@notabene/verify-proof 1.11.1-next.1 → 1.12.0-next.12

package/src/cashaddr.ts

@@ -0,0 +1,157 @@
+import { bech32 } from "@scure/base";
+
+/**
+ * CashAddr base32 character set.
+ * Each character maps to its 5-bit index value (0–31).
+ * Spec: https://github.com/bitcoincashorg/bitcoincash.org/blob/master/spec/cashaddr.md
+ */
+const CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+
+/**
+ * Generator polynomials for the CashAddr BCH checksum.
+ * These five constants define the GF(2^32) polynomial used to compute
+ * and validate the 40-bit checksum appended to every CashAddr string.
+ */
+const GENERATOR = [
+  BigInt("0x98f2bc8e61"),
+  BigInt("0x79b76d99e2"),
+  BigInt("0xf33e5fb3c4"),
+  BigInt("0xae2eabe2a8"),
+  BigInt("0x1e4f43e470"),
+];
+
+/**
+ * Computes the CashAddr BCH checksum over an array of 5-bit values.
+ *
+ * The input should be the concatenation of:
+ *   - the prefix expansion (see {@link prefixExpand})
+ *   - all payload words including the 8 checksum words
+ *
+ * A valid address produces a result of `0n`; any other value indicates
+ * a corrupt or invalid address.
+ *
+ * @param values - Array of 5-bit integers covering prefix + full payload
+ * @returns The 40-bit checksum residue as a bigint (0n = valid)
+ */
+function polymod(values: number[]): bigint {
+  let c = BigInt(1);
+  for (const d of values) {
+    // Extract the top 5 bits before shifting
+    const c0 = c >> BigInt(35);
+    // Shift the accumulator left by 5 bits and XOR in the next data word
+    c = ((c & BigInt("0x07ffffffff")) << BigInt(5)) ^ BigInt(d);
+    // Apply each generator polynomial for set bits in c0
+    for (let i = 0; i < 5; i++) {
+      if ((c0 >> BigInt(i)) & BigInt(1)) {
+        c ^= GENERATOR[i];
+      }
+    }
+  }
+  // Final XOR with 1 so a valid address yields 0
+  return c ^ BigInt(1);
+}
+
+/**
+ * Expands a CashAddr prefix into the form required by the checksum algorithm.
+ *
+ * Each character of the prefix is reduced to its lower 5 bits, then a zero
+ * byte is appended as a separator between the prefix and the payload words.
+ *
+ * @param prefix - The human-readable prefix (e.g. `"bitcoincash"`)
+ * @returns Array of 5-bit integers representing the expanded prefix
+ */
+function prefixExpand(prefix: string): number[] {
+  const result: number[] = [];
+  for (let i = 0; i < prefix.length; i++) {
+    // Keep only the lower 5 bits of each character's ASCII code
+    result.push(prefix.charCodeAt(i) & 0x1f);
+  }
+  // Zero separator between prefix and payload
+  result.push(0);
+  return result;
+}
+
+/**
+ * Decodes a CashAddr string into its prefix, address type, and raw hash.
+ *
+ * Supports both prefixed (`bitcoincash:q...`) and prefix-less (`q...`) forms.
+ * Validates the BCH checksum and rejects non-P2PKH types or malformed input.
+ *
+ * Address type values (upper nibble of the version byte):
+ *   - `0` — P2PKH (pay-to-public-key-hash)
+ *   - `1` — P2SH  (pay-to-script-hash)
+ *
+ * @param address - The CashAddr string to decode
+ * @param defaultPrefix - Prefix to assume when none is present in the address (default: `"bitcoincash"`)
+ * @returns An object with:
+ *   - `prefix` — the decoded human-readable prefix
+ *   - `type`   — the address type (0 = P2PKH, 1 = P2SH, …)
+ *   - `hash`   — the raw public-key or script hash bytes
+ * @throws If the address contains invalid characters, fails the checksum, has a mismatched hash length,
+ *   contains mixed upper/lower case, or if the payload contains invalid 5-to-8-bit padding
+ *   (thrown by {@link bech32.fromWords} from `@scure/base`)
+ */
+export function decodeCashAddr(
+  address: string,
+  defaultPrefix = "bitcoincash"
+): { prefix: string; type: number; hash: Uint8Array } {
+  let prefix: string;
+
+  // Split on ":" to separate an explicit prefix from the payload
+  const colonIndex = address.indexOf(":");
+  if (colonIndex !== -1) {
+    prefix = address.slice(0, colonIndex).toLowerCase();
+  } else {
+    prefix = defaultPrefix;
+  }
+
+  // CashAddr spec forbids mixed upper/lower case
+  const rawPayload = colonIndex !== -1 ? address.slice(colonIndex + 1) : address;
+  if (/[A-Z]/.test(rawPayload) && /[a-z]/.test(rawPayload)) {
+    throw new Error("Invalid CashAddr: mixed case");
+  }
+  const payload = rawPayload.toLowerCase();
+
+  // Map each character to its 5-bit index in the CashAddr alphabet
+  const words: number[] = [];
+  for (const ch of payload) {
+    const idx = CHARSET.indexOf(ch);
+    if (idx === -1) throw new Error("Invalid CashAddr character: " + ch);
+    words.push(idx);
+  }
+
+  // Minimum length: at least 1 data word + 8 checksum words
+  if (words.length < 8) throw new Error("CashAddr too short");
+
+  // Verify the BCH checksum over prefix expansion + all payload words
+  const checksumData = [...prefixExpand(prefix), ...words];
+  if (polymod(checksumData) !== BigInt(0)) {
+    throw new Error("Invalid CashAddr checksum");
+  }
+
+  // Strip the 8 trailing checksum words; the remainder encodes (version_byte || hash)
+  const dataWords = words.slice(0, -8);
+  // Convert from 5-bit words to 8-bit bytes using bech32.fromWords (equivalent to convertBits(data, 5, 8))
+  const payloadBytes = bech32.fromWords(dataWords);
+  if (payloadBytes.length === 0) {
+    throw new Error("Invalid CashAddr padding");
+  }
+
+  // The first byte is the version byte: upper nibble = type, lower 3 bits = hash size index
+  const versionByte = payloadBytes[0];
+  const type = (versionByte >> 3) & 0x0f;
+  const hashSizeBits = versionByte & 0x07;
+
+  // Look up the expected hash length in bytes from the size index
+  const expectedSizes = [20, 24, 28, 32, 40, 48, 56, 64];
+  const expectedSize = expectedSizes[hashSizeBits];
+
+  const hashBytes = payloadBytes.slice(1);
+  if (hashBytes.length !== expectedSize) {
+    throw new Error(
+      `Hash length mismatch: expected ${expectedSize}, got ${hashBytes.length}`
+    );
+  }
+
+  return { prefix, type, hash: Uint8Array.from(hashBytes) };
+}

