@smartledger/bsv 5.5.3 → 6.0.1

package/test/smart_contract/ordinal_transfer.js

@@ -0,0 +1,83 @@
+'use strict'
+
+/* global describe, it, before, after */
+
+// Ordinal-safe transfer (Phase 1). A 1-sat ordinal held in a covenant must be
+// transferred WITHOUT burning the inscribed satoshi. The single-output
+// ownershipToken sets output = input - fee, so it destroys a 1-sat UTXO; these
+// tests prove (a) the single-output path refuses a 1-sat UTXO, and (b)
+// transferOrdinal recreates the token at exactly 1 sat among funding outputs and
+// the covenant verifies.
+
+require('chai').should()
+var bsv = require('../..')
+var SC = bsv.SmartContract
+var PrivateKey = bsv.PrivateKey
+var Transaction = bsv.Transaction
+
+var Token = SC.Token
+var help = SC.CovenantHelpers
+var fundAndSpend = help.fundAndSpend
+var p2pkhOutput = help.p2pkhOutput
+var verify = help.verify
+
+describe('Ordinal-safe transfer (1-sat, SIGHASH_ALL)', function () {
+  this.timeout(20000)
+  var I = bsv.Script.Interpreter
+  var saved
+  var alice = PrivateKey.fromRandom()
+  var bob = PrivateKey.fromRandom()
+
+  before(function () {
+    saved = { el: I.MAX_SCRIPT_ELEMENT_SIZE, num: I.MAXIMUM_ELEMENT_SIZE, ops: I.MAX_OPS_PER_SCRIPT }
+    SC.enableGenesis()
+  })
+  after(function () {
+    I.MAX_SCRIPT_ELEMENT_SIZE = saved.el
+    I.MAXIMUM_ELEMENT_SIZE = saved.num
+    I.MAX_OPS_PER_SCRIPT = saved.ops
+  })
+
+  it('transferOrdinal recreates the 1-sat token among funding outputs and verifies', function () {
+    var lock = Token.ordinalLock(Token.ownerId(alice))
+    var bobHash = Token.ownerId(bob)
+    var nextToken = Token.ordinalLock(bobHash)
+
+    // Ordinal output stays exactly 1 sat; a change output carries the funding.
+    var tokenOutput = new Transaction.Output({ script: nextToken, satoshis: 1 })
+    var change = p2pkhOutput(PrivateKey.fromRandom(), 5000)
+
+    // token output at index 0 (ordinal FIFO), change after.
+    var spend = fundAndSpend(lock, 1, { outputs: [tokenOutput, change] }).spend
+    spend.inputs[0].setScript(Token.transferOrdinal(alice, bobHash, spend, 1, lock, { tokenIndex: 0 }))
+
+    verify(spend.inputs[0].script, lock, { tx: spend, satoshis: 1 }).ok.should.equal(true)
+    // The recreated token output is still exactly 1 sat.
+    spend.outputs[0].satoshis.should.equal(1)
+  })
+
+  it('guardrail: single-output unlockTransfer refuses a 1-sat UTXO', function () {
+    var lock = Token.ordinalLock(Token.ownerId(alice))
+    var bobHash = Token.ownerId(bob)
+    var next = Token.ownershipToken(500, bobHash)
+    var spend = fundAndSpend(lock, 1, {
+      outputs: [new Transaction.Output({ script: next, satoshis: 1 })]
+    }).spend
+    ;(function () {
+      Token.unlockTransfer(alice, bobHash, spend, 1, lock)
+    }).should.throw(/burns|ordinal/)
+  })
+
+  it('anti-burn: transferOrdinal rejects a token output not equal to the ordinal value', function () {
+    var lock = Token.ordinalLock(Token.ownerId(alice))
+    var bobHash = Token.ownerId(bob)
+    var nextToken = Token.ordinalLock(bobHash)
+    // Wrong: token output is 2 sat, not the ordinal's 1 sat.
+    var tokenOutput = new Transaction.Output({ script: nextToken, satoshis: 2 })
+    var change = p2pkhOutput(PrivateKey.fromRandom(), 5000)
+    var spend = fundAndSpend(lock, 1, { outputs: [tokenOutput, change] }).spend
+    ;(function () {
+      Token.transferOrdinal(alice, bobHash, spend, 1, lock, { tokenIndex: 0 })
+    }).should.throw(/equal the ordinal|burn/)
+  })
+})

