@bitpay-labs/bitcore-wallet-service 11.10.10 → 11.10.12

package/package.json

@@ -2,7 +2,7 @@
   "name": "@bitpay-labs/bitcore-wallet-service",
   "description": "A service for Mutisig HD Bitcoin Wallets",
   "author": "BitPay Inc",
-  "version": "11.10.10",
+  "version": "11.10.12",
   "license": "MIT",
   "main": "ts_build/src/index.js",
   "types": "./ts_build/src/index.d.ts",
@@ -42,8 +42,8 @@
   },
   "dependencies": {
     "@bitpay-labs/bitcore-logging": "^11.10.9",
-    "@bitpay-labs/bitcore-tss": "^11.10.9",
-    "@bitpay-labs/crypto-wallet-core": "^11.10.9",
+    "@bitpay-labs/bitcore-tss": "^11.10.12",
+    "@bitpay-labs/crypto-wallet-core": "^11.10.12",
     "@sendgrid/mail": "6.5.4",
     "abi-decoder": "2.4.0",
     "async": "0.9.2",
@@ -107,5 +107,5 @@
       "email": "kjoseph@bitpay.com"
     }
   ],
-  "gitHead": "ea86af5f3e1049d0ee1469fd0cd1fa34c2a579c4"
+  "gitHead": "d1992fd744501a1b69b8cb97f07b0896df7223fd"
 }

package/src/externalservices/simplex.ts

@@ -32,6 +32,18 @@ export class SimplexService {
     return keys;
   }
 
+  private simplexGetUserIp(req): string {
+    const isWebContext = req.body?.context === 'web';
+    let userIp = (isWebContext && req.body.deviceIp) || Utils.getIpFromReq(req);
+    delete req.body.deviceIp;
+    if (userIp) {
+      // Canonicalize IPv4-mapped IPv6 (dual-stack sockets report IPv4 clients as
+      // ::ffff:1.2.3.4) so Simplex sees a plain IPv4 address.
+      userIp = String(userIp).trim().replace(/^::ffff:/i, '');
+    }
+    return userIp || '';
+  }
+
   simplexGetCurrencies(req): Promise<any> {
     return new Promise((resolve, reject) => {
       const keys = this.simplexGetKeys(req);
@@ -63,11 +75,11 @@ export class SimplexService {
 
   simplexGetQuote(req): Promise<any> {
     return new Promise((resolve, reject) => {
+      const ip = this.simplexGetUserIp(req);
       const keys = this.simplexGetKeys(req);
 
       const API = keys.API;
       const API_KEY = keys.API_KEY;
-      const ip = Utils.getIpFromReq(req);
 
       req.body.client_ip = ip;
       req.body.wallet_id = keys.APP_PROVIDER_ID;
@@ -147,6 +159,7 @@ export class SimplexService {
 
   simplexPaymentRequest(req): Promise<any> {
     return new Promise((resolve, reject) => {
+      const ip = this.simplexGetUserIp(req);
       const keys = this.simplexGetKeys(req);
 
       const API = keys.API;
@@ -155,7 +168,6 @@ export class SimplexService {
       const paymentId = Uuid.v4();
       const orderId = Uuid.v4();
       const apiHost = keys.API;
-      const ip = Utils.getIpFromReq(req);
 
       if (
         !checkRequired(req.body, ['account_details', 'transaction_details']) &&
@@ -248,34 +260,4 @@ export class SimplexService {
       );
     });
   }
-
-  simplexGetEvents(req): Promise<any> {
-    return new Promise((resolve, reject) => {
-      if (!config.simplex) return reject(new Error('Simplex missing credentials'));
-      if (!req.env || (req.env != 'sandbox' && req.env != 'production'))
-        return reject(new Error("Simplex's request wrong environment"));
-
-      const API = config.simplex[req.env].api;
-      const API_KEY = config.simplex[req.env].apiKey;
-      const headers = {
-        'Content-Type': 'application/json',
-        Authorization: 'ApiKey ' + API_KEY
-      };
-
-      this.request.get(
-        API + '/wallet/merchant/v2/events',
-        {
-          headers,
-          json: true
-        },
-        (err, data) => {
-          if (err) {
-            return reject(err.body ? err.body : null);
-          } else {
-            return resolve(data.body ? data.body : null);
-          }
-        }
-      );
-    });
-  }
-}
+}

