@scure/btc-signer 1.0.0 → 1.1.0

package/index.ts

@@ -2,7 +2,7 @@
 import { secp256k1 as _secp, schnorr } from '@noble/curves/secp256k1';
 import { sha256 } from '@noble/hashes/sha256';
 import { ripemd160 } from '@noble/hashes/ripemd160';
-import { hex, base58, base58check as _b58, bech32, bech32m } from '@scure/base';
+import { hex, base58check as _b58, bech32, bech32m } from '@scure/base';
 import type { Coder } from '@scure/base';
 import * as P from 'micro-packed';
 
@@ -327,6 +327,7 @@ export function OpToNum(op: ScriptOP, bytesLimit = 4, forceMinimal = true) {
       return;
     }
   }
+  return;
 }
 
 // BTC specific variable length integer encoding
@@ -680,8 +681,8 @@ const PSBTInputCoder = P.validate(PSBTKeyMap(PSBTInput), (i) => {
     throw new Error('validateInput: wmpty finalScriptWitness');
   //if (i.finalScriptSig && !i.finalScriptSig.length) throw new Error('validateInput: empty finalScriptSig');
   if (i.partialSig && !i.partialSig.length) throw new Error('Empty partialSig');
-  if (i.partialSig) for (const [k, v] of i.partialSig) validatePubkey(k, PubT.ecdsa);
-  if (i.bip32Derivation) for (const [k, v] of i.bip32Derivation) validatePubkey(k, PubT.ecdsa);
+  if (i.partialSig) for (const [k] of i.partialSig) validatePubkey(k, PubT.ecdsa);
+  if (i.bip32Derivation) for (const [k] of i.bip32Derivation) validatePubkey(k, PubT.ecdsa);
   // Locktime = unsigned little endian integer greater than or equal to 500000000 representing
   if (i.requiredTimeLocktime !== undefined && i.requiredTimeLocktime < 500000000)
     throw new Error(`validateInput: wrong timeLocktime=${i.requiredTimeLocktime}`);
@@ -724,7 +725,7 @@ const PSBTInputCoder = P.validate(PSBTKeyMap(PSBTInput), (i) => {
 });
 
 const PSBTOutputCoder = P.validate(PSBTKeyMap(PSBTOutput), (o) => {
-  if (o.bip32Derivation) for (const [k, v] of o.bip32Derivation) validatePubkey(k, PubT.ecdsa);
+  if (o.bip32Derivation) for (const [k] of o.bip32Derivation) validatePubkey(k, PubT.ecdsa);
   return o;
 });
 
@@ -906,7 +907,7 @@ const TxHashIdx = P.struct({ txid: P.bytes(32, true), index: P.U32LE });
 // - generate input script
 // - generate address/output/redeem from user input
 // P2ret represents generic interface for all p2* methods
-type P2Ret = {
+export type P2Ret = {
   type: string;
   script: Bytes;
   address?: string;
@@ -929,7 +930,9 @@ const OutPK: Coder<OptScript, OutPKType | undefined> = {
   },
   decode: (to: OutPKType): OptScript => (to.type === 'pk' ? [to.pubkey, 'CHECKSIG'] : undefined),
 };
+// @ts-ignore
 export const p2pk = (pubkey: Bytes, network = NETWORK): P2Ret => {
+  // network is unused
   if (!isValidPubkey(pubkey, PubT.ecdsa)) throw new Error('P2PK: invalid publicKey');
   return {
     type: 'pk',
@@ -937,7 +940,7 @@ export const p2pk = (pubkey: Bytes, network = NETWORK): P2Ret => {
   };
 };
 
