@scure/btc-signer 2.2.0 → 2.3.0

package/script.js

@@ -1,11 +1,16 @@
 import * as P from 'micro-packed';
-import { isBytes, reverseObject } from "./utils.js";
+import { aarray, abytes, isBytes, reverseObject, } from "./utils.js";
 /**
  * Maximum byte size allowed for a single pushed script element.
  * BIP 342 keeps this 520-byte stack-element limit even though tapscript removes
  * the old 10,000-byte overall script-size cap.
  */
 export const MAX_SCRIPT_BYTE_LENGTH = 520;
+// Be friendly to bad ECMAScript parsers by not using bigint literals.
+// prettier-ignore
+const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _8n = /* @__PURE__ */ BigInt(8);
+const U8_MAX = /* @__PURE__ */ BigInt(0xff);
+const COMPACT_DIRECT_MAX = /* @__PURE__ */ BigInt(0xfc);
 // prettier-ignore
 /**
  * Bitcoin Script opcode table.
@@ -75,13 +80,13 @@ export const OPNames = /* @__PURE__ */ (() => Object.freeze(reverseObject(OP)))(
 export function ScriptNum(bytesLimit = 6, forceMinimal = false) {
     return P.wrap({
         encodeStream: (w, value) => {
-            if (value === 0n)
+            if (value === _0n)
                 return;
             const neg = value < 0;
             const val = BigInt(value);
             const nums = [];
-            for (let abs = neg ? -val : val; abs; abs >>= 8n)
-                nums.push(Number(abs & 0xffn));
+            for (let abs = neg ? -val : val; abs; abs >>= _8n)
+                nums.push(Number(abs & U8_MAX));
             if (nums[nums.length - 1] >= 0x80)
                 nums.push(neg ? 0x80 : 0);
             else if (neg)
@@ -93,24 +98,23 @@ export function ScriptNum(bytesLimit = 6, forceMinimal = false) {
             if (len > bytesLimit)
                 throw new Error(`ScriptNum: number (${len}) bigger than limit=${bytesLimit}`);
             if (len === 0)
-                return 0n;
+                return _0n;
+            // Read the payload once instead of peeking for the minimality check and
+            // then re-reading it byte-by-byte through the Reader.
+            const data = r.bytes(len);
             if (forceMinimal) {
-                const data = r.bytes(len, true);
                 // MSB is zero (without sign bit) -> not minimally encoded
-                if ((data[data.length - 1] & 0x7f) === 0) {
+                if ((data[len - 1] & 0x7f) === 0) {
                     // exception
-                    if (len <= 1 || (data[data.length - 2] & 0x80) === 0)
+                    if (len <= 1 || (data[len - 2] & 0x80) === 0)
                         throw new Error('Non-minimally encoded ScriptNum');
                 }
             }
-            let last = 0;
-            let res = 0n;
-            for (let i = 0; i < len; ++i) {
-                last = r.byte();
-                res |= BigInt(last) << (8n * BigInt(i));
-            }
-            if (last >= 0x80) {
-                res &= (2n ** BigInt(len * 8) - 1n) >> 1n;
+            let res = _0n;
+            for (let i = 0; i < len; ++i)
+                res |= BigInt(data[i]) << (_8n * BigInt(i));
+            if (data[len - 1] >= 0x80) {
+                res &= (_2n ** BigInt(len * 8) - _1n) >> _1n;
                 res = -res;
             }
             return res;
@@ -137,7 +141,9 @@ export function OpToNum(op, bytesLimit = 4, forceMinimal = true) {
     if (isBytes(op)) {
         try {
             const val = ScriptNum(bytesLimit, forceMinimal).decode(op);
-            if (val > Number.MAX_SAFE_INTEGER)
+            // Symmetric safe-integer bound: large negative values would otherwise
+            // coerce through Number() with silent precision loss.
+            if (val > Number.MAX_SAFE_INTEGER || val < -Number.MAX_SAFE_INTEGER)
                 return;
             return Number(val);
         }
@@ -192,11 +198,15 @@ export const scriptPushLen = (op, read) => {
  */
 export const Script = /* @__PURE__ */ (() => Object.freeze(P.wrap({
     encodeStream: (w, value) => {
+        aarray(value, 'value');
         for (let o of value) {
             if (typeof o === 'string') {
-                if (OP[o] === undefined)
+                const op = OP[o];
+                // OP is a plain object, so inherited Object.prototype keys ('toString',
+                // 'constructor', ...) are not opcodes and must be rejected here too.
