 | AllowedCalls only | | SUPER_STATICCALL | 0x1000 | 🟢 | | | STATICCALL | 0x2000 | 🟢 | | | SUPER_DELEGATECALL | 0x4000 | 🔴 | | | DELEGATECALL | 0x8000 | 🔴 | | | DEPLOY | 0x010000 | 🟡 | | | SUPER_SETDATA | 0x020000 | 🟠 | Any key | | SETDATA | 0x040000 | 🟡 | AllowedERC725YDataKeys only | | ENCRYPT | 0x080000 | 🟢 | | | DECRYPT | 0x100000 | 🟢 | | | SIGN | 0x200000 | 🟢 | | | EXECUTE_RELAY_CALL | 0x400000 | 🟢 | |

SUPER variants = unrestricted. Regular = restricted to AllowedCalls/AllowedERC725YDataKeys. Prefer restricted.

Transactions

Direct Execution (all chains)

// Controller calls UP.execute() directly — works on LUKSO, Base, Ethereum
const provider = new ethers.JsonRpcProvider(rpcUrl);  // use correct RPC for chain
const wallet = new ethers.Wallet(controllerPrivateKey, provider);
const up = new ethers.Contract(upAddress, ['function execute(uint256,address,uint256,bytes) payable returns (bytes)'], wallet);
await (await up.execute(0, recipient, ethers.parseEther('0.01'), '0x')).wait();

Gasless Relay (LUKSO only)

LSP25 Relay Signature — EIP-191 v0, do NOT use signMessage():

const encoded = ethers.solidityPacked(
  ['uint256','uint256','uint256','uint256','uint256','bytes'],
  [25, chainId, nonce, validityTimestamps, msgValue, payload]
);
const prefix = new Uint8Array([0x19, 0x00]);
const msg = new Uint8Array([...prefix, ...ethers.getBytes(kmAddress), ...ethers.getBytes(encoded)]);
const signature = ethers.Signature.from(new ethers.SigningKey(privateKey).sign(ethers.keccak256(msg))).serialized;

Relay API:

POST https://relayer.mainnet.lukso.network/api/execute
{ "address": "0xUP", "transaction": { "abi": "0xpayload", "signature": "0x...", "nonce": 0, "validityTimestamps": "0x0" } }

The payload for relay calls is the full UP.execute(...) calldata. The relay service calls KeyManager.executeRelayCall() — you never call the KM directly.

For setData via relay, the payload is the setData(...) calldata (NOT wrapped in execute()).

Nonce channels: getNonce(controller, channelId) — same channel = sequential, different = parallel. Validity timestamps: (startTimestamp << 128) | endTimestamp. Use 0 for no restriction.

Cross-Chain Deployment (LSP23)

UPs can be redeployed at the same address on other chains by replaying the original LSP23 factory calldata.

Factory & Implementations (identical addresses on LUKSO, Base, Ethereum)

| Contract | Address | |---|---| | LSP23 Factory | 0x2300000A84D25dF63081feAa37ba6b62C4c89a30 | | UniversalProfileInit v0.14.0 | 0x3024D38EA2434BA6635003Dc1BDC0daB5882ED4F | | LSP6KeyManagerInit v0.14.0 | 0x2Fe3AeD98684E7351aD2D408A43cE09a738BF8a4 | | PostDeploymentModule | 0x000000000066093407b6704B89793beFfD0D8F00 |

Workflow

1. Retrieve original deployment calldata: node commands/cross-chain-deploy-data.js [--verify]
2. Fund controller with ETH on target chain
3. Submit same calldata to factory: wallet.sendTransaction({ to: factoryAddress, data: calldata, value: 0n })
4. Authorize controller on new chain via Authorization UI (permissions are per-chain)

Limitations

• Legacy UPs (pre-LSP23, old lsp-factory) have no deployment events
• Determinism requires identical salt + implementations + init data

LSP Ecosystem

...