package/src/concordium.ts

@@ -1,309 +1,60 @@
 import { ProofStatus, SignatureProof } from "@notabene/javascript-sdk";
+import { VerifiablePresentation } from "@concordium/web-sdk";
 
-// Concordium network configurations
-interface ConcordiumNetwork {
-  grpcUrl: string;
-  walletProxyUrl: string;
-}
-
-const NETWORKS: Record<string, ConcordiumNetwork> = {
-  testnet: {
-    grpcUrl: "https://grpc.testnet.concordium.com:20000",
-    walletProxyUrl: "https://wallet-proxy.testnet.concordium.com"
-  },
-  mainnet: {
-    grpcUrl: "https://grpc.mainnet.concordium.com:20000", 
-    walletProxyUrl: "https://wallet-proxy.mainnet.concordium.software"
-  }
-};
-
-// Configuration options for verification
-interface ConcordiumVerificationOptions {
-  network?: "testnet" | "mainnet";
-  timeout?: number; // timeout in milliseconds
-  retries?: number; // number of retry attempts
-  testMode?: boolean; // skip network calls for testing
-}
-
-// Signature object type
-interface ConcordiumSignature {
-  [key: string]: string | ConcordiumSignature;
-}
-
-// Default options
-const DEFAULT_OPTIONS: Required<ConcordiumVerificationOptions> = {
-  network: "testnet",
-  timeout: 50000, // 10 seconds
-  retries: 3,
-  testMode: true
-};
+const CONCORDIUM_VERIFIER_URL =
+  "https://web3id-verifier.mainnet.concordium.software";
 
 /**
- * Verifies a Concordium signature proof with proper cryptographic validation
+ * Verifies a Concordium signature proof using Concordium's hosted verifier service
  * @param proof The signature proof to verify
- * @param options Optional configuration for network and timeouts
  * @returns Promise resolving to the proof with updated status
  */
 export const verifyConcordiumSignature = async (
   proof: SignatureProof,
-  options: ConcordiumVerificationOptions = {}
 ): Promise<SignatureProof> => {
-  // Merge with default options
-  const config = { ...DEFAULT_OPTIONS, ...options };
-  
-  // Parse and validate address format
-  const [ns, networkId, address] = proof.address.split(/:/);
+  const [ns] = proof.address.split(/:/);
+
   if (ns !== "ccd") {
     return { ...proof, status: ProofStatus.FAILED };
   }
 
