@alephium/ledger-app 0.4.0 → 0.5.0

package/dist/src/index.d.ts

@@ -1,6 +1,7 @@
 /// <reference types="node" />
 import { Account, KeyType } from '@alephium/web3';
 import Transport from '@ledgerhq/hw-transport';
+import * as serde from './serde';
 export declare const CLA = 128;
 export declare enum INS {
     GET_VERSION = 0,
@@ -17,5 +18,5 @@ export default class AlephiumApp {
     getVersion(): Promise<string>;
     getAccount(startPath: string, targetGroup?: number, keyType?: KeyType, display?: boolean): Promise<readonly [Account, number]>;
     signHash(path: string, hash: Buffer): Promise<string>;
-    signUnsignedTx(path: string, unsignedTx: Buffer): Promise<string>;
+    signUnsignedTx(path: string, unsignedTx: Buffer, tokenMetadata?: serde.TokenMetadata[]): Promise<string>;
 }

package/dist/src/index.js

@@ -39,6 +39,8 @@ var INS;
 })(INS = exports.INS || (exports.INS = {}));
 exports.GROUP_NUM = 4;
 exports.HASH_LEN = 32;
+// The maximum payload size is 255: https://github.com/LedgerHQ/ledger-live/blob/develop/libs/ledgerjs/packages/hw-transport/src/Transport.ts#L261
+const MAX_PAYLOAD_SIZE = 255;
 class AlephiumApp {
     constructor(transport) {
         this.transport = transport;
@@ -78,17 +80,18 @@ class AlephiumApp {
         console.log(`response ${response.length} - ${response.toString('hex')}`);
         return decodeSignature(response);
     }
-    async signUnsignedTx(path, unsignedTx) {
+    async signUnsignedTx(path, unsignedTx, tokenMetadata = []) {
         console.log(`unsigned tx size: ${unsignedTx.length}`);
         const encodedPath = serde.serializePath(path);
-        const firstFrameTxLength = 256 - 25;
+        const encodedTokenMetadata = serde.serializeTokenMetadata(tokenMetadata);
+        const firstFrameTxLength = MAX_PAYLOAD_SIZE - 20 - encodedTokenMetadata.length;
         const txData = unsignedTx.slice(0, unsignedTx.length > firstFrameTxLength ? firstFrameTxLength : unsignedTx.length);
-        const data = Buffer.concat([encodedPath, txData]);
+        const data = Buffer.concat([encodedPath, encodedTokenMetadata, txData]);
         let response = await this.transport.send(exports.CLA, INS.SIGN_TX, 0x00, 0x00, data, [hw_transport_1.StatusCodes.OK]);
         if (unsignedTx.length <= firstFrameTxLength) {
             return decodeSignature(response);
         }
-        const frameLength = 256 - 5;
+        const frameLength = MAX_PAYLOAD_SIZE;
         let fromIndex = firstFrameTxLength;
         while (fromIndex < unsignedTx.length) {
             const remain = unsignedTx.length - fromIndex;

package/dist/src/serde.d.ts

@@ -3,3 +3,13 @@ export declare const TRUE = 16;
 export declare const FALSE = 0;
 export declare function splitPath(path: string): number[];
 export declare function serializePath(path: string): Buffer;
+export declare const MAX_TOKEN_SIZE = 5;
+export declare const MAX_TOKEN_SYMBOL_LENGTH = 12;
+export declare const TOKEN_METADATA_SIZE = 46;
+export interface TokenMetadata {
+    version: number;
+    tokenId: string;
+    symbol: string;
+    decimals: number;
+}
+export declare function serializeTokenMetadata(tokens: TokenMetadata[]): Buffer;

