@bitpay-labs/bitcore-wallet-service 11.11.2 → 11.11.4

package/src/lib/routes/middleware/verifyTssMessage.ts

@@ -14,7 +14,10 @@ export async function verifyTssMessage(req, res, next) {
       throw Errors.TSS_PUBKEY_MISSING;
     }
 
-    if (!message.broadcastMessages?.length && !message.p2pMessages?.length) {
+    // 1-of-N signing sessions won't have messages for other recipients.
+    //  req.session is unset for a new session, and keygen sessions have no `m`.
+    const isSoloSigner = req.session?.m === 1;
+    if (!isSoloSigner && !message.broadcastMessages?.length && !message.p2pMessages?.length) {
       throw Errors.TSS_INVALID_MESSAGE;
     }
 

package/src/lib/routes/services.ts

@@ -3,6 +3,7 @@ import express from 'express';
 import rp from 'request-promise-native';
 import config from '../../config';
 import { Common } from '../common';
+import { ClientError } from '../errors/clienterror';
 import type * as Types from '../../types/expressapp';
 import type { WalletService } from '../server';
 
@@ -125,13 +126,18 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.get('/v1/fiatrates/:code/', (req, res) => {
+    const { coin } = req.query;
+    if (coin !== undefined && typeof coin !== 'string') {
+      return context.returnError(new ClientError('Invalid coin'), res, req);
+    }
+
     setPublicCache(res, 5 * ONE_MINUTE);
     respondWithPublicServer(req, res, context, server =>
       callbackResult(resolve => {
         server.getFiatRate(
           {
             code: req.params['code'],
-            coin: req.query.coin || 'btc',
+            coin: coin || 'btc',
             ts: req.query.ts ? +req.query.ts : null
           },
           resolve
@@ -455,7 +461,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
 
   router.post('/v1/service/transak/orderDetails', cors(transakCorsOptions), (req, res) => {
     respondWithAuthServer(req, res, context, server => {
-      return server.externalServices.transak.transakGetOrderDetails(req);
+      return server.externalServices.transak.transakGetOrderDetails(req, server.walletId);
     });
   });
 

package/src/lib/routes/tss.ts

@@ -1,7 +1,6 @@
 import express from 'express';
 import * as Types from '../../types/expressapp';
 import { TssKeyGen, TssSign } from '../tss';
-import { authRequest } from './middleware/authRequest';
 import { authTssKeyGenRequest, authTssSignRequest } from './middleware/authTssRequest';
 import { createWalletLimiter } from './middleware/createWalletLimiter';
 import { verifyTssMessage } from './middleware/verifyTssMessage';
@@ -49,6 +48,36 @@ export class TssRouter {
       }
     });
 
+    // Must be before /keygen/:id/:round so "secret" doesn't get interpreted as a round number
+    router.get('/v1/tss/keygen/:id/secret', authTssKeyGenRequest({ bypassExpired: true }), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const copayerId = req.headers['x-identity'];
+        const { chain, network } = req.query as { [key: string]: string };
+        const secret = await TssKeyGen.getBwsJoinSecret({ id, chain, network, copayerId });
+        return res.json({ secret });
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.post('/v1/tss/keygen/:id/secret', authTssKeyGenRequest({ bypassExpired: true }), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const { chain, network, secrets, secret } = req.body;
+        const copayerId = req.headers['x-identity'];
+        if (secrets == null && secret != null) {
+          // Legacy (< v1.3) clients send a single unencrypted secret
+          await TssKeyGen.storeBwsJoinSecret({ id, secret, copayerId });
+        } else {
+          await TssKeyGen.storeBwsJoinSecrets({ id, chain, network, secrets, copayerId });
+        }
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
     router.get('/v1/tss/keygen/:id/:round', authTssKeyGenRequest(), async function(req, res) {
       let interval: NodeJS.Timeout;
       try {
@@ -58,10 +87,6 @@ export class TssRouter {
         const { id, round } = req.params as { [key: string]: string };
         const { maxWaitTime } = req.query as { [key: string]: string };
         const copayerId = req.headers['x-identity'];
-        if (round === 'secret') {
-          const secret = await TssKeyGen.getBwsJoinSecret({ id, copayerId });
-          return res.json({ secret });
-        }
 
