@smartledger/bsv 9.11.1 → 9.12.0

package/CHANGELOG.md

@@ -7,6 +7,89 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.12.0] - 2026-09-29
+
+**A block header is no longer believed about the difficulty it declares.** A forged header cost
+one attempt to mine and passed SPV verification, proof of work enabled. The declared target is
+now capped, and `powLimit`, `minWork` and `blockHashAtHeight` are new options. Regtest headers
+need `powLimit: 0x207fffff`; mainnet and testnet are unaffected.
+
+### Fixed — a forged block header passed SPV verification, because it declared its own difficulty
+
+`BlockHeader.validProofOfWork()` answers one question: does the hash meet the target written in
+this header's own `bits`? Nothing capped that target, so a header could declare any difficulty it
+liked and then meet it. Measured against 9.11.2:
+
+| declared `bits` | nonces needed to mine it | `NotaryHash.verify(cert, { header })` |
+| --- | --- | --- |
+| `0x1d00ffff` (mainnet, difficulty 1) | over 2,000,000, not found | correctly refused |
+| `0x2000ffff` | 120 | **`valid: true`** |
+| `0x2100ffff` | **1** | **`valid: true`** |
+
+Proof of work was *enabled* in those rows. `SPV.verifyHeaderChain` accepted a whole chain of such
+headers, which its own comment warned about. It matters wherever a header reaches the verifier
+from the same place as the thing it is meant to check independently — an offline certificate and
+header bundle, or a provider that serves both.
+
+**The declared target is now capped.** `SPV.verifyTxInclusion`, `SPV.verifyHeaderChain`,
+`NotaryHash.verify`/`verifyAnchorSPV` and the GDAF anchor take `powLimit`, the easiest target a
+header may declare, defaulting to `SPV.POW_LIMIT_BITS` (`0x1d00ffff`, difficulty 1 — the
+proof-of-work limit of mainnet and testnet). `minWork` demands more than the cap if you want a
+difficulty floor. `bits` values no header may use — negative, zero, or overflowing — are refused
+outright: `targetFromBits` transcribes Bitcoin's `SetCompact` and `CheckProofOfWork`, none of
+whose rules `getTargetDifficulty` implements (it also shifts the wrong way for a size below 4,
+which is why it is not used here).
+
+**Two smaller holes closed with it.** A header is now taken as exactly 80 bytes and re-parsed, so
+every checked field comes from one snapshot and an object merely stating a `merkleRoot` is refused
+by name instead of failing with `header.validProofOfWork is not a function`. And
+`NotaryHash.verify` takes `blockHashAtHeight`: no amount of proof of work detects an orphan,
+because a block that lost a race carries real work, so a caller with its own chain view says which
+block that height holds.
+
+**What this rejects that 9.11.2 accepted:** forged headers, and honest regtest headers, which
+declare `0x207fffff` — pass `powLimit: 0x207fffff` for those, as `test/gdaf/anchor_spv.js` now
+does. `requirePow: false` still switches off every work check together. Mainnet and testnet
+headers are unaffected; the genesis block verifies under the default.
+
+Retargeting is still not validated, and this is still not a substitute for a chain source: a fork
+whose headers each clear the limit remains possible, which is what `trustedHash` and
+`blockHashAtHeight` are for.
+
+Found while mirroring a hardening of the BRC-220 reference implementation, whose difficulty floor
+prompted the check.
+
+## [9.11.2] - 2026-09-17
+
+**A patch: an empty push is no longer lost when a script is written as ASM or as a string.** No API change.
+
+### Fixed — an empty push written with OP_PUSHDATA survives being written as text
+
+An empty push encoded with `OP_PUSHDATA1`, `OP_PUSHDATA2` or `OP_PUSHDATA4` (`4c00`, `4d0000`,
+`4e00000000`) was written badly by both text forms:
+
+| script `514c0051` | 9.11.1 | now |
+| --- | --- | --- |
+| `toASM()` | `OP_1 OP_1`: the push is gone, so it reads back as `5151`, one stack element fewer | `OP_1 0 OP_1`, read back as `510051` |
+| `toString()` | `OP_1 OP_PUSHDATA1 OP_1`, which `fromString` cannot read | `OP_1 OP_PUSHDATA1 0 0x OP_1`, read back as `514c0051` |
+
+ASM writes every push in its minimal form, and the minimal empty push is `OP_0`, so the ASM
+now does what the script does. `toString` keeps the exact encoding.
+
+The same fault hid the empty push built by `Script#add(Buffer.alloc(0))`, and so by
+`Script.buildDataOut('')` and `buildSafeDataOut('')`. The chunk serializes to `0x00`, but both
+text forms wrote nothing for it: `buildDataOut('')` is `6a00` and its `toString()` was
+`OP_RETURN`, which reads back as `6a`. It is now `OP_RETURN OP_0` (ASM `OP_RETURN 0`), the text
+`Script.fromHex('6a00')` already produced. Four tests had pinned the invisible form; they now
+assert the text reads back as the script.
+
+No reader changes: `fromString` already read `OP_PUSHDATA1 0 0x`. Of 4,000 generated scripts
+mixing both shapes with ordinary pushes and opcodes, the 909 whose text changed all contain an
+empty push, and every one of their new texts reads back exactly; every text 9.11.1 wrote is read
+the same way (8,000 texts).
+
+Reported by the scriptmin work (codenlighten/scriptmin#4).
+
 ## [9.11.1] - 2026-09-17
 
 **A patch: a script written as ASM or as a string reads back as the same script.** No API change.

package/README.md

@@ -2,7 +2,7 @@
 
 Bitcoin SV library with an interpreter-verified script engine.
 
-[![Version](https://img.shields.io/badge/version-9.11.1-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
+[![Version](https://img.shields.io/badge/version-9.12.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Stability](https://img.shields.io/badge/9.x%20stable%20until-2027--09--01-brightgreen.svg)](STABILITY.md)
 
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv')                 // 128 modules
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1057KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.11.1/bsv.min.js` |
-| **bsv.bundle.js** | 1057KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.11.1/bsv.bundle.js` |
+| **bsv.min.js** | 1060KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.12.0/bsv.min.js` |
+| **bsv.bundle.js** | 1060KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.12.0/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.11.1/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.11.1/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.11.1/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.11.1/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.12.0/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.12.0/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.12.0/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.12.0/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.11.1/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.11.1/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.11.1/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.11.1/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.12.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.12.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.12.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.12.0/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 541KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.11.1/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1057KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.11.1/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 541KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.12.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1060KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.12.0/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.11.1/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.12.0/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.11.1/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.11.1/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.11.1/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.12.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.12.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.12.0/bsv-mnemonic.min.js` |
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.11.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.12.0/bsv.min.js"></script>
 <script>
   const key = bsv.PrivateKey.fromRandom()
 </script>
@@ -240,4 +240,4 @@ MIT
 
 ---
 
-**SmartLedger-BSV v9.11.1**
+**SmartLedger-BSV v9.12.0**