@bitpay-labs/bitcore-wallet-service 11.10.7 → 11.10.8

package/package.json

@@ -2,7 +2,7 @@
   "name": "@bitpay-labs/bitcore-wallet-service",
   "description": "A service for Mutisig HD Bitcoin Wallets",
   "author": "BitPay Inc",
-  "version": "11.10.7",
+  "version": "11.10.8",
   "license": "MIT",
   "main": "ts_build/src/index.js",
   "types": "./ts_build/src/index.d.ts",
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@bitpay-labs/bitcore-logging": "^11.10.4",
-    "@bitpay-labs/bitcore-tss": "^11.10.4",
+    "@bitpay-labs/bitcore-tss": "^11.10.8",
     "@bitpay-labs/crypto-wallet-core": "^11.10.4",
     "@sendgrid/mail": "6.5.4",
     "abi-decoder": "2.4.0",
@@ -107,5 +107,5 @@
       "email": "kjoseph@bitpay.com"
     }
   ],
-  "gitHead": "4bf49d22f9ff24d3811ce24edeb7a5d4c6a1a2cf"
+  "gitHead": "c22ec6ab93ac3d455bfd76421509ecfa7b0aab1c"
 }

package/src/externalservices/coingecko.ts

@@ -36,8 +36,13 @@ type CoinGeckoRequest = Pick<Request, 'params' | 'query'>;
 
 const SUPPORTED_FIAT_CODES = new Set<string>(Defaults.FIAT_CURRENCIES.map(f => f.code));
 
-const ALLOWED_DAYS = new Set([1, 7, 30, 90, 365, 1825]);
-const DEFAULT_ALL_TIME_DAYS = 100000;
+const ALLOWED_NUMERIC_DAYS = new Set([1, 7, 30, 90, 365, 1825]);
+
+// CoinGecko's documented all-time value for `market_chart` is the literal string `max`
+const ALL_TIME_DAYS = 'max';
+
+type FiatRateNumericDays = 1 | 7 | 30 | 90 | 365 | 1825;
+type FiatRateDays = FiatRateNumericDays | typeof ALL_TIME_DAYS;
 
 const MAX_QUERY_PARAM_LENGTH = 64;
 const CHAIN_PARAM_PATTERN = /^[a-z0-9-_]+$/i;
@@ -122,6 +127,16 @@ function validateQueryParam(query: Record<string, unknown> | undefined, key: str
   }
 }
 
+function isAllowedNumericDays(value: number): value is FiatRateNumericDays {
+  return ALLOWED_NUMERIC_DAYS.has(value);
+}
+
+function parseFiatRateNumericDays(raw: string): FiatRateNumericDays {
+  const parsed = +raw;
+  if (!isAllowedNumericDays(parsed)) throw badRequest('Invalid days');
+  return parsed;
+}
+
 function parseCoinChainTokenAddress(
   query: Record<string, unknown> | undefined
 ): { coin?: string; chain?: string; tokenAddress?: string } {
@@ -320,12 +335,12 @@ export class CoinGeckoService {
     throw badRequest('Unsupported coin. For token symbols, pass `chain` and `tokenAddress`.');
   }
 
-  private async fetchFiatRatesForId(id: string, vsCurrency: string, days: number): Promise<FiatRatePoint[]> {
+  private async fetchFiatRatesForId(id: string, vsCurrency: string, days: FiatRateDays): Promise<FiatRatePoint[]> {
     const { API_KEY } = this.coinGeckoGetCredentials();
     const headers = this.coinGeckoGetHeaders(API_KEY);
 
-    const params: any = { vs_currency: vsCurrency, days };
-    if (days >= 90) params.interval = 'daily';
+    const params: Record<string, string | number | boolean | undefined> = { vs_currency: vsCurrency, days };
+    if (days === ALL_TIME_DAYS || days >= 90) params.interval = 'daily';
 
     const url = this.cgUrl(`/v3/coins/${encodeURIComponent(id)}/market_chart`, params);
     const body = await this.coinGeckoGetJson(url, headers);
@@ -341,7 +356,7 @@ export class CoinGeckoService {
   private async getFiatRatesForId(
     id: string,
     vsCurrency: string,
-    days: number,
+    days: FiatRateDays,
     useDbCache: boolean
   ): Promise<FiatRatePoint[]> {
     if (!useDbCache) return this.fetchFiatRatesForId(id, vsCurrency, days);
@@ -465,13 +480,12 @@ export class CoinGeckoService {
 
     const { coin: coinParam, chain: chainParam, tokenAddress: tokenAddressParam } = parseCoinChainTokenAddress(req.query);
 
