@steemit/steem-js 1.0.19 → 1.1.0

package/dist/index.umd.js

@@ -16982,7 +16982,7 @@
 	        const Q = curve.recoverPubKey(msgBuffer, sigObj, i);
 	        return Q;
 	    }
-	    catch (error) {
+	    catch {
 	        // Fallback to manual implementation if elliptic's method fails
 	        const G = curve.g;
 	        // A set LSB signifies that the y-coordinate is odd
@@ -17002,7 +17002,7 @@
 	        try {
 	            R = curve.curve.pointFromX(xHexPadded, isYOdd);
 	        }
-	        catch (error) {
+	        catch {
 	            // If hex string fails, try with Buffer
 	            const xBuffer = x.toArrayLike(buffer.Buffer, 'be', 32);
 	            R = curve.curve.pointFromX(xBuffer, isYOdd);
@@ -26542,18 +26542,34 @@
 	        return false;
 	    }
 	};
+	// Serialize a transaction to its binary form for digest calculation.
+	// Alias for transaction.toBuffer() so verifyTransaction mirrors signTransaction's
+	// serialization path exactly (signTransaction calls transaction.toBuffer at line 161).
+	const serializeTrx = (trx) => transaction.toBuffer(trx);
 	const verifyTransaction = (transaction, publicKey) => {
 	    try {
 	        const pub = PublicKey.fromString(publicKey);
 	        if (!pub)
 	            return false;
-	        const serialized = buffer.Buffer.from(JSON.stringify(transaction));
 	        const trx = transaction;
 	        if (!trx.signatures || !Array.isArray(trx.signatures))
 	            return false;
+	        // Reconstruct the exact digest signTransaction signs over:
+	        //   Buffer.concat([chain_id, transaction.toBuffer(normalizedTrx)])
+	        // signatures are NOT part of the signed digest — signTransaction serializes
+	        // BEFORE attaching signatures — so strip them before serializing, otherwise
+	        // serializeTransaction() would emit the signatures array and change the digest.
+	        const normalizedTrx = normalizeTransactionForBroadcast(trx);
+	        // Build a copy without the signatures key, so serializeTransaction() does not
+	        // emit the signatures array into the digest (signTransaction serializes pre-signature).
+	        const trxWithoutSigs = { ...normalizedTrx };
+	        delete trxWithoutSigs.signatures;
+	        const chainId = getConfig().get('chain_id') || '';
+	        const cid = buffer.Buffer.from(chainId, 'hex');
+	        const buf = serializeTrx(trxWithoutSigs);
 	        return trx.signatures.some((sig) => {
 	            const signature = Signature.fromHex(sig);
-	            return signature.verifyBuffer(serialized, pub);
+	            return signature.verifyBuffer(buffer.Buffer.concat([cid, buf]), pub);
 	        });
 	    }
 	    catch {
@@ -26598,6 +26614,7 @@
 		normalizeTransactionForBroadcast: normalizeTransactionForBroadcast,
 		resolveAuthorityForSerialize: resolveAuthorityForSerialize,
 		sanitizeAccountUpdatePayload: sanitizeAccountUpdatePayload,
+		serializeTransaction: serializeTransaction,
 		sign: sign$1,
 		signTransaction: signTransaction,
 		toWif: toWif,
@@ -29419,7 +29436,7 @@
 	    operations,
 	    utils: utils$n,
 	    ...crypto$1,
-	    version: '1.0.19',
+	    version: '1.1.0',
 	    config: {
 	        set: (options) => {
 	            // If nodes is provided, extract the first node as url for API