-// Publick Key Hash (P2PKH)
+// Public Key Hash (P2PKH)
 type OutPKHType = { type: 'pkh'; hash: Bytes };
 const OutPKH: Coder<OptScript, OutPKHType | undefined> = {
   encode(from: ScriptType): OutPKHType | undefined {
@@ -1094,32 +1097,51 @@ export function taprootListToTree(taprootList: TaprootScriptList): TaprootScript
   return (last?.childs || last) as TaprootScriptTree;
 }
 type HashedTree =
-  | { type: 'leaf'; version?: number; script: Bytes; hash: Bytes; tapInternalKey?: Bytes }
+  | { type: 'leaf'; version?: number; script: Bytes; hash: Bytes }
   | { type: 'branch'; left: HashedTree; right: HashedTree; hash: Bytes };
-function checkTaprootScript(script: Bytes, allowUnknowOutput = false) {
+function checkTaprootScript(script: Bytes, internalPubKey: Bytes, allowUnknownOutputs = false) {
   const out = OutScript.decode(script);
-  if (out.type === 'unknown' && allowUnknowOutput) return;
+  if (out.type === 'unknown' && allowUnknownOutputs) return;
   if (!['tr_ns', 'tr_ms'].includes(out.type))
     throw new Error(`P2TR: invalid leaf script=${out.type}`);
+  const outms = out as OutTRNSType | OutTRMSType;
+  if (!allowUnknownOutputs && outms.pubkeys) {
+    for (const p of outms.pubkeys) {
+      if (P.equalBytes(p, TAPROOT_UNSPENDABLE_KEY))
+        throw new Error('Unspendable taproot key in leaf script');
+      // It's likely a mistake at this point:
+      // 1. p2tr(A, p2tr_ns(2, [A, B])) == p2tr(A, p2tr_pk(B)) (A or B key)
+      // but will take more space and fees.
+      // 2. For multi-sig p2tr(A, p2tr_ns(2, [A, B, C])) it's probably a security issue:
+      // User creates 2 of 3 multisig of keys [A, B, C],
+      // but key A always can spend whole output without signatures from other keys.
+      // p2tr(A, p2tr_ns(2, [B, C, D])) is ok: A or (B and C) or (B and D) or (C and D)
+      if (P.equalBytes(p, internalPubKey)) {
+        throw new Error(
+          'Using P2TR with leaf script with same key as internal key is not supported'
+        );
+      }
+    }
+  }
 }
-function taprootHashTree(tree: TaprootScriptTree, allowUnknowOutput = false): HashedTree {
+function taprootHashTree(
+  tree: TaprootScriptTree,
+  internalPubKey: Bytes,
+  allowUnknownOutputs = false
+): HashedTree {
   if (!tree) throw new Error('taprootHashTree: empty tree');
   if (Array.isArray(tree) && tree.length === 1) tree = tree[0];
   // Terminal node (leaf)
   if (!Array.isArray(tree)) {
-    const { leafVersion: version, script: leafScript, tapInternalKey } = tree;
+    const { leafVersion: version, script: leafScript } = tree;
     // Earliest tree walk where we can validate tapScripts
     if (tree.tapLeafScript || (tree.tapMerkleRoot && !P.equalBytes(tree.tapMerkleRoot, P.EMPTY)))
       throw new Error('P2TR: tapRoot leafScript cannot have tree');
-    // Just to be sure that it is spendable
-    if (tapInternalKey && P.equalBytes(tapInternalKey, TAPROOT_UNSPENDABLE_KEY))
-      throw new Error('P2TR: tapRoot leafScript cannot have unspendble key');
     const script = typeof leafScript === 'string' ? hex.decode(leafScript) : leafScript;
     if (!isBytes(script)) throw new Error(`checkScript: wrong script type=${script}`);
-    checkTaprootScript(script, allowUnknowOutput);
+    checkTaprootScript(script, internalPubKey, allowUnknownOutputs);
     return {
       type: 'leaf',
-      tapInternalKey,
       version,
       script,
       hash: tapLeafHash(script, version),
@@ -1130,8 +1152,8 @@ function taprootHashTree(tree: TaprootScriptTree, allowUnknowOutput = false): Ha
   if (tree.length !== 2) throw new Error('hashTree: non binary tree!');
   // branch
   // Both nodes should exist
-  const left = taprootHashTree(tree[0], allowUnknowOutput);
-  const right = taprootHashTree(tree[1], allowUnknowOutput);
+  const left = taprootHashTree(tree[0], internalPubKey, allowUnknownOutputs);
+  const right = taprootHashTree(tree[1], internalPubKey, allowUnknownOutputs);
   // We cannot swap left/right here, since it will change structure of tree
   let [lH, rH] = [left.hash, right.hash];
   if (_cmpBytes(rH, lH) === -1) [lH, rH] = [rH, lH];
@@ -1143,7 +1165,6 @@ type TaprootLeaf = {
   script: Bytes;
   hash: Bytes;
   path: Bytes[];
-  tapInternalKey?: Bytes;
 };
 