-  // Determine network from address or use config
-  let network = config.network;
-  if (networkId) {
-    // If network ID is specified in address, use it to determine network
-    network = networkId.includes("testnet") ? "testnet" : "mainnet";
-  }
-
   try {
-    // Validate signature format and extract signature data
-    let signature: ConcordiumSignature;
-    try {
-      signature = JSON.parse(proof.proof) as ConcordiumSignature;
-    } catch {
-      return { ...proof, status: ProofStatus.FAILED };
-    }
+    const presentationJson = JSON.parse(proof.proof) as VerifiablePresentation;
 
-    // Basic signature structure validation
-    if (!signature || typeof signature !== 'object' || Object.keys(signature).length === 0) {
-      return { ...proof, status: ProofStatus.FAILED };
+    // Validate presentation context matches attestation
+    if (presentationJson.presentationContext !== proof.attestation) {
+      throw new Error("Presentation context does not match attestation");
     }
 
-    // In test mode, skip network validation but still validate signature structure
-    if (config.testMode) {
-      // Perform signature format validation
-      try {
-        const signatureHex = convertSignatureToHex(signature);
-        
-        // Validate signature format
-        if (!signatureHex || signatureHex.length < 64 || !/^[0-9a-fA-F]+$/.test(signatureHex)) {
-          return { ...proof, status: ProofStatus.FAILED };
-        }
-        
-        return { ...proof, status: ProofStatus.VERIFIED };
-        
-      } catch {
-        return { ...proof, status: ProofStatus.FAILED };
-      }
-    }
-
-    // Production mode: validate account existence and get account info with retry logic
-    const accountInfo = await retryWithTimeout(
-      () => validateAccountAndGetInfo(address, network, config.timeout),
-      config.retries
-    );
-
-    if (!accountInfo) {
-      return { ...proof, status: ProofStatus.FAILED };
+    // Validate verifiableCredential exists and is not empty
+    if (
+      !presentationJson.verifiableCredential ||
+      presentationJson.verifiableCredential.length === 0
+    ) {
+      throw new Error("Verifiable credential is missing or empty");
     }
 
-    // Perform cryptographic signature verification
-    const isValidSignature = await retryWithTimeout(
-      () => verifyCryptographicSignature(
-        signature,
-        config.timeout,
-        // proof.attestation,
-        // address,
-        // network
-      ),
-      config.retries
-    );
+    // Use Concordium's hosted verifier instead of gRPC
+    const response = await fetch(`${CONCORDIUM_VERIFIER_URL}/v0/verify`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(presentationJson),
+    });
 
-    if (isValidSignature) {
-      return { ...proof, status: ProofStatus.VERIFIED };
-    } else {
-      return { ...proof, status: ProofStatus.FAILED };
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Verifier returned ${response.status}: ${errorText}`);
     }
 