package/dist/src/serde.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.serializePath = exports.splitPath = exports.FALSE = exports.TRUE = void 0;
+exports.serializeTokenMetadata = exports.TOKEN_METADATA_SIZE = exports.MAX_TOKEN_SYMBOL_LENGTH = exports.MAX_TOKEN_SIZE = exports.serializePath = exports.splitPath = exports.FALSE = exports.TRUE = void 0;
+const web3_1 = require("@alephium/web3");
 exports.TRUE = 0x10;
 exports.FALSE = 0x00;
 function splitPath(path) {
@@ -30,3 +31,49 @@ function serializePath(path) {
     return buffer;
 }
 exports.serializePath = serializePath;
+exports.MAX_TOKEN_SIZE = 5;
+exports.MAX_TOKEN_SYMBOL_LENGTH = 12;
+exports.TOKEN_METADATA_SIZE = 46;
+function symbolToBytes(symbol) {
+    const buffer = Buffer.alloc(exports.MAX_TOKEN_SYMBOL_LENGTH, 0);
+    for (let i = 0; i < symbol.length; i++) {
+        buffer[i] = symbol.charCodeAt(i) & 0xFF;
+    }
+    return buffer;
+}
+function check(tokens) {
+    const hasDuplicate = tokens.some((token, index) => index !== tokens.findIndex((t) => t.tokenId === token.tokenId));
+    if (hasDuplicate) {
+        throw new Error(`There are duplicate tokens`);
+    }
+    tokens.forEach((token) => {
+        if (!((0, web3_1.isHexString)(token.tokenId) && token.tokenId.length === 64)) {
+            throw new Error(`Invalid token id: ${token.tokenId}`);
+        }
+        if (token.symbol.length > exports.MAX_TOKEN_SYMBOL_LENGTH) {
+            throw new Error(`The token symbol is too long: ${token.symbol}`);
+        }
+    });
+    if (tokens.length > exports.MAX_TOKEN_SIZE) {
+        throw new Error(`The token size exceeds maximum size`);
+    }
+}
+function serializeTokenMetadata(tokens) {
+    check(tokens);
+    const array = tokens
+        .map((metadata) => {
+        const symbolBytes = symbolToBytes(metadata.symbol);
+        const buffer = Buffer.concat([
+            Buffer.from([metadata.version]),
+            Buffer.from(metadata.tokenId, 'hex'),
+            symbolBytes,
+            Buffer.from([metadata.decimals])
+        ]);
+        if (buffer.length !== exports.TOKEN_METADATA_SIZE) {
+            throw new Error(`Invalid token metadata: ${metadata}`);
+        }
+        return buffer;
+    });
+    return Buffer.concat([Buffer.from([array.length]), ...array]);
+}
+exports.serializeTokenMetadata = serializeTokenMetadata;

package/dist/src/serde.test.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const web3_1 = require("@alephium/web3");
 const serde_1 = require("./serde");
+const crypto_1 = require("crypto");
 describe('serde', () => {
     it('should split path', () => {
         expect((0, serde_1.splitPath)(`m/44'/1234'/0'/0/0`)).toStrictEqual([44 + 0x80000000, 1234 + 0x80000000, 0 + 0x80000000, 0, 0]);
@@ -10,4 +12,68 @@ describe('serde', () => {
         expect((0, serde_1.serializePath)(`m/1'/2'/0'/0/0`)).toStrictEqual(Buffer.from([0x80, 0, 0, 1, 0x80, 0, 0, 2, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]));
         expect((0, serde_1.serializePath)(`m/1'/2'/0'/0/0`)).toStrictEqual(Buffer.from([0x80, 0, 0, 1, 0x80, 0, 0, 2, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]));
     });
+    it('should encode token metadata', () => {
+        const token0 = {
+            version: 0,
