@bitpay-labs/bitcore-wallet-service 11.10.11 → 11.10.13

package/src/lib/server.ts

@@ -3032,8 +3032,8 @@ export class WalletService implements IWalletService {
                     spenderAddress: txp.multiSendContractAddress
                   }, (err, allowance) => {
                     if (err) { return next(err); }
-                    if (BigInt(allowance) < BigInt(txp.getTotalAmount())) {
-                      return next(new Error(`Insufficient token allowance. Allowed: ${BigInt(allowance)}, Want: ${BigInt(txp.getTotalAmount())}`));
+                    if (BigInt(allowance) < txp.getTotalAmountBigInt()) {
+                      return next(new Error(`Insufficient token allowance. Allowed: ${BigInt(allowance)}, Want: ${txp.getTotalAmountBigInt()}`));
                     }
                     return next();
                   });
@@ -3108,6 +3108,9 @@ export class WalletService implements IWalletService {
           if (err) return cb(err);
           if (!txp) return cb(Errors.TX_NOT_FOUND);
           if (!txp.isTemporary() && !txp.hasMutableTxData()) return cb(null, txp);
+          // Broadcasted proposals should not be published again. Only temporary or pending proposals can be published.
+          if (txp.isBroadcasted()) return cb(Errors.TX_ALREADY_BROADCASTED);
+          if (!txp.isTemporary() && txp.status !== 'pending') return cb(Errors.TX_NOT_PENDING);
 
           const copayer = wallet.getCopayer(this.copayerId);
 
@@ -3120,8 +3123,12 @@ export class WalletService implements IWalletService {
 
           let signingKey = this._getSigningKey(raw, opts.proposalSignature, copayer.requestPubKeys);
           if (!signingKey) {
-            // If the txp has been published previously, we will verify the signature against the previously published raw tx
-            if (txp.hasMutableTxData() && txp.prePublishRaw) {
+            // The signature didn't match the current (refreshed) raw tx. Fall back to the previously-published
+            // raw tx -- but only if it is bound to THIS proposal (differs from the current tx solely in the
+            // field BWS mutates at publish: blockhash/nonce). Without that check a tampered stored proposal
+            // could reuse an old, still-valid proposalSignature over prePublishRaw. Mirrors the client
+            // Verifier.checkPrePublishRaw guard.
+            if (txp.hasMutableTxData() && txp.prePublishRaw && ChainService.isPrePublishRawBound(txp)) {
               raw = txp.prePublishRaw;
               signingKey = this._getSigningKey(raw, opts.proposalSignature, copayer.requestPubKeys);
             }

package/src/types/chain.d.ts

@@ -33,6 +33,7 @@ export interface IChain {
   checkScriptOutput(output: { script: string; amount: number });
   getFee(server: WalletService, wallet: IWallet, opts: { fee: number; feePerKb: number; signatures?: number } & any);
   getBitcoreTx(txp: TxProposal, opts: { signed: boolean });
+  isPrePublishRawBound(txp: TxProposal): boolean;
   convertFeePerKb(p: number, feePerKb: number);
   checkTx(server: WalletService, txp: ITxProposal);
   checkTxUTXOs(server: WalletService, txp: ITxProposal, opts: { noCashAddr: boolean } & any, cb);

package/src/types/expressapp.d.ts

@@ -13,4 +13,4 @@ export type ServerCallback = (server: WalletService, err?: Error) => void;
 export type GetServerWithAuthFn = (req: express.Request, res: express.Response, opts?: ServerOpts | ServerCallback, cb?: ServerCallback) => Promise<WalletService | void>;
 export type GetServerWithMultiAuthFn = (req: express.Request, res: express.Response, opts?: ServerOpts) => Array<Promise<WalletService | void>>;
 export type CreateWalletLimiterFn = (req: express.Request, res: express.Response, next: express.NextFunction) => void;
-export type CheckNumberFormatFn = (numberFormat: string | undefined, res: express.Response) => void;
+export type CheckNumberFormatFn = (numberFormat: string | undefined, res: express.Response) => boolean;

package/test/chain/btc.test.ts

@@ -15,6 +15,26 @@ const { Constants } = Common;
 const segWitToAddress = 'BC1QW508D6QEJXTDG4Y5R3ZARVARY0C5XW7KV8F3T4'; // 'bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq';
 