package/test/smart_contract/sighash_marketplace.js

@@ -0,0 +1,110 @@
+'use strict'
+
+/* global describe, it, before, after */
+
+// Configurable SIGHASH core (Phase 2). The OP_PUSH_TX core was hard-wired to
+// SIGHASH_ALL|FORKID (0x41). It can now be built under any flag; these tests prove
+// the marketplace / partially-signed pattern with SIGHASH_SINGLE|ANYONECANPAY|FORKID
+// (0xc3): a seller commits only to its own input and its own output, and a buyer may
+// add funding inputs and change outputs without invalidating the covenant — while
+// the seller's OWN output stays bound.
+
+require('chai').should()
+var bsv = require('../..')
+var SC = bsv.SmartContract
+var PrivateKey = bsv.PrivateKey
+var Script = bsv.Script
+var Opcode = bsv.Opcode
+var Transaction = bsv.Transaction
+
+var P = SC.PushTx
+var help = SC.CovenantHelpers
+var fundAndSpend = help.fundAndSpend
+var p2pkhOutput = help.p2pkhOutput
+var verify = help.verify
+
+var SATS = 100000
+
+describe('Configurable SIGHASH — SINGLE|ANYONECANPAY marketplace covenant', function () {
+  this.timeout(20000)
+  var I = bsv.Script.Interpreter
+  var saved
+  var flag = P.SIGHASH_SINGLE_ANYONECANPAY_FORKID // 0xc3
+
+  before(function () {
+    saved = { el: I.MAX_SCRIPT_ELEMENT_SIZE, num: I.MAXIMUM_ELEMENT_SIZE, ops: I.MAX_OPS_PER_SCRIPT }
+    SC.enableGenesis()
+  })
+  after(function () {
+    I.MAX_SCRIPT_ELEMENT_SIZE = saved.el
+    I.MAXIMUM_ELEMENT_SIZE = saved.num
+    I.MAX_OPS_PER_SCRIPT = saved.ops
+  })
+
+  // Lock: authenticate the pushed preimage under `flag`, assert the flag, succeed.
+  function makeLock () {
+    var lock = new Script()
+    lock.add(Opcode.OP_DUP)
+    P.pushTxCore(lock, { sighashType: flag })
+    lock.add(Opcode.OP_VERIFY)
+    P.assertSighashType(lock, flag)
+    lock.add(Opcode.OP_DROP)
+    lock.add(Opcode.OP_TRUE)
+    return lock
+  }
+
+  function grindUnlock (spend, lock) {
+    var g = P.grind(spend, 0, lock, SATS, { sighashType: flag })
+    spend.inputs[0].setScript(new Script().add(g.preimage))
+  }
+
+  it('verifies a SINGLE|ANYONECANPAY covenant spend', function () {
+    var lock = makeLock()
+    var sellerOut = p2pkhOutput(PrivateKey.fromRandom(), SATS - 500) // committed output (index 0)
+    var spend = fundAndSpend(lock, SATS, { outputs: [sellerOut] }).spend
+    grindUnlock(spend, lock)
+    verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+  })
+
+  it('stays valid when a buyer adds a funding input and a change output', function () {
+    var lock = makeLock()
+    var sellerOut = p2pkhOutput(PrivateKey.fromRandom(), SATS - 500)
+    var spend = fundAndSpend(lock, SATS, { outputs: [sellerOut] }).spend
+    grindUnlock(spend, lock) // seller signs input0 + output0 only
+
+    // Buyer adds a funding input and their own change output AFTER the seller signed.
+    spend.addInput(new Transaction.Input({
+      prevTxId: '11'.repeat(32), outputIndex: 0, script: Script.empty()
+    }), p2pkhOutput(PrivateKey.fromRandom(), 50000).script, 50000)
+    spend.addOutput(p2pkhOutput(PrivateKey.fromRandom(), 49000)) // buyer change at index 1
+
+    // The seller's covenant on input 0 is unaffected (ANYONECANPAY ignores the new
+    // input; SINGLE ignores the new output).
+    verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+  })
+
+  it('still binds the seller\'s OWN output (SINGLE commits output at the input index)', function () {
+    var lock = makeLock()
+    var sellerOut = p2pkhOutput(PrivateKey.fromRandom(), SATS - 500)
+    var spend = fundAndSpend(lock, SATS, { outputs: [sellerOut] }).spend
+    grindUnlock(spend, lock)
+
+    // Tamper the committed output (index 0) after signing → must fail.
+    spend.outputs[0] = p2pkhOutput(PrivateKey.fromRandom(), 1)
+    verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+  })
+
+  it('back-compat: default pushTxCore is still SIGHASH_ALL|FORKID', function () {
+    var lock = new Script()
+    lock.add(Opcode.OP_DUP)
+    P.pushTxCore(lock) // no opts → 0x41
+    lock.add(Opcode.OP_VERIFY)
+    P.assertSighashAll(lock)
+    lock.add(Opcode.OP_DROP).add(Opcode.OP_TRUE)
+    var out = p2pkhOutput(PrivateKey.fromRandom(), SATS - 500)
+    var spend = fundAndSpend(lock, SATS, { outputs: [out] }).spend
+    var g = P.grind(spend, 0, lock, SATS) // default sighash
+    spend.inputs[0].setScript(new Script().add(g.preimage))
+    verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+  })
+})

