@bitpay-labs/bitcore-wallet-service 11.10.6 → 11.10.8

package/package.json

@@ -2,7 +2,7 @@
   "name": "@bitpay-labs/bitcore-wallet-service",
   "description": "A service for Mutisig HD Bitcoin Wallets",
   "author": "BitPay Inc",
-  "version": "11.10.6",
+  "version": "11.10.8",
   "license": "MIT",
   "main": "ts_build/src/index.js",
   "types": "./ts_build/src/index.d.ts",
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@bitpay-labs/bitcore-logging": "^11.10.4",
-    "@bitpay-labs/bitcore-tss": "^11.10.4",
+    "@bitpay-labs/bitcore-tss": "^11.10.8",
     "@bitpay-labs/crypto-wallet-core": "^11.10.4",
     "@sendgrid/mail": "6.5.4",
     "abi-decoder": "2.4.0",
@@ -107,5 +107,5 @@
       "email": "kjoseph@bitpay.com"
     }
   ],
-  "gitHead": "68cba09ab40e3e91528cae682333303c08b3f565"
+  "gitHead": "c22ec6ab93ac3d455bfd76421509ecfa7b0aab1c"
 }

package/src/externalservices/coingecko.ts

@@ -36,8 +36,13 @@ type CoinGeckoRequest = Pick<Request, 'params' | 'query'>;
 
 const SUPPORTED_FIAT_CODES = new Set<string>(Defaults.FIAT_CURRENCIES.map(f => f.code));
 
-const ALLOWED_DAYS = new Set([1, 7, 30, 90, 365, 1825]);
-const DEFAULT_ALL_TIME_DAYS = 100000;
+const ALLOWED_NUMERIC_DAYS = new Set([1, 7, 30, 90, 365, 1825]);
+
+// CoinGecko's documented all-time value for `market_chart` is the literal string `max`
+const ALL_TIME_DAYS = 'max';
+
+type FiatRateNumericDays = 1 | 7 | 30 | 90 | 365 | 1825;
+type FiatRateDays = FiatRateNumericDays | typeof ALL_TIME_DAYS;
 
 const MAX_QUERY_PARAM_LENGTH = 64;
 const CHAIN_PARAM_PATTERN = /^[a-z0-9-_]+$/i;
@@ -122,6 +127,16 @@ function validateQueryParam(query: Record<string, unknown> | undefined, key: str
   }
 }
 
+function isAllowedNumericDays(value: number): value is FiatRateNumericDays {
+  return ALLOWED_NUMERIC_DAYS.has(value);
+}
+
+function parseFiatRateNumericDays(raw: string): FiatRateNumericDays {
+  const parsed = +raw;
+  if (!isAllowedNumericDays(parsed)) throw badRequest('Invalid days');
+  return parsed;
+}
+
 function parseCoinChainTokenAddress(
   query: Record<string, unknown> | undefined
 ): { coin?: string; chain?: string; tokenAddress?: string } {
@@ -320,12 +335,12 @@ export class CoinGeckoService {
     throw badRequest('Unsupported coin. For token symbols, pass `chain` and `tokenAddress`.');
   }
 
-  private async fetchFiatRatesForId(id: string, vsCurrency: string, days: number): Promise<FiatRatePoint[]> {
+  private async fetchFiatRatesForId(id: string, vsCurrency: string, days: FiatRateDays): Promise<FiatRatePoint[]> {
     const { API_KEY } = this.coinGeckoGetCredentials();
     const headers = this.coinGeckoGetHeaders(API_KEY);
 
-    const params: any = { vs_currency: vsCurrency, days };
-    if (days >= 90) params.interval = 'daily';
+    const params: Record<string, string | number | boolean | undefined> = { vs_currency: vsCurrency, days };
+    if (days === ALL_TIME_DAYS || days >= 90) params.interval = 'daily';
 
     const url = this.cgUrl(`/v3/coins/${encodeURIComponent(id)}/market_chart`, params);
     const body = await this.coinGeckoGetJson(url, headers);
@@ -341,7 +356,7 @@ export class CoinGeckoService {
   private async getFiatRatesForId(
     id: string,
     vsCurrency: string,
-    days: number,
+    days: FiatRateDays,
     useDbCache: boolean
   ): Promise<FiatRatePoint[]> {
     if (!useDbCache) return this.fetchFiatRatesForId(id, vsCurrency, days);
@@ -465,13 +480,12 @@ export class CoinGeckoService {
 
     const { coin: coinParam, chain: chainParam, tokenAddress: tokenAddressParam } = parseCoinChainTokenAddress(req.query);
 