 describe('Chain BTC', function() { 
+  describe('#getEstimatedFee', function() {
+    const btcChain = ChainService.get('btc') as BtcChain;
+    const readyTxp = (satoshis, amounts) => ({
+      inputs: satoshis.map(s => ({ satoshis: s })),
+      outputs: amounts.map(amount => ({ amount })),
+      changeAddress: null,
+      feePerKb: 10000
+    });
+    const feeOf = txp => btcChain.getEstimatedFee(txp as any, { conservativeEstimation: false });
+
+    it('should derive the same fee from string and number amounts', function() {
+      const fromNumbers = feeOf(readyTxp([2000, 1000], [1000, 1000]));
+
+      fromNumbers.should.equal(1000);
+      feeOf(readyTxp([2000, 1000], ['1000', '1000'])).should.equal(fromNumbers);
+      feeOf(readyTxp(['2000', '1000'], [1000, 1000])).should.equal(fromNumbers);
+      feeOf(readyTxp(['2000', '1000'], ['1000', '1000'])).should.equal(fromNumbers);
+    });
+  });
+
   describe('#getBitcoreTx', function() {
     it('should create a valid bitcore TX', function() {
       const txp = TxProposal.fromObj(aTXP()) as TxProposal;
@@ -22,6 +42,18 @@ describe('Chain BTC', function() {
       should.exist(t);
     });
 
+    it('should build the same tx from string and number amounts without mutating the proposal', function() {
+      const asStrings: any = aTXP();
+      asStrings.outputs = asStrings.outputs.map(o => ({ ...o, amount: String(o.amount) }));
+      const fromStrings = TxProposal.fromObj(asStrings) as TxProposal;
+      const fromNumbers = TxProposal.fromObj(aTXP()) as TxProposal;
+
+      const built = ChainService.getBitcoreTx(fromStrings);
+
+      built.uncheckedSerialize().should.equal(ChainService.getBitcoreTx(fromNumbers).uncheckedSerialize());
+      fromStrings.outputs[0].amount.should.equal(String(aTXP().outputs[0].amount));
+    });
+
     it('should order outputs as specified by outputOrder', function() {
       const txp = TxProposal.fromObj(aTXP()) as TxProposal;
 

package/test/chain/eth.test.ts

@@ -2,6 +2,7 @@
 
 import * as chai from 'chai';
 import { ChainService } from '../../src/lib/chain';
+import { TxProposal } from '../../src/lib/model/txproposal';
 
 const should = chai.should();
 
@@ -17,5 +18,47 @@ describe('Chain ETH', function() {
     ChainService.addressFromStorageTransform('eth', 'dfg', x);
     x.address.should.equal('0x01');
   });
+
+  describe('#selectTxInputs', function() {
+    it('should reject a total that a number rounds down to the balance', function(done) {
+      const server = {
+        getBalance: (_opts, cb) => cb(null, { totalAmount: 9007199254740992, availableAmount: 9007199254740992 })
+      };
+      const txp = TxProposal.fromObj({
+        ...aTXP(),
+        outputs: [
+          { ...aTXP().outputs[0], amount: '9007199254740992' },
+          { ...aTXP().outputs[0], amount: '1' }
+        ]
+      } as any);
+
+      ChainService.get('eth').selectTxInputs(server as any, txp, {} as any, {}, err => {
+        should.exist(err);
+        err.code.should.equal('INSUFFICIENT_FUNDS');
+        done();
+      });
+    });
+  });
 });
 
