@smartledger/bsv 9.15.0 → 9.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (28) hide show
  1. package/CHANGELOG.md +63 -0
  2. package/README.md +19 -19
  3. package/bsv-gdaf.min.js +2 -2
  4. package/bsv-ltp.min.js +3 -3
  5. package/bsv-smartcontract.min.js +1 -1
  6. package/bsv.bundle.js +2 -2
  7. package/bsv.min.js +2 -2
  8. package/docs/AUDIT_SCOPE.md +6 -6
  9. package/docs/BRC220_BATCH_LEAF_AMENDMENT.md +16 -4
  10. package/docs/BRC220_CERTIFICATE_FIELDS_AMENDMENT.md +11 -4
  11. package/docs/BRC220_PLAN.md +5 -2
  12. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  13. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  14. package/docs/audit-rfq/cure53.txt +1 -1
  15. package/docs/audit-rfq/ncc-group.txt +1 -1
  16. package/docs/audit-rfq/trail-of-bits.txt +1 -1
  17. package/docs/getting-started/INSTALLATION.md +23 -23
  18. package/docs/getting-started/QUICK_START.md +7 -7
  19. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  20. package/lib/script/interpreter.js +38 -15
  21. package/package.json +9 -5
  22. package/tools/gen-blind-spot-vectors.js +422 -0
  23. package/tools/minimal_reproduction.js +1 -1
  24. package/tools/opcode_map.js +11 -4
  25. package/tools/simple_real_tx.js +1 -1
  26. package/tools/sv-vector-coverage.js +174 -0
  27. package/tools/sv-vector-harness.js +8 -4
  28. package/version.js +1 -1
package/CHANGELOG.md CHANGED
@@ -7,6 +7,69 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [9.16.0] - 2026-10-01
11
+
12
+ ### Security — `OP_CHECKMULTISIG`'s counts were decoded with the era's length, not four bytes
13
+
14
+ Both counts used `maxScriptNumLength()`, which is 750,000 bytes after Genesis and 32,000,000 after
15
+ Chronicle. The node hardcodes four and says why:
16
+
17
+ ```cpp
18
+ // initialize to max size of CScriptNum::MAXIMUM_ELEMENT_SIZE (4 bytes)
19
+ // because only 4 byte integers are supported by OP_CHECKMULTISIG / OP_CHECKMULTISIGVERIFY
20
+ nKeysCountSigned = CScriptNum(stack.stacktop(-i).GetElement(), requireMinimal,
21
+ CScriptNum::MAXIMUM_ELEMENT_SIZE).getint();
22
+ ```
23
+
24
+ These two are the **only** operand decodes in the interpreter that do not take the era's length.
25
+ Every other one does, which is precisely why passing it here looked correct. The consequence was a
26
+ **false accept**: a 5-byte key or signature count that the node refuses as `SCRIPTNUM_OVERFLOW` in
27
+ every era was accepted. Present in 9.15.0 and earlier.
28
+
29
+ ### Fixed — the Magnetic opcodes needed a flag the node does not have
30
+
31
+ `OP_MUL`, `OP_LSHIFT`, `OP_RSHIFT` and `OP_INVERT` were refused unless
32
+ `SCRIPT_ENABLE_MAGNETIC_OPCODES` was set. `IsOpcodeDisabled` disables `OP_2MUL` and `OP_2DIV` and
33
+ nothing else, so those four execute in every era the node can validate. Measured against the
34
+ node's own corpus with the library-only opcode bits withheld: **77 rows refused as
35
+ `DISABLED_OPCODE`**, every one a false reject. Fail-closed, so nothing was wrongly accepted, but
36
+ they are spends the network accepts.
37
+
38
+ This landed after the 9.15.0 tag, so 9.15.0 shipped without it — and `@smartledger/bsv-core@1.0.2`
39
+ was briefly more correct than the published library. That is the reason this release exists now
40
+ rather than later.
41
+
42
+ Both flag constants remain exported and accepted; setting either is redundant.
43
+
44
+ ### Fixed — a disabled opcode in an unexecuted branch
45
+
46
+ The era decides, not the branch. The node reads
47
+ `IsOpcodeDisabled(opcode, era) && (!utxo_after_genesis || fExec)`, so an unexecuted disabled opcode
48
+ is fatal before Genesis and harmless after it. The behaviour was already right in all four
49
+ combinations; a comment claimed it was fatal in every era, and no test pinned any of it. Both
50
+ fixed.
51
+
52
+ ### Added — portable cross-implementation vectors, now 25
53
+
54
+ `test/data/blind-spot-vectors.json` carries raw-byte vectors for five defect classes the node's
55
+ own corpus cannot reach, with the node's flag names, its error-name table vendored beside them,
56
+ and a generator so the file is a build product rather than hand-maintained.
57
+
58
+ They are not decorative: they found a false accept in the official
59
+ [`bsv-blockchain/go-sdk`](https://github.com/bsv-blockchain/go-sdk/issues/373) and five unguarded
60
+ malleability sites in an independent Rust implementation. `@bsv/sdk` 2.8.11 agrees with all of
61
+ them. Four rows covering the Magnetic opcodes were added by a second session after it observed
62
+ that the original set could not have caught the gate above.
63
+
64
+ ### Added — `npm run vectors:sv-coverage`, which reports what a corpus cannot test
65
+
66
+ A 1483/1483 score says we agree with the corpus; it says nothing about rules the corpus never
67
+ exercises, and the percentage cannot tell the two apart. The report names them on four axes:
68
+ verdicts no row asks for, masking flag pairs never set together, how often each flag appears at all
69
+ against whether mainnet requires it, and rules the row format cannot express. Run against the
70
+ node's vectors it names both defect classes released in 9.15.0 — so it would have pointed at them
71
+ before either was found.
72
+
10
73
  ## [9.15.0] - 2026-09-29
11
74
 
