@aptos-labs/ts-sdk 6.0.0 → 6.2.0

package/package.json

@@ -1,7 +1,6 @@
 {
   "name": "@aptos-labs/ts-sdk",
   "description": "Aptos TypeScript SDK",
-  "packageManager": "pnpm@8.15.1",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=20.0.0"
@@ -32,68 +31,55 @@
     "dist",
     "src"
   ],
-  "scripts": {
-    "build:clean": "rm -rf dist",
-    "build": "pnpm build:clean && tsup",
-    "prepublishOnly": "pnpm run build",
-    "_fmt": "prettier 'src/**/*.ts' 'tests/**/*.ts' 'examples/**/*.js' 'examples/**/*.ts' 'confidential-assets/**/*.ts' 'eslint.config.cjs'",
-    "fmt": "pnpm _fmt --write",
-    "lint": "eslint '**/*.{cts,mts,ts}'",
-    "test": "pnpm jest",
-    "unit-test": "pnpm jest tests/unit",
-    "e2e-test": "pnpm jest tests/e2e",
-    "indexer-codegen": "graphql-codegen --config ./src/types/codegen.yaml && pnpm fmt",
-    "doc": "scripts/generateDocs.sh",
-    "check-version": "scripts/checkVersion.sh",
-    "update-version": "scripts/updateVersion.sh && pnpm doc",
-    "spec": "pnpm build && pnpm _spec",
-    "_spec": "cucumber-js -p default"
-  },
   "dependencies": {
-    "@aptos-labs/aptos-cli": "^1.0.2",
+    "@aptos-labs/aptos-cli": "^1.1.1",
     "@aptos-labs/aptos-client": "^2.1.0",
     "@noble/curves": "^1.9.0",
     "@noble/hashes": "^1.5.0",
     "@scure/bip32": "^1.4.0",
     "@scure/bip39": "^1.3.0",
-    "eventemitter3": "^5.0.1",
+    "eventemitter3": "^5.0.4",
     "js-base64": "^3.7.7",
     "jwt-decode": "^4.0.0",
     "poseidon-lite": "^0.2.0"
   },
   "devDependencies": {
-    "@babel/traverse": "^7.28.4",
-    "@cucumber/cucumber": "^12.2.0",
-    "@eslint/eslintrc": "^3.3.1",
-    "@graphql-codegen/cli": "^6.0.0",
+    "@babel/traverse": "^7.28.6",
+    "@biomejs/biome": "^2.4.6",
+    "@cucumber/cucumber": "^12.6.0",
+    "@graphql-codegen/cli": "^6.1.2",
     "@graphql-codegen/import-types-preset": "^3.0.1",
-    "@graphql-codegen/typescript": "^5.0.0",
-    "@graphql-codegen/typescript-graphql-request": "^6.3.0",
-    "@graphql-codegen/typescript-operations": "^5.0.0",
-    "@types/base-64": "^1.0.2",
-    "@types/jest": "^29.5.14",
-    "@types/jsonwebtoken": "^9.0.10",
+    "@graphql-codegen/typescript": "^5.0.8",
+    "@graphql-codegen/typescript-graphql-request": "^6.4.0",
+    "@graphql-codegen/typescript-operations": "^5.0.8",
     "@types/node": "^24.3.1",
-    "@typescript-eslint/eslint-plugin": "^8.43.0",
-    "@typescript-eslint/parser": "^8.43.0",
-    "dotenv": "^16.4.7",
-    "eslint": "^9.35.0",
-    "eslint-config-airbnb-base": "^15.0.0",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-import": "^2.32.0",
-    "graphql": "^16.11.0",
-    "globals": "^16.4.0",
-    "graphql-request": "^7.2.0",
-    "jest": "^29.7.0",
-    "jsonwebtoken": "^9.0.2",
-    "prettier": "^3.6.2",
+    "@vitest/coverage-v8": "^4.0.18",
+    "dotenv": "^16.6.1",
+    "graphql": "^16.12.0",
+    "graphql-request": "^7.4.0",
     "tree-kill": "^1.2.2",
-    "ts-jest": "^29.4.1",
-    "ts-loader": "^9.5.4",
-    "tsup": "^8.5.0",
-    "typedoc": "^0.28.12",
-    "typedoc-plugin-missing-exports": "^4.1.0",
-    "typescript": "^5.8.3"
+    "tsup": "^8.5.1",
+    "typedoc": "^0.28.16",
+    "typedoc-plugin-missing-exports": "^4.1.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
   },
-  "version": "6.0.0"
+  "version": "6.2.0",
+  "scripts": {
+    "build:clean": "rm -rf dist",
+    "build": "pnpm build:clean && tsup",
+    "_fmt": "biome format 'src/' 'tests/'",
+    "fmt": "biome format --write 'src/' 'tests/'",
+    "lint": "biome lint 'src/' 'tests/'",
+    "check": "biome check 'src/' 'tests/'",
+    "test": "vitest run",
+    "unit-test": "vitest run tests/unit",
+    "e2e-test": "vitest run tests/e2e",
+    "indexer-codegen": "graphql-codegen --config ./src/types/codegen.yaml && pnpm fmt",
+    "doc": "scripts/generateDocs.sh",
+    "check-version": "scripts/checkVersion.sh",
+    "update-version": "scripts/updateVersion.sh && pnpm doc",
+    "spec": "pnpm build && pnpm _spec",
+    "_spec": "cucumber-js -p default"
+  }
 }