package/src/lib/blockchainexplorers/v8/client.ts

@@ -61,6 +61,20 @@ export class Client {
     });
   }
 
+  async getBalanceAtTime(params) {
+    const { payload, pubKey, time, tokenAddress } = params;
+    let url = `${this.baseUrl}/wallet/${pubKey}/balance/${encodeURIComponent(time)}`;
+    if (tokenAddress) {
+      url += `?tokenAddress=${encodeURIComponent(tokenAddress)}`;
+    }
+    const signature = this.sign({ method: 'GET', url, payload });
+    return request.get(url, {
+      headers: { 'x-signature': signature },
+      body: payload,
+      json: true
+    });
+  }
+
   async getCheckData(params) {
     const { payload, pubKey } = params;
     const url = `${this.baseUrl}/wallet/${pubKey}/check`;

package/src/lib/blockchainexplorers/v8.ts

@@ -178,6 +178,17 @@ export class V8 {
       .catch(cb);
   }
 
+  async getBalanceAtTime(wallet: WalletWithOpts, time: string, cb) {
+    const client = this._getAuthClient(wallet);
+    const { tokenAddress } = wallet;
+    client
+      .getBalanceAtTime({ pubKey: wallet.beAuthPublicKey2, payload: {}, time, tokenAddress })
+      .then(ret => {
+        return cb(null, ret);
+      })
+      .catch(cb);
+  }
+
   getConnectionInfo() {
     return 'V8 (' + this.chain + '/' + this.v8network + ') @ ' + this.host;
   }
@@ -788,4 +799,4 @@ export class V8 {
 
 const getPerformanceKey = (name: string) => {
   return name + '-' + crypto.randomBytes(5).toString('hex');
-};
+};

package/src/lib/chain/btc/index.ts

@@ -349,6 +349,11 @@ export class BtcChain implements IChain {
     });
   }
 
+  isPrePublishRawBound(_txp: TxProposal) {
+    // UTXO chains never mutate tx data at publish, so they never legitimately carry prePublishRaw.
+    return false;
+  }
+
   getBitcoreTx(txp, opts = { signed: true }) {
     const t = new this.bitcoreLib.Transaction();
 

package/src/lib/chain/eth/index.ts

@@ -287,6 +287,10 @@ export class EthChain implements IChain {
     });
   }
 
+  isPrePublishRawBound(txp: TxProposal) {
+    return Common.Utils.isPrePublishRawBound(this, txp);
+  }
+
   getBitcoreTx(txp: TxProposal, opts = { signed: true }) {
     const {
       data,

package/src/lib/chain/index.ts

@@ -98,6 +98,10 @@ class ChainProxy {
     return this.get(txp.chain).getBitcoreTx(txp, { signed: opts.signed });
   }
 
+  isPrePublishRawBound(txp: TxProposal<any>) {
+    return this.get(txp.chain).isPrePublishRawBound(txp);
+  }
+
   convertFeePerKb(chain, p, feePerKb) {
     return this.get(chain).convertFeePerKb(p, feePerKb);
   }

package/src/lib/chain/sol/index.ts

@@ -2,6 +2,7 @@ import { Transactions, Utils, Validation } from '@bitpay-labs/crypto-wallet-core
 import _ from 'lodash';
 import { IChain } from '../../../types/chain';
 import { WalletWithOpts } from '../../blockchainexplorers/v8';
+import { Common } from '../../common';
 import { Defaults } from '../../common/defaults';
 import { Errors } from '../../errors/errordefinitions';
 import logger from '../../logger';
@@ -28,6 +29,7 @@ export class SolChain implements IChain {
       totalConfirmedAmount: confirmed,
       lockedAmount: activatedLocked,
       lockedConfirmedAmount: activatedLocked,
+      reserve: balance > 0 ? minRent : 0,
       availableAmount: balance - activatedLocked,
       availableConfirmedAmount: confirmed - activatedLocked,
       byAddress: []
@@ -98,6 +100,10 @@ export class SolChain implements IChain {
     });
   }
 
