@obolnetwork/obol-sdk 2.11.4 → 2.11.5-rc.1

package/src/utils.ts

@@ -1,88 +0,0 @@
-import { ethers } from 'ethers';
-import { DefinitionFlow, PROVIDER_MAP } from './constants';
-import { FORK_NAMES, type ProviderType, type ClusterDefinition } from './types';
-
-export const hexWithout0x = (hex: string): string => {
-  return hex.slice(2, hex.length);
-};
-
-export const strToUint8Array = (str: string): Uint8Array => {
-  return new TextEncoder().encode(str);
-};
-
-export const definitionFlow = (
-  clusterDefinition: ClusterDefinition,
-): DefinitionFlow | null => {
-  if (
-    clusterDefinition.creator.address &&
-    clusterDefinition.creator.config_signature &&
-    clusterDefinition.operators.every(operator => {
-      return (
-        operator.address &&
-        operator.config_signature &&
-        operator.enr &&
-        operator.enr_signature
-      );
-    })
-  ) {
-    return DefinitionFlow.Group;
-  } else if (
-    clusterDefinition.creator.address &&
-    clusterDefinition.creator.config_signature &&
-    clusterDefinition.operators.every(operator => {
-      return (
-        !operator.address &&
-        !operator.config_signature &&
-        operator.enr &&
-        !operator.enr_signature
-      );
-    })
-  ) {
-    return DefinitionFlow.Solo;
-  } else if (
-    !clusterDefinition.creator.address &&
-    !clusterDefinition.creator.config_signature &&
-    clusterDefinition.operators.every(operator => {
-      return (
-        !operator.address &&
-        !operator.config_signature &&
-        operator.enr &&
-        !operator.enr_signature
-      );
-    })
-  ) {
-    return DefinitionFlow.Charon;
-  }
-  return null;
-};
-
-export const findDeployedBytecode = async (
-  contractAddress: string,
-  provider: ProviderType,
-): Promise<string> => {
-  return await provider?.getCode(contractAddress);
-};
-
-export const isContractAvailable = async (
-  contractAddress: string,
-  provider: ProviderType,
-  bytecode?: string,
-): Promise<boolean> => {
-  const code = await findDeployedBytecode(contractAddress, provider);
-
-  if (bytecode) {
-    return !!code && code === bytecode;
-  }
-  return !!code && code !== '0x' && code !== '0x0';
-};
-
-export const getProvider = (
-  chainId: number,
-  rpcUrl?: string,
-): ethers.JsonRpcProvider => {
-  const resolvedRpcUrl = rpcUrl ?? PROVIDER_MAP[chainId];
-  if (chainId && (!resolvedRpcUrl || resolvedRpcUrl === 'undefined')) {
-    throw new Error(`No provider configured for ${FORK_NAMES[chainId]}`);
-  }
-  return new ethers.JsonRpcProvider(resolvedRpcUrl);
-};

package/src/verification/common.ts

@@ -1,532 +0,0 @@
-import { fromHexString } from '@chainsafe/ssz';
-import elliptic from 'elliptic';
-import { init } from '@chainsafe/bls';
-import {
-  FORK_MAPPING,
-  type ClusterDefinition,
-  type ClusterLock,
-  type DepositData,
-  type BuilderRegistrationMessage,
-  type DistributedValidator,
-  type SafeRpcUrl,
-} from '../types.js';
-import * as semver from 'semver';
-import {
-  clusterDefinitionContainerTypeV1X6,
-  hashClusterDefinitionV1X6,
-  hashClusterLockV1X6,
-  verifyDVV1X6,
-} from './v1.6.0.js';
-import {
-  clusterDefinitionContainerTypeV1X7,
-  hashClusterDefinitionV1X7,
-  hashClusterLockV1X7,
-  verifyDVV1X7,
-} from './v1.7.0.js';
-import {
-  DOMAIN_APPLICATION_BUILDER,
