@qorechain/wallet-adapter 0.1.2 → 0.1.4

package/README.md

@@ -85,3 +85,30 @@ await fetch(`${rpc}`, { method:'POST', body: JSON.stringify({
 ## License
 
 Apache-2.0
+
+## Unified wallet generation (all 3 addresses)
+
+Every account is one 20-byte identity rendered as three encodings that share a
+single on-chain balance. Generate an eth-native wallet and get all three at once,
+plus the ML-DSA-87 (Dilithium-5) key for the PQC-hybrid Cosmos ante:
+
+```js
+import { generateQoreWallet, walletFromMnemonic } from "@qorechain/wallet-adapter";
+
+const w = await generateQoreWallet();          // random 24-word mnemonic
+// const w = await walletFromMnemonic(existing); // or recover
+w.cosmos // qor1…            (bech32)
+w.evm    // 0x… (EIP-55)     (hex — EVM-native, spendable via eth_sendRawTransaction)
+w.svm    // <base58>         (base58 of the 20 bytes + 12 zero-byte pad)
+w.privateKey // 0x… (32B)
+w.pqc    // { publicKey, secretKey }  ML-DSA-87
+```
+
+The key is **eth-native** (address = `keccak256(pubkey)[12:]`), so it is spendable
+on the EVM lane; `cosmos` and `svm` are just other encodings of the same 20 bytes,
+under which the chain reads one `x/bank` balance. The account can sign EVM txs
+(EIP-155) **and** PQC-hybrid Cosmos txs (the chain's Cosmos ante handles
+`eth_secp256k1` and the hybrid decorator keys off the address).
+
+`addressesFrom20(bytes20)` / `qoreAddresses({cosmos|evm|hex})` derive the three
+encodings from a known account (for explorers / backends).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qorechain/wallet-adapter",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Drop-in adapter to add QoreChain to any Cosmos wallet (Keplr, Leap, Cosmostation, …) and sign its PQC-required transactions. The wallet signs an ordinary SIGN_MODE_DIRECT SignDoc; the adapter layers a standard FIPS-204 ML-DSA-87 hybrid signature into the tx body, so no wallet code changes are needed.",
   "type": "module",
   "main": "src/index.js",
@@ -31,7 +31,9 @@
   },
   "dependencies": {
     "@qorechain/pqc": "^0.1.1",
-    "cosmjs-types": "^0.9.0"
+    "cosmjs-types": "^0.9.0",
+    "@cosmjs/crypto": "^0.32.0",
+    "@cosmjs/encoding": "^0.32.0"
   },
   "devDependencies": {
     "@noble/post-quantum": "^0.6.1"

package/src/index.js

@@ -29,6 +29,14 @@ export {
   base58Encode, base58Decode, SYSTEM_PROGRAM_ID, systemTransferData,
   authSignBytes, buildPhantomSvmEnvelope, buildPhantomTransfer, registerAuthenticatorMsg,
 } from './phantom.js';
+// Unified wallet generation: one eth-native key → cosmos/evm/svm addresses + PQC key.
+export {
+  generateQoreWallet, walletFromMnemonic, addressesFrom20, qoreAddresses,
+} from './wallet.js';
+// eth-native (eth_secp256k1) Cosmos signing — classical (register) + hybrid (PQC).
+export {
+  signClassicalEth, signHybridEth, ETHSECP256K1_PUBKEY_TYPE,
+} from './sign-eth.js';
 import { TxBody, AuthInfo, TxRaw, SignerInfo, ModeInfo, Fee } from 'cosmjs-types/cosmos/tx/v1beta1/tx.js';
 import { SignMode } from 'cosmjs-types/cosmos/tx/signing/v1beta1/signing.js';
 import { SignDoc } from 'cosmjs-types/cosmos/tx/v1beta1/tx.js';

