@exodus/bitcoin-api 4.0.2 → 4.0.4

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.0.4](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.0.3...@exodus/bitcoin-api@4.0.4) (2025-09-16)
+
+
+### Bug Fixes
+
+
+* fix: mixed input transactions incorrectly classified as receive (#6472)
+
+
+
+## [4.0.3](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.0.2...@exodus/bitcoin-api@4.0.3) (2025-09-05)
+
+
+### Bug Fixes
+
+
+* fix: update bip32 to ^4.1.0 (#6406)
+
+
+
 ## [4.0.2](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.0.1...@exodus/bitcoin-api@4.0.2) (2025-09-01)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/bitcoin-api",
-  "version": "4.0.2",
+  "version": "4.0.4",
   "description": "Bitcoin transaction and fee monitors, RPC with the blockchain node, other networking code.",
   "type": "module",
   "main": "src/index.js",
@@ -22,7 +22,7 @@
   "dependencies": {
     "@exodus/asset-lib": "^5.0.0",
     "@exodus/basic-utils": "^3.0.1",
-    "@exodus/bip32": "^3.3.0",
+    "@exodus/bip32": "^4.1.0",
     "@exodus/bip322-js": "^2.1.0",
     "@exodus/bip44-constants": "^195.0.0",
     "@exodus/bitcoin-lib": "^2.4.3",
@@ -59,5 +59,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "afae6f33fd023d0acd33ee536c4bbad98147312d"
+  "gitHead": "1e736fa10b97d17bfa72bdbac09b57dc64b34d44"
 }

package/src/sign-message.js

@@ -5,7 +5,7 @@ export const signMessage = async ({ privateKey, message: _message }) => {
   assert(_message?.bip322Message, `expected bip322Message`)
 
   const { address, message } = _message.bip322Message
-  const signedMessage = Signer.sign(Buffer.from(privateKey), address, message)
+  const signedMessage = await Signer.signAsync(Buffer.from(privateKey), address, message)
 
   return Buffer.isBuffer(signedMessage) ? signedMessage : Buffer.from(signedMessage, 'base64')
 }

package/src/tx-log/bitcoin-monitor-scanner.js

@@ -451,6 +451,9 @@ export class BitcoinMonitorScanner {
 
       // if txItem.vin has an address that matches ours, means we've spent this tx
       let isSent = false
+      // Track whether all non-coinbase inputs belong to our wallet
+      let allInputsAreOurs = true
+
       txItem.vin.forEach((vin) => {
         // It's an coinbase vin
         if (Object.keys(vin).length === 0) return
@@ -459,7 +462,12 @@ export class BitcoinMonitorScanner {
         from.push(vin.addr)
 
         const address = addrMap[vin.addr]
-        if (!address) return
+        if (!address) {
+          // This input doesn't belong to our wallet
+          allInputsAreOurs = false
+          return
+        }
+
         // it came from us...
         txLogItem.coinAmount = txLogItem.coinAmount.sub(currency.defaultUnit(vin.value))
         isSent = true
@@ -597,12 +605,16 @@ export class BitcoinMonitorScanner {
         if (isSelfSent) {
           txLogItem.selfSend = true
           txLogItem.coinAmount = currency.ZERO
-        } else {
+        } else if (allInputsAreOurs) {
           // we want coinAmount to be without the fee
-          // so far coinAmount = -vins + vouts (to us) = - (sent amount + fees)
+          // so far coinAmount = -vins (from us) + vouts (to us) = - (sent amount + fees)
           // add fees to get only sent amount
+          // Only do this adjustment when ALL inputs belong to our wallet to avoid
+          // false positives in mixed-input transactions (collaborative transactions like coinjoin)
           txLogItem.coinAmount = txLogItem.coinAmount.add(txLogItem.feeAmount)
         }
+        // If not all inputs are ours, leave coinAmount as-is to avoid misclassification
+        // coinAmount = -vins (from us) + vouts (to us), which will be negative for send transactions
       } else {
         txLogItem.from = from
       }

package/src/tx-sign/create-get-key-and-purpose.js

@@ -1,9 +1,9 @@
 import { getOwnProperty, memoize } from '@exodus/basic-utils'
-import { ECPair } from '@exodus/bitcoinjs'
 import { privateKeyToPublicKey } from '@exodus/crypto/secp256k1'
 import KeyIdentifier from '@exodus/key-identifier'
 import BipPath from 'bip32-path'
 import assert from 'minimalistic-assert'
+import WIF from 'wif'
 
 export const createGetKeyWithMetadata = ({
   signer,
@@ -32,7 +32,7 @@ export const createGetKeyWithMetadata = ({
         return getPrivateKeyFromMap(privateKeysAddressMap, networkInfo, purpose, address)
       }
 
-      return getPrivateKeyFromHDKeys(hdkeys, addressPathsMap, networkInfo, purpose, address)
+      return getPrivateKeyFromHDKeys(hdkeys, addressPathsMap, purpose, address)
     },
     ({ address, derivationPath }) => address + '_' + derivationPath
   )
@@ -41,30 +41,22 @@ function standardGetPrivateKeyFromMap(privateKeysAddressMap, networkInfo, purpos
   const privateWif = getOwnProperty(privateKeysAddressMap, address, 'string')
   assert(privateWif, `there is no private key for address ${address}`)
 
-  // ECPair.fromWIF() rejects network objects whose pubKeyHash/scriptHash are wider than one byte (UInt8).
-  // so we skip the network argument in that case and let the library infer it from the WIF prefix.
-  const useNet =
-    networkInfo && networkInfo.pubKeyHash <= 0xff && networkInfo.scriptHash <= 0xff
-      ? networkInfo
-      : undefined
-
-  const { privateKey, compressed } = useNet
-    ? ECPair.fromWIF(privateWif, useNet)
-    : ECPair.fromWIF(privateWif)
+  // networkInfo is coininfo('{something}').toBitcoinJS()
+  const useNet = networkInfo || { wif: 0x80 } // default to bitcoin
+  const { privateKey, compressed, version } = WIF.decode(privateWif)
+  if (version !== useNet.wif) throw new Error('Invalid network version')
 
   const publicKey = privateKeyToPublicKey({ privateKey, compressed, format: 'buffer' })
-  return { privateKey, publicKey, purpose }
+  return { privateKey: Buffer.from(privateKey), publicKey, purpose }
 }
 
-function getPrivateKeyFromHDKeys(hdkeys, addressPathsMap, networkInfo, purpose, address) {
+function getPrivateKeyFromHDKeys(hdkeys, addressPathsMap, purpose, address) {
   const path = getOwnProperty(addressPathsMap, address, 'string')
   assert(hdkeys, 'hdkeys must be provided')
   assert(purpose, `purpose for address ${address} could not be resolved`)
   const hdkey = hdkeys[purpose]
   assert(hdkey, `hdkey for purpose for ${purpose} and address ${address} could not be resolved`)
-  const derivedhdkey = hdkey.derive(path)
-  const { privateKey } = ECPair.fromPrivateKey(derivedhdkey.privateKey, { network: networkInfo })
-  const publicKey = derivedhdkey.publicKey
+  const { privateKey, publicKey } = hdkey.derive(path)
   return { privateKey, publicKey, purpose }
 }