@bitpay-labs/bitcore-wallet-service 11.10.10 → 11.10.12

package/ts_build/test/integration/server.test.js

@@ -48,6 +48,7 @@ const config_1 = __importDefault(require("../../src/config"));
 const server_1 = require("../../src/lib/server");
 const storage_1 = require("../../src/lib/storage");
 const common_1 = require("../../src/lib/common");
+const logger_1 = __importDefault(require("../../src/lib/logger"));
 const Model = __importStar(require("../../src/lib/model"));
 const tsskeygen_1 = require("../../src/lib/model/tsskeygen");
 const bchaddresstranslator_1 = require("../../src/lib/bchaddresstranslator");
@@ -8109,6 +8110,73 @@ describe('Wallet service', function () {
             result.nonce.should.be.a('number');
             result.nonce.should.equal(5);
         });
+        describe('prePublishRaw binding (isPrePublishRawBound)', function () {
+            const ATTACKER_ADDR = '0x1111111111111111111111111111111111111111';
+            it('accepts prePublishRaw when only the mutable field (nonce) changed', async function () {
+                blockchainExplorer.getTransactionCount = sinon_1.default.stub().callsArgWith(1, null, '42');
+                const created = await helpers_1.default.createAndPublishTx(server, {
+                    outputs: [{ toAddress: ETH_ADDR, amount: 8000 }],
+                    feePerKb: 123e2, from: fromAddr, deferNonce: true
+                }, TestData.copayers[0].privKey_1H_0);
+                await util_1.default.promisify(server.prepareTx).call(server, { txProposalId: created.id });
+                const withNonce = await util_1.default.promisify(server.getTx).call(server, { txProposalId: created.id });
+                should.exist(withNonce.prePublishRaw);
+                withNonce.nonce.should.equal(42);
+                index_1.ChainService.isPrePublishRawBound(withNonce).should.equal(true);
+            });
+            it('rejects prePublishRaw when the destination was tampered', async function () {
+                const created = await helpers_1.default.createAndPublishTx(server, {
+                    outputs: [{ toAddress: ETH_ADDR, amount: 8000 }],
+                    feePerKb: 123e2, from: fromAddr, deferNonce: true
+                }, TestData.copayers[0].privKey_1H_0);
+                const txp = await util_1.default.promisify(server.getTx).call(server, { txProposalId: created.id });
+                should.exist(txp.prePublishRaw);
+                index_1.ChainService.isPrePublishRawBound(txp).should.equal(true);
+                txp.outputs[0].toAddress = ATTACKER_ADDR;
+                index_1.ChainService.isPrePublishRawBound(txp).should.equal(false);
+            });
+            it('rejects a prePublishRaw that holds no usable raw tx', async function () {
+                const created = await helpers_1.default.createAndPublishTx(server, {
+                    outputs: [{ toAddress: ETH_ADDR, amount: 8000 }],
+                    feePerKb: 123e2, from: fromAddr, deferNonce: true
+                }, TestData.copayers[0].privKey_1H_0);
+                const txp = await util_1.default.promisify(server.getTx).call(server, { txProposalId: created.id });
+                const warn = sinon_1.default.spy(logger_1.default, 'warn');
+                try {
+                    for (const prePublishRaw of [[], [''], ['', '']]) {
+                        txp.prePublishRaw = prePublishRaw;
+                        index_1.ChainService.isPrePublishRawBound(txp).should.equal(false);
+                    }
+                    warn.called.should.equal(false);
+                }
+                finally {
+                    warn.restore();
+                }
+            });
+            it('rejects the publishTx fallback when the stored proposal was tampered', async function () {
+                blockchainExplorer.getTransactionCount = sinon_1.default.stub().callsArgWith(1, null, '7');
+                const created = await util_1.default.promisify(server.createTx).call(server, {
+                    outputs: [{ toAddress: ETH_ADDR, amount: 8000 }],
+                    feePerKb: 123e2, from: fromAddr, deferNonce: true
+                });
+                const publishOpts = helpers_1.default.getProposalSignatureOpts(created, TestData.copayers[0].privKey_1H_0);
+                await util_1.default.promisify(server.publishTx).call(server, publishOpts);
+                await util_1.default.promisify(server.prepareTx).call(server, { txProposalId: created.id });
+                const stored = await util_1.default.promisify(server.storage.fetchTx).call(server.storage, wallet.id, created.id);
+                should.exist(stored.prePublishRaw);
+                stored.outputs[0].toAddress = ATTACKER_ADDR;
+                await util_1.default.promisify(server.storage.storeTx).call(server.storage, wallet.id, stored);
+                let err;
+                try {
+                    await util_1.default.promisify(server.publishTx).call(server, publishOpts);
+                }
+                catch (e) {
+                    err = e;
+                }
+                should.exist(err);
+                err.message.should.contain('Invalid proposal signature');
+            });
+        });
     });
     describe('#prepareTx XRP (deferred nonce)', function () {
         const XRP_ADDR = 'rDzTZxa7NwD9vmNf5dvTbW4FQDNSRsfPv6';
@@ -8185,6 +8253,18 @@ describe('Wallet service', function () {
             });
             signed.status.should.equal('accepted');
         });
+        it('rejects prePublishRaw binding when an XRP destination was tampered', async function () {
+            const ATTACKER_XRP = 'rPT1Sjq2YGrBMTttX4GZHjKu9dyfzbpAYe';
+            const created = await helpers_1.default.createAndPublishTx(server, {
+                outputs: [{ toAddress: XRP_ADDR, amount: 8000 }],
+                feePerKb: 123e2, from: fromAddr, deferNonce: true
+            }, TestData.copayers[0].privKey_1H_0);
+            const txp = await util_1.default.promisify(server.getTx).call(server, { txProposalId: created.id });
+            should.exist(txp.prePublishRaw);
+            index_1.ChainService.isPrePublishRawBound(txp).should.equal(true);
+            txp.outputs[0].toAddress = ATTACKER_XRP;
+            index_1.ChainService.isPrePublishRawBound(txp).should.equal(false);
+        });
     });
     describe('#signTx nonce override', function () {
         const ETH_ADDR = '0x37d7B3bBD88EFdE6a93cF74D2F5b0385D3E3B08A';