package/src/sign-eth.js

@@ -0,0 +1,91 @@
+// @qorechain/wallet-adapter — eth-native (eth_secp256k1) Cosmos signing.
+//
+// A QoreChain account created eth-native (address = keccak(pubkey)[12:]) signs
+// Cosmos SDK txs with the `eth_secp256k1` scheme: the classical signature is
+// secp256k1 over the KECCAK-256 of the SignDoc (not sha256), and the account's
+// pubkey is `/cosmos.evm.crypto.v1.ethsecp256k1.PubKey`. This is the same account
+// that spends on the EVM lane, so its qor1/0x/svm forms are one identity.
+//
+// Mainnet requires the ML-DSA-87 hybrid extension in the tx body; signHybridEth
+// adds it. signClassicalEth omits it (used for the one-time PQC key registration,
+// which is bootstrap-exempt from the hybrid requirement).
+
+import { Secp256k1, Keccak256 } from '@cosmjs/crypto';
+import { fromHex } from '@cosmjs/encoding';
+import { TxBody, AuthInfo, TxRaw, SignerInfo, ModeInfo, Fee, SignDoc } from 'cosmjs-types/cosmos/tx/v1beta1/tx.js';
+import { SignMode } from 'cosmjs-types/cosmos/tx/signing/v1beta1/signing.js';
+import { PubKey } from 'cosmjs-types/cosmos/crypto/secp256k1/keys.js';
+import { mldsa } from '@qorechain/pqc';
+import { frame, encodePqcHybridSignature, HYBRID_SIG_TYPE_URL, ALGORITHM_ML_DSA_87 } from './framing.js';
+
+// cosmos/evm eth_secp256k1 pubkey type. Wire shape is identical to the cosmos
+// secp256k1 PubKey ({1: bytes key}), only the typeUrl differs.
+export const ETHSECP256K1_PUBKEY_TYPE = '/cosmos.evm.crypto.v1.ethsecp256k1.PubKey';
+
+function toBytes(x) {
+  if (x instanceof Uint8Array) return x;
+  return fromHex(String(x).replace(/^0x/, ''));
+}
+
+function buildAuthInfo(compressedPubkey, sequence, fee) {
+  const pubAny = {
+    typeUrl: ETHSECP256K1_PUBKEY_TYPE,
+    value: PubKey.encode(PubKey.fromPartial({ key: toBytes(compressedPubkey) })).finish(),
+  };
+  const authInfo = AuthInfo.fromPartial({
+    signerInfos: [SignerInfo.fromPartial({
+      publicKey: pubAny,
+      modeInfo: ModeInfo.fromPartial({ single: { mode: SignMode.SIGN_MODE_DIRECT } }),
+      sequence: BigInt(sequence),
+    })],
+    fee: Fee.fromPartial(fee),
+  });
+  return AuthInfo.encode(authInfo).finish();
+}
+
+// eth_secp256k1 classical signature over a SignDoc: secp256k1 sign of keccak(signBytes),
+// serialized as the 64-byte r‖s (low-s normalized by @cosmjs/crypto).
+async function ethSign(signBytes, privateKey) {
+  const hash = new Keccak256(signBytes).digest();
+  const sig = await Secp256k1.createSignature(hash, toBytes(privateKey));
+  const out = new Uint8Array(64);
+  out.set(sig.r(32), 0);
+  out.set(sig.s(32), 32);
+  return out;
+}
+
+/**
+ * Classical-only eth_secp256k1 Cosmos tx (no PQC extension). Use for the one-time
+ * MsgRegisterPQCKeyV2 (bootstrap-exempt). `key` = { privateKey, pubkey } from
+ * generateQoreWallet/walletFromMnemonic.
+ */
+export async function signClassicalEth({ key, chainId, accountNumber, messages, fee, sequence, memo = '', timeoutHeight = 0n }) {
+  const authInfoBytes = buildAuthInfo(key.pubkey, sequence, fee);
+  const bodyBytes = TxBody.encode(TxBody.fromPartial({ messages, memo, timeoutHeight })).finish();
+  const signBytes = SignDoc.encode(SignDoc.fromPartial({
+    bodyBytes, authInfoBytes, chainId, accountNumber: BigInt(accountNumber),
+  })).finish();
+  const classical = await ethSign(signBytes, key.privateKey);
+  return TxRaw.encode(TxRaw.fromPartial({ bodyBytes, authInfoBytes, signatures: [classical] })).finish();
+}
+
+/**
+ * Hybrid eth_secp256k1 + ML-DSA-87 Cosmos tx. `key` must include `pqc`
+ * ({publicKey, secretKey}) as produced by generateQoreWallet/walletFromMnemonic.
+ */
+export async function signHybridEth({ key, chainId, accountNumber, messages, fee, sequence, memo = '', timeoutHeight = 0n }) {
+  const authInfoBytes = buildAuthInfo(key.pubkey, sequence, fee);
+  // B0 = body without the PQC extension.
+  const b0 = TxBody.encode(TxBody.fromPartial({ messages, memo, timeoutHeight })).finish();
+  // ML-DSA-87 over frame(B0, authInfo).
+  const pqcSig = mldsa.sign(key.pqc.secretKey, frame(b0, authInfoBytes));
+  const bodyWithExt = TxBody.encode(TxBody.fromPartial({
+    messages, memo, timeoutHeight,
+    extensionOptions: [{ typeUrl: HYBRID_SIG_TYPE_URL, value: encodePqcHybridSignature(ALGORITHM_ML_DSA_87, pqcSig) }],
+  })).finish();
+  const signBytes = SignDoc.encode(SignDoc.fromPartial({
+    bodyBytes: bodyWithExt, authInfoBytes, chainId, accountNumber: BigInt(accountNumber),
+  })).finish();
+  const classical = await ethSign(signBytes, key.privateKey);
+  return TxRaw.encode(TxRaw.fromPartial({ bodyBytes: bodyWithExt, authInfoBytes, signatures: [classical] })).finish();
+}

