@smartledger/bsv 9.15.0 → 9.16.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +155 -0
- package/README.md +19 -19
- package/bsv-gdaf.min.js +55 -55
- package/bsv-ltp.min.js +36 -36
- package/bsv-smartcontract.min.js +1 -1
- package/bsv.bundle.js +55 -55
- package/bsv.min.js +55 -55
- package/docs/AUDIT_SCOPE.md +6 -6
- package/docs/BRC220_BATCH_LEAF_AMENDMENT.md +16 -4
- package/docs/BRC220_CERTIFICATE_FIELDS_AMENDMENT.md +11 -4
- package/docs/BRC220_PLAN.md +5 -2
- package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
- package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
- package/docs/audit-rfq/cure53.txt +1 -1
- package/docs/audit-rfq/ncc-group.txt +1 -1
- package/docs/audit-rfq/trail-of-bits.txt +1 -1
- package/docs/getting-started/INSTALLATION.md +23 -23
- package/docs/getting-started/QUICK_START.md +7 -7
- package/docs/migration/FROM_BSV_1_5_6.md +5 -5
- package/lib/script/interpreter.js +91 -49
- package/package.json +9 -5
- package/tools/gen-blind-spot-vectors.js +422 -0
- package/tools/minimal_reproduction.js +1 -1
- package/tools/opcode_map.js +11 -4
- package/tools/simple_real_tx.js +1 -1
- package/tools/sv-vector-coverage.js +174 -0
- package/tools/sv-vector-harness.js +8 -4
- package/version.js +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,161 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [9.16.1] - 2026-10-01
|
|
11
|
+
|
|
12
|
+
Three resource and validation defects in the shift and binary-conversion opcodes, found by a
|
|
13
|
+
differential fuzzer run against this package and by independent review of the first fix. The
|
|
14
|
+
conformance corpus passes 1483/1483 before and after: every one of these was invisible to it.
|
|
15
|
+
|
|
16
|
+
### Security — `OP_LSHIFT` and `OP_RSHIFT` did work proportional to the shift COUNT
|
|
17
|
+
|
|
18
|
+
Both built the shifted value as a bignum and then truncated it, so `ushln(n)` allocated a value of
|
|
19
|
+
the shifted width — the count's magnitude, not the operand's. A short script could therefore buy
|
|
20
|
+
an unbounded amount of work from a verifier, in **every era**, since a count of 2^31-1 fits the
|
|
21
|
+
four bytes allowed before Genesis, and `IsOpcodeDisabled` in the node disables only `OP_2MUL`
|
|
22
|
+
and `OP_2DIV` — never the shifts. Confirmed by execution: a pre-Genesis `OP_LSHIFT` with a count
|
|
23
|
+
of 2^31-1 is accepted and returns one zero byte. Past a certain count the implied length is not a valid array
|
|
24
|
+
length and bn.js raised a `RangeError`, which the evaluator reported as
|
|
25
|
+
`SCRIPT_ERR_UNKNOWN_ERROR`. **That is a false reject**, not merely a slow one: the node returns
|
|
26
|
+
zero bytes for the same script, so this library refused spends the node accepts. So the path had
|
|
27
|
+
two faults at once — unbounded work, and a wrong verdict in the direction of refusal. No false
|
|
28
|
+
accept was found on this path; the false accept in this release is the separate empty-operand bug
|
|
29
|
+
below.
|
|
30
|
+
|
|
31
|
+
Both opcodes now follow the node's shape, which bounds the work by the operand:
|
|
32
|
+
|
|
33
|
+
```cpp
|
|
34
|
+
CScriptNum n{top, requireMinimal, params.MaxScriptNumLength(), utxo_after_genesis};
|
|
35
|
+
if(n < 0) return SCRIPT_ERR_INVALID_NUMBER_RANGE;
|
|
36
|
+
if(n >= values.size() * bits_per_byte) fill(begin(values), end(values), 0);
|
|
37
|
+
else { ... LShift(values, n.getint()) ... }
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
The count is compared as a bignum before any narrowing, and a shift reaching the operand's full
|
|
41
|
+
width returns that many zero bytes directly. The node's `LShift` allocates
|
|
42
|
+
`valtype result(x.size(), 0x00)` and loops over `x.size()`; nothing it allocates follows the
|
|
43
|
+
count. Verified against the previous implementation on 719,360 operand-and-count pairs — every value at
|
|
44
|
+
operand lengths 1 to 4, sampled above 4096 per length, at every count from 0 to 8·len+4, both
|
|
45
|
+
directions — and against an independent bit-string model. That equivalence covers the **valid
|
|
46
|
+
counts for which the previous implementation completed**, and over those the output is
|
|
47
|
+
byte-identical. It deliberately does not cover the counts that previously threw, or the
|
|
48
|
+
empty-operand counts in the next section, where the verdict changes on purpose; both are covered
|
|
49
|
+
by their own tests.