-  DOMAIN_DEPOSIT,
-  DefinitionFlow,
-  GENESIS_VALIDATOR_ROOT,
-  signCreatorConfigHashPayload,
-  signEnrPayload,
-  signOperatorConfigHashPayload,
-} from '../constants.js';
-import {
-  builderRegistrationMessageType,
-  depositMessageType,
-  forkDataType,
-  signingRootType,
-} from './sszTypes.js';
-import { definitionFlow, hexWithout0x } from '../utils.js';
-import { ENR } from '@chainsafe/discv5';
-import {
-  clusterDefinitionContainerTypeV1X8,
-  hashClusterDefinitionV1X8,
-  hashClusterLockV1X8,
-  verifyDVV1X8,
-} from './v1.8.0.js';
-import { validateAddressSignature } from './signature-validator.js';
-import {
-  clusterDefinitionContainerTypeV1X10,
-  hashClusterDefinitionV1X10,
-  hashClusterLockV1X10,
-  verifyDVV1X10,
-} from './v1.10.0.js';
-
-// cluster-definition hash
-
-/**
- * @param cluster The cluster configuration or the cluster definition
- * @param configOnly a boolean to indicate config hash or definition hash
- * @returns The config hash or the definition hash in of the corresponding cluster
- */
-export const clusterConfigOrDefinitionHash = (
-  cluster: ClusterDefinition,
-  configOnly: boolean,
-): string => {
-  let definitionType, val;
-
-  if (semver.eq(cluster.version, 'v1.6.0')) {
-    definitionType = clusterDefinitionContainerTypeV1X6(configOnly);
-    val = hashClusterDefinitionV1X6(cluster, configOnly);
-    return (
-      '0x' +
-      Buffer.from(definitionType.hashTreeRoot(val).buffer).toString('hex')
-    );
-  }
-
-  if (semver.eq(cluster.version, 'v1.7.0')) {
-    definitionType = clusterDefinitionContainerTypeV1X7(configOnly);
-    val = hashClusterDefinitionV1X7(cluster, configOnly);
-    return (
-      '0x' +
-      Buffer.from(definitionType.hashTreeRoot(val).buffer).toString('hex')
-    );
-  }
-
-  if (semver.eq(cluster.version, 'v1.8.0')) {
-    definitionType = clusterDefinitionContainerTypeV1X8(configOnly);
-    val = hashClusterDefinitionV1X8(cluster, configOnly);
-    return (
-      '0x' +
-      Buffer.from(definitionType.hashTreeRoot(val).buffer).toString('hex')
-    );
-  }
-
-  if (semver.eq(cluster.version, 'v1.10.0')) {
-    definitionType = clusterDefinitionContainerTypeV1X10(configOnly);
-    val = hashClusterDefinitionV1X10(cluster, configOnly);
-    const x =
-      '0x' +
-      Buffer.from(definitionType.hashTreeRoot(val).buffer).toString('hex');
-    return x;
-  }
-
-  throw new Error('unsupported version');
-};
-
-// cluster-lock hash
-
-/**
- * Returns the SSZ cluster lock hash of the given cluster lock object
- * @param cluster The cluster lock whose lock hash needs to be calculated
- * @returns The cluster lock hash in of the corresponding cluster lock
- */
-export const clusterLockHash = (clusterLock: ClusterLock): string => {
-  if (semver.eq(clusterLock.cluster_definition.version, 'v1.6.0')) {
-    return hashClusterLockV1X6(clusterLock);
-  }
-
-  if (semver.eq(clusterLock.cluster_definition.version, 'v1.7.0')) {
-    return hashClusterLockV1X7(clusterLock);
-  }
-
-  if (semver.eq(clusterLock.cluster_definition.version, 'v1.8.0')) {
-    if (
-      clusterLock.cluster_definition.deposit_amounts === null &&
-      clusterLock.distributed_validators.some(
-        distributedValidator =>
-          distributedValidator.partial_deposit_data?.length !== 1 ||