         // Validate access and fetch session before committing to a streaming response, so that errors like
         //   "session not found" or "not a participant" can still be returned with a proper
@@ -100,33 +125,10 @@ export class TssRouter {
       }
     });
 
-    router.post('/v1/tss/keygen/:id/secret', authTssKeyGenRequest(), async function(req, res) {
-      try {
-        const id = req.params.id;
-        const { secret } = req.body;
-        const copayerId = req.headers['x-identity'];
-        await TssKeyGen.storeBwsJoinSecret({ id, secret, copayerId });
-        return res.send();
-      } catch (err) {
-        return returnError(err ?? 'unknown', res, req);
-      }
-    });
-
-    router.get('/v1/tss/keygen/:id/secret', authTssKeyGenRequest(), async function(req, res) {
-      try {
-        const id = req.params.id;
-        const copayerId = req.headers['x-identity'];
-        const secret = await TssKeyGen.getBwsJoinSecret({ id, copayerId });
-        return res.json({ secret });
-      } catch (err) {
-        return returnError(err ?? 'unknown', res, req);
-      }
-    });
-
 
     /** Signature Methods */
 
-    router.post('/v1/tss/sign/:id', authRequest(), verifyTssMessage, async function(req, res) {
+    router.post('/v1/tss/sign/:id', authTssSignRequest({ joinable: true }), verifyTssMessage, async function(req, res) {
       try {
         const id = req.params.id;
         // version was not given by client until 1.1, so fallback to 1.0
@@ -178,7 +180,8 @@ export class TssRouter {
       try {
         const id = req.params.id;
         const { signature } = req.body;
-        await TssSign.storeSignature({ id, signature });
+        const copayerId = req.headers['x-identity'];
+        await TssSign.storeSignature({ id, signature, copayerId });
         return res.send();
       } catch (err) {
         return returnError(err ?? 'unknown', res, req);

package/src/lib/routes/walletdata.ts

@@ -125,11 +125,13 @@ export function registerWalletDataRoutes(router: express.Router, context: RouteC
       const opts: {
         feePerKb?: number;
         feeLevel?: number;
+        txType?: number;
         returnInputs?: boolean;
         excludeUnconfirmedUtxos?: boolean;
       } = {};
       if (query.feePerKb) opts.feePerKb = +query.feePerKb;
       if (query.feeLevel) opts.feeLevel = Number(query.feeLevel);
+      if (query.txType != null) opts.txType = Number(query.txType);
       if (query.excludeUnconfirmedUtxos == '1') opts.excludeUnconfirmedUtxos = true;
       if (query.returnInputs == '1') opts.returnInputs = true;
 

package/src/lib/server.ts

@@ -71,6 +71,7 @@ const Bitcore_ = {
   arb: Bitcore,
   base: Bitcore,
   op: Bitcore,
+  arc: Bitcore,
   xrp: Bitcore,
   doge: BitcoreDoge,
   ltc: BitcoreLtc,
@@ -187,7 +188,7 @@ export class WalletService implements IWalletService {
       sardine: new SardineService(),
       simplex: new SimplexService(),
       thorswap: new ThorswapService(),
-      transak: new TransakService(),
+      transak: new TransakService(this.storage, this.lock),
       coinGecko: new CoinGeckoService(this.storage),
     };
   }
@@ -604,6 +605,7 @@ export class WalletService implements IWalletService {
    * @param {number} [opts.tssVersion] TSS version to use. Supplying this with n > 1 and a multisig chain (e.g. btc) will tell the wallet to use
    *                                   threshold insead of on-chain multisig. Otherwise, n > 1 and a non-multisig chain will default to TSS_KEYGEN_SCHEME_VERSION
    * @param {string} [opts.tssKeyId] TSS key session id. This is the id of the TSS key generation session that will be used to create the wallet.
+   * @param {string} [opts.tssKeygenCopayerId] The ID of the copayer creating the wallet. Required for TSS version >= 1.3.
    */
   async createWallet(opts, cb) {
     let pubKey;
@@ -674,6 +676,17 @@ export class WalletService implements IWalletService {
         return cb(new ClientError('Invalid TSS version'));
       }
 