package/src/account/AbstractKeylessAccount.ts

@@ -25,7 +25,7 @@ import { AccountAuthenticatorSingleKey } from "../transactions/authenticator/acc
 import { Deserializer, Serializable, Serializer } from "../bcs";
 import { deriveTransactionType, generateSigningMessage } from "../transactions/transactionBuilder/signingMessage";
 import { AnyRawTransaction, AnyRawTransactionInstance } from "../transactions/types";
-import { base64UrlDecode } from "../utils/helpers";
+import { base64UrlDecode, warnIfDevelopment } from "../utils/helpers";
 import { FederatedKeylessPublicKey } from "../core/crypto/federatedKeyless";
 import { Account } from "./Account";
 import { AptosConfig } from "../api/aptosConfig";
@@ -368,8 +368,7 @@ export abstract class AbstractKeylessAccount extends Serializable implements Key
         });
       }
     } else {
-      // eslint-disable-next-line no-console
-      console.warn(
+      warnIfDevelopment(
         "[Aptos SDK] The verification key hash was not set. Proof may be invalid if the verification key has rotated.",
       );
     }

package/src/account/DerivableAbstractedAccount.ts

@@ -1,12 +1,10 @@
 import { sha3_256 } from "@noble/hashes/sha3";
 import { Serializer } from "../bcs/serializer";
 import { AccountAddress } from "../core/accountAddress";
-import { AccountAbstractionMessage, AccountAuthenticatorAbstraction } from "../transactions/authenticator/account";
+import { AccountAuthenticatorAbstraction } from "../transactions/authenticator/account";
 import { HexInput } from "../types";
 import { isValidFunctionInfo } from "../utils/helpers";
 import { AbstractedAccount } from "./AbstractedAccount";
-import { generateSigningMessage } from "../transactions/transactionBuilder/signingMessage";
-import { ACCOUNT_ABSTRACTION_SIGNING_DATA_SALT } from "../utils/const";
 
 type DerivableAbstractedAccountArgs = {
   /**

package/src/account/EphemeralKeyPair.ts

@@ -70,6 +70,12 @@ export class EphemeralKeyPair extends Serializable {
    */
   private publicKey: EphemeralPublicKey;
 
+  /**
+   * Whether the ephemeral key pair has been cleared from memory.
+   * @private
+   */
+  private cleared: boolean = false;
+
   /**
    * Creates an instance of the class with a specified private key, optional expiry date, and optional blinder.
    * This constructor initializes the public key, sets the expiry date to a default value if not provided,
@@ -120,6 +126,49 @@ export class EphemeralKeyPair extends Serializable {
     return currentTimeSecs > this.expiryDateSecs;
   }
 