package/test/spv/headerchain.js

@@ -0,0 +1,86 @@
+'use strict'
+
+/* global describe, it */
+
+// SPV header-chain verification: linkage + per-header proof-of-work + optional
+// trusted-hash anchoring. Uses the regtest max target (0x207fffff) so a header's
+// PoW passes after trivial nonce grinding (no real mining needed).
+
+require('chai').should()
+var bsv = require('../..')
+var SPV = bsv.SPV
+
+function rand32 () { return bsv.crypto.Random.getRandomBuffer(32) }
+
+// "Mine" a header at regtest difficulty: grind nonce until PoW passes (~1-2 tries).
+function minedHeader (prevHashInternal, merkleInternal) {
+  for (var nonce = 0; nonce < 100000; nonce++) {
+    var h = new bsv.BlockHeader({
+      version: 1,
+      prevHash: prevHashInternal,
+      merkleRoot: merkleInternal,
+      time: 1231006505 + nonce,
+      bits: 0x207fffff,
+      nonce: nonce
+    })
+    if (h.validProofOfWork()) return h
+  }
+  throw new Error('could not mine a regtest header')
+}
+
+function chain (n) {
+  var hs = []
+  var prev = Buffer.alloc(32)
+  for (var i = 0; i < n; i++) {
+    var h = minedHeader(prev, rand32())
+    hs.push(h)
+    prev = h._getHash()
+  }
+  return hs
+}
+
+describe('SPV.verifyHeaderChain', function () {
+  this.timeout(10000)
+
+  it('accepts a linked, PoW-valid chain', function () {
+    var hs = chain(4)
+    var res = SPV.verifyHeaderChain(hs)
+    res.valid.should.equal(true)
+    res.count.should.equal(4)
+    res.anchorHash.should.equal(hs[0].id)
+    res.tipHash.should.equal(hs[3].id)
+  })
+
+  it('rejects a broken link', function () {
+    var hs = chain(3)
+    var res = SPV.verifyHeaderChain([hs[0], hs[2]]) // hs[2] links to hs[1], not hs[0]
+    res.valid.should.equal(false)
+    res.reason.should.match(/broken link/)
+  })
+
+  it('rejects a header that fails proof-of-work', function () {
+    // Mainnet-difficulty bits with nonce 0 — the hash will not meet the tiny target.
+    var bad = new bsv.BlockHeader({
+      version: 1, prevHash: Buffer.alloc(32), merkleRoot: rand32(),
+      time: 1231006505, bits: 0x1d00ffff, nonce: 0
+    })
+    SPV.verifyHeaderChain([bad]).valid.should.equal(false)
+    // ...but skipping PoW, a single header is trivially "valid".
+    SPV.verifyHeaderChain([bad], { requirePow: false }).valid.should.equal(true)
+  })
+
+  it('honours a trusted-hash anchor (tip or anchor)', function () {
+    var hs = chain(3)
+    SPV.verifyHeaderChain(hs, { trustedHash: hs[2].id }).valid.should.equal(true)
+    SPV.verifyHeaderChain(hs, { trustedHash: hs[0].id }).valid.should.equal(true)
+    var res = SPV.verifyHeaderChain(hs, { trustedHash: 'ff'.repeat(32) })
+    res.valid.should.equal(false)
+    res.reason.should.match(/trusted hash/)
+  })
+
+  it('accepts hex / buffer headers', function () {
+    var hs = chain(2)
+    var asHex = hs.map(function (h) { return h.toBuffer().toString('hex') })
+    SPV.verifyHeaderChain(asHex).valid.should.equal(true)
+  })
+})

