@btc-vision/transaction 1.8.7 → 1.8.9

package/build/epoch/validator/EpochValidator.d.ts

@@ -6,9 +6,31 @@ export declare class EpochValidator {
      */
     static sha1(data: Uint8Array): Uint8Array;
     /**
-     * Calculate mining preimage
+     * Calculate mining preimage.
+     *
+     * When useConcatenatedPreimage is false the legacy XOR construction is used
+     * (checksumRoot ^ publicKey ^ salt). That construction is malleable: a
+     * miner can set salt == publicKey to force preimage == checksumRoot (max
+     * difficulty for free), or transform any solution to another key via
+     * salt' = publicKey' ^ publicKey ^ salt. When useConcatenatedPreimage is true
+     * the preimage is the 96-byte concatenation checksumRoot || publicKey || salt,
+     * which removes both (the SHA-1 proof-of-work over it is unchanged).
+     *
+     * The switch is a consensus rule: callers pass useConcatenatedPreimage =
+     * (epochBlockHeight >= activationHeight) using the activation height for the
+     * network they are on (opnet-node exposes it as
+     * consensusEpochPatches.PREIMAGE_CONCAT_PATCH_BLOCK_HEIGHT). The value MUST be
+     * identical across opnet-node, this library and the mining pool.
      */
-    static calculatePreimage(checksumRoot: Uint8Array, publicKey: Uint8Array, salt: Uint8Array): Uint8Array;
+    static calculatePreimage(checksumRoot: Uint8Array, publicKey: Uint8Array, salt: Uint8Array, useConcatenatedPreimage?: boolean): Uint8Array;
+    /**
+     * Non-malleable mining preimage: the 96-byte concatenation
+     * checksumRoot || publicKey || salt. The public key sits in its own segment,
+     * so a miner-chosen salt can neither cancel it nor be transformed to
+     * re-attribute another miner's solution. The SHA-1 proof-of-work over it is
+     * unchanged.
+     */
+    static concatenatePreimage(checksumRoot: Uint8Array, publicKey: Uint8Array, salt: Uint8Array): Uint8Array;
     /**
      * Count matching bits between two hashes
      */
@@ -16,7 +38,7 @@ export declare class EpochValidator {
     /**
      * Verify an epoch solution using IPreimage
      */
-    static verifySolution(challenge: IChallengeSolution, log?: boolean): boolean;
+    static verifySolution(challenge: IChallengeSolution, log?: boolean, useConcatenatedPreimage?: boolean): boolean;
     /**
      * Get the mining target block for an epoch
      */
@@ -24,11 +46,11 @@ export declare class EpochValidator {
     /**
      * Validate epoch winner from raw data
      */
-    static validateEpochWinner(epochData: RawChallenge): boolean;
+    static validateEpochWinner(epochData: RawChallenge, useConcatenatedPreimage?: boolean): boolean;
     /**
      * Validate epoch winner from Preimage instance
      */
-    static validateChallengeSolution(challenge: IChallengeSolution): boolean;
+    static validateChallengeSolution(challenge: IChallengeSolution, useConcatenatedPreimage?: boolean): boolean;
     /**
      * Calculate solution hash from preimage components
      * @param targetChecksum The target checksum (32 bytes)
@@ -36,7 +58,7 @@ export declare class EpochValidator {
      * @param salt The salt buffer (32 bytes)
      * @returns The SHA-1 hash of the preimage
      */
-    static calculateSolution(targetChecksum: Uint8Array, publicKey: Uint8Array, salt: Uint8Array): Uint8Array;
+    static calculateSolution(targetChecksum: Uint8Array, publicKey: Uint8Array, salt: Uint8Array, useConcatenatedPreimage?: boolean): Uint8Array;
     /**
      * Check if a solution meets the minimum difficulty requirement
      */