+  isPrePublishRawBound(txp) {
+    return Common.Utils.isPrePublishRawBound(this, txp);
+  }
+
   getBitcoreTx(txp, opts = { signed: true }) {
     const {
       data,

package/src/lib/chain/xrp/index.ts

@@ -29,6 +29,7 @@ export class XrpChain implements IChain {
       totalConfirmedAmount: confirmed,
       lockedAmount: activatedLocked,
       lockedConfirmedAmount: activatedLocked,
+      reserve: balance > 0 ? reserve : 0,
       availableAmount: balance - activatedLocked,
       availableConfirmedAmount: confirmed - activatedLocked,
       byAddress: []
@@ -143,6 +144,10 @@ export class XrpChain implements IChain {
     });
   }
 
+  isPrePublishRawBound(txp) {
+    return Common.Utils.isPrePublishRawBound(this, txp);
+  }
+
   getBitcoreTx(txp, opts = { signed: true }) {
     const { destinationTag, outputs, outputOrder, multiTx } = txp;
     const chain = 'XRP';

package/src/lib/common/utils.ts

@@ -3,7 +3,8 @@ import {
   BitcoreLibCash,
   BitcoreLibDoge,
   BitcoreLibLtc,
-  Constants as CWConstants
+  Constants as CWConstants,
+  Transactions
 } from '@bitpay-labs/crypto-wallet-core';
 import _ from 'lodash';
 import { singleton } from 'preconditions';
@@ -12,6 +13,8 @@ import Config from '../../config';
 import { logger } from '../logger';
 import { Constants } from './constants';
 import { Defaults } from './defaults';
+import type { IChain } from '../../types/chain';
+import type { TxProposal } from '../model/txproposal';
 
 const $ = singleton();
 const Bitcore_ = {
@@ -23,6 +26,54 @@ const Bitcore_ = {
 
 export const Utils = {
 
+  /**
+   * txp.prePublishRaw as a list of raw transactions, or null when it isn't one. An empty list is truthy and
+   * hashes to nothing, so without this the value reaches the tx provider and fails as a thrown error rather
+   * than a refused check. Mirrors the client-side Verifier helper so both ends agree on a usable fallback.
+   *
+   * @param txp - the transaction proposal
+   */
+  prePublishRawParts(txp: TxProposal<any>): string[] | null {
+    if (!txp?.prePublishRaw) {
+      return null;
+    }
+    const parts = Array.isArray(txp.prePublishRaw) ? txp.prePublishRaw : [txp.prePublishRaw];
+    if (!parts.length || parts.some(raw => !raw || typeof raw !== 'string')) {
+      return null;
+    }
+    return parts;
+  },
+
+  /**
+   * Shared implementation of IChain.isPrePublishRawBound for account-based chains (SVM/EVM/XRP). True only if
+   * txp.prePublishRaw is the same transaction as the current proposal, differing solely in the field BWS
+   * mutates at publish (blockhash on SVM, nonce on EVM/XRP). Recovers that field from prePublishRaw, rebuilds
+   * the proposal via the chain's own getBitcoreTx, and requires byte-for-byte equality, so a tampered stored
+   * proposal cannot reuse an old, still-valid proposalSignature. Fails closed on any error.
+   *
+   * @param chain - the IChain implementation (provides chain + getBitcoreTx)
+   * @param txp - the transaction proposal (must carry prePublishRaw)
+   */
+  isPrePublishRawBound(chain: IChain, txp: TxProposal<any>): boolean {
+    try {
+      const prePublishRaw = Utils.prePublishRawParts(txp);
+      if (!prePublishRaw) return false;
+      const provider = Transactions.get({ chain: txp.chain }) as any;
+      if (typeof provider?.getMutableFields !== 'function') return false;
+      const mutableFields = provider.getMutableFields(prePublishRaw[0]);
+      if (!mutableFields || Object.values(mutableFields).every(v => v == null)) return false;
+      const cloned = Object.assign(Object.create(Object.getPrototypeOf(txp)), txp, mutableFields);
+      // signed: false to match prePublishRaw, which is captured before any copayer signature exists.
+      const rebuilt = chain.getBitcoreTx(cloned, { signed: false }).uncheckedSerialize();
+      const rebuiltArr = Array.isArray(rebuilt) ? rebuilt : [rebuilt];
+      if (rebuiltArr.length !== prePublishRaw.length) return false;
+      return rebuiltArr.every((raw, i) => raw === prePublishRaw[i]);
+    } catch (err) {
+      logger.warn('prePublishRaw binding check failed for txp %s on %s: %o', txp?.id, txp?.chain, err.stack || err.message || err);
+      return false;
+    }
+  },
+
   /**
    * @deprecated
    * Moved from ChainService to prevent circular dependency