-          distributedValidator.partial_deposit_data[0].amount !== '32000000000',
-      )
-    ) {
-      throw new Error(
-        'mismatch between deposit_amounts and partial_deposit_data fields',
-      );
-    }
-    return hashClusterLockV1X8(clusterLock);
-  }
-
-  if (semver.eq(clusterLock.cluster_definition.version, 'v1.10.0')) {
-    // if (
-    //   clusterLock.cluster_definition.deposit_amounts === null &&
-    //   clusterLock.distributed_validators.some(
-    //     distributedValidator =>
-    //       distributedValidator.partial_deposit_data?.length !== 1 ||
-    //       distributedValidator.partial_deposit_data[0].amount !== '32000000000',
-    //   )
-    // ) {
-    //   throw new Error(
-    //     'mismatch between deposit_amounts and partial_deposit_data fields',
-    //   );
-    // }
-    return hashClusterLockV1X10(clusterLock);
-  }
-
-  // other versions
-  throw new Error('unsupported version');
-};
-
-// Lock verification
-
-// cluster-definition signatures verification
-
-const validatePOSTConfigHashSigner = async (
-  address: string,
-  signature: string,
-  configHash: string,
-  chainId: FORK_MAPPING,
-  safeRpcUrl?: SafeRpcUrl,
-): Promise<boolean> => {
-  try {
-    const data = signCreatorConfigHashPayload(
-      { creator_config_hash: configHash },
-      chainId,
-    );
-
-    return await validateAddressSignature({
-      address,
-      token: signature,
-      data,
-      chainId,
-      safeRpcUrl,
-    });
-  } catch (err) {
-    throw err;
-  }
-};
-
-const validatePUTConfigHashSigner = async (
-  address: string,
-  signature: string,
-  configHash: string,
-  chainId: number,
-  safeRpcUrl?: SafeRpcUrl,
-): Promise<boolean> => {
-  try {
-    const data = signOperatorConfigHashPayload(
-      { operator_config_hash: configHash },
-      chainId,
-    );
-    return await validateAddressSignature({
-      address,
-      token: signature,
-      data,
-      chainId,
-      safeRpcUrl,
-    });
-  } catch (err) {
-    throw err;
-  }
-};
-
-const validateEnrSigner = async (
-  address: string,
-  signature: string,
-  payload: string,
-  chainId: number,
-  safeRpcUrl?: SafeRpcUrl,
-): Promise<boolean> => {
-  try {
-    const data = signEnrPayload({ enr: payload }, chainId);
-
-    return await validateAddressSignature({
-      address,
-      token: signature,
-      data,
-      chainId,
-      safeRpcUrl,
-    });
-  } catch (err) {
-    throw err;
-  }
-};
-
-const verifyDefinitionSignatures = async (
-  clusterDefinition: ClusterDefinition,
-  definitionType: DefinitionFlow,
-  safeRpcUrl?: SafeRpcUrl,
-): Promise<boolean> => {
-  if (definitionType === DefinitionFlow.Charon) {
-    return true;
-  } else {
-    const isPOSTConfigHashSignerValid = await validatePOSTConfigHashSigner(
-      clusterDefinition.creator.address,
-      clusterDefinition.creator.config_signature as string,
-      clusterDefinition.config_hash,
-      FORK_MAPPING[clusterDefinition.fork_version as keyof typeof FORK_MAPPING],
-      safeRpcUrl,
-    );
-
-    if (!isPOSTConfigHashSignerValid) {
-      return false;
-    }
-    if (definitionType === DefinitionFlow.Solo) {
-      return true;
-    }
-
-    for (const operator of clusterDefinition.operators) {
-      const isPUTConfigHashSignerValid = await validatePUTConfigHashSigner(