 type HashedTreeWithPath =
@@ -1197,7 +1218,7 @@ export function p2tr(
   internalPubKey?: Bytes | string,
   tree?: TaprootScriptTree,
   network = NETWORK,
-  allowUnknowOutput = false
+  allowUnknownOutputs = false
 ): P2TROut {
   // Unspendable
   if (!internalPubKey && !tree) throw new Error('p2tr: should have pubKey or scriptTree (or both)');
@@ -1206,7 +1227,9 @@ export function p2tr(
       ? hex.decode(internalPubKey)
       : internalPubKey || TAPROOT_UNSPENDABLE_KEY;
   if (!isValidPubkey(pubKey, PubT.schnorr)) throw new Error('p2tr: non-schnorr pubkey');
-  let hashedTree = tree ? taprootAddPath(taprootHashTree(tree, allowUnknowOutput)) : undefined;
+  let hashedTree = tree
+    ? taprootAddPath(taprootHashTree(tree, pubKey, allowUnknownOutputs))
+    : undefined;
   const tapMerkleRoot = hashedTree ? hashedTree.hash : undefined;
   const [tweakedPubkey, parity] = taprootTweakPubkey(pubKey, tapMerkleRoot || P.EMPTY);
   let leaves;
@@ -1215,7 +1238,7 @@ export function p2tr(
       ...l,
       controlBlock: TaprootControlBlock.encode({
         version: (l.version || TAP_LEAF_VERSION) + parity,
-        internalKey: l.tapInternalKey || pubKey,
+        internalKey: pubKey,
         merklePath: l.path,
       }),
     }));
@@ -1351,7 +1374,7 @@ export function p2tr_ms(m: number, pubkeys: Bytes[], allowSamePubkeys = false) {
     script: OutScript.encode({ type: 'tr_ms', pubkeys, m }),
   };
 }
-// Uknown output type
+// Unknown output type
 type OutUnknownType = { type: 'unknown'; script: Bytes };
 const OutUnknown: Coder<OptScript, OutUnknownType | undefined> = {
   encode(from: ScriptType): OutUnknownType | undefined {
@@ -1481,19 +1504,17 @@ export function Address(network = NETWORK) {
         if (version === 0 && data.length === 32) return { type: 'wsh', hash: data };
         else if (version === 0 && data.length === 20) return { type: 'wpkh', hash: data };
         else if (version === 1 && data.length === 32) return { type: 'tr', pubkey: data };
-        else throw new Error('Unkown witness program');
+        else throw new Error('Unknown witness program');
       }
-      const data = base58.decode(address);
-      if (data.length !== 25) throw new Error('Invalid base58 address');
+      const data = base58check.decode(address);
+      if (data.length !== 21) throw new Error('Invalid base58 address');
       // Pay To Public Key Hash
       if (data[0] === network.pubKeyHash) {
-        const bytes = base58.decode(address);
-        return { type: 'pkh', hash: bytes.slice(1, bytes.length - 4) };
+        return { type: 'pkh', hash: data.slice(1) };
       } else if (data[0] === network.scriptHash) {
-        const bytes = base58.decode(address);
         return {
           type: 'sh',
-          hash: base58.decode(address).slice(1, bytes.length - 4),
+          hash: data.slice(1),
         };
       }
       throw new Error(`Invalid address prefix=${data[0]}`);
@@ -1502,6 +1523,10 @@ export function Address(network = NETWORK) {
 }
 // /Address
 