+                if (typeof op !== 'number')
                     throw new Error(`Unknown opcode=${o}`);
-                w.byte(OP[o]);
+                w.byte(op);
                 continue;
             }
             else if (typeof o === 'number') {
@@ -218,8 +228,7 @@ export const Script = /* @__PURE__ */ (() => Object.freeze(P.wrap({
             // Encode big numbers
             if (typeof o === 'number')
                 o = ScriptNum().encode(BigInt(o));
-            if (!isBytes(o))
-                throw new Error(`Wrong Script OP=${o} (${typeof o})`);
+            abytes(o, undefined, 'value');
             // Bytes
             const len = o.length;
             if (len < OP.PUSHDATA1)
@@ -269,13 +278,6 @@ export const Script = /* @__PURE__ */ (() => Object.freeze(P.wrap({
         return out;
     },
 })))();
-// BTC specific variable length integer encoding
-// https://en.bitcoin.it/wiki/Protocol_documentation#Variable_length_integer
-const CSLimits = {
-    0xfd: [0xfd, 2, 253n, 65535n],
-    0xfe: [0xfe, 4, 65536n, 4294967295n],
-    0xff: [0xff, 8, 4294967296n, 18446744073709551615n],
-};
 /**
  * Bitcoin CompactSize integer coder.
  * @example
@@ -284,37 +286,48 @@ const CSLimits = {
  * CompactSize.encode(1n);
  * ```
  */
-export const CompactSize = /* @__PURE__ */ (() => Object.freeze(P.wrap({
-    encodeStream: (w, value) => {
-        if (typeof value === 'number')
-            value = BigInt(value);
-        if (0n <= value && value <= 252n)
-            return w.byte(Number(value));
-        for (const [flag, bytes, start, stop] of Object.values(CSLimits)) {
-            if (start > value || value > stop)
-                continue;
-            w.byte(flag);
+export const CompactSize = /* @__PURE__ */ (() => {
+    // BTC specific variable length integer encoding
+    // https://en.bitcoin.it/wiki/Protocol_documentation#Variable_length_integer
+    const limits = {
+        0xfd: [0xfd, 2, BigInt(0xfd), BigInt(0xffff)],
+        0xfe: [0xfe, 4, BigInt(0x10000), BigInt(0xffffffff)],
+        0xff: [0xff, 8, BigInt(0x100000000), BigInt('0xffffffffffffffff')],
+    };
+    // Hoisted: Object.values() would otherwise allocate a fresh array on every encode.
+    const limitsList = Object.values(limits);
+    return Object.freeze(P.wrap({
+        encodeStream: (w, value) => {
+            if (typeof value === 'number')
+                value = BigInt(value);
+            if (_0n <= value && value <= COMPACT_DIRECT_MAX)
+                return w.byte(Number(value));
+            for (const [flag, bytes, start, stop] of limitsList) {
+                if (start > value || value > stop)
+                    continue;
+                w.byte(flag);
+                for (let i = 0; i < bytes; i++)
+                    w.byte(Number((value >> (_8n * BigInt(i))) & U8_MAX));
+                return;
+            }
+            throw w.err(`VarInt too big: ${value}`);
+        },
+        decodeStream: (r) => {
+            const b0 = r.byte();
+            if (b0 <= 0xfc)
+                return BigInt(b0);
+            const [_, bytes, start] = limits[b0];
+            let num = _0n;
             for (let i = 0; i < bytes; i++)
-                w.byte(Number((value >> (8n * BigInt(i))) & 0xffn));
-            return;
-        }
-        throw w.err(`VarInt too big: ${value}`);
-    },
-    decodeStream: (r) => {
-        const b0 = r.byte();
-        if (b0 <= 0xfc)
-            return BigInt(b0);
-        const [_, bytes, start] = CSLimits[b0];
-        let num = 0n;
-        for (let i = 0; i < bytes; i++)
-            num |= BigInt(r.byte()) << (8n * BigInt(i));
-        // BIP 152 / BIP 174: CompactSize fields must use the shortest encoding,
-        // so wider prefixes for smaller values are rejected here.
-        if (num < start)
-            throw r.err(`Wrong CompactSize(${8 * bytes})`);
-        return num;
-    },
-})))();
+                num |= BigInt(r.byte()) << (_8n * BigInt(i));
+            // BIP 152 / BIP 174: CompactSize fields must use the shortest encoding,
+            // so wider prefixes for smaller values are rejected here.