package/src/lib/routes/middleware/authTssRequest.ts

@@ -35,7 +35,7 @@ export function authTssRequest(): express.RequestHandler {
       if (req.path.includes('/tss/keygen/')) {
         session = await storage.fetchTssKeyGenSession({ id });
         partyId = session?.participants.indexOf(copayerId);
-        pubKey = partyId > -1 ? session.rounds[0][partyId].messages.publicKey : null;
+        pubKey = partyId > -1 ? session.rounds[0].find(r => r.fromPartyId === partyId)?.messages.publicKey : null;
       } else if (req.path.includes('/tss/sign/')) {
         session = await storage.fetchTssSigSession({ id });
         partyId = session?.participants.find(p => p.copayerId === copayerId)?.partyId;

package/src/lib/routes/services.ts

@@ -65,7 +65,7 @@ function respondWithAuthServer(req, res, context: RouteContext, handler: RouteHa
 }
 
 export function registerServiceRoutes(router: express.Router, context: RouteContext) {
-  const { getServerWithAuth, setPublicCache, returnError } = context;
+  const { setPublicCache } = context;
 
   const transakCorsOptions = {
     origin: (origin, cb) => {
@@ -399,19 +399,6 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
     });
   });
 
-  router.get('/v1/service/simplex/events', (req, res) => {
-    getServerWithAuth(req, res, server => {
-      Promise.resolve()
-        .then(() => server.externalServices.simplex.simplexGetEvents({ env: req.query.env }))
-        .then(response => {
-          res.json(response);
-        })
-        .catch(err => {
-          returnError(err ?? 'unknown', res, req);
-        });
-    });
-  });
-
   router.post('/v1/service/thorswap/supportedChains', (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.externalServices.thorswap.thorswapGetSupportedChains(req);

package/src/lib/routes/walletdata.ts

@@ -108,6 +108,17 @@ export function registerWalletDataRoutes(router: express.Router, context: RouteC
     });
   });
 
+  router.get('/v1/balance/:time/', (req, res) => {
+    getServerWithAuth(req, res, server => {
+      const opts: { time: string; tokenAddress?: string } = { time: req.params.time };
+      if (req.query.tokenAddress) opts.tokenAddress = req.query.tokenAddress as string;
+      server.getBalanceAtTime(opts, (err, balance) => {
+        if (err) return returnError(err, res, req);
+        res.json(balance);
+      });
+    });
+  });
+
   router.get('/v1/sendmaxinfo/', (req, res) => {
     getServerWithAuth(req, res, server => {
       const query = req.query;

package/src/lib/server.ts

@@ -2092,6 +2092,44 @@ export class WalletService implements IWalletService {
     });
   }
 
