@smartledger/bsv 5.5.3 → 6.0.1

package/lib/statuslist/index.js

@@ -7,6 +7,57 @@
 
 var vcjwt = require('../vcjwt')
 var crypto = require('crypto')
+var zlib = require('zlib')
+
+// Upper bound on the decompressed bitstring to defuse gzip-bomb DoS: a tiny
+// crafted payload can otherwise inflate to gigabytes. A StatusList2021 bitstring
+// is 1 bit per credential, so 8 MB covers ~64M credentials — far beyond any real
+// list — while refusing a malicious blow-up. Override with maxDecompressedBytes.
+var MAX_DECOMPRESSED_BYTES = 8 * 1024 * 1024
+
+function _safeGunzip (encodedList, params) {
+  var max = (params && params.maxDecompressedBytes) || MAX_DECOMPRESSED_BYTES
+  return zlib.gunzipSync(Buffer.from(encodedList, 'base64'), { maxOutputLength: max })
+}
+
+/**
+ * Verify the status-list JWT signature and issuer BEFORE trusting any bit it
+ * carries, then return the verified payload. Without this, anyone who can
+ * substitute the list JWT (MITM, stale cache, swapped URL, hand-crafted token)
+ * can flip a revoked credential back to "valid", defeating StatusList2021.
+ *
+ * Fails closed: throws unless the signature verifies against the PINNED issuer's
+ * key. Requires params.expectedIssuerDid plus a key source (params.didResolver,
+ * params.issuerJwks, or params.issuerPublicJwk).
+ */
+async function _verifyAndDecode (listVcJwt, params) {
+  if (!params.expectedIssuerDid) {
+    throw new Error('expectedIssuerDid is required to verify a status list (issuer ' +
+      'pinning); refusing to read revocation state from an unpinned/unverified JWT')
+  }
+  var resolver = params.didResolver
+  if (!resolver) {
+    var jwks = params.issuerJwks ||
+      (params.issuerPublicJwk ? { keys: [params.issuerPublicJwk] } : null)
+    if (!jwks) {
+      throw new Error('Provide params.didResolver, params.issuerJwks, or ' +
+        'params.issuerPublicJwk to verify the status list signature')
+    }
+    resolver = async function () { return { jwks: jwks } }
+  }
+  var result = await vcjwt.verifyVcJwt(listVcJwt, {
+    didResolver: resolver,
+    expectedIssuerDid: params.expectedIssuerDid,
+    allowedAlgs: params.allowedAlgs,
+    allowLegacyDER: params.allowLegacyDER,
+    clockToleranceSec: params.clockToleranceSec
+  })
+  if (!result.valid) {
+    throw new Error('Status list signature verification failed: ' +
+      (result.error || 'invalid signature'))
+  }
+  return result.payload
+}
 
 // Create a new status list
 async function createStatusList(params) {
@@ -65,19 +116,13 @@ async function updateStatusList(params) {
     throw new Error('listVcJwt, index, status, and privateJwk are required')
   }
 
-  // Decode the existing status list JWT
-  var parts = params.listVcJwt.split('.')
-  if (parts.length !== 3) {
-    throw new Error('Invalid JWT format')
-  }
-
-  var payload = JSON.parse(vcjwt.base64UrlDecode(parts[1]).toString())
+  // Verify the existing list's signature+issuer before building on top of it —
+  // an unverified base list lets an attacker seed forged revocation state.
+  var payload = await _verifyAndDecode(params.listVcJwt, params)
   var encodedList = payload.vc.credentialSubject.encodedList
 
-  // Decompress
-  var zlib = require('zlib')
-  var compressed = Buffer.from(encodedList, 'base64')
-  var bitstring = zlib.gunzipSync(compressed)
+  // Decompress (bounded to defuse gzip bombs)
+  var bitstring = _safeGunzip(encodedList, params)
 
   // Update the bit at the given index
   var byteIndex = Math.floor(params.index / 8)
@@ -124,25 +169,21 @@ async function updateStatusList(params) {
   }
 }
 
-// Get credential status entry
-function getCredentialStatusEntry(params) {
+// Get credential status entry.
+// ASYNC + fail-closed: the status list JWT signature and issuer are verified
+// before any bit is read. Reading revocation state from an unverified JWT is a
+// revocation bypass (a forged/substituted list can un-revoke a credential).
+async function getCredentialStatusEntry(params) {
   if (!params.listVcJwt || params.index === undefined) {
     throw new Error('listVcJwt and index are required')
   }
 
