@smartledger/bsv 9.18.0 → 9.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +123 -0
- package/README.md +19 -19
- package/bsv-gdaf.min.js +32 -32
- package/bsv-smartcontract.min.js +1 -1
- package/bsv.bundle.js +32 -32
- package/bsv.min.js +32 -32
- package/docs/AUDIT_SCOPE.md +7 -7
- package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
- package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
- package/docs/audit-rfq/cure53.txt +2 -2
- package/docs/audit-rfq/ncc-group.txt +2 -2
- package/docs/audit-rfq/trail-of-bits.txt +2 -2
- package/docs/getting-started/INSTALLATION.md +23 -23
- package/docs/getting-started/QUICK_START.md +7 -7
- package/docs/migration/FROM_BSV_1_5_6.md +5 -5
- package/lib/gdaf/zk-prover.js +80 -10
- package/lib/notaryhash/certificate.js +64 -1
- package/lib/notaryhash/index.js +108 -3
- package/package.json +1 -1
- package/version.js +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,129 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [9.20.0] - 2026-10-05
|
|
11
|
+
|
|
12
|
+
A security release. One verifier accepted a forged proof outright; another accepted eight tampered
|
|
13
|
+
certificates. Both defects are the same shape: **a field that looks checked and is not.**
|
|
14
|
+
|
|
15
|
+
### Security — `ZKProver.verifyMembershipProof` accepted a forged proof
|
|
16
|
+
|
|
17
|
+
It took the proof alone and returned
|
|
18
|
+
|
|
19
|
+
```js
|
|
20
|
+
proof.setCommitments.includes(proof.valueCommitment) && proof.isMember
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
where **every value in that expression came from the prover**. Nothing bound the commitments to a
|
|
24
|
+
set the verifier knew, nothing opened the value commitment, and `isMember` was the prover's own
|
|
25
|
+
claim. So this returned `true`:
|
|
26
|
+
|
|
27
|
+
```js
|
|
28
|
+
verifyMembershipProof({ type: 'MembershipProof',
|
|
29
|
+
setCommitments: ['x'], valueCommitment: 'x', isMember: true })
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
A forgery needed no key, no salt and no set. This is the same defect `verifyAgeProof` and
|
|
33
|
+
`verifyRangeProof` had before 8.2.0, in the one function that fix did not reach.
|
|
34
|
+
|
|
35
|
+
The verifier now takes `(proof, opening, set)`: the **verifier** supplies the set it believes in,
|
|
36
|
+
the holder supplies `{ value, salt }`, both commitments are recomputed, the prover's array must
|
|
37
|
+
equal the verifier's set commitment-for-commitment in order — so a prover cannot append one — and
|
|
38
|
+
membership is decided against the verifier's set. `proof.isMember` is no longer consulted.
|
|
39
|
+
`generateMembershipProof` now returns the `salt` so a holder can build the opening.
|
|
40
|
+
|
|
41
|
+
This is **not zero-knowledge and cannot be**, consistent with this module's header note. One salt
|
|
42
|
+
covers every member, so a verifier holding the set and the salt can recompute every commitment, and
|
|
43
|
+
a low-entropy set is not hidden from anyone who sees the proof. The honest claim is "this value is
|
|
44
|
+
in a set the verifier already holds" — a membership *check*. A caller needing the value or set
|
|
45
|
+
hidden needs a different primitive; per-attribute fresh salts under an issuer-signed RFC 6962 root
|
|
46
|
+
is the construction to reach for.
|
|
47
|
+
|
|
48
|
+
Reported against 9.19.0 by a consumer that had reviewed these proofs in July and re-tested them.
|
|
49
|
+
**No test in this repository covered the forged path** — the suite count did not move when the fix
|
|
50
|
+
landed.
|
|
51
|
+
|
|
52
|
+
### Security — `NotaryHash.verify` accepted eight tampered certificates
|
|
53
|
+
|
|
54
|
+
Each is a single edited field, covered by no signature and checked by nothing, on one real mainnet
|
|
55
|
+
batch certificate (block 954784):
|
|
56
|
+
|
|
57
|
+
| case | change | now |
|
|
58
|
+
|---|---|---|
|
|
59
|
+
| T01 | `anchor.blockTime` + 3600 | refused |
|
|
60
|
+
| T02 | `anchor.blockTime` − 100000000 | refused |
|
|
61
|
+
| T03 | `anchor.blockHeight` − 1000 | refused |
|
|
62
|
+
| T05 | `anchor.vout` = 1 (a payment output) | refused |
|
|
63
|
+
| T06 | `anchor.vout` = 99 (past the last output) | refused |
|
|
64
|
+
| T07 | `spv.merkleProof.index` + 2^(nodes+3) | refused |
|
|
65
|
+
| T19 | `createdAt` `.000Z` → `.123Z` | refused |
|
|
66
|
+
| T20 | `createdAt` `.000Z` → `Z` | refused |
|
|
67
|
+
|
|
68
|
+
The rules now enforced:
|
|
69
|
+
|
|
70
|
+
- **`anchor.blockTime` must equal the time in the 80-byte header**, and `anchor.blockHeight` must
|
|
71
|
+
equal `spv.blockHeight`. A `null` is not a claim — a certificate issued before confirmation
|
|
72
|
+
legitimately carries nulls, and only a stated value is checked.