+            tokenId: (0, web3_1.binToHex)((0, crypto_1.randomBytes)(32)),
+            symbol: 'Token0',
+            decimals: 8
+        };
+        const token1 = {
+            version: 1,
+            tokenId: (0, web3_1.binToHex)((0, crypto_1.randomBytes)(32)),
+            symbol: 'Token1',
+            decimals: 18
+        };
+        const token2 = {
+            version: 2,
+            tokenId: (0, web3_1.binToHex)((0, crypto_1.randomBytes)(32)),
+            symbol: 'Token2',
+            decimals: 6
+        };
+        const token3 = {
+            version: 3,
+            tokenId: (0, web3_1.binToHex)((0, crypto_1.randomBytes)(32)),
+            symbol: 'Token3',
+            decimals: 0
+        };
+        const token4 = {
+            version: 4,
+            tokenId: (0, web3_1.binToHex)((0, crypto_1.randomBytes)(32)),
+            symbol: 'Token4',
+            decimals: 12
+        };
+        const encodeSymbol = (symbol) => {
+            return (0, web3_1.binToHex)(Buffer.from(symbol, 'ascii')).padEnd(serde_1.MAX_TOKEN_SYMBOL_LENGTH * 2, '0');
+        };
+        expect((0, web3_1.binToHex)((0, serde_1.serializeTokenMetadata)([]))).toEqual('00');
+        expect((0, web3_1.binToHex)((0, serde_1.serializeTokenMetadata)([token0]))).toEqual('01' + '00' + token0.tokenId + encodeSymbol(token0.symbol) + '08');
+        expect((0, web3_1.binToHex)((0, serde_1.serializeTokenMetadata)([token1]))).toEqual('01' + '01' + token1.tokenId + encodeSymbol(token1.symbol) + '12');
+        expect((0, web3_1.binToHex)((0, serde_1.serializeTokenMetadata)([token0, token1]))).toEqual('02' + '00' + token0.tokenId + encodeSymbol(token0.symbol) + '08' +
+            '01' + token1.tokenId + encodeSymbol(token1.symbol) + '12');
+        expect((0, web3_1.binToHex)((0, serde_1.serializeTokenMetadata)([token0, token1, token2, token3, token4]))).toEqual('05' + '00' + token0.tokenId + encodeSymbol(token0.symbol) + '08' +
+            '01' + token1.tokenId + encodeSymbol(token1.symbol) + '12' +
+            '02' + token2.tokenId + encodeSymbol(token2.symbol) + '06' +
+            '03' + token3.tokenId + encodeSymbol(token3.symbol) + '00' +
+            '04' + token4.tokenId + encodeSymbol(token4.symbol) + '0c');
+        expect(() => (0, serde_1.serializeTokenMetadata)([token0, token1, token0])).toThrow('There are duplicate tokens');
+        const token5 = {
+            version: 5,
+            tokenId: (0, web3_1.binToHex)((0, crypto_1.randomBytes)(32)),
+            symbol: 'Token5',
+            decimals: 18
+        };
+        expect(() => (0, serde_1.serializeTokenMetadata)([token0, token1, token2, token3, token4, token5])).toThrow('The token size exceeds maximum size');
+        const invalidToken = {
+            ...token0,
+            tokenId: (0, web3_1.binToHex)((0, crypto_1.randomBytes)(33))
+        };
+        expect(() => (0, serde_1.serializeTokenMetadata)([token0, invalidToken])).toThrow('Invalid token id');
+        const longSymbolToken = {
+            ...token0,
+            tokenId: (0, web3_1.binToHex)((0, crypto_1.randomBytes)(32)),
+            symbol: 'LongSymbolToken'
+        };
+        expect(() => (0, serde_1.serializeTokenMetadata)([token0, longSymbolToken, token1])).toThrow('The token symbol is too long');
+    });
 });