+/**
+ * Internal, exported only for backwards-compat. Use `SigHash` instead.
+ * @deprecated
+ */
 export enum SignatureHash {
   DEFAULT,
   ALL,
@@ -1509,7 +1534,23 @@ export enum SignatureHash {
   SINGLE,
   ANYONECANPAY = 0x80,
 }
-export const SigHashCoder = P.apply(P.U32LE, P.coders.tsEnum(SignatureHash));
+
+export enum SigHash {
+  DEFAULT = SignatureHash.DEFAULT,
+  ALL = SignatureHash.ALL,
+  NONE = SignatureHash.NONE,
+  SINGLE = SignatureHash.SINGLE,
+  DEFAULT_ANYONECANPAY = SignatureHash.DEFAULT | SignatureHash.ANYONECANPAY,
+  ALL_ANYONECANPAY = SignatureHash.ALL | SignatureHash.ANYONECANPAY,
+  NONE_ANYONECANPAY = SignatureHash.NONE | SignatureHash.ANYONECANPAY,
+  SINGLE_ANYONECANPAY = SignatureHash.SINGLE | SignatureHash.ANYONECANPAY,
+}
+
+function validateSigHash(s: SigHash) {
+  if (typeof s !== 'number' || typeof SigHash[s] !== 'string')
+    throw new Error(`Invalid SigHash=${s}`);
+  return s;
+}
 
 function unpackSighash(hashType: number) {
   const masked = hashType & 0b0011111;
@@ -1605,9 +1646,13 @@ export type TxOpts = {
   PSBTVersion?: number;
   // Flags
   // Allow output scripts to be unknown scripts (probably unspendable)
+  /** @deprecated Use `allowUnknownOutputs` */
   allowUnknowOutput?: boolean;
+  allowUnknownOutputs?: boolean;
   // Try to sign/finalize unknown input. All bets are off, but there is chance that it will work
+  /** @deprecated Use `allowUnknownInputs` */
   allowUnknowInput?: boolean;
+  allowUnknownInputs?: boolean;
   // Check input/output scripts for sanity
   disableScriptCheck?: boolean;
   // There is strange behaviour where tx without outputs encoded with empty output in the end,
@@ -1619,18 +1664,22 @@ export type TxOpts = {
   lowR?: boolean; // Use lowR signatures
 };
 
-// Check if object doens't have custom constructor (like Uint8Array/Array)
-const isPlainObject = (obj: any) =>
-  Object.prototype.toString.call(obj) === '[object Object]' && obj.constructor === Object;
-
+const toStr = {}.toString;
 function validateOpts(opts: TxOpts) {
-  if (!isPlainObject(opts)) throw new Error(`Wrong object type for transaction options: ${opts}`);
+  if (opts !== undefined && toStr.call(opts) !== '[object Object]')
+    throw new Error(`Wrong object type for transaction options: ${opts}`);
+
   const _opts = {
     ...opts,
+    // Defaults
     version: def(opts.version, DEFAULT_VERSION),
     lockTime: def(opts.lockTime, 0),
     PSBTVersion: def(opts.PSBTVersion, 0),
-  }; // Defaults
+  };
+  if (typeof _opts.allowUnknowInput !== 'undefined')
+    opts.allowUnknownInputs = _opts.allowUnknowInput;
+  if (typeof _opts.allowUnknowOutput !== 'undefined')
+    opts.allowUnknownOutputs = _opts.allowUnknowOutput;
   // 0 and -1 happens in tests
   if (![-1, 0, 1, 2].includes(_opts.version)) throw new Error(`Unknown version: ${_opts.version}`);
   if (typeof _opts.lockTime !== 'number') throw new Error('Transaction lock time should be number');
@@ -1641,8 +1690,8 @@ function validateOpts(opts: TxOpts) {
     throw new Error(`Unknown PSBT version ${_opts.PSBTVersion}`);
   // Flags
   for (const k of [
-    'allowUnknowOutput',
-    'allowUnknowInput',
+    'allowUnknownOutputs',
+    'allowUnknownInputs',
     'disableScriptCheck',
     'bip174jsCompat',
     'allowLegacyWitnessUtxo',
@@ -1856,7 +1905,7 @@ export class Transaction {
     out += 4 * CompactSizeLen.encode(this.inputs.length).length;
     out += 4 * CompactSizeLen.encode(this.outputs.length).length;
     for (const i of this.inputs)
-      if (i.finalScriptSig) out += 160 + 4 * VarBytes.encode(i.finalScriptSig).length;
+      out += 160 + 4 * VarBytes.encode(i.finalScriptSig || P.EMPTY).length;
     for (const o of outputs) out += 32 + 4 * VarBytes.encode(o.script).length;
     if (this.hasWitnesses) {
       for (const i of this.inputs)
@@ -1980,11 +2029,11 @@ export class Transaction {
     PSBTOutputCoder.encode(res);
     if (
       res.script &&
-      !this.opts.allowUnknowOutput &&
+      !this.opts.allowUnknownOutputs &&
       OutScript.decode(res.script).type === 'unknown'
     ) {
       throw new Error(
-        'Transaction/output: unknown output script type, there is a chance that input is unspendable. Pass allowUnkownScript=true, if you sure'
+        'Transaction/output: unknown output script type, there is a chance that input is unspendable. Pass allowUnknownScript=true, if you sure'
       );
     }
     if (!this.opts.disableScriptCheck) checkScript(res.script, res.redeemScript, res.witnessScript);
@@ -2148,10 +2197,10 @@ export class Transaction {
   // Used pretty often, should be fast
   private prevOut(input: TransactionInput): P.UnwrapCoder<typeof RawOutput> {
     if (input.nonWitnessUtxo) {
-      if (input.index === undefined) throw new Error('Uknown input index');
+      if (input.index === undefined) throw new Error('Unknown input index');
       return input.nonWitnessUtxo.outputs[input.index];
     } else if (input.witnessUtxo) return input.witnessUtxo;
-    else throw new Error('Cannot find previous output info.');
+    else throw new Error('Cannot find previous output info');
   }
   private inputType(input: TransactionInput) {
     let txType = 'legacy';
@@ -2212,12 +2261,7 @@ export class Transaction {
   }
 