-    let days = DEFAULT_ALL_TIME_DAYS;
+    // An omitted `days` means ALL-time history.
+    let days: FiatRateDays = ALL_TIME_DAYS;
     try {
       const daysParam = getQueryString(req.query, 'days');
       if (daysParam !== undefined) {
-        const parsed = +daysParam;
-        if (!ALLOWED_DAYS.has(parsed)) throw badRequest('Invalid days');
-        days = parsed;
+        days = parseFiatRateNumericDays(daysParam);
       }
     } catch {
       throw badRequest('Invalid days');

package/src/externalservices/moonpay.ts

@@ -218,14 +218,32 @@ export class MoonpayService {
     qs.push('baseCurrencyAmount=' + encodeURIComponent(req.body.baseCurrencyAmount));
     qs.push('externalTransactionId=' + encodeURIComponent(req.body.externalTransactionId));
     qs.push('redirectURL=' + encodeURIComponent(req.body.redirectURL));
+    if (req.body.defaultCurrencyCode) qs.push('defaultCurrencyCode=' + encodeURIComponent(req.body.defaultCurrencyCode));
+    if (req.body.walletAddressTag) qs.push('walletAddressTag=' + encodeURIComponent(req.body.walletAddressTag));
+    if (req.body.walletAddresses) qs.push('walletAddresses=' + encodeURIComponent(req.body.walletAddresses));
+    if (req.body.walletAddressTags) qs.push('walletAddressTags=' + encodeURIComponent(req.body.walletAddressTags));
     if (req.body.lockAmount) qs.push('lockAmount=' + encodeURIComponent(req.body.lockAmount));
     if (req.body.colorCode) qs.push('colorCode=' + encodeURIComponent(req.body.colorCode));
     if (req.body.theme) qs.push('theme=' + encodeURIComponent(req.body.theme));
+    if (req.body.themeId) qs.push('themeId=' + encodeURIComponent(req.body.themeId));
     if (req.body.language) qs.push('language=' + encodeURIComponent(req.body.language));
+    if (req.body.quoteCurrencyAmount) qs.push('quoteCurrencyAmount=' + encodeURIComponent(req.body.quoteCurrencyAmount));
+    if (req.body.email) qs.push('email=' + encodeURIComponent(req.body.email));
+    if (req.body.externalCustomerId) qs.push('externalCustomerId=' + encodeURIComponent(req.body.externalCustomerId));
     if (req.body.showWalletAddressForm)
       qs.push('showWalletAddressForm=' + encodeURIComponent(req.body.showWalletAddressForm));
     if (req.body.paymentMethod) qs.push('paymentMethod=' + encodeURIComponent(req.body.paymentMethod));
     if (req.body.areFeesIncluded) qs.push('areFeesIncluded=' + encodeURIComponent(req.body.areFeesIncluded));
+    if (req.body.showAllCurrencies) qs.push('showAllCurrencies=' + encodeURIComponent(req.body.showAllCurrencies));
+    if (req.body.showOnlyCurrencies) qs.push('showOnlyCurrencies=' + encodeURIComponent(req.body.showOnlyCurrencies));
+    if (req.body.unsupportedRegionRedirectUrl)
+      qs.push('unsupportedRegionRedirectUrl=' + encodeURIComponent(req.body.unsupportedRegionRedirectUrl));
+    if (req.body.skipUnsupportedRegionScreen)
+      qs.push('skipUnsupportedRegionScreen=' + encodeURIComponent(req.body.skipUnsupportedRegionScreen));
+
+    // Only supported for DeFi Buy integrations
+    if (req.body.contractAddress) qs.push('contractAddress=' + encodeURIComponent(req.body.contractAddress));
+    if (req.body.networkCode) qs.push('networkCode=' + encodeURIComponent(req.body.networkCode));
 