|
|
50
|
+
|
|
51
|
+
### Security — an invalid shift count was accepted whenever the operand was empty
|
|
52
|
+
|
|
53
|
+
Both opcodes short-circuited when the value being shifted was empty, popping the count without
|
|
54
|
+
decoding it, and therefore without any of its three checks. A negative count, a count too wide for
|
|
55
|
+
the era, and a non-minimally-encoded count were all accepted, where the node refuses each by name.
|
|
56
|
+
**A false accept.** The node's only guard before the decode is `stack.size() < 2`, and it checks
|
|
57
|
+
`n < 0` before it reads the operand at all.
|
|
58
|
+
|
|
59
|
+
This one was found by review of the first shift fix, which corrected the cost and left this in
|
|
60
|
+
place.
|
|
61
|
+
|
|
62
|
+
### Fixed — `OP_NUM2BIN`'s size was not bounded by `INT32_MAX`
|
|
63
|
+
|
|
64
|
+
The node caps it in every era, **before** the element-size test:
|
|
65
|
+
|
|
66
|
+
```cpp
|
|
67
|
+
if(n < 0 || n > std::numeric_limits<int32_t>::max()) return SCRIPT_ERR_PUSH_SIZE;
|
|
68
|
+
const auto size{n.to_size_t_limited()};
|
|
69
|
+
if(!utxo_after_genesis && (size > MAX_SCRIPT_ELEMENT_SIZE_BEFORE_GENESIS))
|
|
70
|
+
return SCRIPT_ERR_PUSH_SIZE;
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
The era only widens the second test; the first is fixed. Without it a size above `INT32_MAX`
|
|
74
|
+
passed the post-Genesis element check, which is effectively unbounded, and the allocation that
|
|
75
|
+
followed was proportional to the operand's **value** rather than its length. A size the node
|
|
76
|
+
refuses without allocating is now refused the same way, and the bound is checked on the bignum
|
|
77
|
+
before narrowing, because `toNumber()` rounds past 2^53 and returns `Infinity` at extreme widths
|
|
78
|
+
rather than failing.
|
|
79
|
+
|
|
80
|
+
**This cap matches the node; it does not make the opcode cheap.** A size just under `INT32_MAX` is
|
|
81
|
+
consensus-valid and still requests an allocation approaching 2 GB, from a script of a few bytes —
|
|
82
|
+
so a limit on script size does not address it. **This release adds no execution or allocation
|
|
83
|
+
budget, and this package enforces none.** Evaluating untrusted scripts therefore needs a bound on
|
|
84
|
+
execution resources, not just on input size: run it in a process whose memory and CPU time are
|
|
85
|
+
capped, or do not evaluate untrusted scripts in a process you need to keep alive.
|
|
86
|
+
|
|
87
|
+
### Note on `OP_DIV` and `OP_MOD`
|
|
88
|
+
|
|
89
|
+
Both are quadratic in operand length. **This is not a consensus divergence, and it is not fixed in
|
|
90
|
+
this release.** The node shares the shape: `OP_DIV`/`OP_MOD` are bounded only by
|
|
91
|
+
`params.MaxScriptNumLength()` and its `bsv::bint` division is also schoolbook, so verdicts and
|
|
92
|
+
bounds match and changing ours would diverge from consensus.
|
|
93
|
+
|
|
94
|
+
Parity settles the verdict, not the cost. **Quadratic CPU exhaustion remains a risk when
|
|
95
|
+
evaluating attacker-controlled scripts**, and the node's practical protection is policy rather
|
|
96
|
+
than consensus — `DEFAULT_MAX_SCRIPT_SIZE_POLICY_AFTER_GENESIS` of 500 KB and
|
|
97
|
+
`DEFAULT_STACK_MEMORY_USAGE_POLICY_AFTER_GENESIS` of 100 MB. Neither is a CPU-time bound, and this
|
|
98
|
+
package enforces neither. Measured here: 320 KB of operand takes about 18 seconds, growing by
|
|
99
|
+
roughly 4× per doubling. Bound execution resources yourself, as above. An opt-in budget is under
|
|
100
|
+
consideration and will not change default behaviour.
