@hwlt/era-connect 0.4.0 → 0.5.0

package/dist/verify.js

@@ -1,17 +1,236 @@
 import { A as utf8Encode, D as hexToBytes, E as equalBytes, K as EraSdkError, T as concatBytes, k as utf8Decode, w as bytesToHex } from "./shared-Bbgejrus.js";
 import { i as parsePath } from "./keypath-Bvv_cfHt.js";
-import { a as cardanoSoftDerivePath } from "./derive-CK9Nc9Jc.js";
+import { n as decodeCashAddr } from "./cashaddr-BIzawizX.js";
+import { o as cardanoSoftDerivePath } from "./derive-00JUOkmn.js";
 import { n as parseWitnessSet } from "./cardano-BCT55gwf.js";
+import { a as firstBytes, i as splitSignedTronTx, o as firstVarint, s as readFields } from "./messages--XbVef_k.js";
 import { n as EvmDataType, r as foldRecoveryId } from "./evm-CI1cuZsp.js";
 import { n as suiIntentDigest } from "./sui-BtbPG6Xt.js";
 import { n as TonDataType } from "./ton-BSPKU5B9.js";
-import { a as firstVarint, i as firstBytes, o as readFields, r as splitSignedTronTx } from "./messages-DbnXy3dC.js";
 import { secp256k1 } from "@noble/curves/secp256k1";
 import { blake2b } from "@noble/hashes/blake2b";
+import { ripemd160 } from "@noble/hashes/ripemd160";
 import { sha256, sha512 } from "@noble/hashes/sha2";
 import { keccak_256 } from "@noble/hashes/sha3";
 import { createBase58check } from "@scure/base";
 import { ed25519 } from "@noble/curves/ed25519";
+//#region src/verify/result.ts
+const verified = {
+	ok: true,
+	checked: true
+};
+const failed = (reason) => ({
+	ok: false,
+	reason
+});
+const unverifiable = (reason) => ({
+	ok: true,
+	checked: false,
+	reason
+});
+//#endregion
+//#region src/verify/bch.ts
+const SIGHASH_FORKID_ALL = 65;
+const BCH_TX_VERSION = 1;
+const BCH_TX_LOCKTIME = 0;
+const BCH_TX_SEQUENCE = 4294967293;
+/** Hardened reader for the legacy (non-witness) transaction serialization. */
+function decodeBchRawTx(rawTxHex) {
+	let bytes;
+	try {
+		bytes = hexToBytes(rawTxHex);
+	} catch {
+		throw new EraSdkError("malformed-reply", "signed transaction is not hex");
+	}
+	let offset = 0;
+	const need = (n) => {
+		if (offset + n > bytes.length) throw new EraSdkError("malformed-reply", "signed transaction is truncated");
+	};
+	const readU32 = () => {
+		need(4);
+		const v = bytes[offset] | bytes[offset + 1] << 8 | bytes[offset + 2] << 16 | bytes[offset + 3] << 24;
+		offset += 4;
+		return v >>> 0;
+	};
+	const readU64 = () => {
+		need(8);
+		let v = 0n;
+		for (let i = 7; i >= 0; i--) v = v << 8n | BigInt(bytes[offset + i]);
+		offset += 8;
+		return v;
+	};
+	const readVarint = () => {
+		need(1);
+		const first = bytes[offset++];
+		if (first < 253) return first;
+		if (first === 253) {
+			need(2);
+			const v = bytes[offset] | bytes[offset + 1] << 8;
+			offset += 2;
+			return v;
+		}
+		throw new EraSdkError("malformed-reply", "unreasonable varint in signed transaction");
+	};
+	const readSlice = (n) => {
+		need(n);
+		const s = bytes.subarray(offset, offset + n);
+		offset += n;
+		return s;
+	};
+	const version = readU32();
+	const inputCount = readVarint();
+	if (inputCount === 0 || inputCount > 1e3) throw new EraSdkError("malformed-reply", "unreasonable input count in signed transaction");
+	const inputs = [];
+	for (let i = 0; i < inputCount; i++) {
+		const txidLE = readSlice(32);
+		const index = readU32();
+		const scriptSig = readSlice(readVarint());
+		const sequence = readU32();
+		inputs.push({
+			txidLE,
+			index,
+			scriptSig,
+			sequence
+		});
+	}
+	const outputCount = readVarint();
+	if (outputCount === 0 || outputCount > 1e3) throw new EraSdkError("malformed-reply", "unreasonable output count in signed transaction");
+	const outputs = [];
+	for (let i = 0; i < outputCount; i++) {