-    let days = DEFAULT_ALL_TIME_DAYS;
+    // An omitted `days` means ALL-time history.
+    let days: FiatRateDays = ALL_TIME_DAYS;
     try {
       const daysParam = getQueryString(req.query, 'days');
       if (daysParam !== undefined) {
-        const parsed = +daysParam;
-        if (!ALLOWED_DAYS.has(parsed)) throw badRequest('Invalid days');
-        days = parsed;
+        days = parseFiatRateNumericDays(daysParam);
       }
     } catch {
       throw badRequest('Invalid days');

package/src/externalservices/moonpay.ts

@@ -218,14 +218,32 @@ export class MoonpayService {
     qs.push('baseCurrencyAmount=' + encodeURIComponent(req.body.baseCurrencyAmount));
     qs.push('externalTransactionId=' + encodeURIComponent(req.body.externalTransactionId));
     qs.push('redirectURL=' + encodeURIComponent(req.body.redirectURL));
+    if (req.body.defaultCurrencyCode) qs.push('defaultCurrencyCode=' + encodeURIComponent(req.body.defaultCurrencyCode));
+    if (req.body.walletAddressTag) qs.push('walletAddressTag=' + encodeURIComponent(req.body.walletAddressTag));
+    if (req.body.walletAddresses) qs.push('walletAddresses=' + encodeURIComponent(req.body.walletAddresses));
+    if (req.body.walletAddressTags) qs.push('walletAddressTags=' + encodeURIComponent(req.body.walletAddressTags));
     if (req.body.lockAmount) qs.push('lockAmount=' + encodeURIComponent(req.body.lockAmount));
     if (req.body.colorCode) qs.push('colorCode=' + encodeURIComponent(req.body.colorCode));
     if (req.body.theme) qs.push('theme=' + encodeURIComponent(req.body.theme));
+    if (req.body.themeId) qs.push('themeId=' + encodeURIComponent(req.body.themeId));
     if (req.body.language) qs.push('language=' + encodeURIComponent(req.body.language));
+    if (req.body.quoteCurrencyAmount) qs.push('quoteCurrencyAmount=' + encodeURIComponent(req.body.quoteCurrencyAmount));
+    if (req.body.email) qs.push('email=' + encodeURIComponent(req.body.email));
+    if (req.body.externalCustomerId) qs.push('externalCustomerId=' + encodeURIComponent(req.body.externalCustomerId));
     if (req.body.showWalletAddressForm)
       qs.push('showWalletAddressForm=' + encodeURIComponent(req.body.showWalletAddressForm));
     if (req.body.paymentMethod) qs.push('paymentMethod=' + encodeURIComponent(req.body.paymentMethod));
     if (req.body.areFeesIncluded) qs.push('areFeesIncluded=' + encodeURIComponent(req.body.areFeesIncluded));
+    if (req.body.showAllCurrencies) qs.push('showAllCurrencies=' + encodeURIComponent(req.body.showAllCurrencies));
+    if (req.body.showOnlyCurrencies) qs.push('showOnlyCurrencies=' + encodeURIComponent(req.body.showOnlyCurrencies));
+    if (req.body.unsupportedRegionRedirectUrl)
+      qs.push('unsupportedRegionRedirectUrl=' + encodeURIComponent(req.body.unsupportedRegionRedirectUrl));
+    if (req.body.skipUnsupportedRegionScreen)
+      qs.push('skipUnsupportedRegionScreen=' + encodeURIComponent(req.body.skipUnsupportedRegionScreen));
+
+    // Only supported for DeFi Buy integrations
+    if (req.body.contractAddress) qs.push('contractAddress=' + encodeURIComponent(req.body.contractAddress));
+    if (req.body.networkCode) qs.push('networkCode=' + encodeURIComponent(req.body.networkCode));
 