+const aTXP = function() {
+  return {
+    version: 3,
+    createdOn: 1423146231,
+    id: '75c34f49-1ed6-255f-e9fd-0c71ae75ed1e',
+    walletId: '1',
+    creatorId: '1',
+    coin: 'eth',
+    chain: 'eth',
+    network: 'livenet',
+    from: '0x9858EfFD232B4033E47d90003D41EC34EcaEda94',
+    nonce: 5,
+    gasPrice: 25000000000,
+    gasLimit: 60000,
+    fee: 1500000000000000,
+    outputs: [{ toAddress: '0xc27eD3DF0DE776246cdAD5a052A9982473FceaB8', amount: 1000, gasLimit: 60000 }],
+    status: 'pending' as const,
+    actions: []
+  };
+};
+

package/test/chain/sol.test.ts

@@ -0,0 +1,229 @@
+'use strict';
+
+import * as chai from 'chai';
+import sinon from 'sinon';
+import { ChainService } from '../../src/lib/chain';
+import { Defaults } from '../../src/lib/common/defaults';
+import { ClientError } from '../../src/lib/errors/clienterror';
+import { TxProposal } from '../../src/lib/model/txproposal';
+
+const should = chai.should();
+
+describe('Chain SOL', function() {
+  describe('#getWalletBalance', function() {
+    const cases = [
+      { name: 'pending amounts and fees', amount: 1000000000, txps: [{ amount: '2000000000', fee: '5000' }], reserve: 1002240, locked: 2001007240, available: -1001007240 },
+      { name: 'dust below rent', amount: 10000, txps: [], reserve: 1002240, locked: 1002240, available: -992240 },
+      { name: 'an empty account with a pending proposal', amount: 0, txps: [{ amount: '2000000000', fee: '5000' }], reserve: 0, locked: 2000005000, available: -2000005000 },
+      { name: 'an SPL balance', amount: 1000000, txps: [{ tokenAddress: 'mint', amount: '500000', fee: '5000' }], tokenAddress: 'mint', reserve: 0, locked: 500000, available: 500000 }
+    ];
+
+    for (const c of cases) {
+      it('should expose the reserve separately for ' + c.name, function(done) {
+        const server = {
+          walletId: '1',
+          _getBlockchainExplorer: () => ({
+            getBalance: (_wallet, cb) => cb(null, { balance: c.amount, confirmed: c.amount }),
+            getRentMinimum: (_space, cb) => cb(null, Defaults.MIN_SOL_BALANCE)
+          }),
+          getPendingTxs: (_opts, cb) => cb(null, c.txps),
+          storage: { fetchAddresses: (_walletId, cb) => cb(null, []) }
+        };
+        const wallet = { chain: 'sol', network: 'livenet' };
+
+        ChainService.get('sol').getWalletBalance(server as any, wallet as any, { tokenAddress: (c as { tokenAddress?: string }).tokenAddress }, (err, balance) => {
+          should.not.exist(err);
+          balance.should.deep.equal({
+            totalAmount: c.amount,
+            totalConfirmedAmount: c.amount,
+            lockedAmount: c.locked,
+            lockedConfirmedAmount: c.locked,
+            reserve: c.reserve,
+            availableAmount: c.available,
+            availableConfirmedAmount: c.available,
+            byAddress: []
+          });
+          done();
+        });
+      });
+    }
+  });
+
+  describe('#getFee', function() {
+    const sol = ChainService.get('sol');
+    const getFee = async opts => (await sol.getFee(null, null, opts)).fee;
+    const outputs = n => Array.from({ length: n }, () => ({ toAddress: 'addr', amount: 1 }));
+
+    it('should be the signature fee when no priority fee is set', async function() {
+      (await getFee({ outputs: outputs(1) })).should.equal(5000);
+      (await getFee({ outputs: outputs(1), numSignatures: 2 })).should.equal(10000);
+      (await getFee({ outputs: outputs(1), computeUnits: 300000 })).should.equal(5000);
+    });
+
+    it('should add the priority fee for the given compute unit limit', async function() {