   // Signer can be privateKey OR instance of bip32 HD stuff
-  signIdx(
-    privateKey: Signer,
-    idx: number,
-    allowedSighash?: SignatureHash[],
-    _auxRand?: Bytes
-  ): boolean {
+  signIdx(privateKey: Signer, idx: number, allowedSighash?: SigHash[], _auxRand?: Bytes): boolean {
     this.checkInputIdx(idx);
     const input = this.inputs[idx];
     const inputType = this.inputType(input);
@@ -2242,7 +2286,8 @@ export class Transaction {
     }
     // Sighash checks
     // Just for compat with bitcoinjs-lib, so users won't face unexpected behaviour.
-    if (!allowedSighash) allowedSighash = [inputType.defaultSighash];
+    if (!allowedSighash) allowedSighash = [inputType.defaultSighash as unknown as SigHash];
+    else allowedSighash.forEach(validateSigHash);
     const sighash = inputType.sighash;
     if (!allowedSighash.includes(sighash)) {
       throw new Error(
@@ -2253,7 +2298,7 @@ export class Transaction {
     // however this was because of bug in bitcoin-core, which remains here because of consensus.
     // If this is absolutely neccessary for your case, please open issue.
     // We disable it to avoid complicated workflow where SINGLE will block adding new outputs
-    const { sigInputs, sigOutputs } = this.inputSighash(idx);
+    const { sigOutputs } = this.inputSighash(idx);
     if (sigOutputs === SignatureHash.SINGLE && idx >= this.outputs.length) {
       throw new Error(
         `Input with sighash SINGLE, but there is no output with corresponding index=${idx}`
@@ -2282,7 +2327,7 @@ export class Transaction {
           input.tapInternalKey,
           merkleRoot
         );
-        const [taprootPubKey, parity] = taprootTweakPubkey(input.tapInternalKey, merkleRoot);
+        const [taprootPubKey, _] = taprootTweakPubkey(input.tapInternalKey, merkleRoot);
         if (P.equalBytes(taprootPubKey, pubKey)) {
           const hash = this.preimageWitnessV1(idx, prevOutScript, sighash, amount);
           const sig = concat(
@@ -2295,18 +2340,13 @@ export class Transaction {
       }
       if (input.tapLeafScript) {
         input.tapScriptSig = input.tapScriptSig || [];
-        for (const [cb, _script] of input.tapLeafScript) {
+        for (const [_, _script] of input.tapLeafScript) {
           const script = _script.subarray(0, -1);
           const scriptDecoded = Script.decode(script);
           const ver = _script[_script.length - 1];
           const hash = tapLeafHash(script, ver);
-          const { pubKey, privKey } = getTaprootKeys(
-            privateKey,
-            schnorrPub,
-            cb.internalKey,
-            P.EMPTY // Because we cannot have nested taproot tree
-          );
-          const pos = scriptDecoded.findIndex((i) => isBytes(i) && P.equalBytes(i, pubKey));
+          // NOTE: no need to tweak internal key here, since we don't support nested p2tr
+          const pos = scriptDecoded.findIndex((i) => isBytes(i) && P.equalBytes(i, schnorrPub));
           // Skip if there is no public key in tapLeafScript
           if (pos === -1) continue;
           const msg = this.preimageWitnessV1(
@@ -2319,12 +2359,12 @@ export class Transaction {
             ver
           );
           const sig = concat(
-            schnorr.sign(msg, privKey, _auxRand),
+            schnorr.sign(msg, privateKey, _auxRand),
             sighash !== SignatureHash.DEFAULT ? new Uint8Array([sighash]) : P.EMPTY
           );
           this.updateInput(
             idx,
-            { tapScriptSig: [[{ pubKey: pubKey, leafHash: hash }, sig]] },
+            { tapScriptSig: [[{ pubKey: schnorrPub, leafHash: hash }, sig]] },
             true
           );
           signed = true;
@@ -2428,7 +2468,7 @@ export class Transaction {
               signatures.push(scriptSig[sigIdx][1]);
             }
             if (signatures.length !== outScript.pubkeys.length) continue;
-          } else if (outScript.type === 'unknown' && this.opts.allowUnknowInput) {
+          } else if (outScript.type === 'unknown' && this.opts.allowUnknownInputs) {
             // Trying our best to sign what we can
             const scriptDecoded = Script.decode(script);
             signatures = scriptSig
@@ -2485,7 +2525,7 @@ export class Transaction {
     } else if (inputType.last.type === 'wpkh') {
       inputScript = P.EMPTY;
       witness = [input.partialSig[0][1], input.partialSig[0][0]];
-    } else if (inputType.last.type === 'unknown' && !this.opts.allowUnknowInput)
+    } else if (inputType.last.type === 'unknown' && !this.opts.allowUnknownInputs)
       throw new Error('Unknown inputs not allowed');
 
