@exodus/bip322-js 3.2.0 → 3.2.1

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.2.1](https://github.com/ExodusMovement/exodus-hydra/compare/@exodus/bip322-js@3.2.0...@exodus/bip322-js@3.2.1) (2026-04-22)
+
+### Bug Fixes
+
+- fix(bip322-js): reject oversized DER R/S lengths (ECDSA malleability) (#16083)
+
 ## [3.2.0](https://github.com/ExodusMovement/exodus-hydra/compare/@exodus/bip322-js@3.1.0...@exodus/bip322-js@3.2.0) (2025-12-26)
 
 ### Features

package/dist/bitcoinjs/DecodeScriptSignature.js

@@ -12,8 +12,10 @@ export function decodeScriptSignature(buffer) {
 function fromDER(x) {
     if (x[0] === 0x00)
         x = x.slice(1);
+    if (x.length > 32)
+        throw new Error('Value length is too long');
     const buffer = Buffer.alloc(32, 0);
-    const bstart = Math.max(0, 32 - x.length);
+    const bstart = 32 - x.length;
     x.copy(buffer, bstart);
     return buffer;
 }
@@ -33,6 +35,8 @@ function decode2(buffer) {
         throw new Error('R length is zero');
     if (5 + lenR >= buffer.length)
         throw new Error('R length is too long');
+    if (lenR > 33)
+        throw new Error('R length is too long');
     if (buffer[4 + lenR] !== 0x02)
         throw new Error('Expected DER integer (2)');
     const lenS = buffer[5 + lenR];
@@ -40,6 +44,8 @@ function decode2(buffer) {
         throw new Error('S length is zero');
     if (6 + lenR + lenS !== buffer.length)
         throw new Error('S length is invalid');
+    if (lenS > 33)
+        throw new Error('S length is too long');
     if (buffer[4] & 0x80)
         throw new Error('R value is negative');
     if (lenR > 1 && buffer[4] === 0x00 && !(buffer[5] & 0x80)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/bip322-js",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "A Javascript library that provides utility functions related to the BIP-322 signature scheme",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -43,7 +43,7 @@
     "typescript": "^5.1.3"
   },
   "dependencies": {
-    "@exodus/asset-types": "^0.3.0",
+    "@exodus/asset-types": "^0.5.0",
     "@exodus/bitcoinjs": "^2.0.0",
     "@exodus/bytes": "^1.0.0-rc.8",
     "@exodus/crypto": "^1.0.0-rc.26",
@@ -57,5 +57,5 @@
   "bugs": {
     "url": "https://github.com/ExodusMovement/exodus-hydra/issues?q=is%3Aissue+is%3Aopen+label%3Abip322-js"
   },
-  "gitHead": "dab4f446f30bf73babe598463627eaad6e14fa4b"
+  "gitHead": "9eb3d238b1c333391f6963c53d8816ed58d926de"
 }