+		const value = readU64();
+		const script = readSlice(readVarint());
+		outputs.push({
+			value,
+			script
+		});
+	}
+	const locktime = readU32();
+	if (offset !== bytes.length) throw new EraSdkError("malformed-reply", "trailing bytes after signed transaction");
+	return {
+		version,
+		inputs,
+		outputs,
+		locktime
+	};
+}
+function sha256d(data) {
+	return sha256(sha256(data));
+}
+function hash160(data) {
+	return ripemd160(sha256(data));
+}
+function p2pkhScript(pubkeyHash) {
+	return concatBytes(new Uint8Array([
+		118,
+		169,
+		20
+	]), pubkeyHash, new Uint8Array([136, 172]));
+}
+function p2shScript(scriptHash) {
+	return concatBytes(new Uint8Array([169, 20]), scriptHash, new Uint8Array([135]));
+}
+function scriptForAddress(address) {
+	const decoded = decodeCashAddr(address);
+	return decoded.type === "p2pkh" ? p2pkhScript(decoded.hash) : p2shScript(decoded.hash);
+}
+function le32(value) {
+	return new Uint8Array([
+		value & 255,
+		value >>> 8 & 255,
+		value >>> 16 & 255,
+		value >>> 24 & 255
+	]);
+}
+function le64(value) {
+	const out = /* @__PURE__ */ new Uint8Array(8);
+	let v = value;
+	for (let i = 0; i < 8; i++) {
+		out[i] = Number(v & 255n);
+		v >>= 8n;
+	}
+	return out;
+}
+function varintBytes(value) {
+	if (value < 253) return new Uint8Array([value]);
+	return new Uint8Array([
+		253,
+		value & 255,
+		value >>> 8 & 255
+	]);
+}
+/**
+* BIP-143 sighash preimage with FORKID, exactly as consensus defines it:
+* `version ‖ hashPrevouts ‖ hashSequence ‖ outpoint ‖ scriptCode ‖ value ‖
+* sequence ‖ hashOutputs ‖ locktime ‖ hashType(LE)`, double-SHA256d.
+*/
+function computeBchSighash(args) {
+	const { tx, inputIndex, scriptCode, value } = args;
+	const hashType = args.hashType ?? SIGHASH_FORKID_ALL;
+	const input = tx.inputs[inputIndex];
+	if (!input) throw new EraSdkError("invalid-props", "sighash input index out of range");
+	const hashPrevouts = sha256d(concatBytes(...tx.inputs.map((i) => concatBytes(i.txidLE, le32(i.index)))));
+	const hashSequence = sha256d(concatBytes(...tx.inputs.map((i) => le32(i.sequence))));
+	const hashOutputs = sha256d(concatBytes(...tx.outputs.map((o) => concatBytes(le64(o.value), varintBytes(o.script.length), o.script))));
+	return sha256d(concatBytes(le32(tx.version), hashPrevouts, hashSequence, input.txidLE, le32(input.index), varintBytes(scriptCode.length), scriptCode, le64(value), le32(input.sequence), hashOutputs, le32(tx.locktime), le32(hashType)));
+}
+function toBigintValue(value, label) {
+	const v = typeof value === "number" ? BigInt(value) : value;
+	if (v <= 0n) throw new EraSdkError("invalid-props", `${label} must be positive`);
+	return v;
+}
+function toPublicKeyBytes(publicKey) {
+	return typeof publicKey === "string" ? hexToBytes(publicKey) : publicKey;
+}
+function verifyBchSignedTx(args) {
+	try {
+		const tx = decodeBchRawTx(args.rawTx);
+		if (tx.version !== BCH_TX_VERSION || tx.locktime !== BCH_TX_LOCKTIME) return failed(`transaction parameters (version ${tx.version}, locktime ${tx.locktime}) are not the device signer's (1, 0)`);
+		for (let i = 0; i < tx.inputs.length; i++) if (tx.inputs[i].sequence !== BCH_TX_SEQUENCE) return failed(`input ${i} sequence is not the device signer's 0xfffffffd`);
+		if (tx.inputs.length !== args.inputs.length) return failed(`signed transaction has ${tx.inputs.length} inputs, the request had ${args.inputs.length}`);
+		if (tx.outputs.length !== args.outputs.length) return failed(`signed transaction has ${tx.outputs.length} outputs, the request had ${args.outputs.length}`);
+		for (let i = 0; i < args.outputs.length; i++) {
+			const requested = args.outputs[i];
+			const actual = tx.outputs[i];