     // Create final scripts (generic part)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scure/btc-signer",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Audited & minimal library for creating, signing & decoding Bitcoin transactions: with Schnorr, Taproot, UTXO & PSBT",
   "files": [
     "index.js",
@@ -14,13 +14,13 @@
   "module": "index.js",
   "types": "index.d.ts",
   "dependencies": {
-    "@noble/curves": "~1.0.0",
-    "@noble/hashes": "~1.3.0",
-    "@scure/base": "~1.1.1",
+    "@noble/curves": "~1.2.0",
+    "@noble/hashes": "~1.3.1",
+    "@scure/base": "~1.1.3",
     "micro-packed": "~0.3.2"
   },
   "devDependencies": {
-    "@scure/bip32": "~1.3.0",
+    "@scure/bip32": "~1.3.2",
     "micro-packed-debugger": "0.3.1",
     "micro-should": "0.4.0",
     "prettier": "2.8.4",
@@ -36,8 +36,10 @@
   "scripts": {
     "build": "tsc",
     "lint": "prettier --check index.ts",
+    "format": "prettier --write index.ts",
     "test": "node test/index.test.js && node test/psbt-test/bip174-psbt-extended.test.js",
-    "test:extended": "node --experimental-loader ./test/bitcoinjs-test/esm-loader.js ./test/bitcoinjs-test/index.test.js"
+    "test:extended": "node --experimental-loader ./test/bitcoinjs-test/esm-loader.js ./test/bitcoinjs-test/index.test.js",
+    "test:slow": "node test/index.test.js && node test/slow.test.js"
   },
   "keywords": [
     "bitcoin",
@@ -55,10 +57,5 @@
     "p2wsh",
     "p2tr"
   ],
-  "funding": [
-    {
-      "type": "individual",
-      "url": "https://paulmillr.com/funding/"
-    }
-  ]
-}
+  "funding": "https://paulmillr.com/funding/"
+}