-        operator.address,
-        operator.config_signature as string,
-        clusterDefinition.config_hash,
-        FORK_MAPPING[
-          clusterDefinition.fork_version as keyof typeof FORK_MAPPING
-        ],
-        safeRpcUrl,
-      );
-
-      const isENRSignerValid = await validateEnrSigner(
-        operator.address,
-        operator.enr_signature as string,
-        operator.enr as string,
-        FORK_MAPPING[
-          clusterDefinition.fork_version as keyof typeof FORK_MAPPING
-        ],
-        safeRpcUrl,
-      );
-
-      if (!isPUTConfigHashSignerValid || !isENRSignerValid) {
-        return false;
-      }
-    }
-
-    return true;
-  }
-};
-
-// cluster-lock data verification
-const computeSigningRoot = (
-  sszObjectRoot: Uint8Array,
-  domain: Uint8Array,
-): Uint8Array => {
-  const signingRootDefaultValue = signingRootType.defaultValue();
-  signingRootDefaultValue.objectRoot = sszObjectRoot;
-  signingRootDefaultValue.domain = domain;
-  return Buffer.from(
-    signingRootType.hashTreeRoot(signingRootDefaultValue).buffer,
-  );
-};
-
-const computeDepositMsgRoot = (msg: Partial<DepositData>): Buffer => {
-  const depositMsgVal = depositMessageType.defaultValue();
-
-  depositMsgVal.pubkey = fromHexString(msg.pubkey as string);
-  depositMsgVal.withdrawal_credentials = fromHexString(
-    msg.withdrawal_credentials as string,
-  );
-  depositMsgVal.amount = parseInt(msg.amount as string);
-  return Buffer.from(depositMessageType.hashTreeRoot(depositMsgVal).buffer);
-};
-
-const computeForkDataRoot = (
-  currentVersion: Uint8Array,
-  genesisValidatorsRoot: Uint8Array,
-): Uint8Array => {
-  const forkDataVal = forkDataType.defaultValue();
-  forkDataVal.currentVersion = currentVersion;
-  forkDataVal.genesisValidatorsRoot = genesisValidatorsRoot;
-  return Buffer.from(forkDataType.hashTreeRoot(forkDataVal).buffer);
-};
-
-const computebuilderRegistrationMsgRoot = (
-  msg: BuilderRegistrationMessage,
-): Buffer => {
-  const builderRegistrationMsgVal =
-    builderRegistrationMessageType.defaultValue();
-
-  builderRegistrationMsgVal.fee_recipient = fromHexString(msg.fee_recipient);
-  builderRegistrationMsgVal.gas_limit = msg.gas_limit;
-  builderRegistrationMsgVal.timestamp = msg.timestamp;
-  builderRegistrationMsgVal.pubkey = fromHexString(msg.pubkey);
-  return Buffer.from(
-    builderRegistrationMessageType.hashTreeRoot(builderRegistrationMsgVal)
-      .buffer,
-  );
-};
-
-const computeDomain = (
-  domainType: Uint8Array,
-  lockForkVersion: string,
-  genesisValidatorsRoot: Uint8Array = fromHexString(GENESIS_VALIDATOR_ROOT),
-): Uint8Array => {
-  const forkVersion = fromHexString(
-    lockForkVersion.substring(2, lockForkVersion.length),
-  );
-
-  const forkDataRoot = computeForkDataRoot(forkVersion, genesisValidatorsRoot);
-  const domain = new Uint8Array(32);
-  domain.set(domainType);
-  domain.set(forkDataRoot.subarray(0, 28), 4);
-  return domain;
-};
-
-/**
- * Verify deposit data withdrawal credintials and signature
- * @param {string} forkVersion - fork version in definition file.
- * @param {DistributedValidatorDto} validator - distributed validator.
- * @param {string} withdrawalAddress - withdrawal address in definition file.
- * @returns {boolean} - return if deposit data is valid.