-  // Decode the status list JWT
-  var parts = params.listVcJwt.split('.')
-  if (parts.length !== 3) {
-    throw new Error('Invalid JWT format')
-  }
-
-  var payload = JSON.parse(vcjwt.base64UrlDecode(parts[1]).toString())
+  // Verify signature + pinned issuer, then read from the VERIFIED payload.
+  var payload = await _verifyAndDecode(params.listVcJwt, params)
   var encodedList = payload.vc.credentialSubject.encodedList
 
-  // Decompress
-  var zlib = require('zlib')
-  var compressed = Buffer.from(encodedList, 'base64')
-  var bitstring = zlib.gunzipSync(compressed)
+  // Decompress (bounded to defuse gzip bombs)
+  var bitstring = _safeGunzip(encodedList, params)
 
   // Check the bit at the given index
   var byteIndex = Math.floor(params.index / 8)

package/lib/vcjwt/index.js

@@ -151,6 +151,12 @@ async function verifyVcJwt (jwt, opts) {
     var now = Math.floor(Date.now() / 1000)
     var clockTolerance = opts.clockToleranceSec || 60
 
+    // A token with no `exp` never expires. Callers that require bounded-lifetime
+    // credentials should pass requireExpiration:true to reject exp-less tokens.
+    if (opts.requireExpiration && !payload.exp) {
+      return { valid: false, error: 'JWT missing required exp claim', header: header, payload: payload }
+    }
+
     if (payload.exp && payload.exp < (now - clockTolerance)) {
       return { valid: false, error: 'JWT expired', header: header, payload: payload }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "5.5.3",
+  "version": "6.0.1",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",

package/test/credentials-test.js

@@ -141,35 +141,37 @@ async function testStatusListCreation(issuerDid, keys) {
 }
 
 // Test 7: StatusList2021 Update (Revocation)
-async function testStatusListRevocation(listJwt, keys) {
+async function testStatusListRevocation(listJwt, keys, issuerDid, jwks) {
   console.log('\n7️⃣  Testing credential revocation...')
-  
+
   var index = 42
-  
+  var didResolver = async function() { return { jwks: jwks } }
+  var verifyOpts = { expectedIssuerDid: issuerDid, didResolver: didResolver }
+
   // Check initial status
-  var initialStatus = statuslist.getCredentialStatusEntry({
+  var initialStatus = await statuslist.getCredentialStatusEntry(Object.assign({
     listVcJwt: listJwt,
     index: index
-  })
-  
+  }, verifyOpts))
+
   assert.strictEqual(initialStatus, 'valid', 'Initial status should be valid')
   console.log('   ✅ Initial status at index', index + ':', initialStatus)
-  
+
   // Revoke credential
-  var result = await statuslist.updateStatusList({
+  var result = await statuslist.updateStatusList(Object.assign({
     listVcJwt: listJwt,
     index: index,
     status: 'revoked',
     privateJwk: keys.privateJwk
-  })
-  
+  }, verifyOpts))
+
   assert(result.listVcJwt, 'Updated list should be returned')
-  
+
   // Check updated status
-  var updatedStatus = statuslist.getCredentialStatusEntry({
+  var updatedStatus = await statuslist.getCredentialStatusEntry(Object.assign({
     listVcJwt: result.listVcJwt,
     index: index
-  })
+  }, verifyOpts))
   
   assert.strictEqual(updatedStatus, 'revoked', 'Status should be revoked')
   console.log('   ✅ Updated status at index', index + ':', updatedStatus)
@@ -276,19 +278,20 @@ async function testEndToEndWorkflow() {
   })
   
   // Revoke credential
-  var updatedList = await statuslist.updateStatusList({
+  var statusVerifyOpts = { expectedIssuerDid: docs.did, didResolver: didResolver }
+  var updatedList = await statuslist.updateStatusList(Object.assign({
     listVcJwt: statusListResult.listVcJwt,
     index: 10,
     status: 'revoked',
     privateJwk: keys.privateJwk
-  })
-  
+  }, statusVerifyOpts))
+
   // Verify credential is now revoked
   var verification2 = await vcjwt.verifyVcJwt(jwt, { didResolver: didResolver })
-  var revokedStatus = statuslist.getCredentialStatusEntry({
+  var revokedStatus = await statuslist.getCredentialStatusEntry(Object.assign({
     listVcJwt: updatedList.listVcJwt,
     index: 10
-  })
+  }, statusVerifyOpts))
   