package/build/epoch/validator/EpochValidator.js

@@ -10,13 +10,30 @@ export class EpochValidator {
         return crypto.sha1(data);
     }
     /**
-     * Calculate mining preimage
+     * Calculate mining preimage.
+     *
+     * When useConcatenatedPreimage is false the legacy XOR construction is used
+     * (checksumRoot ^ publicKey ^ salt). That construction is malleable: a
+     * miner can set salt == publicKey to force preimage == checksumRoot (max
+     * difficulty for free), or transform any solution to another key via
+     * salt' = publicKey' ^ publicKey ^ salt. When useConcatenatedPreimage is true
+     * the preimage is the 96-byte concatenation checksumRoot || publicKey || salt,
+     * which removes both (the SHA-1 proof-of-work over it is unchanged).
+     *
+     * The switch is a consensus rule: callers pass useConcatenatedPreimage =
+     * (epochBlockHeight >= activationHeight) using the activation height for the
+     * network they are on (opnet-node exposes it as
+     * consensusEpochPatches.PREIMAGE_CONCAT_PATCH_BLOCK_HEIGHT). The value MUST be
+     * identical across opnet-node, this library and the mining pool.
      */
-    static calculatePreimage(checksumRoot, publicKey, salt) {
+    static calculatePreimage(checksumRoot, publicKey, salt, useConcatenatedPreimage = false) {
         // Ensure all are 32 bytes
         if (checksumRoot.length !== 32 || publicKey.length !== 32 || salt.length !== 32) {
             throw new Error('All inputs must be 32 bytes');
         }
+        if (useConcatenatedPreimage) {
+            return this.concatenatePreimage(checksumRoot, publicKey, salt);
+        }
         const preimage = new Uint8Array(32);
         for (let i = 0; i < 32; i++) {
             preimage[i] =
@@ -24,6 +41,23 @@ export class EpochValidator {
         }
         return preimage;
     }
+    /**
+     * Non-malleable mining preimage: the 96-byte concatenation
+     * checksumRoot || publicKey || salt. The public key sits in its own segment,
+     * so a miner-chosen salt can neither cancel it nor be transformed to
+     * re-attribute another miner's solution. The SHA-1 proof-of-work over it is
+     * unchanged.
+     */
+    static concatenatePreimage(checksumRoot, publicKey, salt) {
+        if (checksumRoot.length !== 32 || publicKey.length !== 32 || salt.length !== 32) {
+            throw new Error('All inputs must be 32 bytes');
+        }
+        const message = new Uint8Array(96);
+        message.set(checksumRoot, 0);
+        message.set(publicKey, 32);
+        message.set(salt, 64);
+        return message;
+    }
     /**
      * Count matching bits between two hashes
      */
@@ -56,10 +90,10 @@ export class EpochValidator {
     /**
      * Verify an epoch solution using IPreimage
      */
-    static verifySolution(challenge, log = false) {
+    static verifySolution(challenge, log = false, useConcatenatedPreimage = false) {
         try {
             const verification = challenge.verification;
-            const calculatedPreimage = this.calculatePreimage(verification.targetChecksum, challenge.publicKey.toBuffer(), challenge.salt);
+            const calculatedPreimage = this.calculatePreimage(verification.targetChecksum, challenge.publicKey.toBuffer(), challenge.salt, useConcatenatedPreimage);
             const computedSolution = this.sha1(calculatedPreimage);
             if (!equals(computedSolution, challenge.solution)) {
                 return false;
@@ -92,7 +126,7 @@ export class EpochValidator {
     /**
      * Validate epoch winner from raw data
      */
-    static validateEpochWinner(epochData) {
+    static validateEpochWinner(epochData, useConcatenatedPreimage = false) {
         try {
             const epochNumber = BigInt(epochData.epochNumber);
             const publicKey = Address.fromString(epochData.mldsaPublicKey, epochData.legacyPublicKey);
@@ -108,7 +142,7 @@ export class EpochValidator {
                 endBlock: BigInt(epochData.verification.endBlock),
                 proofs: Object.freeze(epochData.verification.proofs.map((p) => stringToBuffer(p))),
             };
-            const calculatedPreimage = this.calculatePreimage(verification.targetChecksum, publicKey.toBuffer(), salt);
+            const calculatedPreimage = this.calculatePreimage(verification.targetChecksum, publicKey.toBuffer(), salt, useConcatenatedPreimage);
             const computedSolution = this.sha1(calculatedPreimage);
             if (!equals(computedSolution, solution)) {
                 return false;
@@ -129,8 +163,8 @@ export class EpochValidator {
     /**
      * Validate epoch winner from Preimage instance
      */
-    static validateChallengeSolution(challenge) {
-        return this.verifySolution(challenge);
+    static validateChallengeSolution(challenge, useConcatenatedPreimage = false) {
+        return this.verifySolution(challenge, false, useConcatenatedPreimage);
     }
     /**
      * Calculate solution hash from preimage components
@@ -139,8 +173,8 @@ export class EpochValidator {
      * @param salt The salt buffer (32 bytes)
      * @returns The SHA-1 hash of the preimage
      */
-    static calculateSolution(targetChecksum, publicKey, salt) {
-        const preimage = this.calculatePreimage(targetChecksum, publicKey, salt);
+    static calculateSolution(targetChecksum, publicKey, salt, useConcatenatedPreimage = false) {
+        const preimage = this.calculatePreimage(targetChecksum, publicKey, salt, useConcatenatedPreimage);
         return this.sha1(preimage);
     }
     /**

