@smartledger/bsv 9.18.0 → 9.20.0

package/lib/notaryhash/index.js

@@ -129,9 +129,25 @@ NotaryHash.txidFromRawTx = function (rawTx) {
  * @param {Buffer|String} rawTx
  * @returns {Object|null} the parsed record, or null if there is none
  */
-NotaryHash.recordFromRawTx = function (rawTx) {
+NotaryHash.recordFromRawTx = function (rawTx, vout) {
   try {
     var tx = new Transaction(Buffer.isBuffer(rawTx) ? rawTx.toString('hex') : rawTx)
+
+    // With a vout, read THAT output and no other.
+    //
+    // Scanning every output means the certificate's `anchor.vout` is decorative: it can name
+    // any index, or one past the end, and the record is still found somewhere else in the
+    // transaction. `anchor.vout` is covered by no signature, so that made it an editable
+    // field that looked authoritative. A caller verifying an anchor must read the output the
+    // certificate points at.
+    if (vout !== undefined && vout !== null) {
+      if (!Number.isInteger(vout) || vout < 0 || vout >= tx.outputs.length) {
+        return null
+      }
+      var at = tx.outputs[vout].script
+      return NotaryScript.isNotaryHash(at) ? NotaryScript.parse(at) : null
+    }
+
     for (var i = 0; i < tx.outputs.length; i++) {
       var script = tx.outputs[i].script
       if (NotaryScript.isNotaryHash(script)) {
@@ -252,9 +268,9 @@ NotaryHash.verifyAnchorSPV = function (certificate, opts) {
       errors.push('rawTx does not hash to anchor.txid')
     }
 
-    var record = NotaryHash.recordFromRawTx(spv.rawTx)
+    var record = NotaryHash.recordFromRawTx(spv.rawTx, c.anchor && c.anchor.vout)
     if (!record) {
-      errors.push('no NotaryHash record found in rawTx')
+      errors.push('no NotaryHash record at anchor.vout in rawTx')
     } else if (!NotaryHash.recordMatchesCertificate(record, c)) {
       errors.push('on-chain record does not match the certificate')
     }
@@ -349,6 +365,48 @@ NotaryHash.verifyAnchorSPV = function (certificate, opts) {
       }
     }
 
+    // The anchor's own labels must agree with what was actually proved.
+    //
+    // `anchor.blockTime` and `anchor.blockHeight` are covered by no signature and were
+    // checked by nothing, so an edited certificate verified while reporting a different time
+    // or height than the header and proof establish. A reader shown "anchored at
+    // 2026-06-23T10:06:04Z in block 954784" has no reason to doubt either number.
+    //
+    // A null is not a claim: a certificate issued before confirmation legitimately carries
+    // nulls, and only a stated value is checked.
+    var headerBuf = Buffer.isBuffer(opts.header)
+      ? opts.header
+      : Buffer.from(String(opts.header).replace(/^0x/, ''), 'hex')
+    if (headerBuf.length === 80 && c.anchor) {
+      if (c.anchor.blockTime !== undefined && c.anchor.blockTime !== null) {
+        var headerTime = headerBuf.readUInt32LE(68)
+        if (Number(c.anchor.blockTime) !== headerTime) {
+          errors.push('anchor.blockTime ' + c.anchor.blockTime +
+            ' is not the time in the block header (' + headerTime + ')')
+        }
+      }
+      if (c.anchor.blockHeight !== undefined && c.anchor.blockHeight !== null &&
+          spv.blockHeight !== undefined && spv.blockHeight !== null &&
+          Number(c.anchor.blockHeight) !== Number(spv.blockHeight)) {
+        errors.push('anchor.blockHeight ' + c.anchor.blockHeight +
+          ' does not equal spv.blockHeight ' + spv.blockHeight)
+      }
+    }
+
+    // A TSC index must be representable by the path it comes with: a path of n nodes
+    // addresses at most 2^n leaves, so a larger index describes a tree the path cannot
+    // belong to. Unchecked, the index was another unsigned field that verified while naming
+    // an impossible position.
+    var mp = spv.merkleProof
+    if (mp && Array.isArray(mp.nodes) && mp.index !== undefined && mp.index !== null) {
+      var capacity = Math.pow(2, mp.nodes.length)
+      if (!Number.isInteger(Number(mp.index)) || Number(mp.index) < 0 ||
+          Number(mp.index) >= capacity) {
+        errors.push('spv.merkleProof.index ' + mp.index + ' does not fit a path of ' +
+          mp.nodes.length + ' nodes, which addresses at most ' + capacity + ' leaves')
+      }
+    }
+
     return { valid: errors.length === 0, errors: errors }
   } catch (e) {
     return { valid: false, errors: ['anchor verification error: ' + e.message] }
@@ -408,6 +466,53 @@ function merkleFolds (c, failure) {
     var leafData = Certificate.decodeBytes(c.proofHash, 'hex', 'proofHash')
     var root = Certificate.decodeBytes(m.root, 'hex', 'merkle.root')
 