   assert.strictEqual(verification2.valid, true, 'JWT signature still valid')
   assert.strictEqual(revokedStatus, 'revoked', 'But credential is revoked')
@@ -306,7 +309,7 @@ async function runTests() {
     var jwt = await testVCIssuanceES256(docs.did, p256Keys)
     var verification = await testVCVerification(jwt, docs.jwks)
     var statusListJwt = await testStatusListCreation(docs.did, p256Keys)
-    var revokedListJwt = await testStatusListRevocation(statusListJwt, p256Keys)
+    var revokedListJwt = await testStatusListRevocation(statusListJwt, p256Keys, docs.did, docs.jwks)
     var hash = testAnchorHashing()
     var anchorPayload = testAnchorPayload(hash, docs.did)
     await testEndToEndWorkflow()

package/test/crypto/shamir.js

@@ -77,7 +77,9 @@ describe('Shamir Secret Sharing', function () {
 
   describe('integrity and isolation', function () {
     it('detects a tampered share at combine time', function () {
-      var shares = Shamir.split(crypto.randomBytes(16), 3, 5)
+      // checksum is opt-in (off by default to avoid leaking a hash of the secret);
+      // this test exercises the checksum-based detection, so enable it explicitly.
+      var shares = Shamir.split(crypto.randomBytes(16), 3, 5, { checksum: true })
       // flip a hex nibble in one share's data
       var s = shares[1]
       var ch = s.share[s.share.length - 1]
@@ -95,6 +97,12 @@ describe('Shamir Secret Sharing', function () {
       assert.throws(function () { Shamir.combine([a[0], b[1]]) }, /different splits|splitId/)
     })
 
+    it('does not embed a secret checksum by default (no leak to sub-threshold holders)', function () {
+      var shares = Shamir.split('low-entropy-pin-1234', 2, 3)
+      assert.strictEqual(shares[0].checksum, null)
+      assert.strictEqual(Shamir.combine(shares.slice(0, 2)).toString('utf8'), 'low-entropy-pin-1234')
+    })
+
     it('checksum can be disabled', function () {
       var shares = Shamir.split('no-checksum', 2, 3, { checksum: false })
       assert.strictEqual(shares[0].checksum, null)

package/test/crypto/shamir_rngcap.js

@@ -0,0 +1,29 @@
+'use strict'
+
+/* global describe, it, afterEach */
+
+// Regression: the secrets.js RNG callback re-draws on an all-zero draw. A broken
+// or stubbed CSPRNG that returns all-zero bytes forever (e.g. a bundle mocking
+// node crypto to Buffer.alloc) previously made that loop spin forever. The bounded
+// loop now throws a clear error instead of hanging.
+
+var assert = require('assert')
+var Shamir = require('../../lib/crypto/shamir')
+var Random = require('../../lib/crypto/random')
+
+describe('Shamir RNG degenerate-source cap', function () {
+  var orig = Random.getRandomBuffer
+  afterEach(function () { Random.getRandomBuffer = orig })
+
+  it('throws (does not hang) when the CSPRNG is stuck returning all zeros', function () {
+    Random.getRandomBuffer = function (n) { return Buffer.alloc(n, 0) }
+    assert.throws(function () {
+      Shamir.split('secret', 2, 3)
+    }, /all-zero|degenerate/)
+  })
+
+  it('still splits/combines normally with a healthy CSPRNG', function () {
+    var shares = Shamir.split('round-trip', 2, 3)
+    assert.strictEqual(Shamir.combine(shares.slice(0, 2)).toString('utf8'), 'round-trip')
+  })
+})

