@smartledger/bsv 7.2.0 → 7.3.0

package/test/ordinals/bsv20.js

@@ -56,7 +56,9 @@ describe('Ordinals BSV-20 fungible tokens', function () {
   })
 
   it('preserves integer amounts larger than 2^53 exactly (string, never a JS number)', function () {
-    var huge = '99999999999999999999999999'
+    // uint64 max: far beyond 2^53, and the largest amount the spec allows. The value this
+    // used to test (26 digits) exceeded uint64 and would have been burned by an indexer.
+    var huge = '18446744073709551615'
     var p = B.parseBsv20(B.buildMint({ address: address, tick: 'BIG', amt: huge }))
     p.amt.should.equal(huge)
   })
@@ -72,7 +74,7 @@ describe('Ordinals BSV-20 fungible tokens', function () {
     B.parseBsv20(B.buildMint({ address: address, tick: 'ORDI', amt: '007' })).amt.should.equal('7')
     B.parseBsv20(B.buildDeploy({ address: address, tick: 'ORDI', max: '000100' })).max.should.equal('100')
     // canonicalization does not corrupt a huge value
-    var huge = '90000000000000000000000000'
+    var huge = '18446744073709551615'
     B.parseBsv20(B.buildMint({ address: address, tick: 'ORDI', amt: '0' + huge })).amt.should.equal(huge)
   })
 
