@steemit/steem-js 1.0.19 → 1.0.20

package/dist/index.js

@@ -23528,18 +23528,34 @@ const verifySignature = (message, signature, publicKey) => {
         return false;
     }
 };
+// Serialize a transaction to its binary form for digest calculation.
+// Alias for transaction.toBuffer() so verifyTransaction mirrors signTransaction's
+// serialization path exactly (signTransaction calls transaction.toBuffer at line 161).
+const serializeTrx = (trx) => transaction.toBuffer(trx);
 const verifyTransaction = (transaction, publicKey) => {
     try {
         const pub = PublicKey.fromString(publicKey);
         if (!pub)
             return false;
-        const serialized = Buffer.from(JSON.stringify(transaction));
         const trx = transaction;
         if (!trx.signatures || !Array.isArray(trx.signatures))
             return false;
+        // Reconstruct the exact digest signTransaction signs over:
+        //   Buffer.concat([chain_id, transaction.toBuffer(normalizedTrx)])
+        // signatures are NOT part of the signed digest — signTransaction serializes
+        // BEFORE attaching signatures — so strip them before serializing, otherwise
+        // serializeTransaction() would emit the signatures array and change the digest.
+        const normalizedTrx = normalizeTransactionForBroadcast(trx);
+        // Build a copy without the signatures key, so serializeTransaction() does not
+        // emit the signatures array into the digest (signTransaction serializes pre-signature).
+        const trxWithoutSigs = { ...normalizedTrx };
+        delete trxWithoutSigs.signatures;
+        const chainId = getConfig().get('chain_id') || '';
+        const cid = Buffer.from(chainId, 'hex');
+        const buf = serializeTrx(trxWithoutSigs);
         return trx.signatures.some((sig) => {
             const signature = Signature.fromHex(sig);
-            return signature.verifyBuffer(serialized, pub);
+            return signature.verifyBuffer(Buffer.concat([cid, buf]), pub);
         });
     }
     catch {
@@ -23584,6 +23600,7 @@ const auth = /*#__PURE__*/Object.freeze({
     normalizeTransactionForBroadcast: normalizeTransactionForBroadcast,
     resolveAuthorityForSerialize: resolveAuthorityForSerialize,
     sanitizeAccountUpdatePayload: sanitizeAccountUpdatePayload,
+    serializeTransaction: serializeTransaction,
     sign: sign$1,
     signTransaction: signTransaction,
     toWif: toWif,
@@ -26392,7 +26409,7 @@ const steem = {
     memo,
     operations,
     utils: utils$3,
-    version: '1.0.19',
+    version: '1.0.20',
     config: {
         set: (options) => {
             // If nodes is provided, extract the first node as url for API