+  /**
+   * Clears the ephemeral private key from memory by overwriting it with random bytes.
+   * After calling this method, the ephemeral key pair can no longer be used for signing.
+   *
+   * Note: Due to JavaScript's memory management, this cannot guarantee complete removal of
+   * sensitive data from memory, but it significantly reduces the window of exposure.
+   *
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  clear(): void {
+    if (!this.cleared) {
+      // Clear the underlying private key if it has a clear method
+      if ("clear" in this.privateKey && typeof this.privateKey.clear === "function") {
+        this.privateKey.clear();
+      } else {
+        // Fallback: multiple overwrite passes for better security
+        const keyBytes = this.privateKey.toUint8Array();
+        crypto.getRandomValues(keyBytes);
+        keyBytes.fill(0xff);
+        crypto.getRandomValues(keyBytes);
+        keyBytes.fill(0);
+      }
+      // Also clear the blinder with multiple passes as it's used in nonce calculation
+      crypto.getRandomValues(this.blinder);
+      this.blinder.fill(0xff);
+      crypto.getRandomValues(this.blinder);
+      this.blinder.fill(0);
+      this.cleared = true;
+    }
+  }
+
+  /**
+   * Returns whether the ephemeral key pair has been cleared from memory.
+   *
+   * @returns true if the key pair has been cleared, false otherwise
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  isCleared(): boolean {
+    return this.cleared;
+  }
+
   /**
    * Serializes the object's properties into a format suitable for transmission or storage.
    * This function is essential for preparing the object data for serialization processes.
@@ -185,7 +234,6 @@ export class EphemeralKeyPair extends Serializable {
     let privateKey: PrivateKey;
 
     switch (args?.scheme) {
-      case EphemeralPublicKeyVariant.Ed25519:
       default:
         privateKey = Ed25519PrivateKey.generate();
     }
@@ -199,11 +247,14 @@ export class EphemeralKeyPair extends Serializable {
    *
    * @param data - The data to be signed, provided in HexInput format.
    * @returns EphemeralSignature - The resulting ephemeral signature.
-   * @throws Error - Throws an error if the EphemeralKeyPair has expired.
+   * @throws Error - Throws an error if the EphemeralKeyPair has expired or been cleared from memory.
    * @group Implementation
    * @category Account (On-Chain Model)
    */
   sign(data: HexInput): EphemeralSignature {
+    if (this.cleared) {
+      throw new Error("EphemeralKeyPair has been cleared from memory and can no longer be used");
+    }
     if (this.isExpired()) {
       throw new Error("EphemeralKeyPair has expired");
     }

package/src/account/MultiEd25519Account.ts

@@ -60,12 +60,10 @@ export class MultiEd25519Account implements Account {
 
     if (publicKey.threshold > signers.length) {
       throw new Error(
-        // eslint-disable-next-line max-len
         `Not enough signers provided to satisfy the required signatures. Need ${publicKey.threshold} signers, but only ${signers.length} provided`,
       );
     } else if (publicKey.threshold < signers.length) {
       throw new Error(
-        // eslint-disable-next-line max-len
         `More signers provided than required. Need ${publicKey.threshold} signers, but ${signers.length} provided`,
       );
     }

package/src/account/MultiKeyAccount.ts

@@ -99,12 +99,10 @@ export class MultiKeyAccount implements Account, KeylessSigner {
 
     if (multiKey.signaturesRequired > signers.length) {
       throw new Error(
-        // eslint-disable-next-line max-len
         `Not enough signers provided to satisfy the required signatures. Need ${multiKey.signaturesRequired} signers, but only ${signers.length} provided`,
       );
     } else if (multiKey.signaturesRequired < signers.length) {
       throw new Error(
-        // eslint-disable-next-line max-len
         `More signers provided than required. Need ${multiKey.signaturesRequired} signers, but ${signers.length} provided`,
       );
     }

package/src/account/SingleKeyAccount.ts

@@ -5,7 +5,6 @@ import {
   AnyPublicKey,
   AnySignature,
   Ed25519PrivateKey,
-  KeylessSignature,
   PrivateKeyInput,
   Secp256k1PrivateKey,
   Signature,

package/src/api/account.ts

@@ -22,7 +22,6 @@ import {
   MoveModuleBytecode,
   MoveResource,
   MoveStructId,
-  MoveValue,
   OrderByArg,
   PaginationArgs,
   TokenStandardArg,
@@ -833,7 +832,7 @@ export class Account {
             if (pairedCoinTypeStruct.vec.length > 0 && isEncodedStruct(pairedCoinTypeStruct.vec[0])) {
               return parseEncodedStruct(pairedCoinTypeStruct.vec[0]);
             }
-          } catch (error) {
+          } catch {
             /* No paired coin type found */
           }
           return undefined;

package/src/api/ans.ts

@@ -1,7 +1,6 @@
 // Copyright © Aptos Foundation
 // SPDX-License-Identifier: Apache-2.0
 
-import { Account } from "../account";
 import { AccountAddress, AccountAddressInput } from "../core";
 import {
   RegisterNameParameters,

package/src/api/aptos.ts

@@ -144,7 +144,7 @@ function applyMixin(targetClass: any, baseClass: any, baseClassProp: string) {
 