+      if (opts.tssVersion >= 1.3) {
+        if (!opts.tssKeygenCopayerId) {
+          return cb(new ClientError('Copayer ID is required for TSS version >= 1.3'));
+        }
+        // This is only a sanity check to prevent problems down the line. If this is somehow
+        // spoofed, there are more strict authorization checks later in the wallet creation flow.
+        if (keySession.participants.indexOf(opts.tssKeygenCopayerId) !== 0) {
+          return cb(new ClientError('Only the TSS session leader can create a wallet'));
+        }
+      }
+
       // TSS wallets behave like a single-sig
       opts.m = 1;
       opts.n = 1;
@@ -1038,7 +1051,11 @@ export class WalletService implements IWalletService {
     this._notify(type, data, {}, cb);
   }
 
-  _addCopayerToWallet(wallet: Wallet, opts, cb) {
+  _addCopayerToWallet(
+    wallet: Wallet,
+    opts: JoinWalletOpts,
+    cb: (err: ClientError | null, result?: { copayerId: string | null; wallet: Wallet }) => void
+  ) {
     const copayer = Copayer.create({
       coin: wallet.coin,
       chain: wallet.chain, // chain === coin for stored clients
@@ -1194,20 +1211,11 @@ export class WalletService implements IWalletService {
 
   /**
    * Joins a wallet in creation.
-   * @param {Object} opts
-   * @param {string} opts.walletId The wallet id.
-   * @param {string} opts.coin The expected coin for this wallet (btc, bch, eth, doge, ltc). Default: btc
-   * @param {string} opts.chain The expected chain for this wallet (btc, bch, eth, doge, ltc). Default: btc
-   * @param {string} opts.name The copayer name.
-   * @param {string} opts.xPubKey Extended Public Key for this copayer
-   * @param {string} opts.hardwareSourcePublicKey Public key from a hardware device for this copayer
-   * @param {string} opts.clientDerivedPublicKey Public key from the client for this wallet
-   * @param {string} opts.requestPubKey Public Key used to check requests from this copayer.
-   * @param {string} opts.copayerSignature S(name|xPubKey|requestPubKey). Used by other copayers to verify that the copayer joining knows the wallet secret.
-   * @param {string} [opts.customData] Custom data for this copayer.
-   * @param {boolean} [opts.dryRun] Simulate the action but do not change server state.
    */
-  joinWallet(opts, cb) {
+  joinWallet(
+    opts: JoinWalletOpts,
+    cb: (err: ClientError | null, result?: { copayerId: string | null; wallet: Wallet }) => void
+  ) {
     // xPubKey is the canonical copayer identity in the current protocol. Alternate public-key
     // fields are ancillary metadata; supporting an xPubKey-less copayer requires a versioned
     // end-to-end identity protocol rather than a local identity fallback.
@@ -1226,6 +1234,9 @@ export class WalletService implements IWalletService {
       opts.chain = opts.coin; // chain === coin for stored clients
     }
     if (!Utils.checkValueInCollection(opts.chain, Constants.CHAINS)) return cb(new ClientError('Invalid coin'));
+    if (opts.tssKeygenChain != null && !Utils.checkValueInCollection(opts.tssKeygenChain, Constants.CHAINS)) {
+      return cb(new ClientError('Invalid TSS keygen chain'));
+    }
 