package/test/gdaf/anchor_spv.js

@@ -0,0 +1,163 @@
+'use strict'
+
+/* global describe, it */
+
+// Trustless SPV anchor verification end-to-end: build a real anchoring tx with an
+// OP_RETURN commitment, place it in a block, prove its inclusion with a Merkle
+// branch + header, and verify through SmartLedgerAnchor.verifyAnchor with NO trusted
+// provider. Replaces the old {verified:true} stub / trust-the-caller-txData path.
+
+require('chai').should()
+var bsv = require('../..')
+var Anchor = require('../../lib/gdaf/smartledger-anchor')
+var Hash = bsv.crypto.Hash
+
+function rev (b) { return Buffer.from(b).reverse() }
+function buildTree (leaves) {
+  var tree = leaves.slice(); var j = 0
+  for (var size = leaves.length; size > 1; size = Math.floor((size + 1) / 2)) {
+    for (var i = 0; i < size; i += 2) {
+      var i2 = Math.min(i + 1, size - 1)
+      tree.push(Hash.sha256sha256(Buffer.concat([tree[j + i], tree[j + i2]])))
+    }
+    j += size
+  }
+  return tree
+}
+function rootOf (l) { var t = buildTree(l); return t[t.length - 1] }
+function branchFor (leaves, index) {
+  var tree = buildTree(leaves); var branch = []; var j = 0; var idx = index
+  for (var size = leaves.length; size > 1; size = Math.floor((size + 1) / 2)) {
+    var sib = idx ^ 1; if (sib >= size) sib = idx
+    branch.push(rev(tree[j + sib]).toString('hex'))
+    j += size; idx = Math.floor(idx / 2)
+  }
+  return branch
+}
+
+function anchorTxFor (hashHex) {
+  var tx = new bsv.Transaction()
+  tx.addOutput(new bsv.Transaction.Output({
+    script: bsv.Script.buildDataOut(Buffer.from(hashHex, 'hex')),
+    satoshis: 0
+  }))
+  return tx
+}
+
+function blockOf (rootInternal) {
+  return new bsv.BlockHeader({
+    version: 1, prevHash: Buffer.alloc(32), merkleRoot: rootInternal,
+    time: 1231006505, bits: 0x1d00ffff, nonce: 0
+  })
+}
+
+// "Mine" a regtest-difficulty header (PoW passes after trivial nonce grinding).
+function minedHeader (prevHashInternal, merkleInternal) {
+  for (var nonce = 0; nonce < 100000; nonce++) {
+    var h = new bsv.BlockHeader({
+      version: 1, prevHash: prevHashInternal, merkleRoot: merkleInternal,
+      time: 1231006505 + nonce, bits: 0x207fffff, nonce: nonce
+    })
+    if (h.validProofOfWork()) return h
+  }
+  throw new Error('could not mine header')
+}
+
+describe('SPV anchor verification (trustless)', function () {
+  var anchorHash = Hash.sha256(Buffer.from('anchor me')).toString('hex')
+  var atx = anchorTxFor(anchorHash)
+  var rawTx = atx.uncheckedSerialize()
+  var txid = atx.hash
+  // Place the anchor tx at index 2 among 5 leaves.
+  var leaves = [
+    bsv.crypto.Random.getRandomBuffer(32),
+    bsv.crypto.Random.getRandomBuffer(32),
+    atx._getHash(),
+    bsv.crypto.Random.getRandomBuffer(32),
+    bsv.crypto.Random.getRandomBuffer(32)
+  ]
+  var header = blockOf(rootOf(leaves))
+  var spvProof = { index: 2, nodes: branchFor(leaves, 2) }
+
+  it('verifies inclusion + commitment with a valid proof', async function () {
+    var res = await Anchor.verifyAnchor(txid, anchorHash, {
+      spvProof: spvProof, header: header, rawTx: rawTx, requirePow: false
+    })
+    res.verified.should.equal(true)
+    res.chainVerified.should.equal(true)
+    res.committed.should.equal(true)