     // Web requests are proxied through the bitpay backend, so the IP on this
     // request belongs to that server, not the customer. The proxy captures the
@@ -286,16 +304,20 @@ export class MoonpayService {
     qs.push('externalTransactionId=' + encodeURIComponent(req.body.externalTransactionId));
     qs.push('redirectURL=' + encodeURIComponent(req.body.redirectURL));
 
+    if (req.body.defaultBaseCurrencyCode) qs.push('defaultBaseCurrencyCode=' + encodeURIComponent(req.body.defaultBaseCurrencyCode));
     if (req.body.quoteCurrencyCode) qs.push('quoteCurrencyCode=' + encodeURIComponent(req.body.quoteCurrencyCode));
+    if (req.body.quoteCurrencyAmount) qs.push('quoteCurrencyAmount=' + encodeURIComponent(req.body.quoteCurrencyAmount));
     if (req.body.paymentMethod) qs.push('paymentMethod=' + encodeURIComponent(req.body.paymentMethod));
     if (req.body.externalCustomerId) qs.push('externalCustomerId=' + encodeURIComponent(req.body.externalCustomerId));
     if (req.body.refundWalletAddress) qs.push('refundWalletAddress=' + encodeURIComponent(req.body.refundWalletAddress));
+    if (req.body.refundWalletAddresses) qs.push('refundWalletAddresses=' + encodeURIComponent(req.body.refundWalletAddresses));
     if (req.body.lockAmount) qs.push('lockAmount=' + encodeURIComponent(req.body.lockAmount));
     if (req.body.colorCode) qs.push('colorCode=' + encodeURIComponent(req.body.colorCode));
     if (req.body.theme) qs.push('theme=' + encodeURIComponent(req.body.theme));
+    if (req.body.themeId) qs.push('themeId=' + encodeURIComponent(req.body.themeId));
     if (req.body.language) qs.push('language=' + encodeURIComponent(req.body.language));
     if (req.body.email) qs.push('email=' + encodeURIComponent(req.body.email));
-    if (req.body.externalCustomerId) qs.push('externalCustomerId=' + encodeURIComponent(req.body.externalCustomerId));
+    if (req.body.showAllCurrencies) qs.push('showAllCurrencies=' + encodeURIComponent(req.body.showAllCurrencies));
     if (req.body.showWalletAddressForm)
       qs.push('showWalletAddressForm=' + encodeURIComponent(req.body.showWalletAddressForm));
     if (req.body.unsupportedRegionRedirectUrl) qs.push('unsupportedRegionRedirectUrl=' + encodeURIComponent(req.body.unsupportedRegionRedirectUrl));