package/dist/test/utils.d.ts

@@ -3,7 +3,8 @@ export declare enum OutputType {
     Base = 0,
     Multisig = 1,
     Token = 2,
-    MultisigAndToken = 3
+    BaseAndToken = 3,
+    MultisigAndToken = 4
 }
 export declare function staxFlexApproveOnce(): Promise<void>;
 export declare function approveTx(outputs: OutputType[], hasExternalInputs?: boolean): Promise<void>;

package/dist/test/utils.js

@@ -21,33 +21,41 @@ async function clickAndApprove(times) {
     }
     await pressButton('both');
 }
+function getModel() {
+    const model = process.env.MODEL;
+    return model ? model : 'nanos';
+}
 var OutputType;
 (function (OutputType) {
     OutputType[OutputType["Base"] = 0] = "Base";
     OutputType[OutputType["Multisig"] = 1] = "Multisig";
     OutputType[OutputType["Token"] = 2] = "Token";
-    OutputType[OutputType["MultisigAndToken"] = 3] = "MultisigAndToken";
+    OutputType[OutputType["BaseAndToken"] = 3] = "BaseAndToken";
+    OutputType[OutputType["MultisigAndToken"] = 4] = "MultisigAndToken";
 })(OutputType = exports.OutputType || (exports.OutputType = {}));
 const NanosClickTable = new Map([
     [OutputType.Base, 5],
     [OutputType.Multisig, 10],
     [OutputType.Token, 11],
+    [OutputType.BaseAndToken, 12],
     [OutputType.MultisigAndToken, 16],
 ]);
 const NanospClickTable = new Map([
     [OutputType.Base, 3],
     [OutputType.Multisig, 5],
     [OutputType.Token, 6],
+    [OutputType.BaseAndToken, 6],
     [OutputType.MultisigAndToken, 8],
 ]);
 const StaxClickTable = new Map([
     [OutputType.Base, 2],
     [OutputType.Multisig, 3],
     [OutputType.Token, 3],
+    [OutputType.BaseAndToken, 3],
     [OutputType.MultisigAndToken, 4],
 ]);
 function getOutputClickSize(outputType) {
-    const model = process.env.MODEL;
+    const model = getModel();
     switch (model) {
         case 'nanos': return NanosClickTable.get(outputType);
         case 'nanosp':
@@ -85,15 +93,16 @@ async function touchPosition(pos) {
     });
 }
 async function _touch(times) {
-    let continuePos = process.env.MODEL === 'stax' ? STAX_CONTINUE_POSITION : FLEX_CONTINUE_POSITION;
+    const model = getModel();
+    const continuePos = model === 'stax' ? STAX_CONTINUE_POSITION : FLEX_CONTINUE_POSITION;
     for (let i = 0; i < times; i += 1) {
         await touchPosition(continuePos);
     }
-    let approvePos = process.env.MODEL === 'stax' ? STAX_APPROVE_POSITION : FLEX_APPROVE_POSITION;
+    const approvePos = model === 'stax' ? STAX_APPROVE_POSITION : FLEX_APPROVE_POSITION;
     await touchPosition(approvePos);
 }
 async function staxFlexApproveOnce() {
-    if (process.env.MODEL === 'stax') {
+    if (getModel() === 'stax') {
         await touchPosition(STAX_APPROVE_POSITION);
     }
     else {
@@ -138,7 +147,7 @@ async function approveHash() {
     if (isStaxOrFlex()) {
         return await _touch(3);
     }
-    if (process.env.MODEL === 'nanos') {
+    if (getModel() === 'nanos') {
         await clickAndApprove(5);
     }
     else {
@@ -152,7 +161,7 @@ async function approveAddress() {
     if (isStaxOrFlex()) {
         return await _touch(2);
     }
-    if (process.env.MODEL === 'nanos') {
+    if (getModel() === 'nanos') {
         await clickAndApprove(4);
     }
     else {
@@ -161,13 +170,13 @@ async function approveAddress() {
 }
 exports.approveAddress = approveAddress;
 function isStaxOrFlex() {
-    return !process.env.MODEL.startsWith('nano');
+    return !getModel().startsWith('nano');
 }
 function skipBlindSigningWarning() {
     if (!needToAutoApprove())
         return;
     if (isStaxOrFlex()) {
-        const rejectPos = process.env.MODEL === 'stax' ? STAX_REJECT_POSITION : FLEX_REJECT_POSITION;
+        const rejectPos = getModel() === 'stax' ? STAX_REJECT_POSITION : FLEX_REJECT_POSITION;
         touchPosition(rejectPos);
     }
     else {
@@ -179,8 +188,9 @@ async function enableBlindSigning() {
     if (!needToAutoApprove())
         return;
     if (isStaxOrFlex()) {
-        const settingsPos = process.env.MODEL === 'stax' ? STAX_SETTINGS_POSITION : FLEX_SETTINGS_POSITION;
-        const blindSettingPos = process.env.MODEL === 'stax' ? STAX_BLIND_SETTING_POSITION : FLEX_BLIND_SETTING_POSITION;
+        const model = getModel();
+        const settingsPos = model === 'stax' ? STAX_SETTINGS_POSITION : FLEX_SETTINGS_POSITION;
+        const blindSettingPos = model === 'stax' ? STAX_BLIND_SETTING_POSITION : FLEX_BLIND_SETTING_POSITION;
         await touchPosition(settingsPos);
         await touchPosition(blindSettingPos);
         await touchPosition(settingsPos);