+    res.txidBound.should.equal(true)
+    res.proof.type.should.equal('spv_merkle_inclusion')
+  })
+
+  it('rejects when the tx does not commit to the expected hash', async function () {
+    var otherHash = Hash.sha256(Buffer.from('something else')).toString('hex')
+    var res = await Anchor.verifyAnchor(txid, otherHash, {
+      spvProof: spvProof, header: header, rawTx: rawTx, requirePow: false
+    })
+    res.committed.should.equal(false)
+    res.verified.should.equal(false)
+  })
+
+  it('rejects a tampered Merkle branch (inclusion fails)', async function () {
+    var bad = { index: 2, nodes: branchFor(leaves, 2).slice() }
+    bad.nodes[0] = rev(bsv.crypto.Random.getRandomBuffer(32)).toString('hex')
+    var res = await Anchor.verifyAnchor(txid, anchorHash, {
+      spvProof: bad, header: header, rawTx: rawTx, requirePow: false
+    })
+    res.chainVerified.should.equal(false)
+    res.verified.should.equal(false)
+  })
+
+  it('rejects rawTx that does not hash to txid', async function () {
+    var otherRaw = anchorTxFor(Hash.sha256(Buffer.from('decoy')).toString('hex')).uncheckedSerialize()
+    var res = await Anchor.verifyAnchor(txid, anchorHash, {
+      spvProof: spvProof, header: header, rawTx: otherRaw, requirePow: false
+    })
+    res.txidBound.should.equal(false)
+    res.verified.should.equal(false)
+  })
+
+  it('still refuses to fabricate a result with neither an SPV proof nor a provider', async function () {
+    var threw = false
+    try { await Anchor.verifyAnchor(txid, anchorHash, {}) } catch (e) { threw = true }
+    threw.should.equal(true)
+  })
+
+  describe('with a header chain (confirmations under real PoW)', function () {
+    this.timeout(10000)
+    // Block containing the tx must carry the real merkle root; then descendants.
+    var h0 = minedHeader(Buffer.alloc(32), rootOf(leaves))
+    var h1 = minedHeader(h0._getHash(), bsv.crypto.Random.getRandomBuffer(32))
+    var h2 = minedHeader(h1._getHash(), bsv.crypto.Random.getRandomBuffer(32))
+    var headerChain = [h0, h1, h2]
+
+    it('verifies inclusion + 3 confirmations under real proof-of-work', async function () {
+      var res = await Anchor.verifyAnchor(txid, anchorHash, {
+        spvProof: spvProof, headerChain: headerChain, rawTx: rawTx, minConfirmations: 3
+      })
+      res.verified.should.equal(true)
+      res.confirmations.should.equal(3)
+      res.headerChainValid.should.equal(true)
+      res.powValid.should.equal(true)
+      res.tipHash.should.equal(h2.id)
+      res.proof.type.should.equal('spv_merkle_inclusion_with_confirmations')
+    })
+
+    it('rejects when confirmations are below the required minimum', async function () {
+      var res = await Anchor.verifyAnchor(txid, anchorHash, {
+        spvProof: spvProof, headerChain: headerChain, rawTx: rawTx, minConfirmations: 6
+      })
+      res.confirmations.should.equal(3)
+      res.verified.should.equal(false)
+    })
+
+    it('rejects a header chain with a broken link', async function () {
+      var res = await Anchor.verifyAnchor(txid, anchorHash, {
+        spvProof: spvProof, headerChain: [h0, h2], rawTx: rawTx, minConfirmations: 1
+      })
+      res.headerChainValid.should.equal(false)
+      res.verified.should.equal(false)
+    })
+  })
+})