package/src/lib/chain/eth/abi-invoice.ts

@@ -1,59 +1,12 @@
 export const InvoiceAbi = [
-  {
-    constant: true,
-    inputs: [],
-    name: 'owner',
-    outputs: [
-      {
-        name: '',
-        type: 'address'
-      }
-    ],
-    payable: false,
-    stateMutability: 'view',
-    type: 'function'
-  },
-  {
-    constant: true,
-    inputs: [],
-    name: 'quoteSigner',
-    outputs: [
-      {
-        name: '',
-        type: 'address'
-      }
-    ],
-    payable: false,
-    stateMutability: 'view',
-    type: 'function'
-  },
-  {
-    constant: true,
-    inputs: [
-      {
-        name: '',
-        type: 'bytes32'
-      }
-    ],
-    name: 'isPaid',
-    outputs: [
-      {
-        name: '',
-        type: 'bool'
-      }
-    ],
-    payable: false,
-    stateMutability: 'view',
-    type: 'function'
-  },
   {
     inputs: [
       {
+        internalType: 'address',
         name: 'valueSigner',
         type: 'address'
       }
     ],
-    payable: false,
     stateMutability: 'nonpayable',
     type: 'constructor'
   },
@@ -62,21 +15,25 @@ export const InvoiceAbi = [
     inputs: [
       {
         indexed: true,
+        internalType: 'bytes32',
         name: 'hash',
         type: 'bytes32'
       },
       {
         indexed: true,
+        internalType: 'address',
         name: 'tokenContract',
         type: 'address'
       },
       {
         indexed: false,
+        internalType: 'uint256',
         name: 'time',
         type: 'uint256'
       },
       {
         indexed: false,
+        internalType: 'uint256',
         name: 'value',
         type: 'uint256'
       }
@@ -85,41 +42,95 @@ export const InvoiceAbi = [
     type: 'event'
   },
   {
-    constant: true,
+    inputs: [],
+    name: 'activate',
+    outputs: [],
+    stateMutability: 'nonpayable',
+    type: 'function'
+  },
+  {
+    inputs: [],
+    name: 'deactivate',
+    outputs: [],
+    stateMutability: 'nonpayable',
+    type: 'function'
+  },
+  {
+    inputs: [],
+    name: 'deactivated',
+    outputs: [
+      {
+        internalType: 'bool',
+        name: '',
+        type: 'bool'
+      }
+    ],
+    stateMutability: 'view',
+    type: 'function'
+  },
+  {
+    inputs: [
+      {
+        internalType: 'bytes32',
+        name: '',
+        type: 'bytes32'
+      }
+    ],
+    name: 'isPaid',
+    outputs: [
+      {
+        internalType: 'bool',
+        name: '',
+        type: 'bool'
+      }
+    ],
+    stateMutability: 'view',
+    type: 'function'
+  },
+  {
     inputs: [
       {
+        internalType: 'uint256',
         name: 'value',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'gasPrice',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'expiration',
         type: 'uint256'
       },
       {
+        internalType: 'bytes32',
         name: 'payload',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 'hash',
         type: 'bytes32'
       },
       {
+        internalType: 'uint8',
         name: 'v',
         type: 'uint8'
       },
       {
+        internalType: 'bytes32',
         name: 'r',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 's',
         type: 'bytes32'
       },
       {
+        internalType: 'address',
         name: 'tokenContract',
         type: 'address'
       }
@@ -127,151 +138,189 @@ export const InvoiceAbi = [
     name: 'isValidPayment',
     outputs: [
       {
+        internalType: 'bool',
         name: 'valid',
         type: 'bool'
       }
     ],
-    payable: false,
     stateMutability: 'view',
     type: 'function'
   },
   {
-    constant: true,
+    inputs: [],
+    name: 'owner',
+    outputs: [
+      {
+        internalType: 'address',
+        name: '',
+        type: 'address'
+      }
+    ],
+    stateMutability: 'view',
+    type: 'function'
+  },
+  {
     inputs: [
       {
+        internalType: 'uint256',
         name: 'value',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'gasPrice',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'expiration',
         type: 'uint256'
       },
       {
+        internalType: 'bytes32',
         name: 'payload',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 'hash',
         type: 'bytes32'
       },
       {
+        internalType: 'uint8',
         name: 'v',
         type: 'uint8'
       },
       {
+        internalType: 'bytes32',
         name: 'r',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 's',
         type: 'bytes32'
       },
       {
+        internalType: 'address',
         name: 'tokenContract',
         type: 'address'
       }
     ],
-    name: 'validatePayment',
+    name: 'pay',
+    outputs: [],
+    stateMutability: 'payable',
+    type: 'function'
+  },
+  {
+    inputs: [],
+    name: 'quoteSigner',
     outputs: [
       {
-        name: 'valid',
-        type: 'bool'
+        internalType: 'address',
+        name: '',
+        type: 'address'
       }
     ],
-    payable: false,
     stateMutability: 'view',
     type: 'function'
   },
   {
-    constant: false,
     inputs: [
       {
+        internalType: 'address',
+        name: 'newAdmin',
+        type: 'address'
+      }
+    ],
+    name: 'setAdmin',
+    outputs: [],
+    stateMutability: 'nonpayable',
+    type: 'function'
+  },
+  {
+    inputs: [
+      {
+        internalType: 'address',
+        name: 'newQuoteSigner',
+        type: 'address'
+      }
+    ],
+    name: 'setSigner',
+    outputs: [],
+    stateMutability: 'nonpayable',
+    type: 'function'
+  },
+  {
+    inputs: [
+      {
+        internalType: 'uint256',
         name: 'value',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'gasPrice',
         type: 'uint256'
       },
       {
+        internalType: 'uint256',
         name: 'expiration',
         type: 'uint256'
       },
       {
+        internalType: 'bytes32',
         name: 'payload',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 'hash',
         type: 'bytes32'
       },
       {
+        internalType: 'uint8',
         name: 'v',
         type: 'uint8'
       },
       {
+        internalType: 'bytes32',
         name: 'r',
         type: 'bytes32'
       },
       {
+        internalType: 'bytes32',
         name: 's',
         type: 'bytes32'
       },
       {
+        internalType: 'address',
         name: 'tokenContract',
         type: 'address'
       }
     ],
-    name: 'pay',
-    outputs: [],
-    payable: true,
-    stateMutability: 'payable',
-    type: 'function'
-  },
-  {
-    constant: false,
-    inputs: [
-      {
-        name: 'tokenContract',
-        type: 'address'
-      }
-    ],
-    name: 'withdraw',
-    outputs: [],
-    payable: false,
-    stateMutability: 'nonpayable',
-    type: 'function'
-  },
-  {
-    constant: false,
-    inputs: [
+    name: 'validatePayment',
+    outputs: [
       {
-        name: 'newQuoteSigner',
-        type: 'address'
+        internalType: 'bool',
+        name: 'valid',
+        type: 'bool'
       }
     ],
-    name: 'setSigner',
-    outputs: [],
-    payable: false,
-    stateMutability: 'nonpayable',
+    stateMutability: 'view',
     type: 'function'
   },
   {
-    constant: false,
     inputs: [
       {
-        name: 'newAdmin',
+        internalType: 'address',
+        name: 'tokenContract',
         type: 'address'
       }
     ],
-    name: 'setAdmin',
+    name: 'withdraw',
     outputs: [],
-    payable: false,
     stateMutability: 'nonpayable',
     type: 'function'
   }
-];
+] as const;