+            if (num < start)
+                throw r.err(`Wrong CompactSize(${8 * bytes})`);
+            return num;
+        },
+    }));
+})();
 // Same thing, but in number instead of bigint. Checks for safe integer inside
 /**
  * CompactSize coder that decodes into JavaScript numbers.
@@ -470,4 +483,3 @@ export const RawOldTx = /* @__PURE__ */ (() => Object.freeze(P.struct({
     outputs: BTCArray(RawOutput),
     lockTime: P.U32LE,
 })))();
-//# sourceMappingURL=script.js.map

package/src/_type_test.ts

@@ -0,0 +1,69 @@
+import { secp256k1 as secp } from '@noble/curves/secp256k1.js';
+import { hex } from '@scure/base';
+import * as btc from './index.ts';
+
+const privKey1 = hex.decode('0101010101010101010101010101010101010101010101010101010101010101');
+const P1 = secp.getPublicKey(privKey1, true);
+
+const wpkh = btc.p2wpkh(P1);
+
+const tx = new btc.Transaction();
+
+// Basic input test
+tx.addInput({
+  txid: hex.decode('0af50a00a22f74ece24c12cd667c290d3a35d48124a69f4082700589172a3aa2'),
+  index: 0,
+  ...wpkh,
+  finalScriptSig: Uint8Array.of(),
+  sequence: 1,
+});
+
+// Doesn't force any fields on input addition (only on sign)
+tx.addInput({
+  sequence: 1,
+});
+
+tx.updateInput(0, {
+  sequence: 1,
+});
+
+const nonWitnessUtxo =
+  '0200000001aad73931018bd25f84ae400b68848be09db706eac2ac18298babee71ab656f8b0000000048473044022058f6fc7c6a33e1b31548d481c826c015bd30135aad42cd67790dab66d2ad243b02204a1ced2604c6735b6393e5b41691dd78b00f0c5942fb9f751856faa938157dba01feffffff0280f0fa020000000017a9140fb9463421696b82c833af241c78c17ddbde493487d0f20a270100000017a91429ca74f8a08f81999428185c97b5d852e4063f618765000000';
+const nonWitnessUtxoB = hex.decode(nonWitnessUtxo);
+
+tx.updateInput(0, { nonWitnessUtxo: nonWitnessUtxo });
+tx.updateInput(0, { nonWitnessUtxo: nonWitnessUtxoB });
+tx.addInput({
+  txid: hex.decode('0af50a00a22f74ece24c12cd667c290d3a35d48124a69f4082700589172a3aa2'),
+  index: 0,
+  nonWitnessUtxo: nonWitnessUtxo,
+});
+
+tx.addInput({
+  txid: hex.decode('0af50a00a22f74ece24c12cd667c290d3a35d48124a69f4082700589172a3aa2'),
+  index: 0,
+  nonWitnessUtxo: nonWitnessUtxoB,
+});
+
+// Should fail!
+// tx.updateInput(0, {
+//   nonWitnessUtxo: 1,
+// });
+// Outputs
+tx.addOutput({ amount: BigInt(123) });
+// should fail
+// tx.updateOutput(0, { amount: '1' });
+// tx.updateOutput(0, { amount: 1 });
+// should fail
+// tx.addOutput({ amount: '123' });
+// tx.addOutput({ amount: 123 });
+
+for (let i = 0; i < tx.inputsLength; i++) {
+  // @ts-ignore
+  console.log('I', tx.getInput(i));
+}
+
+for (let i = 0; i < tx.outputsLength; i++) {
+  // @ts-ignore
+  console.log('O', tx.getOutput(i));
+}

package/src/musig2.ts

@@ -1,8 +1,9 @@
 import { schnorr, secp256k1 } from '@noble/curves/secp256k1.js';
+import type { WeierstrassPoint } from '@noble/curves/abstract/weierstrass.js';
 import { aInRange, concatBytes, equalBytes, numberToBytesBE } from '@noble/curves/utils.js';
 import { abytes, anumber, randomBytes } from '@noble/hashes/utils.js';
 import * as P from 'micro-packed';
-import { compareBytes, hasEven, type TArg, type TRet } from './utils.ts';
+import { compareBytes, hasEven, type TArg, type TRet, validateObject } from './utils.ts';
 
 /*
 MuSig2. This is not the full protocol: only an implementation of primitives from BIP-327.