package/test/ltp/verify_failclosed.js

@@ -0,0 +1,134 @@
+'use strict'
+
+/* global describe, it */
+
+// Regression guard for the C1–C4 fail-open verification bugs. Before the fix,
+// LTP signature verification returned the ECDSA instance (always truthy) or
+// skipped the JWS check entirely (a `// TODO`), so a forged token verified as
+// valid. These tests feed known-bad signatures/issuers and assert valid===false.
+
+var expect = require('chai').expect
+var bsv = require('../../')
+
+var LTP = bsv.LTP
+var RightToken = LTP.Right
+var Obligation = LTP.Obligation
+
+function newDid () {
+  var key = bsv.PrivateKey.fromRandom()
+  return { key: key, did: 'did:key:' + key.toPublicKey().toString() }
+}
+
+describe('LTP verification fails closed (C1–C4 regression)', function () {
+  it('a genuinely signed right token still verifies as valid', function () {
+    var issuer = newDid()
+    var result = RightToken.prepareRightToken(
+      'EquityShare', issuer.did, issuer.did,
+      { spv: 'spv-001', units: 1000 }, issuer.key, {}
+    )
+    expect(result.success).to.equal(true)
+    var v = RightToken.prepareRightTokenVerification(result.rightToken, {})
+    expect(v.verification.valid, JSON.stringify(v.verification.errors)).to.equal(true)
+  })
+
+  it('a tampered JWS signature is rejected (C4)', function () {
+    var issuer = newDid()
+    var result = RightToken.prepareRightToken(
+      'EquityShare', issuer.did, issuer.did, { spv: 'x' }, issuer.key, {}
+    )
+    var token = result.rightToken
+    // Flip the signature: replace it with a signature over different data by a
+    // different key, re-encoded as a valid-looking JWS.
+    var attacker = newDid()
+    var parts = token.proof.jws.split('.')
+    var bogusSig = bsv.crypto.ECDSA.sign(
+      bsv.crypto.Hash.sha256(Buffer.from('not the token')), attacker.key
+    )
+    token.proof.jws = parts[0] + '.' + parts[1] + '.' + bogusSig.toDER().toString('base64url')
+
+    var v = RightToken.prepareRightTokenVerification(token, {})
+    expect(v.verification.valid).to.equal(false)
+  })
+
+  it('a token re-signed by an attacker but attributed to the victim issuer is rejected (C4 binding)', function () {
+    var victim = newDid()
+    var attacker = newDid()
+    var result = RightToken.prepareRightToken(
+      'PropertyTitle', victim.did, victim.did, { parcel: '1 Main' }, victim.key, {}
+    )
+    var token = result.rightToken
+    // Attacker re-signs the exact token hash with THEIR key, but leaves issuer =
+    // victim. Verification must bind to the victim issuer key and reject.
+    var sig = bsv.crypto.ECDSA.sign(
+      bsv.crypto.Hash.sha256(Buffer.from(RightToken._canonicalizeToken(token))), attacker.key
+    )
+    var parts = token.proof.jws.split('.')
+    token.proof.jws = parts[0] + '.' + parts[1] + '.' + sig.toDER().toString('base64url')
+
+    var v = RightToken.prepareRightTokenVerification(token, {})
+    expect(v.verification.valid).to.equal(false)
+  })
+
+  it('prepareRightTokenTransfer rejects a transfer signed by a non-owner (ownership binding)', function () {
+    var owner = newDid()
+    var attacker = newDid()
+    var res = RightToken.prepareRightToken(
+      'EquityShare', owner.did, owner.did, { spv: 't-1' }, owner.key, {}
+    )
+    var token = res.rightToken
+    // Attacker tries to transfer a token they do not own → must be refused.
+    var bad = RightToken.prepareRightTokenTransfer(token, attacker.did, attacker.key, {})
+    expect(bad.success).to.equal(false)
+    // The genuine owner can transfer.
+    var good = RightToken.prepareRightTokenTransfer(token, attacker.did, owner.key, {})
+    expect(good.success, JSON.stringify(good.error)).to.equal(true)
+  })
+
+  it('verifyOwnership rejects a signature by the wrong key (C2)', function () {
+    var owner = newDid()
+    var attacker = newDid()
+    var Resolver = require('../../lib/gdaf/did-resolver')
+    var did = 'did:smartledger:' + owner.key.toPublicKey().toString()
+    var msg = 'transfer authorization'
+    // Signature by attacker, checked against owner's DID → must be false.
+    var badSig = bsv.crypto.ECDSA.sign(bsv.crypto.Hash.sha256(Buffer.from(msg)), attacker.key)
+    expect(Resolver.verifyOwnership(did, badSig.toString(), msg)).to.equal(false)
+  })
+
+  it('verifyAnchor refuses to fabricate success without a chain provider (C3)', async function () {
+    var Anchor = require('../../lib/gdaf/smartledger-anchor')
+    var threw = false
+    try {
+      await Anchor.verifyAnchor('deadbeef', 'cafe')
+    } catch (e) {
+      threw = true
+    }
+    expect(threw).to.equal(true)
+  })
+
+  it('a genuinely signed obligation token still verifies as valid', function () {
+    var issuer = newDid()
+    var ob = Obligation.prepareObligationToken(
+      'PaymentObligation', issuer.did, issuer.did, { amount: 1 }, issuer.key, {}
+    )
+    expect(ob.success).to.equal(true)
+    var v = Obligation.prepareObligationVerification(ob.obligationToken, {})
+    expect(v.verification.valid, JSON.stringify(v.verification && v.verification.errors)).to.equal(true)
+  })
+
+  it('a tampered obligation signature is rejected (C4)', function () {
+    var issuer = newDid()
+    var attacker = newDid()
+    var ob = Obligation.prepareObligationToken(
+      'PaymentObligation', issuer.did, issuer.did, { amount: 1 }, issuer.key, {}
+    )
+    var tok = ob.obligationToken
+    var sig = bsv.crypto.ECDSA.sign(
+      bsv.crypto.Hash.sha256(Buffer.from('forged')), attacker.key
+    )
+    var parts = tok.proof.jws.split('.')
+    tok.proof.jws = parts[0] + '.' + parts[1] + '.' + sig.toDER().toString('base64url')
+    var v = Obligation.prepareObligationVerification(tok, {})
+    expect(v.verification.valid).to.equal(false)
+  })
+})