package/src/lib/common/constants.ts

@@ -226,6 +226,9 @@ export const Constants = {
 
   // May be different from the defaults if we rollback
   // or want to beta test new versions.
-  TSS_KEYGEN_SCHEME_VERSION_MAX: 1,
-  TSS_SIGGEN_SCHEME_VERSION_MAX: 1,
+  TSS_KEYGEN_SCHEME_VERSION_MAX: 1.1,
+  TSS_SIGGEN_SCHEME_VERSION_MAX: 1.1,
+  
+  TSS_KEYGEN_SCHEME_VERSION_MIN: 1,
+  TSS_SIGGEN_SCHEME_VERSION_MIN: 1,
 } as const;

package/src/lib/common/defaults.ts

@@ -434,6 +434,15 @@ export const Defaults = {
     { code: 'NZD', name: 'New Zealand Dollar' }
   ],
 
-  TSS_KEYGEN_SCHEME_VERSION: 1,
-  TSS_SIGGEN_SCHEME_VERSION: 1,
+  // In general, the major version represents server upgrades or major security upgrades, and the minor version represents client upgrades.
+  // Example1: If the server has an API response overhaul, that's a breaking change for older clients - it should increment the major version.
+  //           This will result in an UPGRADE_NEEDED error for older clients.
+  // Example2: If the client upgrades the encryption scheme, older clients will still be compatible with the server and
+  //           other older clients - it should increment the minor version. Mismatching client versions will still break the process, but
+  //           the difference from a major version bump is that matching older clients will still work.
+  TSS_KEYGEN_SCHEME_VERSION: 1.1,
+  TSS_SIGGEN_SCHEME_VERSION: 1.1,
+
+  TSS_KEYGEN_TIME_LIMIT: 20, // minutes
+  TSS_SIGGEN_TIME_LIMIT: 60 * 24, // minutes - 1 day (TODO tighten this up after testing)
 } as const;