|
|
101
|
+
|
|
102
|
+
## [9.16.0] - 2026-10-01
|
|
103
|
+
|
|
104
|
+
### Security — `OP_CHECKMULTISIG`'s counts were decoded with the era's length, not four bytes
|
|
105
|
+
|
|
106
|
+
Both counts used `maxScriptNumLength()`, which is 750,000 bytes after Genesis and 32,000,000 after
|
|
107
|
+
Chronicle. The node hardcodes four and says why:
|
|
108
|
+
|
|
109
|
+
```cpp
|
|
110
|
+
// initialize to max size of CScriptNum::MAXIMUM_ELEMENT_SIZE (4 bytes)
|
|
111
|
+
// because only 4 byte integers are supported by OP_CHECKMULTISIG / OP_CHECKMULTISIGVERIFY
|
|
112
|
+
nKeysCountSigned = CScriptNum(stack.stacktop(-i).GetElement(), requireMinimal,
|
|
113
|
+
CScriptNum::MAXIMUM_ELEMENT_SIZE).getint();
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
These two are the **only** operand decodes in the interpreter that do not take the era's length.
|
|
117
|
+
Every other one does, which is precisely why passing it here looked correct. The consequence was a
|
|
118
|
+
**false accept**: a 5-byte key or signature count that the node refuses as `SCRIPTNUM_OVERFLOW` in
|
|
119
|
+
every era was accepted. Present in 9.15.0 and earlier.
|
|
120
|
+
|
|
121
|
+
### Fixed — the Magnetic opcodes needed a flag the node does not have
|
|
122
|
+
|
|
123
|
+
`OP_MUL`, `OP_LSHIFT`, `OP_RSHIFT` and `OP_INVERT` were refused unless
|
|
124
|
+
`SCRIPT_ENABLE_MAGNETIC_OPCODES` was set. `IsOpcodeDisabled` disables `OP_2MUL` and `OP_2DIV` and
|
|
125
|
+
nothing else, so those four execute in every era the node can validate. Measured against the
|
|
126
|
+
node's own corpus with the library-only opcode bits withheld: **77 rows refused as
|
|
127
|
+
`DISABLED_OPCODE`**, every one a false reject. Fail-closed, so nothing was wrongly accepted, but
|
|
128
|
+
they are spends the network accepts.
|
|
129
|
+
|
|
130
|
+
This landed after the 9.15.0 tag, so 9.15.0 shipped without it — and `@smartledger/bsv-core@1.0.2`
|
|
131
|
+
was briefly more correct than the published library. That is the reason this release exists now
|
|
132
|
+
rather than later.
|
|
133
|
+
|
|
134
|
+
Both flag constants remain exported and accepted; setting either is redundant.
|
|
135
|
+
|
|
136
|
+
### Fixed — a disabled opcode in an unexecuted branch
|
|
137
|
+
|
|
138
|
+
The era decides, not the branch. The node reads
|
|
139
|
+
`IsOpcodeDisabled(opcode, era) && (!utxo_after_genesis || fExec)`, so an unexecuted disabled opcode
|
|
140
|
+
is fatal before Genesis and harmless after it. The behaviour was already right in all four
|
|
141
|
+
combinations; a comment claimed it was fatal in every era, and no test pinned any of it. Both
|
|
142
|
+
fixed.
|
|
143
|
+
|
|
144
|
+
### Added — portable cross-implementation vectors, now 25
|
|
145
|
+
|
|
146
|
+
`test/data/blind-spot-vectors.json` carries raw-byte vectors for five defect classes the node's
|
|
147
|
+
own corpus cannot reach, with the node's flag names, its error-name table vendored beside them,
|
|
148
|
+
and a generator so the file is a build product rather than hand-maintained.
|
|
149
|
+
|
|
150
|
+
They are not decorative: they found a false accept in the official
|
|
151
|
+
[`bsv-blockchain/go-sdk`](https://github.com/bsv-blockchain/go-sdk/issues/373) and five unguarded
|
|
152
|
+
malleability sites in an independent Rust implementation. `@bsv/sdk` 2.8.11 agrees with all of
|
|
153
|
+
them. Four rows covering the Magnetic opcodes were added by a second session after it observed
|
|
154
|
+
that the original set could not have caught the gate above.
|
|
155
|
+
|
|
156
|
+
### Added — `npm run vectors:sv-coverage`, which reports what a corpus cannot test
|
|
157
|
+
|
|
158
|
+
A 1483/1483 score says we agree with the corpus; it says nothing about rules the corpus never
|
|
159
|
+
exercises, and the percentage cannot tell the two apart. The report names them on four axes:
|
|
160
|
+
verdicts no row asks for, masking flag pairs never set together, how often each flag appears at all
|
|
161
|
+
against whether mainnet requires it, and rules the row format cannot express. Run against the
|
|
162
|
+
node's vectors it names both defect classes released in 9.15.0 — so it would have pointed at them
|
|
163
|
+
before either was found.