+			if (actual.value !== toBigintValue(requested.value, `output ${i} value`)) return failed(`output ${i} value differs from the request`);
+			if (!equalBytes(actual.script, scriptForAddress(requested.address))) return failed(`output ${i} does not pay the requested address`);
+		}
+		for (let i = 0; i < args.inputs.length; i++) {
+			const requested = args.inputs[i];
+			const actual = tx.inputs[i];
+			const txidLE = hexToBytes(requested.txid).reverse();
+			if (!equalBytes(actual.txidLE, txidLE) || actual.index !== requested.index) return failed(`input ${i} spends a different outpoint than the request named`);
+			const script = actual.scriptSig;
+			if (script.length < 2) return failed(`input ${i} has no signature`);
+			const sigLen = script[0];
+			if (sigLen < 9 || 1 + sigLen + 1 > script.length) return failed(`input ${i} scriptSig is not a signature push`);
+			const sigWithType = script.subarray(1, 1 + sigLen);
+			const pubLen = script[1 + sigLen];
+			if (pubLen !== 33 || 1 + sigLen + 1 + pubLen !== script.length) return failed(`input ${i} scriptSig does not end with a compressed public key push`);
+			const pubkey = script.subarray(1 + sigLen + 1);
+			if (!equalBytes(pubkey, toPublicKeyBytes(requested.publicKey))) return failed(`input ${i} was signed with a different public key than the request named — the transaction cannot spend the requested UTXO`);
+			const hashType = sigWithType[sigWithType.length - 1];
+			if (hashType !== SIGHASH_FORKID_ALL) return failed(`input ${i} uses sighash 0x${hashType.toString(16)}, expected SIGHASH_ALL|FORKID (0x41)`);
+			const sighash = computeBchSighash({
+				tx,
+				inputIndex: i,
+				scriptCode: p2pkhScript(hash160(pubkey)),
+				value: toBigintValue(requested.value, `input ${i} value`)
+			});
+			const signature = secp256k1.Signature.fromDER(sigWithType.subarray(0, sigWithType.length - 1)).toCompactRawBytes();
+			if (!secp256k1.verify(signature, sighash, pubkey)) return failed(`input ${i} signature does not verify against the BIP-143 FORKID sighash`);
+		}
+		if (args.txId !== void 0) {
+			if (bytesToHex(sha256d(hexToBytes(args.rawTx)).reverse()) !== args.txId.toLowerCase()) return failed("reply txId does not match the hash of the signed transaction");
+		}
+		return verified;
+	} catch (e) {
+		return failed(message$1(e));
+	}
+}
+function message$1(e) {
+	return e instanceof EraSdkError || e instanceof Error ? e.message : String(e);
+}
+//#endregion
 //#region src/verify/psbt-reader.ts
 const MAGIC = [
 	112,
@@ -150,21 +369,6 @@ function inputHas(psbt, index, keyType) {
 	return inputEntries(psbt, index, keyType).length > 0;
 }
 //#endregion
-//#region src/verify/result.ts
-const verified = {
-	ok: true,
-	checked: true
-};
-const failed = (reason) => ({
-	ok: false,
-	reason
-});
-const unverifiable = (reason) => ({
-	ok: true,
-	checked: false,
-	reason
-});
-//#endregion
 //#region src/verify/btc.ts
 /**
 * The `crypto-psbt` reply carries NO request id — this comparison IS the
@@ -899,6 +1103,6 @@ function readVl(bytes, pos) {
 	};
 }
 //#endregion
-export { PsbtInputType, bocRootHash, parsePsbt, verifyBtcMessageHeader, verifyCardanoSignature, verifyCosmosSignature, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifySuiSignature, verifyTonSignature, verifyTronSignature, verifyXrpSignature };
+export { PsbtInputType, bocRootHash, computeBchSighash, decodeBchRawTx, parsePsbt, verifyBchSignedTx, verifyBtcMessageHeader, verifyCardanoSignature, verifyCosmosSignature, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifySuiSignature, verifyTonSignature, verifyTronSignature, verifyXrpSignature };
 
 //# sourceMappingURL=verify.js.map