     // Web requests are proxied through the bitpay backend, so the IP on this
     // request belongs to that server, not the customer. The proxy captures the
@@ -286,16 +304,20 @@ export class MoonpayService {
     qs.push('externalTransactionId=' + encodeURIComponent(req.body.externalTransactionId));
     qs.push('redirectURL=' + encodeURIComponent(req.body.redirectURL));
 
+    if (req.body.defaultBaseCurrencyCode) qs.push('defaultBaseCurrencyCode=' + encodeURIComponent(req.body.defaultBaseCurrencyCode));
     if (req.body.quoteCurrencyCode) qs.push('quoteCurrencyCode=' + encodeURIComponent(req.body.quoteCurrencyCode));
+    if (req.body.quoteCurrencyAmount) qs.push('quoteCurrencyAmount=' + encodeURIComponent(req.body.quoteCurrencyAmount));
     if (req.body.paymentMethod) qs.push('paymentMethod=' + encodeURIComponent(req.body.paymentMethod));
     if (req.body.externalCustomerId) qs.push('externalCustomerId=' + encodeURIComponent(req.body.externalCustomerId));
     if (req.body.refundWalletAddress) qs.push('refundWalletAddress=' + encodeURIComponent(req.body.refundWalletAddress));
+    if (req.body.refundWalletAddresses) qs.push('refundWalletAddresses=' + encodeURIComponent(req.body.refundWalletAddresses));
     if (req.body.lockAmount) qs.push('lockAmount=' + encodeURIComponent(req.body.lockAmount));
     if (req.body.colorCode) qs.push('colorCode=' + encodeURIComponent(req.body.colorCode));
     if (req.body.theme) qs.push('theme=' + encodeURIComponent(req.body.theme));
+    if (req.body.themeId) qs.push('themeId=' + encodeURIComponent(req.body.themeId));
     if (req.body.language) qs.push('language=' + encodeURIComponent(req.body.language));
     if (req.body.email) qs.push('email=' + encodeURIComponent(req.body.email));
-    if (req.body.externalCustomerId) qs.push('externalCustomerId=' + encodeURIComponent(req.body.externalCustomerId));
+    if (req.body.showAllCurrencies) qs.push('showAllCurrencies=' + encodeURIComponent(req.body.showAllCurrencies));
     if (req.body.showWalletAddressForm)
       qs.push('showWalletAddressForm=' + encodeURIComponent(req.body.showWalletAddressForm));
     if (req.body.unsupportedRegionRedirectUrl) qs.push('unsupportedRegionRedirectUrl=' + encodeURIComponent(req.body.unsupportedRegionRedirectUrl));

package/src/externalservices/transak.ts

@@ -36,8 +36,27 @@ export class TransakService {
     return keys;
   }
 
+  // Web requests are proxied through the bitpay backend, so the IP on the
+  // request belongs to that server, not the customer. The proxy captures the
+  // customer's public IP and forwards it as deviceIp. Web credentials are only
+  // held by the proxy, so the forwarded value is trusted for that context only.
+  // Falls back to the request IP so web calls keep working until the proxy
+  // change that forwards deviceIp is deployed.
+  // Must be called before transakGetKeys, which strips context from the body.
+  private transakGetUserIp(req): string {
+    const isWebContext = req.body?.context === 'web';
+    let userIp = (isWebContext && req.body.deviceIp) || Utils.getIpFromReq(req);
+    if (userIp) {
+      // Canonicalize IPv4-mapped IPv6 (dual-stack sockets report IPv4 clients as
+      // ::ffff:1.2.3.4) so Transak sees a plain IPv4 address.
+      userIp = String(userIp).trim().replace(/^::ffff:/i, '');
+    }
+    return userIp || '';
+  }
+
   transakGetAccessToken(req): Promise<any> {
     return new Promise((resolve, reject) => {
+      const userIp = this.transakGetUserIp(req);
       let keys;
       try {
         keys = this.transakGetKeys(req);
@@ -52,7 +71,7 @@ export class TransakService {
         'Content-Type': 'application/json',
         'api-secret': SECRET_KEY,
         'x-api-key': API_KEY,
-        'x-user-ip': Utils.getIpFromReq(req),
+        'x-user-ip': userIp,
       };
 