+      // 50,000 micro-lamports/CU * 300,000 CU = 15,000 lamports
+      (await getFee({ outputs: outputs(1), priorityFee: 50000, computeUnits: 300000 })).should.equal(5000 + 15000);
+    });
+
+    it('should round the priority fee up to a whole lamport', async function() {
+      // 1,001 micro-lamports/CU * 1,000 CU = 1,001,000 micro-lamports = 1.001 lamports
+      (await getFee({ outputs: outputs(1), priorityFee: 1001, computeUnits: 1000 })).should.equal(5000 + 2);
+    });
+
+    it('should raise the priority fee to the minimum CWC applies', async function() {
+      // 1 micro-lamport/CU is raised to 1,000; 1,000 * 200,000 CU = 200 lamports
+      (await getFee({ outputs: outputs(1), priorityFee: 1, computeUnits: 200000 })).should.equal(5000 + 200);
+    });
+
+    it('should use the default compute unit limit per instruction without computeUnits', async function() {
+      // 200,000 CU per transfer instruction
+      (await getFee({ outputs: outputs(1), priorityFee: 10000 })).should.equal(5000 + 2000);
+      (await getFee({ outputs: outputs(3), priorityFee: 10000 })).should.equal(5000 + 6000);
+      // the memo is one more instruction
+      (await getFee({ outputs: outputs(1), memo: 'refund', priorityFee: 10000 })).should.equal(5000 + 4000);
+    });
+
+    it('should cap the default compute unit limit at the per-transaction maximum', async function() {
+      // 12 transfers would be 2.4M CU, capped at 1.4M
+      (await getFee({ outputs: outputs(12), priorityFee: 10000 })).should.equal(5000 + 14000);
+    });
+  });
+
+  describe('#selectTxInputs', function() {
+    const sol = ChainService.get('sol');
+    const wallet = { chain: 'sol', network: 'livenet' };
+    const fee = 5000;
+    let checkTxCalled;
+
+    beforeEach(function() {
+      checkTxCalled = false;
+      sinon.stub(sol, 'checkTx').callsFake(() => {
+        checkTxCalled = true;
+        return null;
+      });
+    });
+
+    afterEach(function() {
+      sinon.restore();
+    });
+
+    it('should reject a total that a number rounds down to the balance', function(done) {
+      const balance = 9007199254740992 + Defaults.MIN_SOL_BALANCE;
+      const server = {
+        getBalance: (_opts, cb) => cb(null, { totalAmount: balance, availableAmount: balance })
+      };
+      const txp = TxProposal.fromObj({
+        version: 3,
+        id: '75c34f49-1ed6-255f-e9fd-0c71ae75ed1e',
+        walletId: '1',
+        creatorId: '1',
+        coin: 'sol',
+        chain: 'sol',
+        network: 'livenet',
+        from: '8WyoNvKsmfdG6zrbzNBVN8DETyLra3ond61saU9C52YR',
+        fee: 5000,
+        status: 'pending',
+        actions: [],
+        outputs: [
+          { toAddress: 'F7FknkRckx4yvA3Gexnx1H3nwPxndMxVt58BwAzEQhcY', amount: '9007199254740992' },
+          { toAddress: 'F7FknkRckx4yvA3Gexnx1H3nwPxndMxVt58BwAzEQhcY', amount: '1' }
+        ]
+      } as any);
+
+      ChainService.get('sol').selectTxInputs(server as any, txp, {} as any, {}, err => {
+        should.exist(err);
+        err.code.should.equal('INSUFFICIENT_FUNDS');
+        done();
+      });
+    });
+
+    // Token balance is returned when tokenAddress is passed, native SOL balance otherwise
+    const makeServer = ({ native, token }: { native: any; token?: any }) => ({
+      getBalance: (opts, cb) => cb(null, opts.tokenAddress ? token : native)
+    });
+    const balance = (total, available) => ({ totalAmount: total, availableAmount: available });
+    const makeTxp = amount => ({ fee, getTotalAmount: () => amount, getTotalAmountBigInt: () => BigInt(amount) });
+
+    describe('SPL token', function() {
+      const opts = { tokenAddress: 'mint' };
+