package/test/spv/merkleproof.js

@@ -0,0 +1,133 @@
+'use strict'
+
+/* global describe, it */
+
+// SPV Merkle inclusion proofs, cross-checked against the codebase's own Merkle
+// tree algorithm (lib/block/block.js getMerkleTree). For random trees of many
+// shapes (even, odd, duplicate-last), extract the branch for each leaf and assert
+// the SPV verifier recomputes the exact same root — then assert tampering fails.
+
+require('chai').should()
+var bsv = require('../..')
+var SPV = bsv.SPV
+var Hash = bsv.crypto.Hash
+
+function rev (b) { return Buffer.from(b).reverse() }
+
+// Build the flat merkle tree exactly like Block.getMerkleTree (leaves = internal-LE).
+function buildTree (leaves) {
+  var tree = leaves.slice()
+  var j = 0
+  for (var size = leaves.length; size > 1; size = Math.floor((size + 1) / 2)) {
+    for (var i = 0; i < size; i += 2) {
+      var i2 = Math.min(i + 1, size - 1)
+      tree.push(Hash.sha256sha256(Buffer.concat([tree[j + i], tree[j + i2]])))
+    }
+    j += size
+  }
+  return tree
+}
+function rootOf (leaves) { var t = buildTree(leaves); return t[t.length - 1] }
+
+// Extract the sibling branch (display-order hex) for a leaf, mirroring the tree layout.
+function branchFor (leaves, index) {
+  var tree = buildTree(leaves)
+  var branch = []
+  var j = 0
+  var idx = index
+  for (var size = leaves.length; size > 1; size = Math.floor((size + 1) / 2)) {
+    var sib = idx ^ 1
+    if (sib >= size) sib = idx // odd end -> duplicate self
+    branch.push(rev(tree[j + sib]).toString('hex'))
+    j += size
+    idx = Math.floor(idx / 2)
+  }
+  return branch
+}
+
+function randLeaves (n) {
+  var a = []
+  for (var i = 0; i < n; i++) a.push(bsv.crypto.Random.getRandomBuffer(32))
+  return a
+}
+
+describe('SPV.verifyMerkleProof (cross-checked vs Block.getMerkleTree)', function () {
+  var sizes = [1, 2, 3, 4, 5, 7, 8, 9, 16, 21]
+
+  it('recomputes the root for every leaf across many tree shapes', function () {
+    sizes.forEach(function (n) {
+      var leaves = randLeaves(n)
+      var root = rev(rootOf(leaves)).toString('hex') // display order
+      for (var idx = 0; idx < n; idx++) {
+        var txid = rev(leaves[idx]).toString('hex')
+        var nodes = branchFor(leaves, idx)
+        SPV.merkleRootFromBranch(txid, idx, nodes).should.equal(root,
+          'size ' + n + ' index ' + idx)
+        SPV.verifyMerkleProof({ txid: txid, index: idx, nodes: nodes, merkleRoot: root })
+          .should.equal(true)
+      }
+    })
+  })
+
+  it('rejects a tampered branch node', function () {
+    var leaves = randLeaves(6)
+    var root = rev(rootOf(leaves)).toString('hex')
+    var nodes = branchFor(leaves, 2)
+    nodes[0] = rev(bsv.crypto.Random.getRandomBuffer(32)).toString('hex') // wrong sibling
+    SPV.verifyMerkleProof({ txid: rev(leaves[2]).toString('hex'), index: 2, nodes: nodes, merkleRoot: root })
+      .should.equal(false)
+  })
+
+  it('rejects the right proof against the wrong txid', function () {
+    var leaves = randLeaves(8)
+    var root = rev(rootOf(leaves)).toString('hex')
+    var nodes = branchFor(leaves, 3)
+    var wrongTxid = rev(bsv.crypto.Random.getRandomBuffer(32)).toString('hex')
+    SPV.verifyMerkleProof({ txid: wrongTxid, index: 3, nodes: nodes, merkleRoot: root })
+      .should.equal(false)
+  })
+
+  it("accepts '*' as the odd-node duplicate marker", function () {
+    // 3 leaves: index 2 is the odd one; its level-0 sibling is itself.
+    var leaves = randLeaves(3)
+    var root = rev(rootOf(leaves)).toString('hex')
+    var nodes = branchFor(leaves, 2)
+    nodes[0] = '*' // replace the explicit self-hash with the duplicate marker
+    SPV.verifyMerkleProof({ txid: rev(leaves[2]).toString('hex'), index: 2, nodes: nodes, merkleRoot: root })
+      .should.equal(true)
+  })
+
+  it('single-tx block: empty branch, root == txid', function () {
+    var leaves = randLeaves(1)
+    var txid = rev(leaves[0]).toString('hex')
+    SPV.merkleRootFromBranch(txid, 0, []).should.equal(txid)
+  })
+
+  it('verifyTxInclusion binds the branch to a header merkle root', function () {
+    var leaves = randLeaves(5)
+    var rootInternal = rootOf(leaves)
+    var header = new bsv.BlockHeader({
+      version: 1,
+      prevHash: Buffer.alloc(32),
+      merkleRoot: rootInternal, // internal-LE buffer
+      time: 1231006505,
+      bits: 0x1d00ffff,
+      nonce: 0
+    })
+    var res = SPV.verifyTxInclusion({
+      txid: rev(leaves[3]).toString('hex'),
+      index: 3,
+      nodes: branchFor(leaves, 3),
+      header: header,
+      requirePow: false // synthetic header has no real PoW
+    })
+    res.rootMatches.should.equal(true)
+    res.valid.should.equal(true)
+
+    // Wrong index -> root mismatch.
+    SPV.verifyTxInclusion({
+      txid: rev(leaves[3]).toString('hex'), index: 1,
+      nodes: branchFor(leaves, 3), header: header, requirePow: false
+    }).valid.should.equal(false)
+  })
+})