       const body = {
@@ -220,6 +239,7 @@ export class TransakService {
 
       const requiredParams = req.body.context === 'web' ? ['accessToken'] : appRequiredParams;
       const referrerDomain = req.body.referrerDomain ?? req.body.context === 'web' ? 'bitpay.com' : 'bitpay';
+      const userIp = this.transakGetUserIp(req);
       let keys;
       try {
         keys = this.transakGetKeys(req, false);
@@ -238,12 +258,14 @@ export class TransakService {
         'Content-Type': 'application/json',
         'access-token': req.body.accessToken,
         'x-api-key': API_KEY,
-        'x-user-ip': Utils.getIpFromReq(req),
+        'x-user-ip': userIp,
       };
 
+      const widgetBody = { ...req.body };
+      delete widgetBody.deviceIp;
       const body = {
         widgetParams: {
-          ...req.body,
+          ...widgetBody,
           apiKey: API_KEY,
           referrerDomain,
         },

package/src/lib/chain/doge/index.ts

@@ -377,7 +377,7 @@ export class DogeChain extends BtcChain implements IChain {
         if (amount < Defaults.MIN_OUTPUT_AMOUNT) return cb(null, info);
 
         if (opts.returnInputs) {
-          info.inputs = _.shuffle(inputs);
+          info.inputs = _.shuffle(txp.inputs);
         }
 
         return cb(null, info);

