@steemit/steem-js 1.0.19 → 1.0.20

package/dist/auth/index.d.ts

@@ -49,3 +49,4 @@ export declare const verifyTransaction: (transaction: unknown, publicKey: string
 export declare const getPublicKey: (privateKey: string) => string;
 export declare const getPrivateKey: (seed: string) => string;
 export declare const signTransaction: (trx: unknown, keys: string[]) => unknown;
+export { serializeTransaction } from './serializer/transaction';

package/dist/browser.esm.js

@@ -26856,18 +26856,34 @@ const verifySignature = (message, signature, publicKey) => {
         return false;
     }
 };
+// Serialize a transaction to its binary form for digest calculation.
+// Alias for transaction.toBuffer() so verifyTransaction mirrors signTransaction's
+// serialization path exactly (signTransaction calls transaction.toBuffer at line 161).
+const serializeTrx = (trx) => transaction.toBuffer(trx);
 const verifyTransaction = (transaction, publicKey) => {
     try {
         const pub = PublicKey.fromString(publicKey);
         if (!pub)
             return false;
-        const serialized = bufferExports.Buffer.from(JSON.stringify(transaction));
         const trx = transaction;
         if (!trx.signatures || !Array.isArray(trx.signatures))
             return false;
+        // Reconstruct the exact digest signTransaction signs over:
+        //   Buffer.concat([chain_id, transaction.toBuffer(normalizedTrx)])
+        // signatures are NOT part of the signed digest — signTransaction serializes
+        // BEFORE attaching signatures — so strip them before serializing, otherwise
+        // serializeTransaction() would emit the signatures array and change the digest.
+        const normalizedTrx = normalizeTransactionForBroadcast(trx);
+        // Build a copy without the signatures key, so serializeTransaction() does not
+        // emit the signatures array into the digest (signTransaction serializes pre-signature).
+        const trxWithoutSigs = { ...normalizedTrx };
+        delete trxWithoutSigs.signatures;
+        const chainId = getConfig().get('chain_id') || '';
+        const cid = bufferExports.Buffer.from(chainId, 'hex');
+        const buf = serializeTrx(trxWithoutSigs);
         return trx.signatures.some((sig) => {
             const signature = Signature.fromHex(sig);
-            return signature.verifyBuffer(serialized, pub);
+            return signature.verifyBuffer(bufferExports.Buffer.concat([cid, buf]), pub);
         });
     }
     catch {
@@ -26912,6 +26928,7 @@ const auth = /*#__PURE__*/Object.freeze({
 	normalizeTransactionForBroadcast: normalizeTransactionForBroadcast,
 	resolveAuthorityForSerialize: resolveAuthorityForSerialize,
 	sanitizeAccountUpdatePayload: sanitizeAccountUpdatePayload,
+	serializeTransaction: serializeTransaction,
 	sign: sign$1,
 	signTransaction: signTransaction,
 	toWif: toWif,
@@ -29720,7 +29737,7 @@ const steem = {
     memo,
     operations,
     utils: utils$3,
-    version: '1.0.19',
+    version: '1.0.20',
     config: {
         set: (options) => {
             // If nodes is provided, extract the first node as url for API