package/test/statuslist/failclosed.js

@@ -0,0 +1,78 @@
+'use strict'
+
+/* global describe, it */
+
+// Regression guard for the StatusList2021 revocation-bypass bug. Before the fix,
+// getCredentialStatusEntry / updateStatusList read the revocation bitstring from
+// the JWT payload WITHOUT verifying the signature — so anyone who could substitute
+// the list JWT could flip a revoked credential back to "valid". These tests assert
+// the status-list reads now fail closed.
+
+var expect = require('chai').expect
+var didweb = require('../../lib/didweb')
+var statuslist = require('../../lib/statuslist')
+var vcjwt = require('../../lib/vcjwt')
+
+function tamperEncodedList (listVcJwt, newEncodedList) {
+  var parts = listVcJwt.split('.')
+  var payload = JSON.parse(vcjwt.base64UrlDecode(parts[1]).toString())
+  payload.vc.credentialSubject.encodedList = newEncodedList
+  var tamperedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url')
+  return parts[0] + '.' + tamperedPayload + '.' + parts[2] // keep original signature
+}
+
+describe('StatusList2021 fails closed (revocation-bypass regression)', function () {
+  var keys, docs, resolver, verifyOpts, listJwt
+
+  before(async function () {
+    keys = await didweb.generateIssuerKeys({ alg: 'ES256' })
+    docs = didweb.buildDidWebDocuments({
+      domain: 'example.com',
+      p256: { jwk: keys.publicJwk, kid: keys.kid }
+    })
+    resolver = async function () { return { jwks: docs.jwks } }
+    verifyOpts = { expectedIssuerDid: docs.did, didResolver: resolver }
+    var created = await statuslist.createStatusList({ issuerDid: docs.did, privateJwk: keys.privateJwk })
+    listJwt = created.listVcJwt
+  })
+
+  it('reads a genuine, verified status list', async function () {
+    var status = await statuslist.getCredentialStatusEntry(Object.assign({ listVcJwt: listJwt, index: 7 }, verifyOpts))
+    expect(status).to.equal('valid')
+  })
+
+  it('rejects a list whose bitstring was tampered without re-signing (bypass closed)', async function () {
+    // Build a bitstring that marks index 7 as revoked, then splice it in WITHOUT
+    // the issuer's signature — exactly the substitution attack the bug allowed.
+    var zlib = require('zlib')
+    var buf = Buffer.alloc(Math.ceil(100000 / 8), 0)
+    buf[0] = 0xff
+    var forgedEncoded = zlib.gzipSync(buf).toString('base64')
+    var forgedJwt = tamperEncodedList(listJwt, forgedEncoded)
+
+    var threw = false
+    try {
+      await statuslist.getCredentialStatusEntry(Object.assign({ listVcJwt: forgedJwt, index: 7 }, verifyOpts))
+    } catch (e) { threw = true }
+    expect(threw, 'tampered list must be rejected').to.equal(true)
+  })
+
+  it('refuses to read without a pinned expectedIssuerDid', async function () {
+    var threw = false
+    try {
+      await statuslist.getCredentialStatusEntry({ listVcJwt: listJwt, index: 7, didResolver: resolver })
+    } catch (e) { threw = true }
+    expect(threw).to.equal(true)
+  })
+
+  it('rejects a list signed by a different (attacker) issuer under the victim DID', async function () {
+    var attacker = await didweb.generateIssuerKeys({ alg: 'ES256' })
+    var attackerList = await statuslist.createStatusList({ issuerDid: docs.did, privateJwk: attacker.privateJwk })
+    // Resolver returns the VICTIM's key for docs.did; attacker's signature must fail.
+    var threw = false
+    try {
+      await statuslist.getCredentialStatusEntry(Object.assign({ listVcJwt: attackerList.listVcJwt, index: 7 }, verifyOpts))
+    } catch (e) { threw = true }
+    expect(threw).to.equal(true)
+  })
+})