@exodus/solana-lib 1.6.8 → 1.6.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/solana-lib",
-  "version": "1.6.8",
+  "version": "1.6.9",
   "description": "Exodus internal Solana low-level library",
   "main": "src/index.js",
   "files": [
@@ -26,6 +26,5 @@
     "create-hash": "^1.1.3",
     "lodash": "^4.17.11",
     "tweetnacl": "^1.0.3"
-  },
-  "gitHead": "846ed76714355879216f43c6be8ec2b072169635"
+  }
 }

package/src/tx/sign-message.js

@@ -1,11 +1,45 @@
+import assert from 'assert'
 import nacl from 'tweetnacl'
 import bs58 from 'bs58'
 
+import { Message } from '../vendor/message'
 import { getKeyPairFromPrivateKey } from '../keypair'
 
+function isLegacyMessage(data) {
+  try {
+    const message = Message.from(data)
+    message.serialize() // Invalid messages will throw on serialization.
+    return true
+  } catch (err) {
+    return false
+  }
+}
+
+function isVersionedMessage(data) {
+  if (data.length > 1) {
+    // We deploy a heuristic to detect transaction messages.
+    // The first bytes of a transaction message contains its version number
+    // so we ban all bytes starting at 0x80 and ending at 0xFE
+    // 0xFF is allowed because that is used for offchain messages
+    return data[0] >= 0x80 && data[0] !== 0xff
+  } else {
+    return false
+  }
+}
+
+export function isTransactionMessage(data) {
+  const messageBuffer = Buffer.from(data)
+  return isLegacyMessage(messageBuffer) || isVersionedMessage(messageBuffer)
+}
+
 export default function signMessage({ message, privateKey }) {
   const { secretKey } = getKeyPairFromPrivateKey(privateKey)
-  const signature = nacl.sign.detached(bs58.decode(message), secretKey)
+  const messageBuffer = bs58.decode(message)
+  assert(
+    !isTransactionMessage(messageBuffer),
+    'attempted to sign transaction using message signing'
+  )
+  const signature = nacl.sign.detached(messageBuffer, secretKey)
   const bs58Signature = bs58.encode(signature)
   return bs58Signature
 }