- */
-export const verifyDepositData = (
-  distributedPublicKey: string,
-  depositData: Partial<DepositData>,
-  withdrawalAddress: string,
-  forkVersion: string,
-  compounding?: boolean,
-): { isValidDepositData: boolean; depositDataMsg: Uint8Array } => {
-  const depositDomain = computeDomain(
-    fromHexString(DOMAIN_DEPOSIT),
-    forkVersion,
-  );
-  const withdrawalPrefix = compounding ? '0x02' : '0x01';
-  const expectedWithdrawalCredentials =
-    withdrawalPrefix +
-    '0'.repeat(22) +
-    withdrawalAddress.toLowerCase().slice(2);
-
-  if (expectedWithdrawalCredentials !== depositData.withdrawal_credentials) {
-    return { isValidDepositData: false, depositDataMsg: new Uint8Array(0) };
-  }
-
-  if (distributedPublicKey !== depositData.pubkey) {
-    return { isValidDepositData: false, depositDataMsg: new Uint8Array(0) };
-  }
-
-  const depositMessageBuffer = computeDepositMsgRoot(depositData);
-  const depositDataMessage = signingRoot(depositDomain, depositMessageBuffer);
-
-  return { isValidDepositData: true, depositDataMsg: depositDataMessage };
-};
-
-export const verifyBuilderRegistration = (
-  validator: DistributedValidator,
-  feeRecipientAddress: string,
-  forkVersion: string,
-): {
-  isValidBuilderRegistration: boolean;
-  builderRegistrationMsg: Uint8Array;
-} => {
-  const builderDomain = computeDomain(
-    fromHexString(DOMAIN_APPLICATION_BUILDER),
-    forkVersion,
-  );
-
-  if (
-    validator.distributed_public_key !==
-    validator.builder_registration?.message.pubkey
-  ) {
-    return {
-      isValidBuilderRegistration: false,
-      builderRegistrationMsg: new Uint8Array(0),
-    };
-  }
-  if (
-    feeRecipientAddress.toLowerCase() !==
-    validator.builder_registration.message.fee_recipient.toLowerCase()
-  ) {
-    return {
-      isValidBuilderRegistration: false,
-      builderRegistrationMsg: new Uint8Array(0),
-    };
-  }
-
-  const builderRegistrationMessageBuffer = computebuilderRegistrationMsgRoot(
-    validator.builder_registration.message,
-  );
-
-  const builderRegistrationMessage = signingRoot(
-    builderDomain,
-    builderRegistrationMessageBuffer,
-  );
-
-  return {
-    isValidBuilderRegistration: true,
-    builderRegistrationMsg: builderRegistrationMessage,
-  };
-};
-
-export const verifyNodeSignatures = (clusterLock: ClusterLock): boolean => {
-  const ec = new elliptic.ec('secp256k1');
-  const nodeSignatures = clusterLock.node_signatures;
-
-  const lockHashWithout0x = hexWithout0x(clusterLock.lock_hash);
-  // node(ENR) signatures
-  for (let i = 0; i < (nodeSignatures as string[]).length; i++) {
-    const pubkey = ENR.decodeTxt(
-      clusterLock.cluster_definition.operators[i].enr as string,
-    ).publicKey.toString('hex');
-
-    const ENRsignature = {
-      r: (nodeSignatures as string[])[i].slice(2, 66),
-      s: (nodeSignatures as string[])[i].slice(66, 130),
-    };
-
-    const nodeSignatureVerification = ec
-      .keyFromPublic(pubkey, 'hex')
-      .verify(lockHashWithout0x, ENRsignature);
-
-    if (!nodeSignatureVerification) {
-      return false;
-    }
-  }
-
-  return true;
-};
-
-export const signingRoot = (
-  domain: Uint8Array,
-  messageBuffer: Buffer,
-): Uint8Array => {
-  return computeSigningRoot(messageBuffer, domain);
-};
-
-const verifyLockData = async (clusterLock: ClusterLock): Promise<boolean> => {
-  await init('herumi');
-
-  if (semver.eq(clusterLock.cluster_definition.version, 'v1.6.0')) {
-    return verifyDVV1X6(clusterLock);
-  }
-
-  if (semver.eq(clusterLock.cluster_definition.version, 'v1.7.0')) {
-    return verifyDVV1X7(clusterLock);
-  }
-
-  if (semver.eq(clusterLock.cluster_definition.version, 'v1.8.0')) {
-    return verifyDVV1X8(clusterLock);
-  }
-
-  if (semver.eq(clusterLock.cluster_definition.version, 'v1.10.0')) {