@@ -123,4 +125,98 @@ describe('Ordinals BSV-20 fungible tokens', function () {
       ;(function () { B.buildMint({ tick: 'ORDI', amt: '1' }) }).should.throw(/address or a lock/)
     })
   })
+
+  // Checked against the BSV-20 / BSV-21 specification at docs.1satordinals.com.
+  describe('specification conformance', function () {
+    var OUTPOINT = '3b31'.repeat(16) + '_0'
+    var UINT64_MAX = '18446744073709551615'
+
+    it('accepts lim: 0, which the spec defines as unlimited', function () {
+      // "lim | No | String | Per-mint limit; 0 or omitted = unlimited"
+      B.parseBsv20(B.buildDeploy({ address: address, tick: 'ORDI', max: '21000000', lim: 0 }))
+        .lim.should.equal('0')
+      B.parseBsv20(B.buildDeploy({ address: address, tick: 'ORDI', max: '21000000', lim: '0' }))
+        .lim.should.equal('0')
+    })
+
+    it('accepts an amount of exactly uint64 max but rejects one above it', function () {
+      // "Amounts in BSV-21: strings representing uint64" — larger values are emitted
+      // happily as JSON and then discarded by indexers, burning the tokens.
+      B.parseBsv20(B.buildDeploy({ address: address, tick: 'ORDI', max: UINT64_MAX }))
+        .max.should.equal(UINT64_MAX)
+      ;(function () {
+        B.buildDeploy({ address: address, tick: 'ORDI', max: '18446744073709551616' })
+      }).should.throw(/exceeds the uint64 maximum/)
+      ;(function () {
+        B.buildMint({ address: address, tick: 'ORDI', amt: '9'.repeat(26) })
+      }).should.throw(/exceeds the uint64 maximum/)
+    })
+
+    it('rejects a numeric amount past 2^53, which is already imprecise', function () {
+      (function () {
+        B.buildMint({ address: address, tick: 'ORDI', amt: 1e17 })
+      }).should.throw(/MAX_SAFE_INTEGER/)
+    })
+
+    it('rejects non-string sym / icon instead of stringifying them', function () {
+      (function () {
+        B.buildDeployMint({ address: address, amt: '100', sym: {} })
+      }).should.throw(/sym must be a string, got an object/)
+      ;(function () {
+        B.buildDeployMint({ address: address, amt: '100', icon: 42 })
+      }).should.throw(/icon must be a string/)
+    })
+
+    it('requires icon to be an outpoint reference, as the spec defines it', function () {
+      (function () {
+        B.buildDeployMint({ address: address, amt: '100', icon: 'https://example.com/i.png' })
+      }).should.throw(/outpoint reference/)
+      B.parseBsv20(B.buildDeployMint({ address: address, amt: '100', icon: OUTPOINT }))
+        .icon.should.equal(OUTPOINT)
+    })
+
+    // parseBsv20/isBsv20 are documented to report VALIDITY. They previously returned any
+    // JSON object carrying p:'bsv-20' and a string op, including payloads no indexer acts on.
+    describe('parseBsv20 enforces the validity it reports', function () {
+      function rejects (label, payload) {
+        it('rejects ' + label, function () {
+          var json = JSON.stringify(payload)
+          B.isBsv20(json).should.equal(false)
+          ;(B.parseBsv20(json) === null).should.equal(true)
+        })
+      }
+      rejects('a transfer with no amount and no token', { p: 'bsv-20', op: 'transfer' })
+      rejects('a mint with no amount', { p: 'bsv-20', op: 'mint', tick: 'ORDI' })
+      rejects('a deploy with no max', { p: 'bsv-20', op: 'deploy', tick: 'ORDI' })
+      rejects('an operation the spec does not define', { p: 'bsv-20', op: 'not-an-op' })
+      rejects('a transfer naming both tick and id', { p: 'bsv-20', op: 'transfer', tick: 'A', id: OUTPOINT, amt: '1' })
+      rejects('an auth carrying amt, which the spec forbids', { p: 'bsv-20', op: 'auth', id: OUTPOINT, amt: '1' })
+      rejects('a deploy+auth carrying amt, which the spec forbids', { p: 'bsv-20', op: 'deploy+auth', amt: '1' })
+      rejects('a ticker longer than 4 bytes', { p: 'bsv-20', op: 'mint', tick: 'TOOLONG', amt: '1' })
+      rejects('a malformed token id', { p: 'bsv-20', op: 'transfer', id: 'nope', amt: '1' })
+      rejects('an amount above uint64', { p: 'bsv-20', op: 'mint', tick: 'A', amt: '9'.repeat(26) })
+      rejects('dec out of range', { p: 'bsv-20', op: 'deploy', tick: 'A', max: '1', dec: '19' })
+
+      it('accepts the spec operations this library does not yet emit', function () {
+        // Reading the chain is not the same as writing it: burn/auth/deploy+auth are valid
+        // BSV-21 and must be recognised even though there is no builder for them yet.
+        B.isBsv20(JSON.stringify({ p: 'bsv-20', op: 'burn', id: OUTPOINT, amt: '5' })).should.equal(true)
+        B.isBsv20(JSON.stringify({ p: 'bsv-20', op: 'auth', id: OUTPOINT })).should.equal(true)
+        B.isBsv20(JSON.stringify({ p: 'bsv-20', op: 'deploy+auth', sym: 'STABLE' })).should.equal(true)
+      })
+
+      it('tolerates a non-canonical on-chain amount when reading', function () {
+        // Our builder emits canonical amounts, but other people's payloads are not ours
+        // to reject over leading zeros.
+        B.isBsv20(JSON.stringify({ p: 'bsv-20', op: 'mint', tick: 'A', amt: '007' })).should.equal(true)
+      })
+
+      it('still round-trips everything this library builds', function () {
+        B.isBsv20(B.buildDeploy({ address: address, tick: 'ORDI', max: '21000000' })).should.equal(true)
+        B.isBsv20(B.buildMint({ address: address, tick: 'ORDI', amt: '1' })).should.equal(true)
+        B.isBsv20(B.buildTransfer({ address: address, id: OUTPOINT, amt: '1' })).should.equal(true)
+        B.isBsv20(B.buildDeployMint({ address: address, amt: '1000' })).should.equal(true)
+      })
+    })
+  })
 })