package/src/wallet.js

@@ -0,0 +1,97 @@
+// @qorechain/wallet-adapter — unified wallet generation.
+//
+// One eth-native secp256k1 keypair → the SAME 20-byte account rendered as all
+// THREE QoreChain address encodings, so a wallet never "has funds on Cosmos but
+// not EVM" again. The 20 bytes are the Ethereum derivation `keccak256(pubkey)[12:]`
+// so the key is natively spendable on the EVM lane; the Cosmos (`qor1…`) and SVM
+// (base58) forms are just other encodings of those same 20 bytes — the chain reads
+// one x/bank balance for the account, visible under all three.
+//
+//   {
+//     mnemonic, privateKey (0x hex, 32B),
+//     pubkey (33B compressed),
+//     addressBytes (20B),
+//     cosmos: "qor1…",              // bech32
+//     evm:    "0x…" (EIP-55),       // hex
+//     svm:    "<base58>",           // base58(20B ‖ 12 zero bytes) = 32-byte SVM addr
+//     pqc:    { publicKey, secretKey }  // ML-DSA-87 (Dilithium-5), for the hybrid ante
+//   }
+//
+// Eth-native accounts are fully supported by the chain (the Cosmos ante's
+// SigVerification handles eth_secp256k1 and the PQC hybrid decorator keys off the
+// address), so the same wallet signs EVM txs (EIP-155) AND PQC-hybrid Cosmos txs.
+
+import { Bip39, Random, Slip10, Slip10Curve, stringToPath, Secp256k1, Keccak256, EnglishMnemonic } from '@cosmjs/crypto';
+import { toBech32, toHex, fromHex, fromBech32 } from '@cosmjs/encoding';
+import { mldsa, shake256 } from '@qorechain/pqc';
+import { base58Encode } from './phantom.js';
+
+// Ethereum HD path (coin-type 60) — makes the 20-byte address the keccak
+// derivation, so the key is EVM-native (spendable via eth_sendRawTransaction).
+const ETH_HD_PATH = "m/44'/60'/0'/0/0";
+const HRP = 'qor';
+
+// EIP-55 mixed-case checksum for a 20-byte hex address (no 0x).
+function toEip55(hex20) {
+  const lower = hex20.toLowerCase();
+  const hash = toHex(new Keccak256(new TextEncoder().encode(lower)).digest());
+  let out = '0x';
+  for (let i = 0; i < lower.length; i++) {
+    out += parseInt(hash[i], 16) >= 8 ? lower[i].toUpperCase() : lower[i];
+  }
+  return out;
+}
+
+// Derive the three encodings + the PQC key from a 20-byte account address.
+// Exposed so SDKs / backends can render all three from a known account too.
+export function addressesFrom20(addr20) {
+  if (addr20.length !== 20) throw new Error('address must be 20 bytes');
+  const hex = toHex(addr20);
+  const svmBytes = new Uint8Array(32);
+  svmBytes.set(addr20, 0); // right-pad with 12 zero bytes → the unified 32-byte SVM address
+  return { addressBytes: addr20, cosmos: toBech32(HRP, addr20), evm: toEip55(hex), svm: base58Encode(svmBytes) };
+}
+
+function derivePqc(cosmosAddr, mnemonic) {
+  const seed = shake256(new TextEncoder().encode(`qorechain:pqc:v1|${cosmosAddr}|${mnemonic}`), 32);
+  return mldsa.keygen(seed); // deterministic + recoverable from {address, mnemonic}
+}
+
+async function fromMnemonicObj(mnemonic) {
+  const seed = await Bip39.mnemonicToSeed(new EnglishMnemonic(mnemonic));
+  const { privkey } = Slip10.derivePath(Slip10Curve.Secp256k1, seed, stringToPath(ETH_HD_PATH));
+  const kp = await Secp256k1.makeKeypair(privkey);
+  const uncompressed = kp.pubkey; // 65 bytes, 0x04 || X || Y
+  const compressed = Secp256k1.compressPubkey(uncompressed); // 33 bytes
+  // Ethereum address = last 20 bytes of keccak256 of the 64-byte pubkey (drop 0x04).
+  const addr20 = new Keccak256(uncompressed.slice(1)).digest().slice(12);
+  const enc = addressesFrom20(addr20);
+  return {
+    mnemonic,
+    privateKey: '0x' + toHex(privkey),
+    pubkey: '0x' + toHex(compressed),
+    ...enc,
+    pqc: derivePqc(enc.cosmos, mnemonic),
+  };
+}
+
+/** Generate a fresh unified QoreChain wallet (random 24-word mnemonic). */
+export async function generateQoreWallet(strength = 256) {
+  const mnemonic = Bip39.encode(Random.getBytes(strength / 8)).toString();
+  return fromMnemonicObj(mnemonic);
+}
+
+/** Recover a unified QoreChain wallet from an existing BIP39 mnemonic. */
+export async function walletFromMnemonic(mnemonic) {
+  return fromMnemonicObj(mnemonic);
+}
+
+/** Convenience: the three address encodings of an existing account. */
+export function qoreAddresses({ cosmos, evm, hex }) {
+  let addr20;
+  if (evm) addr20 = fromHex(evm.replace(/^0x/, ''));
+  else if (hex) addr20 = fromHex(hex.replace(/^0x/, ''));
+  else if (cosmos) addr20 = fromBech32(cosmos).data;
+  else throw new Error('provide one of {cosmos, evm, hex}');
+  return addressesFrom20(addr20);
+}