@exodus/web3-ethereum-utils 4.7.6 → 5.0.1

package/lib/signatures.js

@@ -18,9 +18,23 @@ export function signTransaction(transactionParams, privateKey) {
     const signedTransaction = transaction.sign(privateKey);
     return signedTransaction.serialize();
 }
+const HEX_BODY = /^[0-9a-fA-F]*$/;
 export function hex0xStringToBuffer(hex) {
+    if (typeof hex !== 'string') {
+        throw new TypeError('expected a hex string');
+    }
     // Remove the 0x
     const hexWithout0x = hex.startsWith('0x') ? hex.slice(2) : hex;
+    // `Buffer.from(str, 'hex')` decodes the leading valid pairs of `str` and SILENTLY DROPS
+    // the remainder, without error. Anything not fully hex therefore produced a buffer that
+    // no longer corresponds to its input: `<hex> Login only.` decoded to `<hex>`, an
+    // uppercase `0X` prefix decoded to nothing, and plain text decoded to nothing at all --
+    // so `personal_sign` signed bytes that were never on screen, and every plain-text
+    // message signed as the EMPTY message, whose hash is a constant. A partial decode is
+    // never what the caller meant, so refuse it instead of guessing.
+    if (!HEX_BODY.test(hexWithout0x)) {
+        throw new TypeError('expected a hex string');
+    }
     // Pad the value until even
     const hexWithLeadingZeros = hexWithout0x.length % 2 === 0 ? hexWithout0x : '0' + hexWithout0x;
     // Finally  return the buffer
@@ -28,11 +42,11 @@ export function hex0xStringToBuffer(hex) {
 }
 export function bufferToHex0xString(buf) {
     if (!Buffer.isBuffer(buf)) {
-        throw new Error('expected a buffer');
+        throw new TypeError('expected a buffer');
     }
     const hex = buf.toString('hex');
     if (typeof hex !== 'string') {
-        throw new Error('expected hex string');
+        throw new TypeError('expected hex string');
     }
     return '0x' + hex;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@exodus/web3-ethereum-utils",
   "description": "Web3 Ethereum utils.",
-  "version": "4.7.6",
+  "version": "5.0.1",
   "type": "module",
   "sideEffects": false,
   "module": "lib/index.js",
@@ -27,21 +27,21 @@
   },
   "license": "MIT",
   "scripts": {
-    "clean": "run -T rimraf lib",
-    "build": "yarn clean &&  run -T tsc",
-    "lint": "run -T eslintc .",
-    "lint:fix": "yarn lint --fix",
-    "prepublishOnly": "yarn run -T build --scope @exodus/web3-ethereum-utils",
-    "test": "run -T exodus-test --jest --esbuild"
+    "clean": "rimraf lib",
+    "build": "pnpm clean &&  tsc",
+    "prepublishOnly": "pnpm -w run build --scope @exodus/web3-ethereum-utils",
+    "test": "exodus-test --jest --esbuild"
   },
   "devDependencies": {
     "@exodus/assets": "^11.10.0",
-    "@exodus/ethereum-meta": "^2.12.0",
+    "@exodus/ethereum-meta": "^2.13.0",
+    "@types/bn.js": "^5.1.6",
+    "@types/minimalistic-assert": "^1.0.3",
     "lodash": "^4.17.21"
   },
   "dependencies": {
     "@exodus/basic-utils": "^3.0.1",
-    "@exodus/ethereum-api": "^8.76.4",
+    "@exodus/ethereum-api": "^9.0.0",
     "@exodus/ethereum-lib": "^5.20.0",
     "@exodus/ethereumjs": "^1.5.0",
     "@exodus/solidity-contract": "^1.2.1",
@@ -55,5 +55,5 @@
     "url": "https://github.com/ExodusMovement/assets/issues?q=is%3Aissue+is%3Aopen+label%3Aweb3-ethereum-utils"
   },
   "homepage": "https://github.com/ExodusMovement/assets/tree/master/web3/web3-ethereum-utils",
-  "gitHead": "6defbed4f39a326cb0c2d5fcdadf3f2abfb83a46"
+  "gitHead": "92d6cdde313e5244fb05a99b1be964a96f989c3b"
 }