package/test/ordinals/ordlock.js

@@ -549,4 +549,75 @@ describe('Ordinals OrdLock — code-review regressions', function () {
     })
     Ord.parseOrdLock(lock).totalPrice.should.equal(777)
   })
+
+  // parseOrdLock recovers terms from the script's shape. Shape alone proves nothing: a
+  // script wearing the same opcode arrangement without the OP_PUSH_TX covenant enforces no
+  // payment, and reporting a seller and a price for it invents a listing that does not
+  // exist. The terms are therefore verified by rebuilding the listing and comparing bytes.
+  describe('is a verifier, not a shape matcher', function () {
+    var attacker = bsv.PrivateKey.fromBuffer(Buffer.alloc(32, 9))
+
+    // Wears the fingerprint parseOrdLock keys off: a top-level OP_IF with a 20-byte push,
+    // and OP_TOALTSTACK <blob> OP_CAT OP_SWAP in the OP_ELSE branch. Enforces nothing.
+    function fabricatedListing () {
+      var payout = new bsv.Transaction.Output({
+        script: bsv.Script.buildPublicKeyHashOut(attacker.toAddress()),
+        satoshis: 100000000
+      })
+      var s = new bsv.Script()
+      s.add(bsv.Opcode.OP_IF)
+      s.add(attacker.toAddress().hashBuffer)
+      s.add(bsv.Opcode.OP_DROP)
+      s.add(bsv.Opcode.OP_ELSE)
+      s.add(bsv.Opcode.OP_TOALTSTACK)
+      s.add(payout.toBufferWriter().toBuffer())
+      s.add(bsv.Opcode.OP_CAT)
+      s.add(bsv.Opcode.OP_SWAP)
+      s.add(bsv.Opcode.OP_ENDIF)
+      s.add(bsv.Opcode.OP_TRUE)
+      return s
+    }
+
+    it('rejects a fabricated listing that enforces no payment', function () {
+      var fake = fabricatedListing()
+      Ord.isOrdLock(fake).should.equal(false)
+      ;(Ord.parseOrdLock(fake) === null).should.equal(true)
+    })
+
+    it('proves the fabricated listing really is spendable for free', function () {
+      // Without this, the test above only shows we reject *something*.
+      var interp = new bsv.Script.Interpreter()
+      var unlock = new bsv.Script().add(bsv.Opcode.OP_1)
+      var spent = interp.verify(unlock, fabricatedListing(), new bsv.Transaction(), 0, 0)
+      spent.should.equal(true)
+    })
+
+    it('rejects a genuine listing with anything appended', function () {
+      var real = Ord.buildOrdLock({ seller: owner.toAddress(), price: 50000 })
+      var tampered = bsv.Script.fromHex(real.toHex()).add(bsv.Opcode.OP_NOP)
+      Ord.isOrdLock(tampered).should.equal(false)
+    })
+
+    it('still accepts every genuine listing shape', function () {
+      var simple = Ord.buildOrdLock({ seller: owner.toAddress(), price: 50000 })
+      Ord.parseOrdLock(simple).totalPrice.should.equal(50000)
+
+      var withInsc = Ord.buildOrdLock({
+        seller: owner.toAddress(),
+        price: 777,
+        inscription: { contentType: 'text/plain', content: 'for sale' }
+      })
+      var parsed = Ord.parseOrdLock(withInsc)
+      parsed.totalPrice.should.equal(777)
+      parsed.inscription.contentText.should.equal('for sale')
+
+      var multi = Ord.buildOrdLock({
+        seller: owner.toAddress(),
+        price: 1000,
+        royalties: [{ address: attacker.toAddress(), satoshis: 50 }]
+      })
+      Ord.parseOrdLock(multi).payOutputs.length.should.equal(2)
+      Ord.parseOrdLock(multi).totalPrice.should.equal(1050)
+    })
+  })
 })

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '7.2.0'
+module.exports = '7.3.0'