@steemit/steem-js 1.0.19 → 1.1.0

package/dist/index.cjs

@@ -14247,7 +14247,7 @@ function recoverPubKey(curve, e, signature, i) {
         const Q = curve.recoverPubKey(msgBuffer, sigObj, i);
         return Q;
     }
-    catch (error) {
+    catch {
         // Fallback to manual implementation if elliptic's method fails
         const G = curve.g;
         // A set LSB signifies that the y-coordinate is odd
@@ -14267,7 +14267,7 @@ function recoverPubKey(curve, e, signature, i) {
         try {
             R = curve.curve.pointFromX(xHexPadded, isYOdd);
         }
-        catch (error) {
+        catch {
             // If hex string fails, try with Buffer
             const xBuffer = x.toArrayLike(Buffer, 'be', 32);
             R = curve.curve.pointFromX(xBuffer, isYOdd);
@@ -23548,18 +23548,34 @@ const verifySignature = (message, signature, publicKey) => {
         return false;
     }
 };
+// Serialize a transaction to its binary form for digest calculation.
+// Alias for transaction.toBuffer() so verifyTransaction mirrors signTransaction's
+// serialization path exactly (signTransaction calls transaction.toBuffer at line 161).
+const serializeTrx = (trx) => transaction.toBuffer(trx);
 const verifyTransaction = (transaction, publicKey) => {
     try {
         const pub = PublicKey.fromString(publicKey);
         if (!pub)
             return false;
-        const serialized = Buffer.from(JSON.stringify(transaction));
         const trx = transaction;
         if (!trx.signatures || !Array.isArray(trx.signatures))
             return false;
+        // Reconstruct the exact digest signTransaction signs over:
+        //   Buffer.concat([chain_id, transaction.toBuffer(normalizedTrx)])
+        // signatures are NOT part of the signed digest — signTransaction serializes
+        // BEFORE attaching signatures — so strip them before serializing, otherwise
+        // serializeTransaction() would emit the signatures array and change the digest.
+        const normalizedTrx = normalizeTransactionForBroadcast(trx);
+        // Build a copy without the signatures key, so serializeTransaction() does not
+        // emit the signatures array into the digest (signTransaction serializes pre-signature).
+        const trxWithoutSigs = { ...normalizedTrx };
+        delete trxWithoutSigs.signatures;
+        const chainId = getConfig().get('chain_id') || '';
+        const cid = Buffer.from(chainId, 'hex');
+        const buf = serializeTrx(trxWithoutSigs);
         return trx.signatures.some((sig) => {
             const signature = Signature.fromHex(sig);
-            return signature.verifyBuffer(serialized, pub);
+            return signature.verifyBuffer(Buffer.concat([cid, buf]), pub);
         });
     }
     catch {
@@ -23604,6 +23620,7 @@ var auth = /*#__PURE__*/Object.freeze({
     normalizeTransactionForBroadcast: normalizeTransactionForBroadcast,
     resolveAuthorityForSerialize: resolveAuthorityForSerialize,
     sanitizeAccountUpdatePayload: sanitizeAccountUpdatePayload,
+    serializeTransaction: serializeTransaction,
     sign: sign$1,
     signTransaction: signTransaction,
     toWif: toWif,
@@ -26412,7 +26429,7 @@ const steem = {
     memo,
     operations,
     utils: utils$3,
-    version: '1.0.19',
+    version: '1.1.0',
     config: {
         set: (options) => {
             // If nodes is provided, extract the first node as url for API