-    return verifyDVV1X10(clusterLock);
-  }
-  return false;
-};
-
-export const isValidClusterLock = async (
-  clusterLock: ClusterLock,
-  safeRpcUrl?: SafeRpcUrl,
-): Promise<boolean> => {
-  try {
-    const definitionType = definitionFlow(clusterLock.cluster_definition);
-    if (definitionType == null) {
-      return false;
-    }
-    const isValidDefinitionData = await verifyDefinitionSignatures(
-      clusterLock.cluster_definition,
-      definitionType,
-      safeRpcUrl,
-    );
-    if (!isValidDefinitionData) {
-      return false;
-    }
-
-    if (
-      clusterConfigOrDefinitionHash(clusterLock.cluster_definition, false) !==
-      clusterLock.cluster_definition.definition_hash
-    ) {
-      return false;
-    }
-    if (clusterLockHash(clusterLock) !== clusterLock.lock_hash) {
-      return false;
-    }
-
-    const isValidLockData = await verifyLockData(clusterLock);
-    if (!isValidLockData) {
-      return false;
-    }
-    return true;
-  } catch (err) {
-    return false;
-  }
-};

package/src/verification/signature-validator.ts

@@ -1,103 +0,0 @@
-/* eslint-disable @typescript-eslint/restrict-template-expressions */
-import { ethers } from 'ethers';
-import {
-  SignTypedDataVersion,
-  TypedDataUtils,
-  type TypedMessage,
-} from '@metamask/eth-sig-util';
-import Safe from '@safe-global/protocol-kit';
-import { PROVIDER_MAP } from '../constants';
-import { hashTypedData } from '@safe-global/protocol-kit/dist/src/utils';
-import { type EIP712TypedData } from '@safe-global/safe-core-sdk-types';
-import { isContractAvailable, getProvider } from '../utils';
-import { type SafeRpcUrl } from '../types';
-
-export const validateAddressSignature = async ({
-  address,
-  token,
-  data,
-  chainId,
-  safeRpcUrl,
-}: {
-  address: string;
-  token: string;
-  data: TypedMessage<any>;
-  chainId: number;
-  safeRpcUrl?: SafeRpcUrl;
-}): Promise<boolean> => {
-  try {
-    const provider = getProvider(chainId, safeRpcUrl);
-    if (provider) {
-      const contractAddress = await isContractAvailable(address, provider);
-      if (contractAddress) {
-        return await validateSmartContractSignature({
-          token,
-          data: data as unknown as EIP712TypedData,
-          address,
-          chainId,
-          safeRpcUrl,
-        });
-      }
-    }
-    return validateEOASignature({ token, data, address });
-  } catch (error) {
-    return validateEOASignature({ token, data, address });
-  }
-};
-
-export const validateEOASignature = ({
-  token,
-  data,
-  address,
-}: {
-  token: string;
-  data: TypedMessage<any>;
-  address: string;
-}): boolean => {
-  try {
-    const sig = ethers.Signature.from(token);
-    const digest = TypedDataUtils.eip712Hash(data, SignTypedDataVersion.V4);
-
-    return (
-      ethers.recoverAddress(digest, sig).toLowerCase() ===
-      address.toLocaleLowerCase()
-    );
-  } catch (err) {
-    console.error(`validate EOA Signature error: ${err}`);
-    throw err;
-  }
-};
-
-export const validateSmartContractSignature = async ({
-  token,
-  data,
-  address,
-  chainId,
-  safeRpcUrl,
-}: {
-  token: string;
-  data: EIP712TypedData;
-  address: string;
-  chainId: number;
-  safeRpcUrl?: SafeRpcUrl;
-}): Promise<boolean> => {
-  try {
-    const safeProvider = safeRpcUrl ?? PROVIDER_MAP[chainId];
-
-    const protocolKit = await Safe.init({
-      provider: safeProvider,
-      safeAddress: address,
-    });
-    const messageHash = hashTypedData(data);
-    const isValidSignature = await protocolKit.isValidSignature(
-      messageHash,
-      token,
-    );
-
-    return isValidSignature;
-  } catch (err: any) {
-    throw new Error(
-      `Error validating smart contract signature: ${err.message}`,
-    );
-  }
-};