@@ -33,6 +34,15 @@ export type DetNonce = {
   /** Partial signature produced after combining all participant data. */
   partialSig: Uint8Array;
 };
+/** MuSig2 key aggregation context used by signing sessions. */
+export type KeyAggregate = {
+  /** Aggregate public key before x-only export. */
+  aggPublicKey: WeierstrassPoint<bigint>;
+  /** Accumulated sign from x-only tweaks. */
+  gAcc: bigint;
+  /** Accumulated tweak scalar. */
+  tweakAcc: bigint;
+};
 /**
  * Represents an error indicating an invalid contribution from a signer.
  * This allows pointing out which participant is malicious and what specifically is wrong.
@@ -75,6 +85,9 @@ const PUBKEY_LEN = /* @__PURE__ */ (() => secp256k1.lengths.publicKey!)();
 // BIP327 uses bytes(33, 0) both as cbytes_ext(Point.ZERO) for infinity and as GetSecondKey's
 // "no second distinct key" sentinel, so this all-zero compressed slot is intentionally out-of-band.
 const ZERO = /* @__PURE__ */ new Uint8Array(PUBKEY_LEN); // Compressed zero point
+// Be friendly to bad ECMAScript parsers by not using bigint literals.
+// prettier-ignore
+const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1);
 
 // Encoding
 // TODO: re-use in PSBT?
@@ -89,7 +102,7 @@ const compressed = /* @__PURE__ */ (() =>
 // nonzero scalars in [1, n); tweak scalars use different validation because 0 is allowed there.
 const scalar = /* @__PURE__ */ (() =>
   P.validate(P.U256BE, (n) => {
-    aInRange('n', n, 1n, Fn.ORDER);
+    aInRange('n', n, _1n, Fn.ORDER);
     return n;
   }))();
 // Shared for both per-signer pubnonce bytes and aggregate aggnonce bytes. Because it accepts
@@ -216,7 +229,7 @@ function keyAggCoeffInternal(
   // pk2 is the all-zero sentinel from GetSecondKey, so every real signer key still hashes.
   abytes(publicKey1, PUBKEY_LEN);
   abytes(publicKey2, PUBKEY_LEN);
-  if (equalBytes(publicKey1, publicKey2)) return 1n;
+  if (equalBytes(publicKey1, publicKey2)) return _1n;
   return taggedInt('KeyAgg coefficient', L, publicKey1);
 }
 
@@ -248,7 +261,7 @@ export function keyAggregate(
   publicKeys: TArg<Uint8Array[]>,
   tweaks: TArg<Uint8Array[]> = [],
   isXonly: boolean[] = []
-) {
+): KeyAggregate {
   // BIP327 KeyAgg inputs require `0 < u < 2^32`, and ApplyTweak consumes a one-for-one
   // list of boolean tweak modes; callers should enforce that public contract here.
   abytesArray(publicKeys, PUBKEY_LEN);
@@ -270,6 +283,10 @@ export function keyAggregate(
     }
     aggPublicKey = aggPublicKey.add(Pi.multiply(keyAggCoeffInternal(publicKeys[i], pk2, L)));
   }
+  // BIP327 KeyAggInternal: "Fail if is_infinite(Q)". Computationally unreachable for
+  // hash-derived coefficients, but the spec mandates the explicit check before tweaking.
+  if (isZero(aggPublicKey))
+    throw new Error('keyAggregate: aggregate public key cannot be infinity');
   let gAcc = Fn.ONE;
   let tweakAcc = Fn.ZERO;
   // Apply tweaks
@@ -302,6 +319,9 @@ export function keyAggregate(
  * ```
  */
 export function keyAggExport(ctx: ReturnType<typeof keyAggregate>): TRet<Uint8Array> {
+  validateObject(ctx as Record<string, any>, {}, {}, 'ctx');
+  if (!(ctx.aggPublicKey instanceof Point))
+    throw new TypeError('"ctx.aggPublicKey" expected point, got type=' + typeof ctx.aggPublicKey);
   // BIP327 GetXonlyPubkey returns xbytes(Q), so this is the 32-byte x-only aggregate key
   // instead of the 33-byte compressed SEC1 form.