+  /**
+   * Get wallet balance at a specific time.
+   * @param {Object} opts
+   * @param {string} opts.time - Date or time accepted by the bitcore-node API.
+   * @returns {Object} balance - The chain-state provider balance at the requested time.
+   */
+  getBalanceAtTime(opts, cb) {
+    opts = opts || {};
+    if (!opts.time) {
+      return cb(new ClientError('time is required in getBalanceAtTime'));
+    }
+    let wallet = opts.wallet;
+
+    const setWallet = cb1 => {
+      if (wallet) return cb1();
+      this.getWallet({}, (err, ret) => {
+        if (err) return cb(err);
+        wallet = ret;
+        return cb1(null, wallet);
+      });
+    };
+
+    setWallet(() => {
+      if (!wallet.isComplete()) {
+        return cb(null, { confirmed: 0, unconfirmed: 0, balance: 0 });
+      }
+
+      this.syncWallet(wallet, err => {
+        if (err) return cb(err);
+        const bc = this._getBlockchainExplorer(wallet.chain, wallet.network);
+        if (!bc) {
+          return cb(new Error('Could not get blockchain explorer instance'));
+        }
+        return bc.getBalanceAtTime({ ...wallet, tokenAddress: opts.tokenAddress }, opts.time, cb);
+      });
+    });
+  }
+
   /**
    * Return info needed to send all funds in the wallet
    * @param {Object} opts
@@ -3082,8 +3120,12 @@ export class WalletService implements IWalletService {
 
           let signingKey = this._getSigningKey(raw, opts.proposalSignature, copayer.requestPubKeys);
           if (!signingKey) {
-            // If the txp has been published previously, we will verify the signature against the previously published raw tx
-            if (txp.hasMutableTxData() && txp.prePublishRaw) {
+            // The signature didn't match the current (refreshed) raw tx. Fall back to the previously-published
+            // raw tx -- but only if it is bound to THIS proposal (differs from the current tx solely in the
+            // field BWS mutates at publish: blockhash/nonce). Without that check a tampered stored proposal
+            // could reuse an old, still-valid proposalSignature over prePublishRaw. Mirrors the client
+            // Verifier.checkPrePublishRaw guard.
+            if (txp.hasMutableTxData() && txp.prePublishRaw && ChainService.isPrePublishRawBound(txp)) {
               raw = txp.prePublishRaw;
               signingKey = this._getSigningKey(raw, opts.proposalSignature, copayer.requestPubKeys);
             }

package/src/types/chain.d.ts

@@ -33,6 +33,7 @@ export interface IChain {
   checkScriptOutput(output: { script: string; amount: number });
   getFee(server: WalletService, wallet: IWallet, opts: { fee: number; feePerKb: number; signatures?: number } & any);
   getBitcoreTx(txp: TxProposal, opts: { signed: boolean });
+  isPrePublishRawBound(txp: TxProposal): boolean;
   convertFeePerKb(p: number, feePerKb: number);
   checkTx(server: WalletService, txp: ITxProposal);
   checkTxUTXOs(server: WalletService, txp: ITxProposal, opts: { noCashAddr: boolean } & any, cb);

package/test/chain/sol.test.ts

@@ -0,0 +1,48 @@
+'use strict';
+
+import * as chai from 'chai';
+import { ChainService } from '../../src/lib/chain';
+import { Defaults } from '../../src/lib/common/defaults';
+
+const should = chai.should();
+
+describe('Chain SOL', function() {
+  describe('#getWalletBalance', function() {
+    const cases = [
+      { name: 'pending amounts and fees', amount: 1000000000, txps: [{ amount: '2000000000', fee: '5000' }], reserve: 1002240, locked: 2001007240, available: -1001007240 },
+      { name: 'dust below rent', amount: 10000, txps: [], reserve: 1002240, locked: 1002240, available: -992240 },
+      { name: 'an empty account with a pending proposal', amount: 0, txps: [{ amount: '2000000000', fee: '5000' }], reserve: 0, locked: 2000005000, available: -2000005000 },
+      { name: 'an SPL balance', amount: 1000000, txps: [{ tokenAddress: 'mint', amount: '500000', fee: '5000' }], tokenAddress: 'mint', reserve: 0, locked: 500000, available: 500000 }
+    ];
+
+    for (const c of cases) {
+      it('should expose the reserve separately for ' + c.name, function(done) {
+        const server = {
+          walletId: '1',
+          _getBlockchainExplorer: () => ({
+            getBalance: (_wallet, cb) => cb(null, { balance: c.amount, confirmed: c.amount }),
+            getRentMinimum: (_space, cb) => cb(null, Defaults.MIN_SOL_BALANCE)
+          }),
+          getPendingTxs: (_opts, cb) => cb(null, c.txps),
+          storage: { fetchAddresses: (_walletId, cb) => cb(null, []) }
+        };
+        const wallet = { chain: 'sol', network: 'livenet' };
+
+        ChainService.get('sol').getWalletBalance(server as any, wallet as any, { tokenAddress: (c as { tokenAddress?: string }).tokenAddress }, (err, balance) => {
+          should.not.exist(err);
+          balance.should.deep.equal({
+            totalAmount: c.amount,
+            totalConfirmedAmount: c.amount,
+            lockedAmount: c.locked,
+            lockedConfirmedAmount: c.locked,
+            reserve: c.reserve,
+            availableAmount: c.available,
+            availableConfirmedAmount: c.available,
+            byAddress: []
+          });
+          done();
+        });
+      });
+    }
+  });
+});