package/dist/test/wallet.test.js

@@ -32,6 +32,7 @@ const web3_test_1 = require("@alephium/web3-test");
 const web3_wallet_1 = require("@alephium/web3-wallet");
 const blakejs_1 = __importDefault(require("blakejs"));
 const utils_1 = require("./utils");
+const crypto_1 = require("crypto");
 describe('ledger wallet', () => {
     const nodeProvider = new web3_1.NodeProvider("http://127.0.0.1:22973");
     web3_1.web3.setCurrentNodeProvider(nodeProvider);
@@ -108,7 +109,7 @@ describe('ledger wallet', () => {
         await app.close();
         expect((0, web3_1.transactionVerifySignature)(hash.toString('hex'), account.publicKey, signature)).toBe(true);
     }, 10000);
-    it('shoudl transfer alph to one address', async () => {
+    it('should transfer alph to one address', async () => {
         const transport = await (0, utils_1.createTransport)();
         const app = new src_1.default(transport);
         const [testAccount] = await app.getAccount(path);
@@ -230,6 +231,79 @@ describe('ledger wallet', () => {
         expect(token.amount).toEqual('1111111111111111111111111');
         await app.close();
     }, 120000);
+    async function genTokensAndDestinations(fromAddress, toAddress, mintAmount, transferAmount) {
+        const tokens = [];
+        const tokenSymbol = 'TestTokenABC';
+        const destinations = [];
+        for (let i = 0; i < 5; i += 1) {
+            const tokenInfo = await (0, web3_test_1.mintToken)(fromAddress, mintAmount);
+            const tokenMetadata = {
+                version: 0,
+                tokenId: tokenInfo.contractId,
+                symbol: tokenSymbol.slice(0, tokenSymbol.length - i),
+                decimals: 18 - i
+            };
+            tokens.push(tokenMetadata);
+            destinations.push({
+                address: toAddress,
+                attoAlphAmount: web3_1.DUST_AMOUNT.toString(),
+                tokens: [
+                    {
+                        id: tokenMetadata.tokenId,
+                        amount: transferAmount.toString()
+                    }
+                ]
+            });
+        }
+        return { tokens, destinations };
+    }
+    it('should transfer token with metadata', async () => {
+        const transport = await (0, utils_1.createTransport)();
+        const app = new src_1.default(transport);
+        const [testAccount] = await app.getAccount(path);
+        await transferToAddress(testAccount.address);
+        const toAddress = '1BmVCLrjttchZMW7i6df7mTdCKzHpy38bgDbVL1GqV6P7';
+        const transferAmount = 1234567890123456789012345n;
+        const mintAmount = 2222222222222222222222222n;
+        const { tokens, destinations } = await genTokensAndDestinations(testAccount.address, toAddress, mintAmount, transferAmount);
+        const randomOrderTokens = tokens.sort((a, b) => b.tokenId.localeCompare(a.tokenId));
+        const buildTxResult = await nodeProvider.transactions.postTransactionsBuild({
+            fromPublicKey: testAccount.publicKey,
+            destinations: destinations
+        });
+        (0, utils_1.approveTx)(Array(5).fill(utils_1.OutputType.BaseAndToken));
+        const signature = await app.signUnsignedTx(path, Buffer.from(buildTxResult.unsignedTx, 'hex'), randomOrderTokens);
+        expect((0, web3_1.transactionVerifySignature)(buildTxResult.txId, testAccount.publicKey, signature)).toBe(true);
+        const submitResult = await nodeProvider.transactions.postTransactionsSubmit({
+            unsignedTx: buildTxResult.unsignedTx,
+            signature: signature
+        });
+        await (0, web3_1.waitForTxConfirmation)(submitResult.txId, 1, 1000);
+        const balances = await nodeProvider.addresses.getAddressesAddressBalance(toAddress);
+        tokens.forEach((metadata) => {
+            const tokenBalance = balances.tokenBalances.find((t) => t.id === metadata.tokenId);
+            expect(BigInt(tokenBalance.amount)).toEqual(transferAmount);
+        });
+        await app.close();
+    }, 120000);
+    it('should reject tx if the metadata version is invalid', async () => {
+        const transport = await (0, utils_1.createTransport)();
+        const app = new src_1.default(transport);
+        const [testAccount] = await app.getAccount(path);
+        await transferToAddress(testAccount.address);
+        const toAddress = '1BmVCLrjttchZMW7i6df7mTdCKzHpy38bgDbVL1GqV6P7';
+        const transferAmount = 1234567890123456789012345n;
+        const mintAmount = 2222222222222222222222222n;
+        const { tokens, destinations } = await genTokensAndDestinations(testAccount.address, toAddress, mintAmount, transferAmount);
+        const invalidTokenIndex = (0, crypto_1.randomInt)(5);
+        tokens[invalidTokenIndex] = { ...tokens[invalidTokenIndex], version: 1 };
+        const buildTxResult = await nodeProvider.transactions.postTransactionsBuild({
+            fromPublicKey: testAccount.publicKey,
+            destinations: destinations
+        });
+        await expect(app.signUnsignedTx(path, Buffer.from(buildTxResult.unsignedTx, 'hex'), tokens)).rejects.toThrow();
+        await app.close();
+    }, 120000);
     it('should transfer from multiple inputs', async () => {
         const transport = await (0, utils_1.createTransport)();
         const app = new src_1.default(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alephium/ledger-app",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "GPL",
   "types": "dist/src/index.d.ts",
   "exports": {

package/src/index.ts

@@ -16,6 +16,9 @@ export enum INS {
 export const GROUP_NUM = 4
 export const HASH_LEN = 32
 
+// The maximum payload size is 255: https://github.com/LedgerHQ/ledger-live/blob/develop/libs/ledgerjs/packages/hw-transport/src/Transport.ts#L261
+const MAX_PAYLOAD_SIZE = 255
+
 export default class AlephiumApp {
   readonly transport: Transport
 
@@ -67,18 +70,23 @@ export default class AlephiumApp {
     return decodeSignature(response)
   }
 
-  async signUnsignedTx(path: string, unsignedTx: Buffer): Promise<string> {
+  async signUnsignedTx(
+    path: string,
+    unsignedTx: Buffer,
+    tokenMetadata: serde.TokenMetadata[] = []
+  ): Promise<string> {
     console.log(`unsigned tx size: ${unsignedTx.length}`)
     const encodedPath = serde.serializePath(path)
-    const firstFrameTxLength = 256 - 25;
+    const encodedTokenMetadata = serde.serializeTokenMetadata(tokenMetadata)
+    const firstFrameTxLength = MAX_PAYLOAD_SIZE - 20 - encodedTokenMetadata.length;
     const txData = unsignedTx.slice(0, unsignedTx.length > firstFrameTxLength ? firstFrameTxLength : unsignedTx.length)
-    const data = Buffer.concat([encodedPath, txData])
+    const data = Buffer.concat([encodedPath, encodedTokenMetadata, txData])
     let response = await this.transport.send(CLA, INS.SIGN_TX, 0x00, 0x00, data, [StatusCodes.OK])
     if (unsignedTx.length <= firstFrameTxLength) {
       return decodeSignature(response)
     }
 