     // xPubKey is parsed and validated for every join; ancillary fields never suppress it.
     // A future update will re-add conditional logic which allows opts.hardwareSourcePublicKey
@@ -1286,8 +1297,16 @@ export class WalletService implements IWalletService {
 
         if (wallet.tssKeyId) {
           const keySession = await storage.fetchTssKeyGenSession({ id: wallet.tssKeyId });
-          const copayerId = Copayer.xPubToCopayerId(opts.chain, opts.xPubKey);
-          if (!keySession.participants.includes(copayerId)) {
+          // A sibling wallet on another network (e.g. livenet -> testnet) has an xPubKey serialized for that network,
+          // but the keygen session's copayer IDs were derived from the xPubKey serialized for the session's network.
+          const idChain = opts.tssKeygenChain || opts.chain;
+          const copayerIds = new Set([
+            Copayer.xPubToCopayerId(idChain, opts.xPubKey), // this is probably a duplicate of one of the next two entries, but just in case.
+            Copayer.xPubToCopayerId(idChain, Utils.convertXPubKeyForNetwork(opts.xPubKey, idChain, 'livenet')),
+            Copayer.xPubToCopayerId(idChain, Utils.convertXPubKeyForNetwork(opts.xPubKey, idChain, 'testnet'))
+          ]);
+
+          if (!keySession?.participants.some(id => copayerIds.has(id))) {
             return cb(Errors.TSS_NON_PARTICIPANT);
           }
           return this._addCopayerToWallet(wallet, opts, cb);
@@ -1312,6 +1331,7 @@ export class WalletService implements IWalletService {
    * @param {string} opts.opTokenAddresses - Linked token addresses
    * @param {string} opts.baseTokenAddresses - Linked token addresses
    * @param {string} opts.arbTokenAddresses - Linked token addresses
+   * @param {string[]} opts.arcTokenAddresses - Linked Arc ERC20 token addresses
    * @param {string} opts.solTokenAddresses - Linked token addresses
    * @param {string} opts.multisigMaticInfo - Linked multisig eth wallet info
    *
@@ -1386,6 +1406,14 @@ export class WalletService implements IWalletService {
           return Array.isArray(value) && value.every(x => Validation.validateAddress('arb', 'mainnet', x));
         }
       },
+      {
+        name: 'arcTokenAddresses',
+        isValid(value) {
+          return Array.isArray(value) && value.every(address =>
+            Validation.validateAddress('arc', 'mainnet', address) &&
+            address.toLowerCase() !== Constants.ARC.USDC_CONTRACT_ADDRESS);
+        }
+      },
       {
         name: 'solTokenAddresses',
         isValid(value) {
@@ -1487,6 +1515,13 @@ export class WalletService implements IWalletService {
             preferences.arbTokenAddresses = _.uniq(oldPref.arbTokenAddresses.concat(opts.arbTokenAddresses));
           }
 
+          if (opts.arcTokenAddresses) {
+            oldPref = oldPref || {} as Preferences;
+            oldPref.arcTokenAddresses = oldPref.arcTokenAddresses || [];
+            preferences.arcTokenAddresses = _.uniq(oldPref.arcTokenAddresses.concat(opts.arcTokenAddresses)
+              .map(address => address.toLowerCase()));
+          }
+
           if (opts.solTokenAddresses) {
             oldPref = oldPref || {} as Preferences;
             oldPref.solTokenAddresses = oldPref.solTokenAddresses || [];
@@ -2484,7 +2519,8 @@ export class WalletService implements IWalletService {
               feePerKb: opts.feePerKb,
               excludeUnconfirmedUtxos: !!opts.excludeUnconfirmedUtxos,
               returnInputs: true,
-              numSignatures: opts.numSignatures
+              numSignatures: opts.numSignatures,
+              txType: opts.txType
             },
             (err, info) => {
               if (err) return next(err);
@@ -4177,7 +4213,7 @@ export class WalletService implements IWalletService {
         return cb(err);
       }
       wallet.beRegistered = true;
-      return this.storage.storeWallet(wallet, err => cb(err, true));
+      return this.storage.storeWalletRegistration(wallet, err => cb(err, true));
     });
   }
 