     // Define new method that calls through baseClassProp
     Object.defineProperty(targetClass.prototype, propertyName, {
-      value: function (...args: any[]) {
+      value(...args: any[]) {
         return (this as any)[baseClassProp][propertyName](...args);
       },
       writable: propertyDescriptor.writable,

package/src/api/aptosConfig.ts

@@ -22,6 +22,7 @@ import {
   NetworkToProverAPI,
 } from "../utils/apiEndpoints";
 import { AptosApiType, DEFAULT_MAX_GAS_AMOUNT, DEFAULT_TXN_EXP_SEC_FROM_NOW } from "../utils/const";
+import { isBun } from "../utils/helpers";
 
 /**
  * Represents the configuration settings for an Aptos SDK client instance.
@@ -165,6 +166,16 @@ export class AptosConfig {
       }
     }
 
+    // Warn Bun users about HTTP/2 compatibility issues.
+    // Bun's HTTP/2 support is not fully mature yet, so we recommend disabling it.
+    if (isBun() && settings?.clientConfig?.http2 !== false) {
+      console.warn(
+        "[Aptos SDK] Bun does not fully support HTTP/2, which is enabled by default in this SDK. " +
+          "It is recommended to disable HTTP/2 by setting `clientConfig: { http2: false }` in your AptosConfig. " +
+          "For example: new AptosConfig({ network: Network.TESTNET, clientConfig: { http2: false } })",
+      );
+    }
+
     this.network = settings?.network ?? Network.DEVNET;
     this.fullnode = settings?.fullnode;
     this.faucet = settings?.faucet;
@@ -238,7 +249,7 @@ export class AptosConfig {
         if (this.network === Network.CUSTOM) throw new Error("Please provide a custom prover service url");
         return NetworkToProverAPI[this.network];
       default:
-        throw Error(`apiType ${apiType} is not supported`);
+        throw new Error(`apiType ${apiType} is not supported`);
     }
   }
 

package/src/api/transaction.ts

@@ -36,7 +36,7 @@ import {
   InputGenerateTransactionPayloadData,
   InputTransactionPluginData,
 } from "../transactions";
-import { AccountAddressInput, AccountPublicKey, AuthenticationKey, Ed25519PrivateKey } from "../core";
+import { AccountAddressInput, AccountPublicKey, Ed25519PrivateKey } from "../core";
 import { Account, Ed25519Account, MultiEd25519Account } from "../account";
 import { Build } from "./transactionSubmission/build";
 import { Simulate } from "./transactionSubmission/simulate";
@@ -418,7 +418,7 @@ export class Transaction {
    * ```
    * @group Transaction
    */
-  // eslint-disable-next-line class-methods-use-this
+
   getSigningMessage(args: { transaction: AnyRawTransaction }): Uint8Array {
     return getSigningMessage(args);
   }
@@ -594,7 +594,7 @@ export class Transaction {
    * ```
    * @group Transaction
    */
-  // eslint-disable-next-line class-methods-use-this
+
   sign(args: { signer: Account; transaction: AnyRawTransaction }): AccountAuthenticator {
     return signTransaction({
       ...args,
@@ -638,7 +638,7 @@ export class Transaction {
    * ```
    * @group Transaction
    */
-  // eslint-disable-next-line class-methods-use-this
+
   signAsFeePayer(args: { signer: Account; transaction: AnyRawTransaction }): AccountAuthenticator {
     return signAsFeePayer({
       ...args,

package/src/api/transactionSubmission/build.ts

@@ -3,11 +3,7 @@
 
 import { AccountAddressInput } from "../../core";
 import { generateTransaction } from "../../internal/transactionSubmission";
-import {
-  InputGenerateTransactionPayloadData,
-  InputGenerateTransactionOptions,
-  InputGenerateOrderlessTransactionOptions,
-} from "../../transactions";
+import { InputGenerateTransactionPayloadData, InputGenerateTransactionOptions } from "../../transactions";
 import { MultiAgentTransaction } from "../../transactions/instances/multiAgentTransaction";
 import { SimpleTransaction } from "../../transactions/instances/simpleTransaction";
 import { AptosConfig } from "../aptosConfig";