12
75
  ### Security — `LOW_S` masked every STRICTENC signature check, on this library's own default flags
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  Bitcoin SV library with an interpreter-verified script engine.
4
4
 
5
- [![Version](https://img.shields.io/badge/version-9.15.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
5
+ [![Version](https://img.shields.io/badge/version-9.16.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
  [![Stability](https://img.shields.io/badge/9.x%20stable%20until-2027--09--01-brightgreen.svg)](STABILITY.md)
8
8
 
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv') // 128 modules
155
155
  ### **Core Modules**
156
156
  | Module | Size | Use Case | CDN |
157
157
  |--------|------|----------|-----|
158
- | **bsv.min.js** | 1062KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.15.0/bsv.min.js` |
159
- | **bsv.bundle.js** | 1062KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.15.0/bsv.bundle.js` |
158
+ | **bsv.min.js** | 1062KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js` |
159
+ | **bsv.bundle.js** | 1062KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.16.0/bsv.bundle.js` |
160
160
 
161
161
  ### **W3C Verifiable Credentials**
162
162
  | Module | Size | Use Case | CDN |
163
163
  |--------|------|----------|-----|
164
- | **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.15.0/bsv-didweb.min.js` |
165
- | **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.15.0/bsv-vcjwt.min.js` |
166
- | **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.15.0/bsv-statuslist.min.js` |
167
- | **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.15.0/bsv-anchor.min.js` |
164
+ | **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-didweb.min.js` |
165
+ | **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-vcjwt.min.js` |
166
+ | **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-statuslist.min.js` |
167
+ | **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-anchor.min.js` |
168
168
 
169
169
  ### **Smart Contract & Development**
170
170
  | Module | Size | Use Case | CDN |
171
171
  |--------|------|----------|-----|
172
- | **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.15.0/bsv-smartcontract.min.js` |
173
- | **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.15.0/bsv-covenant.min.js` |
174
- | **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.15.0/bsv-script-helper.min.js` |
175
- | **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.15.0/bsv-security.min.js` |
172
+ | **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.16.0/bsv-smartcontract.min.js` |
173
+ | **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.16.0/bsv-covenant.min.js` |
174
+ | **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.16.0/bsv-script-helper.min.js` |
175
+ | **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.16.0/bsv-security.min.js` |
176
176
 
177
177
  ### **Legal & Compliance**
178
178
  | Module | Size | Use Case | CDN |
179
179
  |--------|------|----------|-----|
180
- | **bsv-ltp.min.js** | 542KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.15.0/bsv-ltp.min.js` |
181
- | **bsv-gdaf.min.js** | 1062KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.15.0/bsv-gdaf.min.js` |
180
+ | **bsv-ltp.min.js** | 542KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.16.0/bsv-ltp.min.js` |
181
+ | **bsv-gdaf.min.js** | 1062KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.16.0/bsv-gdaf.min.js` |
182
182
 
183
183
  ### **Advanced Cryptography**
184
184
  | Module | Size | Use Case | CDN |
185
185
  |--------|------|----------|-----|
186
- | **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.15.0/bsv-shamir.min.js` |
186
+ | **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.16.0/bsv-shamir.min.js` |
187
187
 
188
188
  ### **Utilities**
189
189
  | Module | Size | Use Case | CDN |
190
190
  |--------|------|----------|-----|
191
- | **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.15.0/bsv-ecies.min.js` |
192
- | **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.15.0/bsv-message.min.js` |
193
- | **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.15.0/bsv-mnemonic.min.js` |
191
+ | **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.16.0/bsv-ecies.min.js` |
192
+ | **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.16.0/bsv-message.min.js` |
193
+ | **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.16.0/bsv-mnemonic.min.js` |
194
194
  ```html
195
- <script src="https://unpkg.com/@smartledger/bsv@9.15.0/bsv.min.js"></script>
195
+ <script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
196
196
  <script>
197
197
  const key = bsv.PrivateKey.fromRandom()
198
198
  </script>
@@ -240,4 +240,4 @@ MIT
240
240
 
241
241
  ---
242
242
 
243
- **SmartLedger-BSV v9.15.0**
243
+ **SmartLedger-BSV v9.16.0**