@@ -5838,3 +5874,30 @@ export const UPGRADES = {
 } as const;
 
 type Upgrade = typeof UPGRADES[keyof typeof UPGRADES];
+
+export interface JoinWalletOpts {
+  /** The wallet id. */
+  walletId: string;
+  /** The expected coin for this wallet (btc, bch, eth, doge, ltc). Default: btc */
+  coin?: string;
+  /** The expected chain for this wallet (btc, bch, eth, doge, ltc). Default: btc */
+  chain?: string;
+  /** The copayer name. */
+  name: string;
+  /** Extended Public Key for this copayer */
+  xPubKey: string;
+  /** Public key from a hardware device for this copayer */
+  hardwareSourcePublicKey?: string;
+  /** Public key from the client for this wallet */
+  clientDerivedPublicKey?: string;
+  /** Public Key used to check requests from this copayer. */
+  requestPubKey: string;
+  /** Signature proving knowledge of the wallet secret for this copayer. */
+  copayerSignature: string;
+  /** Custom data for this copayer. */
+  customData?: string;
+  /** Simulate the action but do not change server state. */
+  dryRun?: boolean;
+  /** The chain used for TSS key generation. */
+  tssKeygenChain?: string;
+};

package/src/lib/storage.ts

@@ -835,6 +835,26 @@ export class Storage {
     );
   }
 
+  storeWalletRegistration(wallet, cb) {
+    this.db.collection(collections.WALLETS).updateOne(
+      {
+        id: wallet.id
+      },
+      {
+        $set: {
+          beRegistered: wallet.beRegistered,
+          beAuthPrivateKey2: wallet.beAuthPrivateKey2,
+          beAuthPublicKey2: wallet.beAuthPublicKey2
+        }
+      },
+      {
+        w: 1,
+        upsert: false
+      },
+      cb
+    );
+  }
+
   deregisterWallet(walletId, cb) {
     this.db.collection(collections.WALLETS).updateOne(
       {
@@ -1961,6 +1981,10 @@ export class Storage {
     );
   }
 
+  /**
+   * Use only for legacy (< v1.3) clients, where bwsJoinSecrets was not available.
+   * @deprecated Use storeTssKeyBwsJoinSecrets instead.
+   */
   async storeTssKeyBwsJoinSecret({ id, secret }: { id: string; secret: string }) {
     return this.db.collection(collections.TSS_KEYGEN).updateOne({
       id
@@ -1973,6 +1997,21 @@ export class Storage {
     { upsert: false });
   }
 
+  async storeTssKeyBwsJoinSecrets(params: { id: string; chain: string; network: string; secrets: { [partyId: number]: string } }) {
+    const { id, chain, network, secrets } = params;
+    const _chain = chain.toLowerCase();
+    const _network = network.toLowerCase();
+    return this.db.collection(collections.TSS_KEYGEN).updateOne({
+      id
+    },
+    {
+      $set: {
+        [`bwsJoinSecrets.${_chain}:${_network}`]: secrets
+      }
+    },
+    { upsert: false });
+  }
+
   async fetchTssSigSession({ id }: { id: string }) {
     const doc = await this.db.collection(collections.TSS_SIGN).findOne({ id });
     if (!doc) {

package/src/lib/tss.ts

@@ -1,6 +1,7 @@
 import { EventEmitter } from 'events';
 import { BitcoreLib } from '@bitpay-labs/crypto-wallet-core';
 import { Constants } from './common/constants';
+import { Utils } from './common/utils';
 import { Errors } from './errors/errordefinitions';
 import logger from './logger';
 import { TssKeyGenModel } from './model/tsskeygen';
@@ -553,7 +554,10 @@ class TssKeyGenClass {
     // }
   }
 
-  /** Store the BWS join secret for the TSS keygen session */
+  /**
+   * Store the BWS join secret for the TSS keygen session
+   * @deprecated Use storeBwsJoinSecrets instead.
+   */
   async storeBwsJoinSecret(params: {
     /** Session ID */
     id: string;
@@ -587,10 +591,77 @@ class TssKeyGenClass {
     }
   }
 