+      it('should fail with INSUFFICIENT_SOL_FEE if the wallet has no SOL for the fee', function(done) {
+        const server = makeServer({ token: balance(1e6, 1e6), native: balance(0, 0) });
+        sol.selectTxInputs(server as any, makeTxp(5e5) as any, wallet as any, opts, err => {
+          should.exist(err);
+          err.should.be.instanceof(ClientError);
+          err.code.should.equal('INSUFFICIENT_SOL_FEE');
+          err.message.should.equal('Your linked SOL wallet does not have enough SOL for fee. RequiredFee: 5000');
+          err.messageData.should.deep.equal({ requiredFee: fee });
+          checkTxCalled.should.equal(false);
+          done();
+        });
+      });
+
+      it('should fail with LOCKED_SOL_FEE if the SOL for the fee is locked', function(done) {
+        const server = makeServer({ token: balance(1e6, 1e6), native: balance(1e7, 1000) });
+        sol.selectTxInputs(server as any, makeTxp(5e5) as any, wallet as any, opts, err => {
+          should.exist(err);
+          err.should.be.instanceof(ClientError);
+          err.code.should.equal('LOCKED_SOL_FEE');
+          err.messageData.should.deep.equal({ requiredFee: fee });
+          checkTxCalled.should.equal(false);
+          done();
+        });
+      });
+
+      it('should still fail with INSUFFICIENT_FUNDS when the token balance is short', function(done) {
+        const server = makeServer({ token: balance(1e5, 1e5), native: balance(1e9, 1e9) });
+        sol.selectTxInputs(server as any, makeTxp(5e5) as any, wallet as any, opts, err => {
+          should.exist(err);
+          err.code.should.equal('INSUFFICIENT_FUNDS');
+          done();
+        });
+      });
+
+      it('should pass when both the token and the SOL fee are covered', function(done) {
+        const server = makeServer({ token: balance(1e6, 1e6), native: balance(1e9, 1e9) });
+        sol.selectTxInputs(server as any, makeTxp(5e5) as any, wallet as any, opts, err => {
+          should.not.exist(err);
+          checkTxCalled.should.equal(true);
+          done();
+        });
+      });
+    });
+
+    describe('native SOL', function() {
+      it('should fail with INSUFFICIENT_FUNDS_FOR_FEE if the amount fits but the fee does not', function(done) {
+        const amount = 1e9;
+        const server = makeServer({ native: balance(amount + Defaults.MIN_SOL_BALANCE, amount) });
+        sol.selectTxInputs(server as any, makeTxp(amount) as any, wallet as any, {}, err => {
+          should.exist(err);
+          err.should.be.instanceof(ClientError);
+          err.code.should.equal('INSUFFICIENT_FUNDS_FOR_FEE');
+          err.message.should.equal('Insufficient funds for fee. RequiredFee: 5000');
+          err.messageData.should.deep.equal({ requiredFee: fee });
+          checkTxCalled.should.equal(false);
+          done();
+        });
+      });
+
+      it('should still fail with INSUFFICIENT_FUNDS when the amount does not fit', function(done) {
+        const server = makeServer({ native: balance(1e9, 1e9) });
+        sol.selectTxInputs(server as any, makeTxp(2e9) as any, wallet as any, {}, err => {
+          should.exist(err);
+          err.code.should.equal('INSUFFICIENT_FUNDS');
+          done();
+        });
+      });
+
+      it('should pass when the amount and fee are covered', function(done) {
+        const amount = 1e9;
+        const server = makeServer({ native: balance(2e9, amount + fee) });
+        sol.selectTxInputs(server as any, makeTxp(amount) as any, wallet as any, {}, err => {
+          should.not.exist(err);
+          checkTxCalled.should.equal(true);
+          done();
+        });
+      });
+    });
+  });
+});