|
|
73
|
+
- **The record is read from `anchor.vout` and no other output.** Scanning every output made
|
|
74
|
+
`anchor.vout` decorative: it could name a payment output, or one past the end, and the record was
|
|
75
|
+
still found elsewhere in the transaction.
|
|
76
|
+
- **A TSC `index` must fit its path.** A path of n nodes addresses at most 2^n leaves, so a larger
|
|
77
|
+
index describes a tree the path cannot belong to.
|
|
78
|
+
- **`createdAt` must be the canonical rendering of its second**, in the reference format. The
|
|
79
|
+
proofHash commits to `createdAtUnix`, so `...04.000Z`, `...04.527Z` and `...04Z` produce the
|
|
80
|
+
**same** commitment — the sub-second component is not covered by the proof at all. Applied to the
|
|
81
|
+
reference format only: certificates written by 8.3.0–9.8.0 carry a millisecond component, exist
|
|
82
|
+
in the wild, and are still read.
|
|
83
|
+
|
|
84
|
+
Verified against an external 27-case oracle with seven pinned mainnet headers: **27/27 agreement**,
|
|
85
|
+
with both honest cases still accepted.
|
|
86
|
+
|
|
87
|
+
Found and measured independently by two consumer sessions — the verification API that uses this
|
|
88
|
+
library as a second, independent anchor verifier, and the NotaryHash SDK session whose SPEC the
|
|
89
|
+
rules come from. The eight were reproduced here with a separate harness before any change.
|
|
90
|
+
|
|
91
|
+
## [9.19.0] - 2026-10-03
|
|
92
|
+
|
|
93
|
+
### Security — `merkle.leafIndex` was not validated against the path beside it
|
|
94
|
+
|
|
95
|
+
A batch certificate's `merkle.leafIndex` could be changed to any other value in range and the
|
|
96
|
+
inclusion proof still verified. On a 25-leaf batch, a proof for leaf 3 verified while claiming to
|
|
97
|
+
be leaf 0, leaf 7 or leaf 24.
|
|
98
|
+
|
|
99
|
+
The cause is a seam between the two certificate formats. A sided audit path folds by its **own**
|
|
100
|
+
sides, and `Certificate.normalize` returns a non-legacy certificate untouched — so for a
|
|
101
|
+
**reference** certificate `leafIndex` was read and never used. A **legacy** certificate was fine,
|
|
102
|
+
because normalising it derives the sides from `leafIndex`, so a wrong index produced a wrong fold
|
|
103
|
+
and failed. Moving a certificate from the legacy format to the reference one therefore silently
|
|
104
|
+
lost a check.
|
|
105
|
+
|
|
106
|
+
**This was never a false accept of an invalid proof.** A corrupted path hash and a flipped side
|
|
107
|
+
were both refused before this release and are refused now; inclusion itself was sound. What was
|
|
108
|
+
wrong is that `leafIndex` was an **unvalidated assertion sitting beside validated ones**, and a
|
|
109
|
+
reader shown "leaf 3 of 25" had no way to tell which of those fields was load-bearing. For a
|
|
110
|
+
numbered edition — "card 3 of 25" — that field is the claim the holder cares about.
|
|
111
|
+
|
|
112
|
+
`NotaryHash.verifyBatchInclusion` now recomputes the side sequence the stated index implies and
|
|
113
|
+
refuses a mismatch, naming it:
|
|
114
|
+
|
|
115
|
+
```
|
|
116
|
+
merkle.leafIndex 7 disagrees with the path: node 2 is marked "right" but leaf 7 of 25 requires "left"
|
|
117
|
+
merkle.leafIndex 24 in a tree of 25 leaves needs 2 path nodes; the path has 5
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
No hashing is added: RFC 6962 already determines the sides from the index and the tree size, so
|
|
121
|
+
the check is one pass over the path. Verified across a 25-leaf tree that every leaf verifies at its
|
|
122
|
+
own index and **every leaf is refused at any other index**, 25 of 25.
|
|
123
|
+
|
|
124
|
+
`leafCount` is deliberately not treated the same way. A mis-stated count that implies the same side
|
|
125
|
+
sequence is indistinguishable here by construction, which is exactly what the on-chain
|
|
126
|
+
`u32be(leafCount)` in the batch record is for — `recordMatchesCertificate` compares it, and that
|
|
127
|
+
comparison is the authority.