package/src/lib/chain/eth/abi-invoice.ts

@@ -1,59 +1,12 @@
 export const InvoiceAbi = [
-  {
-    constant: true,
-    inputs: [],
-    name: 'owner',
-    outputs: [
-      {
-        name: '',
-        type: 'address'
-      }
-    ],
-    payable: false,
-    stateMutability: 'view',
-    type: 'function'
-  },
-  {
-    constant: true,
-    inputs: [],
-    name: 'quoteSigner',
-    outputs: [
-      {
-        name: '',
-        type: 'address'
-      }
-    ],
-    payable: false,
-    stateMutability: 'view',
-    type: 'function'
-  },
-  {
-    constant: true,
-    inputs: [
-      {
-        name: '',
-        type: 'bytes32'
-      }
-    ],
-    name: 'isPaid',
-    outputs: [
-      {
-        name: '',
-        type: 'bool'
-      }
-    ],
-    payable: false,
-    stateMutability: 'view',
-    type: 'function'
-  },
   {
     inputs: [
       {
+        internalType: 'address',
         name: 'valueSigner',
         type: 'address'
       }
     ],
-    payable: false,
     stateMutability: 'nonpayable',
     type: 'constructor'
   },
@@ -62,21 +15,25 @@ export const InvoiceAbi = [
     inputs: [
       {
         indexed: true,
+        internalType: 'bytes32',
         name: 'hash',
         type: 'bytes32'
       },
       {
         indexed: true,
+        internalType: 'address',
         name: 'tokenContract',
         type: 'address'
       },
       {
         indexed: false,
+        internalType: 'uint256',
         name: 'time',
         type: 'uint256'
       },
       {
         indexed: false,
+        internalType: 'uint256',
         name: 'value',
         type: 'uint256'
       }
@@ -85,41 +42,95 @@ export const InvoiceAbi = [
     type: 'event'
   },
   {
-    constant: true,
+    inputs: [],
+    name: 'activate',
+    outputs: [],
+    stateMutability: 'nonpayable',
+    type: 'function'
+  },
+  {
+    inputs: [],
+    name: 'deactivate',
+    outputs: [],
+    stateMutability: 'nonpayable',
+    type: 'function'
+  },
+  {
+    inputs: [],
+    name: 'deactivated',
+    outputs: [
+      {
+        internalType: 'bool',
+        name: '',
+        type: 'bool'
+      }
+    ],
+    stateMutability: 'view',
+    type: 'function'
+  },
+  {
+    inputs: [
+      {
+        internalType: 'bytes32',
+        name: '',
+        type: 'bytes32'
+      }
+    ],
+    name: 'isPaid',
+    outputs: [
+      {
+        internalType: 'bool',
+        name: '',
+        type: 'bool'
+      }
+    ],
+    stateMutability: 'view',
+    type: 'function'
+  },
+  {
     inputs: [
       {
+        internalType: 'uint256',
         name: 'value',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'gasPrice',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'expiration',
         type: 'uint256'
       },
       {
+        internalType: 'bytes32',
         name: 'payload',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 'hash',
         type: 'bytes32'
       },
       {
+        internalType: 'uint8',
         name: 'v',
         type: 'uint8'
       },
       {
+        internalType: 'bytes32',
         name: 'r',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 's',
         type: 'bytes32'
       },
       {
+        internalType: 'address',
         name: 'tokenContract',
         type: 'address'
       }
@@ -127,151 +138,189 @@ export const InvoiceAbi = [
     name: 'isValidPayment',
     outputs: [
       {
+        internalType: 'bool',
         name: 'valid',
         type: 'bool'
       }
     ],
-    payable: false,
     stateMutability: 'view',
     type: 'function'
   },
   {
-    constant: true,
+    inputs: [],
+    name: 'owner',
+    outputs: [
+      {
+        internalType: 'address',
+        name: '',
+        type: 'address'
+      }
+    ],
+    stateMutability: 'view',
+    type: 'function'
+  },
+  {
     inputs: [
       {
+        internalType: 'uint256',
         name: 'value',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'gasPrice',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'expiration',
         type: 'uint256'
       },
       {
+        internalType: 'bytes32',
         name: 'payload',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 'hash',
         type: 'bytes32'
       },
       {
+        internalType: 'uint8',
         name: 'v',
         type: 'uint8'
       },
       {
+        internalType: 'bytes32',
         name: 'r',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 's',
         type: 'bytes32'
       },
       {
+        internalType: 'address',
         name: 'tokenContract',
         type: 'address'
       }
     ],
-    name: 'validatePayment',
+    name: 'pay',
+    outputs: [],
+    stateMutability: 'payable',
+    type: 'function'
+  },
+  {
+    inputs: [],
+    name: 'quoteSigner',
     outputs: [
       {
-        name: 'valid',
-        type: 'bool'
+        internalType: 'address',
+        name: '',
+        type: 'address'
       }
     ],
-    payable: false,
     stateMutability: 'view',
     type: 'function'
   },
   {
-    constant: false,
     inputs: [
       {
+        internalType: 'address',
+        name: 'newAdmin',
+        type: 'address'
+      }
+    ],
+    name: 'setAdmin',
+    outputs: [],
+    stateMutability: 'nonpayable',
+    type: 'function'
+  },
+  {
+    inputs: [
+      {
+        internalType: 'address',
+        name: 'newQuoteSigner',
+        type: 'address'
+      }
+    ],
+    name: 'setSigner',
+    outputs: [],
+    stateMutability: 'nonpayable',
+    type: 'function'
+  },
+  {
+    inputs: [
+      {
+        internalType: 'uint256',
         name: 'value',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'gasPrice',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'expiration',
         type: 'uint256'
       },
       {
+        internalType: 'bytes32',
         name: 'payload',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 'hash',
         type: 'bytes32'
       },
       {
+        internalType: 'uint8',
         name: 'v',
         type: 'uint8'
       },
       {
+        internalType: 'bytes32',
         name: 'r',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 's',
         type: 'bytes32'
       },
       {
+        internalType: 'address',
         name: 'tokenContract',
         type: 'address'
       }
     ],
-    name: 'pay',
-    outputs: [],
-    payable: true,
-    stateMutability: 'payable',
-    type: 'function'
-  },
-  {
-    constant: false,
-    inputs: [
-      {
-        name: 'tokenContract',
-        type: 'address'
-      }
-    ],
-    name: 'withdraw',
-    outputs: [],
-    payable: false,
-    stateMutability: 'nonpayable',
-    type: 'function'
-  },
-  {
-    constant: false,
-    inputs: [
+    name: 'validatePayment',
+    outputs: [
       {
-        name: 'newQuoteSigner',
-        type: 'address'
+        internalType: 'bool',
+        name: 'valid',
+        type: 'bool'
       }
     ],
-    name: 'setSigner',
-    outputs: [],
-    payable: false,
-    stateMutability: 'nonpayable',
+    stateMutability: 'view',
     type: 'function'
   },
   {
-    constant: false,
     inputs: [
       {
-        name: 'newAdmin',
+        internalType: 'address',
+        name: 'tokenContract',
         type: 'address'
       }
     ],
-    name: 'setAdmin',
+    name: 'withdraw',
     outputs: [],
-    payable: false,
     stateMutability: 'nonpayable',
     type: 'function'
   }
-];
+] as const;