+    // If we get here, the proof is valid
+    return {
+      ...proof,
+      status: ProofStatus.VERIFIED,
+    };
   } catch {
-    return { ...proof, status: ProofStatus.FAILED };
+    return {
+      ...proof,
+      status: ProofStatus.FAILED,
+    };
   }
 };
-
-/**
- * Validates that a Concordium account exists and retrieves account information
- */
-async function validateAccountAndGetInfo(
-  address: string,
-  network: "testnet" | "mainnet",
-  timeout: number
-): Promise<boolean> {
-  const networkConfig = NETWORKS[network];
-  
-  try {
-    // Check account existence via wallet proxy (faster than gRPC for existence check)
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), timeout);
-
-    const response = await fetch(
-      `${networkConfig.walletProxyUrl}/v0/accEncryptionKey/${address}`,
-      {
-        method: 'GET',
-        headers: {
-          'Accept': 'application/json',
-          'User-Agent': 'verify-proof/1.6.0'
-        },
-        signal: controller.signal
-      }
-    );
-
-    clearTimeout(timeoutId);
-    return response.ok;
-
-  } catch (error) {
-    if (error instanceof Error && error.name === 'AbortError') {
-      throw new Error(`Account validation timeout after ${timeout}ms`);
-    }
-    throw error;
-  }
-}
-
-/**
- * Performs cryptographic verification of the signature using Concordium SDK
- * For production use, this would use the actual Concordium SDK verification methods
- * Currently implementing a comprehensive validation approach
- */
-async function verifyCryptographicSignature(
-  signature: ConcordiumSignature,
-  timeout: number,
-  // message?: string, // intentionally left out for now. Will enable for mainnet.
-  // address?: string,
-  // network?: "testnet" | "mainnet"
-): Promise<boolean> {
-  try {
-    // Convert signature format for verification
-    const signatureHex = convertSignatureToHex(signature);
-    
-    // For production, implement proper signature verification
-    // This is a placeholder for the actual SDK verification
-    // The exact method depends on the available SDK version
-    
-    // Validate that we have a proper signature hex string
-    if (!signatureHex || signatureHex.length < 64) {
-      return false;
-    }
-
-    // For now, return true if we have a valid signature structure
-    // In production, this should call the actual SDK verification method
-    // Example: 
-    // const client = new ConcordiumGRPCNodeClient(networkConfig.grpcUrl, 20000, credentials.createInsecure(), { timeout });
-    // const result = await client.verifyAccountSignature(address, message, signatureHex);
-    
-    // Placeholder validation - replace with actual SDK call
-    return signatureHex.length >= 64 && /^[0-9a-fA-F]+$/.test(signatureHex);
-
-  } catch (error) {
-    // Handle specific error types
-    if (error instanceof Error) {
-      if (error.message?.includes("timeout")) {
-        throw new Error(`Signature verification timeout after ${timeout}ms`);
-      }
-      
-      if (error.message?.includes("UNAVAILABLE")) {
-        throw new Error("Concordium node unavailable");
-      }
-
-      if (error.message?.includes("NOT_FOUND")) {
-        return false;
-      }
-    }
-
-    throw error;
-  }
-}
-
-/**
- * Converts the signature object to the format expected by Concordium SDK
- */
-function convertSignatureToHex(signature: ConcordiumSignature): string {
-  try {
-    // Handle different signature formats
-    if (typeof signature === 'string') {
-      return signature;
-    }
-
-    // Handle nested signature object format (common from wallet)
-    if (signature && typeof signature === 'object') {
-      // Extract signature from nested structure
-      const extractSignature = (obj: ConcordiumSignature): string | null => {
-        if (typeof obj === 'string') {
-          return obj;
-        }
-        
-        if (obj && typeof obj === 'object') {
-          for (const key in obj) {
-            if (Object.prototype.hasOwnProperty.call(obj, key)) {
-              const value = obj[key];
-              if (typeof value === 'string') {
-                return value;
-              } else if (typeof value === 'object') {
-                const result = extractSignature(value);
-                if (result) return result;
-              }
-            }
-          }
-        }
-        
-        return null;
-      };
-
-      const extractedSig = extractSignature(signature);
-      if (extractedSig) {
-        return extractedSig;
-      }
-    }
-
-    throw new Error("Unable to extract signature from object");
-    
-  } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : "Unknown error";
-    throw new Error(`Invalid signature format: ${errorMessage}`);
-  }
-}
-
-/**
- * Utility function to retry operations with exponential backoff
- */
-async function retryWithTimeout<T>(
-  operation: () => Promise<T>,
-  maxRetries: number
-): Promise<T> {
-  let lastError: Error = new Error("No attempts made");
-  
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    try {
-      return await operation();
-    } catch (error) {
-      const errorInstance = error instanceof Error ? error : new Error(String(error));
-      lastError = errorInstance;
-      
-      // Don't retry on certain types of errors
-      if (
-        errorInstance.message?.includes("Invalid signature") ||
-        errorInstance.message?.includes("Account not found")
-      ) {
-        throw errorInstance;
-      }
-
-      // Don't retry on the last attempt
-      if (attempt === maxRetries) {
-        break;
-      }
-
-      // Exponential backoff: wait 2^attempt * 1000ms
-      const delay = Math.min(Math.pow(2, attempt) * 1000, 5000);
-      await new Promise(resolve => setTimeout(resolve, delay));
-    }
-  }
-
-  throw lastError;
-}

package/src/cosmos.ts

@@ -8,6 +8,7 @@ import { StdSignDoc, serializeSignDoc } from "@cosmjs/amino";
 import { secp256k1 } from "@noble/curves/secp256k1";
 import { ripemd160 } from "@noble/hashes/legacy";
 import { sha256 } from "@noble/hashes/sha2";
+import { keccak_256 } from "@noble/hashes/sha3";
 