-  /** Get the BWS join secret for the TSS keygen session */
+  /**
+   * Store the party-encrypted BWS join secrets for a wallet on `chain`:`network` created with the TSS key.
+   * This can be called after the key generation session has expired to create additional wallets (e.g. other EVM chains) for the same key.
+   */
+  async storeBwsJoinSecrets(params: {
+    /** Session ID */
+    id: string;
+    /** Blockchain (e.g., 'btc', 'eth') */
+    chain: string;
+    /** Network (e.g., 'livenet', 'testnet') */
+    network: string;
+    /** Party encrypted BWS join secrets, keyed by partyId or by the party's keygen session copayer ID */
+    secrets: { [party: string]: string };
+    /** Copayer ID of the submitting party (must be the session creator) */
+    copayerId: string;
+  }) {
+    const { id, copayerId } = params;
+    const { chain, network } = getSecretChainNetwork(params.chain, params.network);
+    if (!params.secrets || typeof params.secrets !== 'object' || Array.isArray(params.secrets)) {
+      throw Errors.TSS_GENERIC_ERROR.withMessage('Invalid BWS join secrets provided');
+    }
+    const storage = WalletService.getStorage();
+    const session = await storage.fetchTssKeyGenSession({ id });
+
+    if (!session) {
+      throw Errors.TSS_SESSION_NOT_FOUND;
+    }
+
+    if (session.participants.indexOf(copayerId) !== 0) {
+      throw Errors.TSS_GENERIC_ERROR.withMessage('Only the session creator can store the BWS join secret');
+    }
+
+    // Only store secrets keyed by partyId for the other parties (1..n-1)
+    const secrets: { [partyId: number]: string } = {};
+    for (const [party, secret] of Object.entries(params.secrets)) {
+      const partyId = /^\d+$/.test(party) ? parseInt(party) : session.participants.indexOf(party);
+      if (!(partyId > 0 && partyId < session.n) || typeof secret !== 'string' || !secret) {
+        throw Errors.TSS_GENERIC_ERROR.withMessage('Invalid BWS join secret for party ' + party);
+      }
+      if (secrets[partyId]) {
+        // Malformed secrets objects may be keyed by both partyId (number) and copayerId (string).
+        // While this technically won't break anything (only 1 secret will be stored), it indicates
+        // a malformation which could signal a broader issue with the client.
+        throw Errors.TSS_GENERIC_ERROR.withMessage('Multiple BWS join secret for party ' + party);
+      }
+      secrets[partyId] = secret;
+    }
+
+    if (Object.keys(secrets).length !== session.n - 1) {
+      throw Errors.TSS_GENERIC_ERROR.withMessage('Missing BWS join secrets for some parties');
+    }
+
+    const result = await storage.storeTssKeyBwsJoinSecrets({ id, chain, network, secrets });
+    if (!result.result.ok) {
+      logger.error('Failed to store TSS key generation BWS join secrets %o %o', id, result);
+      throw Errors.TSS_GENERIC_ERROR.withMessage('Failed to store TSS key generation BWS join secrets');
+    }
+  }
+
+  /**
+   * Get the BWS join secret for the TSS keygen session.
+   * If chain & network are given, returns the requesting party's encrypted secret for that chain & network.
+   * Otherwise, returns the legacy (< v1.3) unencrypted secret.
+   */
   async getBwsJoinSecret(params: {
     /** Session ID */
     id: string;
+    /** Blockchain (e.g., 'btc', 'eth'). Omitted by legacy clients */
+    chain?: string;
+    /** Network (e.g., 'livenet', 'testnet'). Omitted by legacy clients */
+    network?: string;
     /** Copayer ID of the requesting party */
     copayerId: string;
   }): Promise<string> {
@@ -600,16 +671,42 @@ class TssKeyGenClass {
     if (!session) {
       throw Errors.TSS_SESSION_NOT_FOUND;
     }
-    if (session.participants.indexOf(copayerId) === -1) {
+    const partyId = session.participants.indexOf(copayerId);
+    if (partyId === -1) {
       throw Errors.TSS_NON_PARTICIPANT;
     }
-    if (!session.bwsJoinSecret) {
+
+    if (params.chain == null && params.network == null) {
+      // Legacy clients don't send chain & network
+      if (!session.bwsJoinSecret) {
+        throw Errors.TSS_BWS_JOIN_SECRET_NOT_FOUND;
+      }
+      return session.bwsJoinSecret;
+    }
+
+    // Note: sessions < v1.3 can have chain-specific secrets too (i.e. wallets created with an existing TSS key)
+    const { chain, network } = getSecretChainNetwork(params.chain, params.network);
+    const secret = session.bwsJoinSecrets?.[`${chain}:${network}`]?.[partyId];
+    if (typeof secret !== 'string') {
       throw Errors.TSS_BWS_JOIN_SECRET_NOT_FOUND;
     }
-    return session.bwsJoinSecret;
+    return secret;
   }
 };
 
