@corpus-core/colibri-stateless 0.4.11 → 0.5.1

package/index.d.ts

@@ -26,12 +26,14 @@ import { EthSubscribeSubscriptionType, EthNewFilterType } from './subscriptionMa
 import Strategy from './strategy.js';
 export { Strategy };
 export { ProviderRpcError, RequestArguments, Cache, C4Config, DataRequest, C4MethodType as MethodType, ProviderMessage, EthSubscribeSubscriptionType, EthNewFilterType };
+export { TransactionVerifier, PrototypeProtection } from './transactionVerifier.js';
 export declare function handle_request(req: DataRequest, conf: C4Config): Promise<void>;
 export default class C4Client {
     config: C4Config;
     private eventEmitter;
     private connectionState;
     private subscriptionManager;
+    private static readonly CRITICAL_METHODS;
     constructor(config?: Partial<C4Config>);
     private getProoferConfig;
     private get flags();

package/index.js

@@ -27,9 +27,12 @@ import { ConnectionState } from './connectionState.js';
 import { ProviderRpcError, MethodType as C4MethodType } from './types.js';
 import { SubscriptionManager } from './subscriptionManager.js';
 import Strategy from './strategy.js';
+import { TransactionVerifier, PrototypeProtection } from './transactionVerifier.js';
 export { Strategy };
 // Re-export types needed by consumers of the C4Client module
 export { ProviderRpcError, C4MethodType as MethodType };
+// Re-export transaction verification utilities
+export { TransactionVerifier, PrototypeProtection } from './transactionVerifier.js';
 async function fetch_rpc(urls, payload, as_proof = false) {
     let last_error = "All nodes failed";
     for (const url of urls) {
@@ -190,10 +193,17 @@ export default class C4Client {
     eventEmitter;
     connectionState;
     subscriptionManager;
+    // Schutz vor Prototype Pollution durch Einfrieren kritischer Methoden
+    static CRITICAL_METHODS = ['rpc', 'request', 'verifyProof', 'createProof'];
+    static {
+        // Schutz vor Prototype Pollution anwenden
+        PrototypeProtection.protectClass(C4Client, C4Client.CRITICAL_METHODS);
+    }
     constructor(config) {
         const chainId = config?.chainId ? get_chain_id(config?.chainId + '') : 1;
         const chain_config = { ...default_config[chainId + ''] };
-        this.config = {
+        // Schutz vor Config-Manipulation durch Deep-Freeze
+        const baseConfig = {
             chains: {},
             trusted_block_hashes: [],
             rpcs: chain_config.rpcs || [],
@@ -202,6 +212,9 @@ export default class C4Client {
             ...config, // User config overrides defaults
             chainId,
         };
+        // Schutz vor Config-Manipulation anwenden
+        PrototypeProtection.protectConfig(baseConfig, ['rpcs', 'beacon_apis', 'proofer', 'trusted_block_hashes']);
+        this.config = baseConfig;
         if (!this.config.warningHandler)
             this.config.warningHandler = async (req, message) => console.warn(message);
         if (!this.config.proofStrategy)
@@ -317,6 +330,10 @@ export default class C4Client {
     async rpc(method, args, method_type) {
         // eth_subscribe and eth_unsubscribe are handled by C4Client.request before this method is called.
         // This rpc method is for the underlying data fetching/proving.
+        // Spezielle Behandlung für eth_sendTransaction mit Verifikation
+        if (method === 'eth_sendTransaction' && this.config.verifyTransactions) {
+            return await TransactionVerifier.verifyAndSendTransaction(args[0], this.config, (method, args, methodType) => this.rpc(method, args, methodType), fetch_rpc);
+        }
         if (method_type === undefined)
             method_type = await this.getMethodSupport(method);
         switch (method_type) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@corpus-core/colibri-stateless",
-    "version": "0.4.11",
+    "version": "0.5.1",
     "description": "Colibri is a stateless and trustless ethereum client, which is optimized for the mobile apps or embedded devices, because it does not hols the state, but verifies on demand.",
     "main": "index.js",
     "type": "module",