-    const frameLength = 256 - 5
+    const frameLength = MAX_PAYLOAD_SIZE
     let fromIndex = firstFrameTxLength
     while (fromIndex < unsignedTx.length) {
       const remain = unsignedTx.length - fromIndex

package/src/serde.ts

@@ -1,3 +1,5 @@
+import { isHexString } from "@alephium/web3"
+
 export const TRUE = 0x10
 export const FALSE = 0x00
 
@@ -28,3 +30,60 @@ export function serializePath(path: string): Buffer {
   nodes.forEach((element, index) => buffer.writeUInt32BE(element, 4 * index))
   return buffer
 }
+
+export const MAX_TOKEN_SIZE = 5
+export const MAX_TOKEN_SYMBOL_LENGTH = 12
+export const TOKEN_METADATA_SIZE = 46
+export interface TokenMetadata {
+  version: number,
+  tokenId: string,
+  symbol: string,
+  decimals: number
+}
+
+function symbolToBytes(symbol: string): Buffer {
+  const buffer = Buffer.alloc(MAX_TOKEN_SYMBOL_LENGTH, 0)
+  for (let i = 0; i < symbol.length; i++) {
+    buffer[i] = symbol.charCodeAt(i) & 0xFF
+  }
+  return buffer
+}
+
+function check(tokens: TokenMetadata[]) {
+  const hasDuplicate = tokens.some((token, index) => index !== tokens.findIndex((t) => t.tokenId === token.tokenId))
+  if (hasDuplicate) {
+    throw new Error(`There are duplicate tokens`)
+  }
+
+  tokens.forEach((token) => {
+    if (!(isHexString(token.tokenId) && token.tokenId.length === 64)) {
+      throw new Error(`Invalid token id: ${token.tokenId}`)
+    }
+    if (token.symbol.length > MAX_TOKEN_SYMBOL_LENGTH) {
+      throw new Error(`The token symbol is too long: ${token.symbol}`)
+    }
+  })
+
+  if (tokens.length > MAX_TOKEN_SIZE) {
+    throw new Error(`The token size exceeds maximum size`)
+  }
+}
+
+export function serializeTokenMetadata(tokens: TokenMetadata[]): Buffer {
+  check(tokens)
+  const array = tokens
+    .map((metadata) => {
+      const symbolBytes = symbolToBytes(metadata.symbol)
+      const buffer = Buffer.concat([
+        Buffer.from([metadata.version]),
+        Buffer.from(metadata.tokenId, 'hex'),
+        symbolBytes,
+        Buffer.from([metadata.decimals])
+      ])
+      if (buffer.length !== TOKEN_METADATA_SIZE) {
+        throw new Error(`Invalid token metadata: ${metadata}`)
+      }
+      return buffer
+    })
+  return Buffer.concat([Buffer.from([array.length]), ...array])
+}

package/test/utils.ts

@@ -19,10 +19,16 @@ async function clickAndApprove(times: number) {
   await pressButton('both')
 }
 
+function getModel(): string {
+  const model = process.env.MODEL
+  return model ? model as string : 'nanos'
+}
+
 export enum OutputType {
   Base,
   Multisig,
   Token,
+  BaseAndToken,
   MultisigAndToken
 }
 
@@ -30,6 +36,7 @@ const NanosClickTable = new Map([
   [OutputType.Base, 5],
   [OutputType.Multisig, 10],
   [OutputType.Token, 11],
+  [OutputType.BaseAndToken, 12],
   [OutputType.MultisigAndToken, 16],
 ])
 
@@ -37,6 +44,7 @@ const NanospClickTable = new Map([
   [OutputType.Base, 3],
   [OutputType.Multisig, 5],
   [OutputType.Token, 6],
+  [OutputType.BaseAndToken, 6],
   [OutputType.MultisigAndToken, 8],
 ])
 