+/** Validate and normalize the chain & network used to key the BWS join secrets */
+function getSecretChainNetwork(chain: string, network: string) {
+  chain = typeof chain === 'string' ? chain.toLowerCase() : chain;
+  if (!Utils.checkValueInCollection(chain, Constants.CHAINS)) {
+    throw Errors.TSS_GENERIC_ERROR.withMessage('Invalid chain provided');
+  }
+  network = typeof network === 'string' ? Utils.getNetworkName(chain, Utils.getGenericName(network.toLowerCase())) : network;
+  if (!Utils.checkValueInCollection(network, Constants.NETWORKS[chain])) {
+    throw Errors.TSS_GENERIC_ERROR.withMessage('Invalid network provided');
+  }
+  return { chain, network };
+}
+
 export const TssKeyGen = new TssKeyGenClass();
 
 class TssSignClass {
@@ -748,7 +845,8 @@ class TssSignClass {
       if (session.isExpired()) {
         throw Errors.TSS_SESSION_EXPIRED;
       }
-      if (!this._isValidBroadcastMessage({ message }) && !this._isValidP2pMessage({ message })) {
+      // 1-of-N sessions won't have messages for other recipients
+      if (session.m > 1 && !this._isValidBroadcastMessage({ message }) && !this._isValidP2pMessage({ message })) {
         throw Errors.TSS_INVALID_MESSAGE.withMessage('Invalid message provided');
       }
 
@@ -903,8 +1001,10 @@ class TssSignClass {
     id: string;
     /** Signature to store */
     signature: ITssSigMessageObject['signature'];
+    /** Copayer ID of the sender */
+    copayerId: string;
   }): Promise<void> {
-    const { id, signature } = params;
+    const { id, signature, copayerId } = params;
     if (!signature) {
       throw Errors.TSS_NO_FINAL_SIGNATURE;
     }
@@ -917,6 +1017,10 @@ class TssSignClass {
     if (!session) {
       throw Errors.TSS_SESSION_NOT_FOUND;
     }
+    const party = session.participants.find(p => p.copayerId === copayerId);
+    if (!party) {
+      throw Errors.TSS_NON_PARTICIPANT;
+    }
 
     const verifySig = (sig1, sig2) => {
       return sig1.r === sig2.r &&

package/test/blockchainexplorer.test.ts

@@ -39,6 +39,13 @@ describe('BlockChain explorer', function() {
       exp2.should.respondTo('initSocket');
       exp2.should.respondTo('register');
       exp2.should.respondTo('addAddresses');
+
+      for (const [network, apiNetwork] of [['livenet', 'mainnet'], ['testnet', 'testnet']]) {
+        const opts = { coin: 'arc', network };
+        BlockChainExplorer(opts).baseUrl.should.equal(`https://api-eth.bitcore.io/api/ARC/${apiNetwork}`);
+        BlockChainExplorer({ ...opts, url: 'http://localhost:3000' })
+          .baseUrl.should.equal(`http://localhost:3000/api/ARC/${apiNetwork}`);
+      }
     });
     it('should fail on unsupported provider', function() {
       try {