|
|
128
|
+
|
|
129
|
+
Found by the ordinals mint that anchors BRC-220 proofs: its own tamper test caught the difference
|
|
130
|
+
when it moved from the legacy format to the reference one, and it reported the seam rather than
|
|
131
|
+
the symptom.
|
|
132
|
+
|
|
10
133
|
## [9.18.0] - 2026-10-03
|
|
11
134
|
|
|
12
135
|
9.17.0 was committed but never published to npm; its contents are included here. The version
|
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
Bitcoin SV library with an interpreter-verified script engine.
|
|
4
4
|
|
|
5
|
-
[](https://www.npmjs.com/package/@smartledger/bsv)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
[](STABILITY.md)
|
|
8
8
|
|
|
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv') // 128 modules
|
|
|
155
155
|
### **Core Modules**
|
|
156
156
|
| Module | Size | Use Case | CDN |
|
|
157
157
|
|--------|------|----------|-----|
|
|
158
|
-
| **bsv.min.js** |
|
|
159
|
-
| **bsv.bundle.js** |
|
|
158
|
+
| **bsv.min.js** | 1068KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js` |
|
|
159
|
+
| **bsv.bundle.js** | 1068KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.20.0/bsv.bundle.js` |
|
|
160
160
|
|
|
161
161
|
### **W3C Verifiable Credentials**
|
|
162
162
|
| Module | Size | Use Case | CDN |
|
|
163
163
|
|--------|------|----------|-----|
|
|
164
|
-
| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.
|
|
165
|
-
| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.
|
|
166
|
-
| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.
|
|
167
|
-
| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.
|
|
164
|
+
| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-didweb.min.js` |
|
|
165
|
+
| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-vcjwt.min.js` |
|
|
166
|
+
| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-statuslist.min.js` |
|
|
167
|
+
| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-anchor.min.js` |
|
|
168
168
|
|
|
169
169
|
### **Smart Contract & Development**
|
|
170
170
|
| Module | Size | Use Case | CDN |
|
|
171
171
|
|--------|------|----------|-----|
|
|
172
|
-
| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.
|
|
173
|
-
| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.
|
|
174
|
-
| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.
|
|
175
|
-
| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.
|
|
172
|
+
| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.20.0/bsv-smartcontract.min.js` |
|
|
173
|
+
| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.20.0/bsv-covenant.min.js` |
|
|
174
|
+
| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.20.0/bsv-script-helper.min.js` |
|
|
175
|
+
| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.20.0/bsv-security.min.js` |
|
|
176
176
|
|
|
177
177
|
### **Legal & Compliance**
|
|
178
178
|
| Module | Size | Use Case | CDN |
|
|
179
179
|
|--------|------|----------|-----|
|
|
180
|
-
| **bsv-ltp.min.js** | 544KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.
|
|
181
|
-
| **bsv-gdaf.min.js** |
|
|
180
|
+
| **bsv-ltp.min.js** | 544KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.20.0/bsv-ltp.min.js` |
|
|
181
|
+
| **bsv-gdaf.min.js** | 1068KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.20.0/bsv-gdaf.min.js` |
|
|
182
182
|
|
|
183
183
|
### **Advanced Cryptography**
|
|
184
184
|
| Module | Size | Use Case | CDN |
|
|
185
185
|
|--------|------|----------|-----|
|
|
186
|
-
| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.
|
|
186
|
+
| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.20.0/bsv-shamir.min.js` |
|
|
187
187
|
|
|
188
188
|
### **Utilities**
|
|
189
189
|
| Module | Size | Use Case | CDN |
|
|
190
190
|
|--------|------|----------|-----|
|
|
191
|
-
| **bsv-ecies.min.js** | 139KB | Encryption | `unpkg.com/@smartledger/bsv@9.
|
|
192
|
-
| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.
|
|
193
|
-
| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.
|
|
191
|
+
| **bsv-ecies.min.js** | 139KB | Encryption | `unpkg.com/@smartledger/bsv@9.20.0/bsv-ecies.min.js` |
|
|
192
|
+
| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.20.0/bsv-message.min.js` |
|
|
193
|
+
| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.20.0/bsv-mnemonic.min.js` |
|
|
194
194
|
```html
|
|
195
|
-
<script src="https://unpkg.com/@smartledger/bsv@9.
|
|
195
|
+
<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
|
|
196
196
|
<script>
|
|
197
197
|
const key = bsv.PrivateKey.fromRandom()
|
|
198
198
|
</script>
|
|
@@ -240,4 +240,4 @@ MIT
|
|
|
240
240
|
|
|
241
241
|
---
|
|
242
242
|
|
|
243
|
-
**SmartLedger-BSV v9.
|
|
243
|
+
**SmartLedger-BSV v9.20.0**
|