package/build/transaction/builders/TransactionBuilder.js

@@ -744,15 +744,31 @@ export class TransactionBuilder extends TweakedTransaction {
     generateMLDSALinkRequest(parameters, features) {
         const mldsaSigner = this.mldsaSigner;
         const legacySignature = this.generateLegacySignature();
+        // Reveal by default. The legacy Schnorr signature only proves ownership of
+        // the Bitcoin key being linked; it says nothing about the claimed
+        // hashedPublicKey. Without the ML-DSA public key and a signature over it,
+        // a link request carries no proof that the sender knows a preimage for
+        // that hash, so a node cannot safely create a NEW identity from it.
+        //
+        // Defaulting to false made every caller responsible for remembering, and
+        // callers do forget: opwallet never set this anywhere, and its deployment
+        // screen calls signDeployment() directly, bypassing any controller-level
+        // fix. Revealing when it was not needed only costs bytes (ML-DSA-44:
+        // 1312-byte key + 2420-byte signature); not revealing when it was needed
+        // gets the transaction rejected.
+        //
+        // Callers that KNOW the key is already linked on-chain should pass false
+        // explicitly to avoid paying for the reveal on every interaction.
+        const shouldReveal = parameters.revealMLDSAPublicKey ?? true;
         let mldsaSignature = null;
-        if (parameters.revealMLDSAPublicKey) {
+        if (shouldReveal) {
             mldsaSignature = this.generateMLDSASignature();
         }
         const mldsaRequest = {
             priority: FeaturePriority.MLDSA_LINK_PUBKEY,
             opcode: Features.MLDSA_LINK_PUBKEY,
             data: {
-                verifyRequest: !!parameters.revealMLDSAPublicKey,
+                verifyRequest: shouldReveal,
                 publicKey: mldsaSigner.publicKey,
                 hashedPublicKey: this.hashedPublicKey,
                 level: getLevelFromPublicKeyLength(mldsaSigner.publicKey.length),

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@btc-vision/transaction",
     "type": "module",
-    "version": "1.8.7",
+    "version": "1.8.9",
     "author": "BlobMaster41",
     "description": "OPNet transaction library allows you to create and sign transactions for the OPNet network.",
     "engines": {

package/src/epoch/validator/EpochValidator.ts

@@ -14,18 +14,37 @@ export class EpochValidator {
     }
 
     /**
-     * Calculate mining preimage
+     * Calculate mining preimage.
+     *
+     * When useConcatenatedPreimage is false the legacy XOR construction is used
+     * (checksumRoot ^ publicKey ^ salt). That construction is malleable: a
+     * miner can set salt == publicKey to force preimage == checksumRoot (max
+     * difficulty for free), or transform any solution to another key via
+     * salt' = publicKey' ^ publicKey ^ salt. When useConcatenatedPreimage is true
+     * the preimage is the 96-byte concatenation checksumRoot || publicKey || salt,
+     * which removes both (the SHA-1 proof-of-work over it is unchanged).
+     *
+     * The switch is a consensus rule: callers pass useConcatenatedPreimage =
+     * (epochBlockHeight >= activationHeight) using the activation height for the
+     * network they are on (opnet-node exposes it as
+     * consensusEpochPatches.PREIMAGE_CONCAT_PATCH_BLOCK_HEIGHT). The value MUST be
+     * identical across opnet-node, this library and the mining pool.
      */
     public static calculatePreimage(
         checksumRoot: Uint8Array,
         publicKey: Uint8Array,
         salt: Uint8Array,
+        useConcatenatedPreimage: boolean = false,
     ): Uint8Array {
         // Ensure all are 32 bytes
         if (checksumRoot.length !== 32 || publicKey.length !== 32 || salt.length !== 32) {
             throw new Error('All inputs must be 32 bytes');
         }
 
+        if (useConcatenatedPreimage) {
+            return this.concatenatePreimage(checksumRoot, publicKey, salt);
+        }
+
         const preimage = new Uint8Array(32);
         for (let i = 0; i < 32; i++) {
             preimage[i] =
@@ -35,6 +54,30 @@ export class EpochValidator {
         return preimage;
     }
 