 // Base64 decode
 function base64ToUint8Array(base64: string): Uint8Array {
@@ -26,12 +27,47 @@ function toBase64Bytes(str: string): string {
 
 // Cosmos address derivation (ADR-36)
 // https://github.com/cosmos/cosmos-sdk/blob/214b11dcbaa129f7b4c0013b2103db9d54b85e9e/docs/architecture/adr-036-arbitrary-signature.md
-function deriveCosmosAddress(pubkey: Uint8Array, prefix = "cosmos"): string {
+function deriveCosmosAddress(pubkey: Uint8Array, prefix: string): string {
   const sha = sha256(pubkey);
   const rip = ripemd160(sha);
   return bech32.encode(prefix, bech32.toWords(rip));
 }
 
+// Ethermint-style chains (Injective, Evmos, ...) use eth-secp256k1 keys: the account is
+// the Ethereum address of the key, bech32-encoded under the chain prefix.
+function deriveEthAddress(pubkey: Uint8Array, prefix: string): string {
+  const uncompressed = secp256k1.ProjectivePoint.fromHex(pubkey)
+    .toRawBytes(false)
+    .slice(1);
+  const eth = keccak_256(uncompressed).slice(-20);
+  return bech32.encode(prefix, bech32.toWords(eth));
+}
+
+// Same selection Keplr's verifyADR36AminoSignDoc makes via its `algo` argument. The signed
+// address tells us which key algorithm the chain uses, so we do not depend on the
+// pub_key.type string wallets put in the amino signature.
+type CosmosKeyAlgo = "secp256k1" | "ethsecp256k1";
+
+function keyAlgoForAddress(
+  pubkey: Uint8Array,
+  address: string
+): CosmosKeyAlgo | undefined {
+  const prefix = bech32Prefix(address);
+  if (deriveCosmosAddress(pubkey, prefix) === address) {
+    return "secp256k1";
+  }
+  if (deriveEthAddress(pubkey, prefix) === address) {
+    return "ethsecp256k1";
+  }
+  return undefined;
+}
+
+// Each Cosmos SDK chain has its own human-readable part (cosmos, celestia, axelar, ...),
+// and bech32 separates it from the data with the last "1" in the string.
+function bech32Prefix(address: string): string {
+  return address.slice(0, address.lastIndexOf("1"));
+}
+
 export async function verifyCosmosSignature(
   proof: SignatureProof
 ): Promise<SignatureProof> {
@@ -47,9 +83,10 @@ export async function verifyCosmosSignature(
     );
     const signatureBytes = base64ToUint8Array(proof.proof);
 
-    // Step 1: Derive address from pubkey
-    const derivedAddress = deriveCosmosAddress(pubKeyBytes);
-    if (derivedAddress !== address) {
+    // Step 1: The pubkey must derive to the signed address; which derivation matches
+    // also decides the digest used in step 3.
+    const algo = keyAlgoForAddress(pubKeyBytes, address);
+    if (!algo) {
       return { ...proof, status: ProofStatus.FAILED };
     }
 
@@ -71,9 +108,10 @@ export async function verifyCosmosSignature(
       memo: "",
     };
 
-    // Step 3: Serialize + hash
+    // Step 3: Serialize + hash (ADR-036 digests are keccak256 on eth-secp256k1 chains)
     const signBytes = await serializeSignDoc(signDoc);
-    const digest = sha256(signBytes);
+    const digest =
+      algo === "ethsecp256k1" ? keccak_256(signBytes) : sha256(signBytes);
 
     // Step 4: Verify using secp256k1
     const verified = secp256k1.verify(signatureBytes, digest, pubKeyBytes);

package/src/index.ts

@@ -69,7 +69,6 @@ export async function verifyProof(
       const { verifyPersonalSignTIP191 } = await import("./tron");
       return verifyPersonalSignTIP191(proof as SignatureProof);
     }
-    case ProofTypes.BIP137_XPUB:
     case ProofTypes.MicroTransfer:
   }
   return proof;

package/src/solana.ts

@@ -1,4 +1,4 @@
-import * as nacl from "tweetnacl";
+import nacl from "tweetnacl";
 import { ProofStatus, SignatureProof, type SIWXInput, type SolanaMetadata } from "@notabene/javascript-sdk";
 import { base64, base58 } from "@scure/base";