package/src/lib/errors/errordefinitions.ts

@@ -76,6 +76,9 @@ interface Errors<T> {
   TSS_BWS_JOIN_SECRET_NOT_FOUND: T;
   TSS_NO_FINAL_SIGNATURE: T;
   TSS_INVALID_FINAL_SIGNATURE: T;
+  TSS_SESSION_EXPIRED: T;
+  TSS_MISMATCH_VERSION: T;
+  TSS_FINAL_SIGNATURE_MISMATCH: T;
 };
 
 const errors: Errors<string> = {
@@ -148,6 +151,9 @@ const errors: Errors<string> = {
   TSS_BWS_JOIN_SECRET_NOT_FOUND: 'BWS join secret not found',
   TSS_NO_FINAL_SIGNATURE: 'No signature provided',
   TSS_INVALID_FINAL_SIGNATURE: 'Invalid signature provided',
+  TSS_SESSION_EXPIRED: 'TSS session has expired',
+  TSS_MISMATCH_VERSION: 'TSS version does not match session version',
+  TSS_FINAL_SIGNATURE_MISMATCH: 'Final signature does not match the one generated by the session',
 };
 
 const errorsObject = { codes: {} };

package/src/lib/model/copayer.ts

@@ -54,6 +54,7 @@ export class Copayer {
   isMarketingStaff?: boolean;
 
   static xPubToCopayerId(coin, xpub) {
+    $.checkArgument(xpub, 'Missing xPubKey for copayer id derivation');
     const str = coin == Defaults.COIN ? xpub : coin + xpub;
     const hash = sjcl.hash.sha256.hash(str);
     return sjcl.codec.hex.fromBits(hash);

package/src/lib/model/tsskeygen.ts

@@ -103,14 +103,36 @@ export class TssKeyGenModel implements ITssKeyGenModel {
   __v: number;
 
 
-  static create(params: { id: string; message: ITssKeyMessageObject; n: number; copayerId: string; passwordHash?: string }): TssKeyGenModel {
-    const { id, message, n, copayerId, passwordHash } = params;
+  /**
+   * Create a new TssKeyGenModel instance. This is used to create a new TSS keygen session.
+   */
+  static create(params: {
+    /** Session ID */
+    id: string;
+    /** Initial broadcast message from party 0 */
+    message: ITssKeyMessageObject;
+    /** Number of key participants */
+    n: number;
+    /** Copayer ID of party 0 */
+    copayerId: string;
+    /** Password hash for joining the session */
+    passwordHash?: string;
+    /** TSS keygen version */
+    version: number;
+    /** Time limit for the session in minutes, after which the session expires */
+    timeLimit?: number;
+  }): TssKeyGenModel {
+    const { id, message, n, copayerId, passwordHash, version } = params;
     const { partyId } = message;
+    const timeLimit = parseFloat(params.timeLimit?.toString());
     $.checkArgument(partyId === 0, 'Key generation session must be started by partyId 0');
+    $.checkArgument(!timeLimit || (Number.isFinite(timeLimit) && timeLimit > 0), 'Time limit must be a positive number');
+
+    const ONE_MINUTE = 60 * 1000;
 
     const x = new TssKeyGenModel();
     x.id = id;
-    x.schemeVersion = Defaults.TSS_KEYGEN_SCHEME_VERSION;
+    x.schemeVersion = version || Defaults.TSS_KEYGEN_SCHEME_VERSION;
     x.n = n;
     x.participants = new Array(n);
     x.participants[partyId] = copayerId;
@@ -121,7 +143,7 @@ export class TssKeyGenModel implements ITssKeyGenModel {
     x.joinPassword = passwordHash;
     x.keyShares = new Array(n);
     x.createdOn = Date.now();
-    x.timeLimit = null; // TODO - add a session time limit
+    x.timeLimit = Math.min(timeLimit || Defaults.TSS_KEYGEN_TIME_LIMIT, 60) * ONE_MINUTE; // capped at 60 minutes
     x.__v = 0;
     return x;
   }
@@ -151,4 +173,11 @@ export class TssKeyGenModel implements ITssKeyGenModel {
     }
     return mostRecentRound;
   }
+
+  isExpired(): boolean {
+    if (!this.timeLimit) {
+      return false;
+    }
+    return Date.now() > this.createdOn + this.timeLimit;
+  }
 }