   return pointToBytes(ctx.aggPublicKey) as TRet<Uint8Array>;
@@ -502,6 +522,7 @@ export class Session {
     tweaks: Uint8Array[] = [],
     isXonly: boolean[] = []
   ) {
+    abytes(aggNonce, 66);
     abytesArray(publicKeys, 33);
     abytesArray(tweaks, 32);
     aXonly(isXonly);
@@ -520,7 +541,10 @@ export class Session {
     this.gAcc = gAcc;
     this.tweakAcc = tweakAcc;
     this.b = taggedInt('MuSig/noncecoef', aggNonce, pointToBytes(aggPublicKey), msg);
-    const R = R1.add(R2.multiply(this.b));
+    // b and the nonce points are public session values, so the faster variable-time
+    // multiplication is safe here; it also matches the reference point_mul, which
+    // maps a (negligible-probability) zero coefficient to infinity instead of failing.
+    const R = R1.add(R2.multiplyUnsafe(this.b));
     this.R = isZero(R) ? Point.BASE : R;
     this.e = taggedInt('BIP0340/challenge', pointToBytes(this.R), pointToBytes(aggPublicKey), msg);
     this.tweaks = tweaks.map((t) => Uint8Array.from(t));
@@ -555,13 +579,16 @@ export class Session {
     // BIP327 PartialSigVerifyInternal: `Let s = int(psig); fail if s >= n`, so s=0 must stay
     // in the public verification equation and return false on mismatch instead of throwing.
     const { R1, R2 } = PubNonce.decode(publicNonce);
-    const Re_s_ = R1.add(R2.multiply(b));
+    // Verification only handles public data (nonces, pubkeys, hash-derived scalars),
+    // so the faster variable-time multiplications are safe here; they also match the
+    // reference point_mul, which maps zero scalars to infinity instead of failing.
+    const Re_s_ = R1.add(R2.multiplyUnsafe(b));
     const Re_s = hasEven(R.y) ? Re_s_ : Re_s_.negate();
     const P = Point.fromBytes(publicKey);
     const a = this.getSessionKeyAggCoeff(P);
-    const g = Fn.mul(evenScalar(Q, 1n), gAcc);
+    const g = Fn.mul(evenScalar(Q, _1n), gAcc);
     const left = Point.BASE.multiplyUnsafe(s);
-    const right = Re_s.add(P.multiply(Fn.mul(e, Fn.mul(a, g))));
+    const right = Re_s.add(P.multiplyUnsafe(Fn.mul(e, Fn.mul(a, g))));
     return left.equals(right);
   }
 
@@ -587,7 +614,7 @@ export class Session {
     // Modifying input arguments is pretty bad.
     secretNonce.fill(0, 0, 64);
     if (!Fn.isValid(k1_)) throw new Error('wrong k1');
-    if (!Fn.isValid(k2_)) throw new Error('wrong k1');
+    if (!Fn.isValid(k2_)) throw new Error('wrong k2');
     const k1 = evenScalar(R, k1_);
     const k2 = evenScalar(R, k2_);
     const d_ = Fn.fromBytes(secret);
@@ -596,7 +623,7 @@ export class Session {
     const pk = P.toBytes(true);
     if (!equalBytes(pk, originalPk)) throw new Error('Public key does not match nonceGen argument');
     const a = this.getSessionKeyAggCoeff(P);
-    const g = evenScalar(Q, 1n);
+    const g = evenScalar(Q, _1n);
     const d = Fn.mul(g, Fn.mul(gAcc, d_));
     /// k1 + (b*k2) + (e*a*d)
     const s = Fn.add(k1, Fn.add(Fn.mul(b, k2), Fn.mul(e, Fn.mul(a, d))));
@@ -654,13 +681,13 @@ export class Session {
     // [] is not a valid aggregate-signature input even though the sum starts from zero.
     if (partialSigs.length < 1) throw new RangeError('partialSigs.length must be >= 1');
     const { Q, tweakAcc, R, e } = this;
-    let s = 0n;
+    let s = _0n;
     for (let i = 0; i < partialSigs.length; i++) {
       const si = Fn.fromBytes(partialSigs[i], true);
       if (!Fn.isValid(si)) throw new InvalidContributionErr(i, 'psig');
       s = Fn.add(s, si);
     }
-    const g = evenScalar(Q, 1n);
+    const g = evenScalar(Q, _1n);
     s = Fn.add(s, Fn.mul(e, Fn.mul(g, tweakAcc))); // s + e * g * tweakAcc
     return concatBytes(pointToBytes(R), Fn.toBytes(s)) as TRet<Uint8Array>;
   }