package/src/api/transactionSubmission/helpers.ts

@@ -103,7 +103,6 @@ export function validateFeePayerDataOnSubmission(
  */
 export function ValidateFeePayerDataOnSimulation(target: unknown, propertyKey: string, descriptor: PropertyDescriptor) {
   const originalMethod = descriptor.value;
-  /* eslint-disable-next-line func-names, no-param-reassign */
   descriptor.value = async function (...args: any[]) {
     return originalMethod.apply(this, args);
   };

package/src/api/transactionSubmission/sign.ts

@@ -76,7 +76,7 @@ export class Sign {
    * ```
    * @group Implementation
    */
-  // eslint-disable-next-line class-methods-use-this
+
   transaction(args: { signer: Account; transaction: AnyRawTransaction }): AccountAuthenticator {
     return signTransaction({
       ...args,
@@ -121,7 +121,7 @@ export class Sign {
    * ```
    * @group Implementation
    */
-  // eslint-disable-next-line class-methods-use-this
+
   transactionAsFeePayer(args: { signer: Account; transaction: AnyRawTransaction }): AccountAuthenticator {
     const { signer, transaction } = args;
 

package/src/bcs/deserializer.ts

@@ -1,11 +1,22 @@
 // Copyright © Aptos Foundation
 // SPDX-License-Identifier: Apache-2.0
 
-/* eslint-disable no-bitwise */
 import { MAX_U32_NUMBER } from "./consts";
 import { Uint8, Uint16, Uint32, Uint64, Uint128, Uint256, HexInput } from "../types";
 import { Hex } from "../core/hex";
 
+/**
+ * Shared TextDecoder instance for string deserialization to avoid repeated instantiation.
+ */
+const TEXT_DECODER = new TextDecoder();
+
+/**
+ * Maximum allowed length for deserialized byte arrays and strings.
+ * This prevents memory exhaustion attacks from malformed BCS data.
+ * Set to 10MB which should be sufficient for any legitimate use case.
+ */
+const MAX_DESERIALIZE_BYTES_LENGTH = 10 * 1024 * 1024; // 10MB
+
 /**
  * This interface exists to define Deserializable<T> inputs for functions that
  * deserialize a byte buffer into a type T.
@@ -70,18 +81,27 @@ export class Deserializer {
 
   /**
    * Reads a specified number of bytes from the buffer and advances the offset.
+   * Returns a view into the buffer rather than copying for better performance.
+   *
+   * SECURITY NOTE: This returns a view, not a copy. Callers that expose the result
+   * externally MUST call .slice() to create a copy. Internal numeric deserializers
+   * (deserializeU8, deserializeU16, etc.) only read values and don't expose the view.
+   * deserializeBytes() and deserializeFixedBytes() call .slice() before returning.
    *
    * @param length - The number of bytes to read from the buffer.
    * @throws Throws an error if the read operation exceeds the buffer's length.
    * @group Implementation
    * @category BCS
    */
-  private read(length: number): ArrayBuffer {
+  private read(length: number): Uint8Array {
     if (this.offset + length > this.buffer.byteLength) {
       throw new Error("Reached to the end of buffer");
     }
 
-    const bytes = this.buffer.slice(this.offset, this.offset + length);
+    // Use subarray to return a view instead of slice which copies
+    // SECURITY: View is safe because numeric deserializers only read values,
+    // and byte deserializers call .slice() before returning to caller
+    const bytes = new Uint8Array(this.buffer, this.offset, length);
     this.offset += length;
     return bytes;
   }
@@ -129,8 +149,7 @@ export class Deserializer {
    */
   deserializeStr(): string {
     const value = this.deserializeBytes();
-    const textDecoder = new TextDecoder();
-    return textDecoder.decode(value);
+    return TEXT_DECODER.decode(value);
   }
 
   /**
@@ -221,24 +240,34 @@ export class Deserializer {
    * The BCS layout for "bytes" consists of a bytes_length followed by the bytes themselves, where bytes_length is a u32 integer
    * encoded as a uleb128 integer, indicating the length of the bytes array.
    *
-   * @returns {Uint8Array} The deserialized array of bytes.
+   * @returns {Uint8Array} The deserialized array of bytes (a copy, safe to modify).
+   * @throws {Error} If the length exceeds the maximum allowed (10MB) to prevent memory exhaustion.
    * @group Implementation
    * @category BCS
    */
   deserializeBytes(): Uint8Array {
     const len = this.deserializeUleb128AsU32();
-    return new Uint8Array(this.read(len));
+    // Security: Prevent memory exhaustion from malformed data
+    if (len > MAX_DESERIALIZE_BYTES_LENGTH) {
+      throw new Error(
+        `Deserialization error: byte array length ${len} exceeds maximum allowed ${MAX_DESERIALIZE_BYTES_LENGTH}`,
+      );
+    }
+    // Return a copy so caller can safely modify without affecting buffer
+    return this.read(len).slice();
   }
 