@@ -44,11 +52,12 @@ const StaxClickTable = new Map([
   [OutputType.Base, 2],
   [OutputType.Multisig, 3],
   [OutputType.Token, 3],
+  [OutputType.BaseAndToken, 3],
   [OutputType.MultisigAndToken, 4],
 ])
 
 function getOutputClickSize(outputType: OutputType) {
-  const model = process.env.MODEL
+  const model = getModel()
   switch (model) {
     case 'nanos': return NanosClickTable.get(outputType)!
     case 'nanosp':
@@ -98,16 +107,17 @@ async function touchPosition(pos: Position) {
 }
 
 async function _touch(times: number) {
-  let continuePos = process.env.MODEL === 'stax' ? STAX_CONTINUE_POSITION : FLEX_CONTINUE_POSITION
+  const model = getModel()
+  const continuePos = model === 'stax' ? STAX_CONTINUE_POSITION : FLEX_CONTINUE_POSITION
   for (let i = 0; i < times; i += 1) {
     await touchPosition(continuePos)
   }
-  let approvePos = process.env.MODEL === 'stax' ? STAX_APPROVE_POSITION : FLEX_APPROVE_POSITION
+  const approvePos = model === 'stax' ? STAX_APPROVE_POSITION : FLEX_APPROVE_POSITION
   await touchPosition(approvePos)
 }
 
 export async function staxFlexApproveOnce() {
-  if (process.env.MODEL === 'stax') {
+  if (getModel() === 'stax') {
     await touchPosition(STAX_APPROVE_POSITION)
   } else {
     await touchPosition(FLEX_APPROVE_POSITION)
@@ -151,7 +161,7 @@ export async function approveHash() {
   if (isStaxOrFlex()) {
     return await _touch(3)
   }
-  if (process.env.MODEL === 'nanos') {
+  if (getModel() === 'nanos') {
     await clickAndApprove(5)
   } else {
     await clickAndApprove(3)
@@ -163,7 +173,7 @@ export async function approveAddress() {
   if (isStaxOrFlex()) {
     return await _touch(2)
   }
-  if (process.env.MODEL === 'nanos') {
+  if (getModel() === 'nanos') {
     await clickAndApprove(4)
   } else {
     await clickAndApprove(2)
@@ -171,13 +181,13 @@ export async function approveAddress() {
 }
 
 function isStaxOrFlex(): boolean {
-  return !process.env.MODEL!.startsWith('nano')
+  return !getModel().startsWith('nano')
 }
 
 export function skipBlindSigningWarning() {
   if (!needToAutoApprove()) return
   if (isStaxOrFlex()) {
-    const rejectPos = process.env.MODEL === 'stax' ? STAX_REJECT_POSITION : FLEX_REJECT_POSITION
+    const rejectPos = getModel() === 'stax' ? STAX_REJECT_POSITION : FLEX_REJECT_POSITION
     touchPosition(rejectPos)
   } else {
     clickAndApprove(3)
@@ -187,8 +197,9 @@ export function skipBlindSigningWarning() {
 export async function enableBlindSigning() {
   if (!needToAutoApprove()) return
   if (isStaxOrFlex()) {
-    const settingsPos = process.env.MODEL === 'stax' ? STAX_SETTINGS_POSITION : FLEX_SETTINGS_POSITION
-    const blindSettingPos = process.env.MODEL === 'stax' ? STAX_BLIND_SETTING_POSITION : FLEX_BLIND_SETTING_POSITION
+    const model = getModel()
+    const settingsPos = model === 'stax' ? STAX_SETTINGS_POSITION : FLEX_SETTINGS_POSITION
+    const blindSettingPos = model === 'stax' ? STAX_BLIND_SETTING_POSITION : FLEX_BLIND_SETTING_POSITION
     await touchPosition(settingsPos)
     await touchPosition(blindSettingPos)
     await touchPosition(settingsPos)

package/test/wallet.test.ts

@@ -1,10 +1,11 @@
-import SpeculosTransport from '@ledgerhq/hw-transport-node-speculos'
 import AlephiumApp, { GROUP_NUM } from '../src'
-import { ALPH_TOKEN_ID, Address, NodeProvider, ONE_ALPH, binToHex, codec, groupOfAddress, node, sleep, transactionVerifySignature, waitForTxConfirmation, web3 } from '@alephium/web3'
+import { ALPH_TOKEN_ID, Address, DUST_AMOUNT, NodeProvider, ONE_ALPH, binToHex, codec, groupOfAddress, node, sleep, transactionVerifySignature, waitForTxConfirmation, web3 } from '@alephium/web3'
 import { getSigner, mintToken, transfer } from '@alephium/web3-test'
 import { PrivateKeyWallet } from '@alephium/web3-wallet'
 import blake from 'blakejs'
 import { approveAddress, approveHash, approveTx, createTransport, enableBlindSigning, getRandomInt, needToAutoApprove, OutputType, skipBlindSigningWarning, staxFlexApproveOnce } from './utils'
+import { TokenMetadata } from '../src/serde'
+import { randomInt } from 'crypto'
 
 describe('ledger wallet', () => {
   const nodeProvider = new NodeProvider("http://127.0.0.1:22973")
@@ -95,7 +96,7 @@ describe('ledger wallet', () => {
     expect(transactionVerifySignature(hash.toString('hex'), account.publicKey, signature)).toBe(true)
   }, 10000)
 
