@onekeyfe/hwk-trezor-connector 1.2.0-alpha.13 → 1.2.0-alpha.131

package/dist/index.js

@@ -63,6 +63,12 @@ function readNumber(value, key) {
   const candidate = value[key];
   return typeof candidate === "number" ? candidate : void 0;
 }
+var HEX_STRING = /^(0x|0X)?[0-9A-Fa-f]*$/;
+function assertHexString(field, value) {
+  if (!HEX_STRING.test(value)) {
+    throw createInvalidParamsError(`${field} must be a hex string`);
+  }
+}
 function formatAnyHex(value) {
   if (typeof value === "string") {
     let stripped = value.startsWith("0x") || value.startsWith("0X") ? value.slice(2) : value;
@@ -425,6 +431,16 @@ function inputToTrezor(input) {
   return result;
 }
 function outputToTrezor(output2) {
+  const targetCount = [
+    output2.opReturnData !== void 0,
+    Boolean(output2.address),
+    Boolean(output2.path)
+  ].filter(Boolean).length;
+  if (targetCount > 1) {
+    throw createInvalidParamsError(
+      "btcSignTransaction output must specify exactly one of opReturnData, address, or path"
+    );
+  }
   const withOutputMetadata = (result) => {
     if (output2.paymentReqIndex !== void 0) {
       result.payment_req_index = output2.paymentReqIndex;
@@ -2088,15 +2104,30 @@ async function evmGetAddress(ctx, params) {
   };
 }
 function normalizeEvmSignTxHexFields(tx) {
-  const hex = (value) => value === void 0 ? void 0 : formatAnyHex(value);
+  const hex = (name, value) => {
+    if (value === void 0) return void 0;
+    assertHexString(name, value);
+    return formatAnyHex(value);
+  };
+  tx.accessList?.forEach((entry, i) => {
+    assertHexString(`accessList[${i}].address`, entry.address);
+    entry.storageKeys?.forEach((key, j) => {
+      assertHexString(`accessList[${i}].storageKeys[${j}]`, key);
+    });
+  });
   return {
     ...tx,
-    value: hex(tx.value),
-    nonce: hex(tx.nonce),
-    gasLimit: hex(tx.gasLimit),
-    gasPrice: hex(tx.gasPrice),
-    maxFeePerGas: hex(tx.maxFeePerGas),
-    maxPriorityFeePerGas: hex(tx.maxPriorityFeePerGas),
+    // data included on purpose: Trezor Suite's EthereumSignTransaction runs its
+    // deepTransform strip/pad over the WHOLE tx, calldata too — special-casing
+    // data out of the padding here is what created truncation + fractional
+    // data_length on odd input. Byte-for-byte parity with upstream.
+    data: hex("data", tx.data),
+    value: hex("value", tx.value),
+    nonce: hex("nonce", tx.nonce),
+    gasLimit: hex("gasLimit", tx.gasLimit),
+    gasPrice: hex("gasPrice", tx.gasPrice),
+    maxFeePerGas: hex("maxFeePerGas", tx.maxFeePerGas),
+    maxPriorityFeePerGas: hex("maxPriorityFeePerGas", tx.maxPriorityFeePerGas),
     accessList: tx.accessList ? formatAnyHex(tx.accessList) : tx.accessList
   };
 }
@@ -2198,7 +2229,7 @@ async function processTxRequest(ctx, initialResponse, remainingData, chainIdForL
   let remaining = remainingData;
   const maxRounds = Math.ceil(remainingData.length / 2) + 64;
   let rounds = 0;
-  while (true) {
+  for (; ; ) {
     rounds += 1;
     if (rounds > maxRounds) {
       throw new Error(
@@ -2712,6 +2743,7 @@ function readSolSignTxParams(params) {
   if (typeof serializedTx !== "string" || serializedTx.length === 0) {
     throw createInvalidParamsError("solSignTransaction requires serializedTx as a hex string");
   }
+  assertHexString("serializedTx", serializedTx);
   return params;
 }
 function stripHexPrefix2(value) {
@@ -7465,6 +7497,19 @@ async function tronSignMessage(_ctx, _params) {
   );
 }
 function buildContractMessage(contract, ownerAddress) {
+  const contractCount = [
+    contract.transferContract,
+    contract.triggerSmartContract,
+    contract.freezeBalanceV2Contract,
+    contract.unfreezeBalanceV2Contract,
+    contract.voteWitnessContract,
+    contract.withdrawExpireUnfreezeContract
+  ].filter(Boolean).length;
+  if (contractCount > 1) {
+    throw createInvalidParamsError(
+      "tronSignTransaction: contract must specify exactly one contract type"
+    );
+  }
   if (contract.transferContract) {
     const c = contract.transferContract;
     return {