   /**
    * Deserializes an array of bytes of a specified length.
    *
    * @param len - The number of bytes to read from the source.
+   * @returns {Uint8Array} The deserialized array of bytes (a copy, safe to modify).
    * @group Implementation
    * @category BCS
    */
   deserializeFixedBytes(len: number): Uint8Array {
-    return new Uint8Array(this.read(len));
+    // Return a copy so caller can safely modify without affecting buffer
+    return this.read(len).slice();
   }
 
   /**
@@ -253,7 +282,7 @@ export class Deserializer {
    * @category BCS
    */
   deserializeBool(): boolean {
-    const bool = new Uint8Array(this.read(1))[0];
+    const bool = this.read(1)[0];
     if (bool !== 1 && bool !== 0) {
       throw new Error("Invalid boolean value");
     }
@@ -270,7 +299,7 @@ export class Deserializer {
    * @category BCS
    */
   deserializeU8(): Uint8 {
-    return new DataView(this.read(1)).getUint8(0);
+    return this.read(1)[0];
   }
 
   /**
@@ -286,7 +315,8 @@ export class Deserializer {
    * @category BCS
    */
   deserializeU16(): Uint16 {
-    return new DataView(this.read(2)).getUint16(0, true);
+    const bytes = this.read(2);
+    return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint16(0, true);
   }
 
   /**
@@ -302,7 +332,8 @@ export class Deserializer {
    * @category BCS
    */
   deserializeU32(): Uint32 {
-    return new DataView(this.read(4)).getUint32(0, true);
+    const bytes = this.read(4);
+    return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0, true);
   }
 
   /**
@@ -367,7 +398,8 @@ export class Deserializer {
    * @category BCS
    */
   deserializeI8(): number {
-    return new DataView(this.read(1)).getInt8(0);
+    const bytes = this.read(1);
+    return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getInt8(0);
   }
 
   /**
@@ -379,7 +411,8 @@ export class Deserializer {
    * @category BCS
    */
   deserializeI16(): number {
-    return new DataView(this.read(2)).getInt16(0, true);
+    const bytes = this.read(2);
+    return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getInt16(0, true);
   }
 
   /**
@@ -391,7 +424,8 @@ export class Deserializer {
    * @category BCS
    */
   deserializeI32(): number {
-    return new DataView(this.read(4)).getInt32(0, true);
+    const bytes = this.read(4);
+    return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getInt32(0, true);
   }
 
   /**
@@ -469,6 +503,7 @@ export class Deserializer {
    * This function is used for interpreting lengths of variable-length sequences and tags of enum values in BCS encoding.
    *
    * @throws {Error} Throws an error if the parsed value exceeds the maximum uint32 number.
+   * @throws {Error} Throws an error if the uleb128 encoding is malformed (too many bytes).
    * @returns {number} The deserialized uint32 value.
    * @group Implementation
    * @category BCS
@@ -476,18 +511,30 @@ export class Deserializer {
   deserializeUleb128AsU32(): Uint32 {
     let value: bigint = BigInt(0);
     let shift = 0;
+    // Maximum 5 bytes for uleb128-encoded u32 (7 bits per byte, 5*7=35 bits > 32 bits needed)
+    const MAX_ULEB128_BYTES = 5;
+    let bytesRead = 0;
 
-    while (value < MAX_U32_NUMBER) {
+    while (bytesRead < MAX_ULEB128_BYTES) {
       const byte = this.deserializeU8();
+      bytesRead += 1;
+
       value |= BigInt(byte & 0x7f) << BigInt(shift);
 
+      // Early overflow check before continuing
+      if (value > MAX_U32_NUMBER) {
+        throw new Error("Overflow while parsing uleb128-encoded uint32 value");
+      }
+
       if ((byte & 0x80) === 0) {
         break;
       }
+
       shift += 7;
     }
 
-    if (value > MAX_U32_NUMBER) {
+    // If we read MAX_ULEB128_BYTES and the last byte had continuation bit set, it's malformed
+    if (bytesRead === MAX_ULEB128_BYTES && value > MAX_U32_NUMBER) {
       throw new Error("Overflow while parsing uleb128-encoded uint32 value");
     }