|
|
164
|
+
|
|
10
165
|
## [9.15.0] - 2026-09-29
|
|
11
166
|
|
|
12
167
|
### Security — `LOW_S` masked every STRICTENC signature check, on this library's own default flags
|
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
Bitcoin SV library with an interpreter-verified script engine.
|
|
4
4
|
|
|
5
|
-
[](https://www.npmjs.com/package/@smartledger/bsv)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
[](STABILITY.md)
|
|
8
8
|
|
|
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv') // 128 modules
|
|
|
155
155
|
### **Core Modules**
|
|
156
156
|
| Module | Size | Use Case | CDN |
|
|
157
157
|
|--------|------|----------|-----|
|
|
158
|
-
| **bsv.min.js** | 1062KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.
|
|
159
|
-
| **bsv.bundle.js** | 1062KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.
|
|
158
|
+
| **bsv.min.js** | 1062KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.16.1/bsv.min.js` |
|
|
159
|
+
| **bsv.bundle.js** | 1062KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.16.1/bsv.bundle.js` |
|
|
160
160
|
|
|
161
161
|
### **W3C Verifiable Credentials**
|
|
162
162
|
| Module | Size | Use Case | CDN |
|
|
163
163
|
|--------|------|----------|-----|
|
|
164
|
-
| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.
|
|
165
|
-
| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.
|
|
166
|
-
| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.
|
|
167
|
-
| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.
|
|
164
|
+
| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.16.1/bsv-didweb.min.js` |
|
|
165
|
+
| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.16.1/bsv-vcjwt.min.js` |
|
|
166
|
+
| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.16.1/bsv-statuslist.min.js` |
|
|
167
|
+
| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.16.1/bsv-anchor.min.js` |
|
|
168
168
|
|
|
169
169
|
### **Smart Contract & Development**
|
|
170
170
|
| Module | Size | Use Case | CDN |
|
|
171
171
|
|--------|------|----------|-----|
|
|
172
|
-
| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.
|
|
173
|
-
| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.
|
|
174
|
-
| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.
|
|
175
|
-
| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.
|
|
172
|
+
| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.16.1/bsv-smartcontract.min.js` |
|
|
173
|
+
| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.16.1/bsv-covenant.min.js` |
|
|
174
|
+
| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.16.1/bsv-script-helper.min.js` |
|
|
175
|
+
| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.16.1/bsv-security.min.js` |
|
|
176
176
|
|
|
177
177
|
### **Legal & Compliance**
|
|
178
178
|
| Module | Size | Use Case | CDN |
|
|
179
179
|
|--------|------|----------|-----|
|
|
180
|
-
| **bsv-ltp.min.js** | 542KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.
|
|
181
|
-
| **bsv-gdaf.min.js** | 1062KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.
|
|
180
|
+
| **bsv-ltp.min.js** | 542KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.16.1/bsv-ltp.min.js` |
|
|
181
|
+
| **bsv-gdaf.min.js** | 1062KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.16.1/bsv-gdaf.min.js` |
|
|
182
182
|
|
|
183
183
|
### **Advanced Cryptography**
|
|
184
184
|
| Module | Size | Use Case | CDN |
|
|
185
185
|
|--------|------|----------|-----|
|
|
186
|
-
| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.
|
|
186
|
+
| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.16.1/bsv-shamir.min.js` |
|
|
187
187
|
|
|
188
188
|
### **Utilities**
|
|
189
189
|
| Module | Size | Use Case | CDN |
|
|
190
190
|
|--------|------|----------|-----|
|
|
191
|
-
| **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.
|
|
192
|
-
| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.
|
|
193
|
-
| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.
|
|
191
|
+
| **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.16.1/bsv-ecies.min.js` |
|
|
192
|
+
| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.16.1/bsv-message.min.js` |
|
|
193
|
+
| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.16.1/bsv-mnemonic.min.js` |
|
|
194
194
|
```html
|
|
195
|
-
<script src="https://unpkg.com/@smartledger/bsv@9.
|
|
195
|
+
<script src="https://unpkg.com/@smartledger/bsv@9.16.1/bsv.min.js"></script>
|
|
196
196
|
<script>
|
|
197
197
|
const key = bsv.PrivateKey.fromRandom()
|
|
198
198
|
</script>
|
|
@@ -240,4 +240,4 @@ MIT
|
|
|
240
240
|
|
|
241
241
|
---
|
|
242
242
|
|
|
243
|
-
**SmartLedger-BSV v9.
|
|
243
|
+
**SmartLedger-BSV v9.16.1**
|