package/transactionVerifier.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Copyright (c) 2025 corpus.core
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+import { MethodType as C4MethodType } from './types.js';
+/**
+ * Transaction Verifier - Sichere Verifikation von eth_sendTransaction
+ *
+ * Implementiert eine Sicherheitsschicht gegen NPM Supply-Chain-Attacks:
+ * 1. Transaction über fallbackProvider signieren lassen
+ * 2. Signierte Transaction mit eth_decodeTransaction dekodieren
+ * 3. Dekodierte Parameter mit Original vergleichen
+ * 4. Bei Übereinstimmung: eth_sendRawTransaction ausführen
+ */
+export interface TransactionVerifierConfig {
+    debug?: boolean;
+    chainId: number | string;
+    fallback_provider?: any;
+    rpcs: string[];
+}
+export declare class TransactionVerifier {
+    /**
+     * Verifizierte Ausführung von eth_sendTransaction
+     * 1. Transaction über fallbackProvider signieren lassen
+     * 2. Signierte Transaction mit eth_decodeTransaction dekodieren
+     * 3. Dekodierte Parameter mit Original vergleichen
+     * 4. eth_sendRawTransaction ausführen
+     */
+    static verifyAndSendTransaction(txObject: any, config: TransactionVerifierConfig, rpcMethod: (method: string, args: any[], method_type?: C4MethodType) => Promise<any>, fetchRpc: (urls: string[], payload: any, as_proof?: boolean) => Promise<any>): Promise<string>;
+    /**
+     * Vergleicht die Parameter einer ursprünglichen Transaction mit einer dekodierten signierten Transaction
+     */
+    private static compareTransactionParameters;
+    /**
+     * Normalisiert Hex-Werte für Vergleiche (entfernt führende Nullen, stellt 0x-Prefix sicher)
+     */
+    private static normalizeHexValue;
+}
+/**
+ * Prototype Protection - Schutz vor NPM Supply-Chain-Attacks
+ *
+ * Friert kritische Prototypen und Methoden ein, um Manipulation zu verhindern
+ */
+export declare class PrototypeProtection {
+    /**
+     * Schützt eine Klasse vor Prototype Pollution
+     */
+    static protectClass<T>(targetClass: new (...args: any[]) => T, criticalMethods?: readonly string[]): void;
+    /**
+     * Schützt ein Konfigurationsobjekt vor Manipulation
+     */
+    static protectConfig(config: any, criticalArrays?: string[]): void;
+}
+/**
+ * Transaction Utilities - Hilfsfunktionen für Transaction-Handling
+ */
+export declare class TransactionUtils {
+    /**
+     * Validiert ein Transaction-Objekt
+     */
+    static validateTransactionObject(txObject: any): boolean;
+    /**
+     * Bereinigt Transaction-Parameter für verschiedene Standards
+     */
+    static cleanupTransactionParams(txObject: any): any;
+    /**
+     * Erstellt eine Zusammenfassung einer Transaction für Logging
+     */
+    static summarizeTransaction(txObject: any): string;
+}
+declare const _default: {
+    TransactionVerifier: typeof TransactionVerifier;
+    PrototypeProtection: typeof PrototypeProtection;
+    TransactionUtils: typeof TransactionUtils;
+};
+export default _default;