package/test/chain/xrp.test.ts

@@ -4,12 +4,43 @@ import * as chai from 'chai';
 import 'chai/register-should';
 import { ChainService } from '../../src/lib/chain';
 import { ITxProposal, TxProposal } from '../../src/lib/model/txproposal';
+import { Defaults } from '../../src/lib/common/defaults';
 
 const should = chai.should();
 
 const xpub = 'tpubDD7tYYerLNNm65Ez7pRjxQ2NpRHDoyRWoLWudnQ8agXjr7qs9BsPsRXk8Z6spPPJodnaY158YqeCKT5oXuZvbuNLfm1R4kXGJ2vPd9pUxDT';
 
 describe('Chain XRP', function() { 
+  describe('#getWalletBalance', function() {
+    it('should expose the reserve separately from pending amounts and fees', function(done) {
+      const server = {
+        walletId: '1',
+        _getBlockchainExplorer: () => ({
+          getBalance: (_wallet, cb) => cb(null, { balance: 2000000, confirmed: 2000000 }),
+          getReserve: cb => cb(null, 1000000)
+        }),
+        getPendingTxs: (_opts, cb) => cb(null, [{ amount: '3000000', fee: '12' }]),
+        storage: { fetchAddresses: (_walletId, cb) => cb(null, []) }
+      };
+      const wallet = { chain: 'xrp', network: 'livenet' };
+
+      ChainService.get('xrp').getWalletBalance(server as any, wallet as any, {}, (err, balance) => {
+        should.not.exist(err);
+        balance.should.deep.equal({
+          totalAmount: 2000000,
+          totalConfirmedAmount: 2000000,
+          lockedAmount: 4000012,
+          lockedConfirmedAmount: 4000012,
+          reserve: 1000000,
+          availableAmount: -2000012,
+          availableConfirmedAmount: -2000012,
+          byAddress: []
+        });
+        done();
+      });
+    });
+  });
+
   describe('#getWalletSendMaxInfo', function() {
     it('should resolve fee level before calculating sendMax amount', function(done) {
       const server = {
@@ -31,6 +62,26 @@ describe('Chain XRP', function() {
     });
   });
 
+  describe('#selectTxInputs', function() {
+    const balanceOf = amount => ({
+      getBalance: (_opts, cb) => cb(null, { totalAmount: amount, availableAmount: amount })
+    });
+    const txpOf = amounts => TxProposal.fromObj({
+      ...aTXP(),
+      outputs: amounts.map(amount => ({ ...aTXP().outputs[0], amount }))
+    } as any);
+
+    it('should reject a total that a number rounds down to the balance', function(done) {
+      const balance = 9007199254740992 + Defaults.MIN_XRP_BALANCE;
+
+      ChainService.get('xrp').selectTxInputs(balanceOf(balance) as any, txpOf(['9007199254740992', '1']), {} as any, {}, err => {
+        should.exist(err);
+        err.code.should.equal('INSUFFICIENT_FUNDS');
+        done();
+      });
+    });
+  });
+
   describe('#getBitcoreTx', function() {
     it('should create a valid bitcore TX', function() {
       const txp = TxProposal.fromObj(aTXP()) as TxProposal;

package/test/integration/externalservices/moonpay.test.ts

@@ -723,6 +723,35 @@ describe('Moonpay integration', () => {
       await server.externalServices.moonpay.moonpayRevokeActiveSession(req);
     });
 
+    it('should return the response body if there is one', async () => {
+      const data = await server.externalServices.moonpay.moonpayRevokeActiveSession(req);
+      data.should.equal('data');
+    });
+
+    it('should return success true without leaking the response if there is no body', async () => {
+      const fakeRequest2 = {
+        delete: (_url, opts, _cb) => {
+          return _cb(null, { statusCode: 204, body: undefined, headers: {}, request: { headers: opts.headers } });
+        },
+      };
+
+      server.externalServices.moonpay.request = fakeRequest2;
+      const data = await server.externalServices.moonpay.moonpayRevokeActiveSession(req);
+      data.should.deep.equal({ success: true });
+    });
+
+    it('should return success false if there is no body and status is not 2xx', async () => {
+      const fakeRequest2 = {
+        delete: (_url, opts, _cb) => {
+          return _cb(null, { statusCode: 404, body: '', headers: {}, request: { headers: opts.headers } });
+        },
+      };
+
+      server.externalServices.moonpay.request = fakeRequest2;
+      const data = await server.externalServices.moonpay.moonpayRevokeActiveSession(req);
+      data.should.deep.equal({ success: false });
+    });
+
     it('should return error if delete returns error', async () => {
       const fakeRequest2 = {
         delete: (_url, _opts, _cb) => { return _cb(new Error('Error'), null); },

package/test/integration/externalservices/simplex.test.ts

@@ -503,22 +503,4 @@ describe('Simplex integration', () => {
       }
     });
   });
-
-  describe('#simplexGetEvents', () => {
-    beforeEach(() => {
-      req = {
-        env: 'production'
-      };
-
-      fakeRequest = {
-        get: (_url, _opts, _cb) => { return _cb(null, { body: {} }); },
-      };
-      server.externalServices.simplex.request = fakeRequest;
-    });
-
-    it('should work properly if req is OK', async () => {
-      const data = await server.externalServices.simplex.simplexGetEvents(req);
-      should.exist(data);
-    });
-  });
 });