+    // `leafIndex` must agree with the sides the path carries, and this is the only place it
+    // can be checked.
+    //
+    // A sided path folds by its OWN sides, and `Certificate.normalize` returns a
+    // non-legacy certificate untouched — so for a reference certificate `leafIndex` was read
+    // and never used. It could be changed to any other value in range and the proof still
+    // verified. A legacy certificate was fine, because normalising it DERIVES the sides from
+    // `leafIndex`, so a wrong index produced a wrong fold and failed.
+    //
+    // That left `leafIndex` an unvalidated assertion sitting beside validated ones, and a
+    // reader shown "leaf 3 of 25" cannot tell which of those fields is load-bearing.
+    // `leafCount` is pinned by the on-chain `u32be` that `recordMatchesCertificate` compares;
+    // `leafIndex` appears on chain nowhere.
+    //
+    // No hashing is needed: RFC 6962 determines the side sequence from the index and the tree
+    // size, so the position the path implies is recomputed and compared in one pass.
+    //
+    // Reported by the ordinals mint anchoring BRC-220 proofs, whose tamper test caught it on
+    // moving from the legacy format to the reference one.
+    if (Number.isInteger(m.leafIndex) && Number.isInteger(m.leafCount) &&
+        m.leafCount > 0 && m.leafIndex >= 0 && m.leafIndex < m.leafCount) {
+      var implied = Merkle.pathSides(m.leafIndex, m.leafCount)
+      var carried = (m.path || []).map(function (n) {
+        return n && typeof n === 'object' && !Buffer.isBuffer(n) ? n.side : undefined
+      })
+      if (implied.length !== carried.length) {
+        return {
+          valid: false,
+          errors: ['merkle.leafIndex ' + m.leafIndex + ' in a tree of ' + m.leafCount +
+            ' leaves needs ' + implied.length + ' path nodes; the path has ' + carried.length]
+        }
+      }
+      for (var si = 0; si < implied.length; si++) {
+        // A bare-hash path carries no sides; those are derived from leafIndex when the
+        // certificate is normalised, so they agree by construction and there is nothing to
+        // cross-check.
+        if (carried[si] !== undefined && carried[si] !== implied[si]) {
+          return {
+            valid: false,
+            errors: ['merkle.leafIndex ' + m.leafIndex + ' disagrees with the path: node ' +
+              si + ' is marked "' + carried[si] + '" but leaf ' + m.leafIndex + ' of ' +
+              m.leafCount + ' requires "' + implied[si] + '"']
+          }
+        }
+      }
+    }
+
     // Folded by side, as the reference folds it. The sides are what the certificate
     // carries; a legacy bare-hash path had them derived from leafIndex and leafCount when
     // it was normalised.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "9.18.0",
+  "version": "9.20.0",
   "description": "Bitcoin SV library with an interpreter-verified script engine: OP_PUSH_TX covenants, BIP-143 preimage tooling, and consensus flags that match what miners actually enforce. Also ships DID:web / W3C VC-JWT credentials and the Legal Token Protocol.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '9.18.0'
+module.exports = '9.20.0'