package/transactionVerifier.js

@@ -0,0 +1,196 @@
+/**
+ * Copyright (c) 2025 corpus.core
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+import { ProviderRpcError, MethodType as C4MethodType } from './types.js';
+export class TransactionVerifier {
+    /**
+     * Verifizierte Ausführung von eth_sendTransaction
+     * 1. Transaction über fallbackProvider signieren lassen
+     * 2. Signierte Transaction mit eth_decodeTransaction dekodieren
+     * 3. Dekodierte Parameter mit Original vergleichen
+     * 4. eth_sendRawTransaction ausführen
+     */
+    static async verifyAndSendTransaction(txObject, config, rpcMethod, fetchRpc) {
+        if (config.debug)
+            console.log('[TransactionVerifier] Verifying transaction before sending:', txObject);
+        if (!config.fallback_provider) {
+            throw new ProviderRpcError(4203, 'Transaction verification requires fallback_provider to be configured');
+        }
+        try {
+            // 1. Transaction über fallbackProvider signieren lassen
+            const signedRawTx = await config.fallback_provider.request({
+                method: 'eth_signTransaction',
+                params: [txObject]
+            });
+            // 2. Signierte Transaction dekodieren
+            const decodedTx = await rpcMethod('eth_decodeTransaction', [signedRawTx], C4MethodType.LOCAL);
+            // 3. Dekodierte Parameter mit Original vergleichen
+            const isValid = this.compareTransactionParameters(txObject, decodedTx, config);
+            if (!isValid) {
+                throw new ProviderRpcError(4201, 'Signed transaction does not match original parameters');
+            }
+            // 4. Verifizierte Transaction senden
+            return await fetchRpc(config.rpcs, {
+                method: 'eth_sendRawTransaction',
+                params: [signedRawTx]
+            }, false);
+        }
+        catch (error) {
+            if (config.debug)
+                console.error('[TransactionVerifier] Transaction verification failed:', error);
+            throw new ProviderRpcError(4202, `Transaction verification failed: ${error.message}`);
+        }
+    }
+    /**
+     * Vergleicht die Parameter einer ursprünglichen Transaction mit einer dekodierten signierten Transaction
+     */
+    static compareTransactionParameters(original, decoded, config) {
+        if (config.debug) {
+            console.log('[TransactionVerifier] Comparing transaction parameters:');
+            console.log('Original:', original);
+            console.log('Decoded:', decoded);
+        }
+        // Kritische Parameter vergleichen
+        const criticalFields = ['to', 'value', 'data', 'gas', 'gasPrice', 'maxFeePerGas', 'maxPriorityFeePerGas', 'nonce'];
+        for (const field of criticalFields) {
+            if (original[field] !== undefined) {
+                // Normalisierung für Hex-Werte (0x-Prefix, Leading Zeros)
+                const originalValue = this.normalizeHexValue(original[field]);
+                const decodedValue = this.normalizeHexValue(decoded[field]);
+                if (originalValue !== decodedValue) {
+                    if (config.debug) {
+                        console.warn(`[TransactionVerifier] Transaction parameter mismatch in '${field}': original='${originalValue}', decoded='${decodedValue}'`);
+                    }
+                    return false;
+                }
+            }
+        }
+        // ChainId prüfen
+        if (decoded.chainId && parseInt(decoded.chainId, 16) !== parseInt(config.chainId)) {
+            if (config.debug) {
+                console.warn(`[TransactionVerifier] ChainId mismatch: expected=${config.chainId}, decoded=${parseInt(decoded.chainId, 16)}`);
+            }
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Normalisiert Hex-Werte für Vergleiche (entfernt führende Nullen, stellt 0x-Prefix sicher)
+     */
+    static normalizeHexValue(value) {
+        if (value === undefined || value === null)
+            return '';
+        if (typeof value === 'number')
+            return '0x' + value.toString(16);
+        const str = value.toString();
+        if (!str.startsWith('0x'))
+            return '0x' + str;
+        // Führende Nullen entfernen, aber mindestens eine Ziffer behalten
+        const withoutPrefix = str.slice(2);
+        const normalized = withoutPrefix.replace(/^0+/, '') || '0';
+        return '0x' + normalized;
+    }
+}
+/**
+ * Prototype Protection - Schutz vor NPM Supply-Chain-Attacks
+ *
+ * Friert kritische Prototypen und Methoden ein, um Manipulation zu verhindern
+ */
+export class PrototypeProtection {
+    /**
+     * Schützt eine Klasse vor Prototype Pollution
+     */
+    static protectClass(targetClass, criticalMethods = []) {
+        // Einfrieren des Prototypes
+        Object.freeze(targetClass.prototype);
+        // Kritische Methoden gegen Überschreibung schützen
+        criticalMethods.forEach(method => {
+            const descriptor = Object.getOwnPropertyDescriptor(targetClass.prototype, method);
+            if (descriptor) {
+                Object.defineProperty(targetClass.prototype, method, {
+                    ...descriptor,
+                    writable: false,
+                    configurable: false
+                });
+            }
+        });
+    }
+    /**
+     * Schützt ein Konfigurationsobjekt vor Manipulation
+     */
+    static protectConfig(config, criticalArrays = []) {
+        // Kritische Arrays einfrieren
+        criticalArrays.forEach(arrayName => {
+            if (config[arrayName] && Array.isArray(config[arrayName])) {
+                Object.freeze(config[arrayName]);
+            }
+        });
+    }
+}
+/**
+ * Transaction Utilities - Hilfsfunktionen für Transaction-Handling
+ */
+export class TransactionUtils {
+    /**
+     * Validiert ein Transaction-Objekt
+     */
+    static validateTransactionObject(txObject) {
+        if (!txObject || typeof txObject !== 'object')
+            return false;
+        // Mindestanforderungen
+        if (!txObject.to && !txObject.data)
+            return false; // Entweder to-Adresse oder data für Contract-Creation
+        return true;
+    }
+    /**
+     * Bereinigt Transaction-Parameter für verschiedene Standards
+     */
+    static cleanupTransactionParams(txObject) {
+        const cleaned = { ...txObject };
+        // EIP-1559 vs Legacy Gas-Handling
+        if (cleaned.maxFeePerGas || cleaned.maxPriorityFeePerGas) {
+            // EIP-1559 - gasPrice entfernen
+            delete cleaned.gasPrice;
+        }
+        else if (cleaned.gasPrice) {
+            // Legacy - EIP-1559 Felder entfernen
+            delete cleaned.maxFeePerGas;
+            delete cleaned.maxPriorityFeePerGas;
+        }
+        return cleaned;
+    }
+    /**
+     * Erstellt eine Zusammenfassung einer Transaction für Logging
+     */
+    static summarizeTransaction(txObject) {
+        const to = txObject.to || 'Contract Creation';
+        const value = txObject.value ? `${parseInt(txObject.value, 16)} wei` : '0 wei';
+        const gas = txObject.gas ? parseInt(txObject.gas, 16) : 'auto';
+        return `Transaction(to: ${to}, value: ${value}, gas: ${gas})`;
+    }
+}
+// Export aller Klassen als Default
+export default {
+    TransactionVerifier,
+    PrototypeProtection,
+    TransactionUtils
+};

package/types.d.ts

@@ -57,6 +57,7 @@ export interface ChainConfig {
     verify?: (method: string, args: any[]) => boolean;
     pollingInterval?: number;
     proofStrategy?: ProofStrategy;
+    verifyTransactions?: boolean;
 }
 export interface EIP1193Client {
     request(args: RequestArguments): Promise<unknown>;