-  it('shoudl transfer alph to one address', async () => {
+  it('should transfer alph to one address', async () => {
     const transport = await createTransport()
     const app = new AlephiumApp(transport)
     const [testAccount] = await app.getAccount(path)
@@ -239,6 +240,96 @@ describe('ledger wallet', () => {
     await app.close()
   }, 120000)
 
+  async function genTokensAndDestinations(
+    fromAddress: string,
+    toAddress: string,
+    mintAmount: bigint,
+    transferAmount: bigint
+  ) {
+    const tokens: TokenMetadata[] = []
+    const tokenSymbol = 'TestTokenABC'
+    const destinations: node.Destination[] = []
+    for (let i = 0; i < 5; i += 1) {
+      const tokenInfo = await mintToken(fromAddress, mintAmount);
+      const tokenMetadata: TokenMetadata = {
+        version: 0,
+        tokenId: tokenInfo.contractId,
+        symbol: tokenSymbol.slice(0, tokenSymbol.length - i),
+        decimals: 18 - i
+      }
+      tokens.push(tokenMetadata)
+      destinations.push({
+        address: toAddress,
+        attoAlphAmount: DUST_AMOUNT.toString(),
+        tokens: [
+          {
+            id: tokenMetadata.tokenId,
+            amount: transferAmount.toString()
+          }
+        ]
+      })
+    }
+    return { tokens, destinations }
+  }
+
+  it('should transfer token with metadata', async () => {
+    const transport = await createTransport()
+    const app = new AlephiumApp(transport)
+    const [testAccount] = await app.getAccount(path)
+    await transferToAddress(testAccount.address)
+
+    const toAddress = '1BmVCLrjttchZMW7i6df7mTdCKzHpy38bgDbVL1GqV6P7';
+    const transferAmount = 1234567890123456789012345n
+    const mintAmount = 2222222222222222222222222n
+    const { tokens, destinations } = await genTokensAndDestinations(testAccount.address, toAddress, mintAmount, transferAmount)
+
+    const randomOrderTokens = tokens.sort((a, b) => b.tokenId.localeCompare(a.tokenId))
+    const buildTxResult = await nodeProvider.transactions.postTransactionsBuild({
+      fromPublicKey: testAccount.publicKey,
+      destinations: destinations
+    })
+
+    approveTx(Array(5).fill(OutputType.BaseAndToken))
+    const signature = await app.signUnsignedTx(path, Buffer.from(buildTxResult.unsignedTx, 'hex'), randomOrderTokens)
+    expect(transactionVerifySignature(buildTxResult.txId, testAccount.publicKey, signature)).toBe(true)
+
+    const submitResult = await nodeProvider.transactions.postTransactionsSubmit({
+      unsignedTx: buildTxResult.unsignedTx,
+      signature: signature
+    })
+    await waitForTxConfirmation(submitResult.txId, 1, 1000)
+    const balances = await nodeProvider.addresses.getAddressesAddressBalance(toAddress)
+    tokens.forEach((metadata) => {
+      const tokenBalance = balances.tokenBalances!.find((t) => t.id === metadata.tokenId)!
+      expect(BigInt(tokenBalance.amount)).toEqual(transferAmount)
+    })
+
+    await app.close()
+  }, 120000)
+
+  it('should reject tx if the metadata version is invalid', async () => {
+    const transport = await createTransport()
+    const app = new AlephiumApp(transport)
+    const [testAccount] = await app.getAccount(path)
+    await transferToAddress(testAccount.address)
+
+    const toAddress = '1BmVCLrjttchZMW7i6df7mTdCKzHpy38bgDbVL1GqV6P7';
+    const transferAmount = 1234567890123456789012345n
+    const mintAmount = 2222222222222222222222222n
+    const { tokens, destinations } = await genTokensAndDestinations(testAccount.address, toAddress, mintAmount, transferAmount)
+
+    const invalidTokenIndex = randomInt(5)
+    tokens[invalidTokenIndex] = { ...tokens[invalidTokenIndex], version: 1 }
+    const buildTxResult = await nodeProvider.transactions.postTransactionsBuild({
+      fromPublicKey: testAccount.publicKey,
+      destinations: destinations
+    })
+
+    await expect(app.signUnsignedTx(path, Buffer.from(buildTxResult.unsignedTx, 'hex'), tokens)).rejects.toThrow()
+
+    await app.close()
+  }, 120000)
+
   it('should transfer from multiple inputs', async () => {
     const transport = await createTransport()
     const app = new AlephiumApp(transport)