@snapshot-labs/snapshot.js 0.14.11 → 0.14.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snapshot-labs/snapshot.js",
-  "version": "0.14.11",
+  "version": "0.14.12",
   "repository": "snapshot-labs/snapshot.js",
   "license": "MIT",
   "main": "dist/snapshot.cjs.js",

package/src/sign/hashedTypes.json

@@ -57,6 +57,7 @@
   "6f6cdd15a1e9e6c4ee544231c4fa7b6c7e5183bc2b37fa4bd1a695f458348ab7": "delete-space",
   "1aad7825b991457fca04aae48a2a49d815ada524e10316af0da5522ea48b3df6": "alias",
   "8ea9074bff3a30cb61f4f0f0f142c9335c6be828feba0571a45de3f1fd0319c0": "alias",
+  "23310e197cbdcd80e506c0dbdd41831c9cf91d103a3ab663b278a1944a210920": "alias",
   "42f8858a21d4aa232721cb97074851e729829ea362b88bb21f3879899663b586": "follow",
   "2bb75450e28b06f259ea764cd669de6bde0ba70ce729b0ff05ab9df56e0ff21d": "unfollow",
   "2ffbebcbd22ef48fd2f4a1182ff1feda7795b57689bd6f0dd73c89e925e7fefb": "profile",

package/src/verify/starknet.spec.ts

@@ -1,6 +1,7 @@
 import { test, expect, describe } from 'vitest';
 import starknetMessage from '../../test/fixtures/starknet/message-alias.json';
 import starknetMessageRsv from '../../test/fixtures/starknet/message-alias-rsv.json';
+import starknetMessageMultisigner from '../../test/fixtures/starknet/message-alias-multisigner.json';
 import verify, { getHash } from './starknet';
 import { validateAndParseAddress } from 'starknet';
 import { clone } from '../utils';
@@ -24,9 +25,10 @@ describe('verify/starknet', () => {
 
   describe('verify()', () => {
     describe.each([
-      ['2', starknetMessage],
-      ['3', starknetMessageRsv]
-    ])('with a %s items signature', (title, message) => {
+      ['2 items', starknetMessage, false],
+      ['3 items', starknetMessageRsv, false],
+      ['multiple signers', starknetMessageMultisigner, true]
+    ])('with a %s signature', (title, message, multisign) => {
       test('should return true if the signature is valid', () => {
         expect(
           verify(message.address, message.sig, message.data, 'SN_MAIN')
@@ -44,11 +46,19 @@ describe('verify/starknet', () => {
         ).resolves.toBe(true);
       });
 
-      test('should return true when verifying on a different network', () => {
-        expect(
-          verify(message.address, message.sig, message.data, 'SN_SEPOLIA')
-        ).resolves.toBe(true);
-      });
+      if (multisign) {
+        test('should throw an error when verifying on a different network', () => {
+          expect(
+            verify(message.address, message.sig, message.data, 'SN_SEPOLIA')
+          ).rejects.toThrowError();
+        });
+      } else {
+        test('should return true when verifying on a different network', () => {
+          expect(
+            verify(message.address, message.sig, message.data, 'SN_SEPOLIA')
+          ).resolves.toBe(true);
+        });
+      }
 
       test('should throw an error if the signature is invalid', () => {
         expect(

package/src/verify/starknet.ts

@@ -62,6 +62,38 @@ export function getHash(data: SignaturePayload, address: string): string {
   );
 }
 
+/**
+ * Processes a StarkNet signature array and returns the appropriate signature format
+ * for contract verification.
+ * Returns the r ands values for each signature in the array.
+ *
+ * Handles the following cases:
+ * - 2-item array: Standard signature, returns as-is.
+ * - 3-item array: Some wallets (e.g., Braavos) may return a 3-item array; returns the last two items.
+ * - Multi-signer array: For multisig accounts, the array may contain multiple signatures;
+ *   this function extracts the relevant signature pairs.
+ *
+ * @param {string[]} sig - The signature array to process. Must have at least 2 items.
+ * @returns {string[]} The processed signature array suitable for contract verification.
+ * @throws {Error} If the signature array has fewer than 2 items.
+ */
+function getSignatureArray(sig: string[]): string[] {
+  if (sig.length < 2) {
+    throw new Error('Invalid signature format');
+  }
+
+  if (sig.length <= 3) {
+    return sig.slice(-2);
+  }
+
+  const results: string[] = [];
+  for (let i = 1; i < sig.length; i += 4) {
+    results.push(sig[i + 2], sig[i + 3]);
+  }
+
+  return results;
+}
+
 export default async function verify(
   address: string,
   sig: string[],
@@ -76,13 +108,9 @@ export default async function verify(
       getProvider(network, options)
     );
 
-    if (sig.length < 2) {
-      throw new Error('Invalid signature format');
-    }
-
     const result = await contractAccount.is_valid_signature(
       getHash(data, address),
-      sig.slice(-2)
+      getSignatureArray(sig)
     );
 
     return BigNumber.from(result).eq(BigNumber.from('370462705988'));