+    /**
+     * Non-malleable mining preimage: the 96-byte concatenation
+     * checksumRoot || publicKey || salt. The public key sits in its own segment,
+     * so a miner-chosen salt can neither cancel it nor be transformed to
+     * re-attribute another miner's solution. The SHA-1 proof-of-work over it is
+     * unchanged.
+     */
+    public static concatenatePreimage(
+        checksumRoot: Uint8Array,
+        publicKey: Uint8Array,
+        salt: Uint8Array,
+    ): Uint8Array {
+        if (checksumRoot.length !== 32 || publicKey.length !== 32 || salt.length !== 32) {
+            throw new Error('All inputs must be 32 bytes');
+        }
+
+        const message = new Uint8Array(96);
+        message.set(checksumRoot, 0);
+        message.set(publicKey, 32);
+        message.set(salt, 64);
+
+        return message;
+    }
+
     /**
      * Count matching bits between two hashes
      */
@@ -69,13 +112,18 @@ export class EpochValidator {
     /**
      * Verify an epoch solution using IPreimage
      */
-    public static verifySolution(challenge: IChallengeSolution, log: boolean = false): boolean {
+    public static verifySolution(
+        challenge: IChallengeSolution,
+        log: boolean = false,
+        useConcatenatedPreimage: boolean = false,
+    ): boolean {
         try {
             const verification = challenge.verification;
             const calculatedPreimage = this.calculatePreimage(
                 verification.targetChecksum,
                 challenge.publicKey.toBuffer(),
                 challenge.salt,
+                useConcatenatedPreimage,
             );
 
             const computedSolution = this.sha1(calculatedPreimage);
@@ -118,7 +166,10 @@ export class EpochValidator {
     /**
      * Validate epoch winner from raw data
      */
-    public static validateEpochWinner(epochData: RawChallenge): boolean {
+    public static validateEpochWinner(
+        epochData: RawChallenge,
+        useConcatenatedPreimage: boolean = false,
+    ): boolean {
         try {
             const epochNumber = BigInt(epochData.epochNumber);
             const publicKey = Address.fromString(
@@ -143,6 +194,7 @@ export class EpochValidator {
                 verification.targetChecksum,
                 publicKey.toBuffer(),
                 salt,
+                useConcatenatedPreimage,
             );
 
             const computedSolution = this.sha1(calculatedPreimage);
@@ -172,8 +224,11 @@ export class EpochValidator {
     /**
      * Validate epoch winner from Preimage instance
      */
-    public static validateChallengeSolution(challenge: IChallengeSolution): boolean {
-        return this.verifySolution(challenge);
+    public static validateChallengeSolution(
+        challenge: IChallengeSolution,
+        useConcatenatedPreimage: boolean = false,
+    ): boolean {
+        return this.verifySolution(challenge, false, useConcatenatedPreimage);
     }
 
     /**
@@ -187,8 +242,14 @@ export class EpochValidator {
         targetChecksum: Uint8Array,
         publicKey: Uint8Array,
         salt: Uint8Array,
+        useConcatenatedPreimage: boolean = false,
     ): Uint8Array {
-        const preimage = this.calculatePreimage(targetChecksum, publicKey, salt);
+        const preimage = this.calculatePreimage(
+            targetChecksum,
+            publicKey,
+            salt,
+            useConcatenatedPreimage,
+        );
         return this.sha1(preimage);
     }
 

package/src/transaction/builders/TransactionBuilder.ts

@@ -983,8 +983,25 @@ export abstract class TransactionBuilder<T extends TransactionType> extends Twea
         const mldsaSigner = this.mldsaSigner;
         const legacySignature = this.generateLegacySignature();
 
+        // Reveal by default. The legacy Schnorr signature only proves ownership of
+        // the Bitcoin key being linked; it says nothing about the claimed
+        // hashedPublicKey. Without the ML-DSA public key and a signature over it,
+        // a link request carries no proof that the sender knows a preimage for
+        // that hash, so a node cannot safely create a NEW identity from it.
+        //
+        // Defaulting to false made every caller responsible for remembering, and
+        // callers do forget: opwallet never set this anywhere, and its deployment
+        // screen calls signDeployment() directly, bypassing any controller-level
+        // fix. Revealing when it was not needed only costs bytes (ML-DSA-44:
+        // 1312-byte key + 2420-byte signature); not revealing when it was needed
+        // gets the transaction rejected.
+        //
+        // Callers that KNOW the key is already linked on-chain should pass false
+        // explicitly to avoid paying for the reveal on every interaction.
+        const shouldReveal = parameters.revealMLDSAPublicKey ?? true;
+
         let mldsaSignature: Uint8Array | null = null;
-        if (parameters.revealMLDSAPublicKey) {
+        if (shouldReveal) {
             mldsaSignature = this.generateMLDSASignature();
         }
 
@@ -992,7 +1009,7 @@ export abstract class TransactionBuilder<T extends TransactionType> extends Twea
             priority: FeaturePriority.MLDSA_LINK_PUBKEY,
             opcode: Features.MLDSA_LINK_PUBKEY,
             data: {
-                verifyRequest: !!parameters.revealMLDSAPublicKey,
+                verifyRequest: shouldReveal,
                 publicKey: mldsaSigner.publicKey,
                 hashedPublicKey: this.hashedPublicKey,
                 level: getLevelFromPublicKeyLength(mldsaSigner.publicKey.length),