package/src/lib/common/constants.ts

@@ -226,6 +226,9 @@ export const Constants = {
 
   // May be different from the defaults if we rollback
   // or want to beta test new versions.
-  TSS_KEYGEN_SCHEME_VERSION_MAX: 1,
-  TSS_SIGGEN_SCHEME_VERSION_MAX: 1,
+  TSS_KEYGEN_SCHEME_VERSION_MAX: 1.1,
+  TSS_SIGGEN_SCHEME_VERSION_MAX: 1.1,
+  
+  TSS_KEYGEN_SCHEME_VERSION_MIN: 1,
+  TSS_SIGGEN_SCHEME_VERSION_MIN: 1,
 } as const;

package/src/lib/common/defaults.ts

@@ -434,6 +434,15 @@ export const Defaults = {
     { code: 'NZD', name: 'New Zealand Dollar' }
   ],
 
-  TSS_KEYGEN_SCHEME_VERSION: 1,
-  TSS_SIGGEN_SCHEME_VERSION: 1,
+  // In general, the major version represents server upgrades or major security upgrades, and the minor version represents client upgrades.
+  // Example1: If the server has an API response overhaul, that's a breaking change for older clients - it should increment the major version.
+  //           This will result in an UPGRADE_NEEDED error for older clients.
+  // Example2: If the client upgrades the encryption scheme, older clients will still be compatible with the server and
+  //           other older clients - it should increment the minor version. Mismatching client versions will still break the process, but
+  //           the difference from a major version bump is that matching older clients will still work.
+  TSS_KEYGEN_SCHEME_VERSION: 1.1,
+  TSS_SIGGEN_SCHEME_VERSION: 1.1,
+
+  TSS_KEYGEN_TIME_LIMIT: 20, // minutes
+  TSS_SIGGEN_TIME_LIMIT: 60 * 24, // minutes - 1 day (TODO tighten this up after testing)
 } as const;

package/src/lib/errors/errordefinitions.ts

@@ -76,6 +76,9 @@ interface Errors<T> {
   TSS_BWS_JOIN_SECRET_NOT_FOUND: T;
   TSS_NO_FINAL_SIGNATURE: T;
   TSS_INVALID_FINAL_SIGNATURE: T;
+  TSS_SESSION_EXPIRED: T;
+  TSS_MISMATCH_VERSION: T;
+  TSS_FINAL_SIGNATURE_MISMATCH: T;
 };
 
 const errors: Errors<string> = {
@@ -148,6 +151,9 @@ const errors: Errors<string> = {
   TSS_BWS_JOIN_SECRET_NOT_FOUND: 'BWS join secret not found',
   TSS_NO_FINAL_SIGNATURE: 'No signature provided',
   TSS_INVALID_FINAL_SIGNATURE: 'Invalid signature provided',
+  TSS_SESSION_EXPIRED: 'TSS session has expired',
+  TSS_MISMATCH_VERSION: 'TSS version does not match session version',
+  TSS_FINAL_SIGNATURE_MISMATCH: 'Final signature does not match the one generated by the session',
 };
 
 const errorsObject = { codes: {} };