package/test/chain/xrp.test.ts

@@ -10,6 +10,36 @@ const should = chai.should();
 const xpub = 'tpubDD7tYYerLNNm65Ez7pRjxQ2NpRHDoyRWoLWudnQ8agXjr7qs9BsPsRXk8Z6spPPJodnaY158YqeCKT5oXuZvbuNLfm1R4kXGJ2vPd9pUxDT';
 
 describe('Chain XRP', function() { 
+  describe('#getWalletBalance', function() {
+    it('should expose the reserve separately from pending amounts and fees', function(done) {
+      const server = {
+        walletId: '1',
+        _getBlockchainExplorer: () => ({
+          getBalance: (_wallet, cb) => cb(null, { balance: 2000000, confirmed: 2000000 }),
+          getReserve: cb => cb(null, 1000000)
+        }),
+        getPendingTxs: (_opts, cb) => cb(null, [{ amount: '3000000', fee: '12' }]),
+        storage: { fetchAddresses: (_walletId, cb) => cb(null, []) }
+      };
+      const wallet = { chain: 'xrp', network: 'livenet' };
+
+      ChainService.get('xrp').getWalletBalance(server as any, wallet as any, {}, (err, balance) => {
+        should.not.exist(err);
+        balance.should.deep.equal({
+          totalAmount: 2000000,
+          totalConfirmedAmount: 2000000,
+          lockedAmount: 4000012,
+          lockedConfirmedAmount: 4000012,
+          reserve: 1000000,
+          availableAmount: -2000012,
+          availableConfirmedAmount: -2000012,
+          byAddress: []
+        });
+        done();
+      });
+    });
+  });
+
   describe('#getWalletSendMaxInfo', function() {
     it('should resolve fee level before calculating sendMax amount', function(done) {
       const server = {

package/test/expressapp.test.ts

@@ -274,6 +274,32 @@ describe('ExpressApp', function() {
             });
           });
         });
+
+        it('should get the balance at a given time', function(done) {
+          const server = {
+            getBalanceAtTime: sinon.stub().callsArgWith(1, null, { balance: 123 }),
+          };
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstanceWithAuth').callsArgWith(1, null, server);
+          start(ExpressApp, function() {
+            const reqOpts = {
+              url: testHost + ':' + testPort + config.basePath + '/v1/balance/2025-01-15T12%3A00%3A00.000Z?tokenAddress=0xToken',
+              headers: {
+                'x-identity': 'identity',
+                'x-signature': 'signature'
+              }
+            };
+            request(reqOpts, function(err, res, body) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              server.getBalanceAtTime.calledOnce.should.be.true;
+              server.getBalanceAtTime.getCall(0).args[0].time.should.equal('2025-01-15T12:00:00.000Z');
+              server.getBalanceAtTime.getCall(0).args[0].tokenAddress.should.equal('0xToken');
+              JSON.parse(body).balance.should.equal(123);
+              done();
+            });
+          });
+        });
       });
 
       describe('v1/wallets/all', function() {