@velumdotcash/sdk 2.1.0 → 2.1.1

package/dist/models/utxo.d.ts

@@ -29,7 +29,7 @@ export declare class Utxo {
      *
      * Generate a new keypair for each UTXO
      */
-    keypair, publicKey, blinding, // Use fixed value for consistency instead of randomBN()
+    keypair, publicKey, blinding, // Cryptographically secure random blinding
     index, mintAddress, // Default to Solana native SOL mint address,
     version }: {
         lightWasm: hasher.LightWasm;

package/dist/models/utxo.js

@@ -5,10 +5,22 @@
  * Based on: https://github.com/tornadocash/tornado-nova
  */
 import BN from 'bn.js';
+import nacl from 'tweetnacl';
 import { Keypair } from './keypair.js';
 import { ethers } from 'ethers';
 import { getMintAddressField } from '../utils/utils.js';
 import { PublicKey } from '@solana/web3.js';
+import { FIELD_SIZE } from '../utils/constants.js';
+/**
+ * Generate a cryptographically secure random blinding factor.
+ * Uses nacl.randomBytes() instead of Math.random() for security.
+ */
+function generateSecureBlinding() {
+    const randomBytes = nacl.randomBytes(32);
+    const randomBN = new BN(randomBytes);
+    // Reduce modulo FIELD_SIZE to ensure it's within the valid range
+    return randomBN.mod(FIELD_SIZE);
+}
 /**
  * Simplified Utxo class inspired by Tornado Cash Nova
  * Based on: https://github.com/tornadocash/tornado-nova/blob/f9264eeffe48bf5e04e19d8086ee6ec58cdf0d9e/src/utxo.js
@@ -31,7 +43,7 @@ export class Utxo {
      *
      * Generate a new keypair for each UTXO
      */
-    keypair, publicKey, blinding = new BN(Math.floor(Math.random() * 1000000000)), // Use fixed value for consistency instead of randomBN()
+    keypair, publicKey, blinding = generateSecureBlinding(), // Cryptographically secure random blinding
     index = 0, mintAddress = '11111111111111111111111111111112', // Default to Solana native SOL mint address,
     version = 'v2' }) {
         this.amount = new BN(amount.toString());

package/dist/utils/debug-logger.d.ts

@@ -76,7 +76,7 @@ export declare function installDebugCommands(): void;
  * 2. PRIVACY_CASH_DEBUG environment variable is set to 'true' or '1'
  * 3. window.PRIVACY_CASH_DEBUG is set to true, 'true', or '1'
  * 4. Running in development mode (NODE_ENV=development or localhost)
- * 5. URL contains ?privacy_cash_debug=true or ?privacy_cash_debug=1 (production feature)
+ * 5. URL contains ?privacy_cash_debug=true or ?privacy_cash_debug=1 (localhost only)
  */
 export declare function isDebugEnabled(): boolean;
 /**

package/dist/utils/debug-logger.js

@@ -30,13 +30,19 @@ function isDevelopmentMode() {
     return false;
 }
 /**
- * Check URL parameters for debug enablement (production feature)
+ * Check URL parameters for debug enablement (development only)
  * Enables via ?privacy_cash_debug=1 or ?privacy_cash_debug=true
+ * SECURITY: Only works on localhost to prevent information leakage in production
  */
 function checkUrlParamDebugEnabled() {
     if (typeof window === 'undefined' || typeof location === 'undefined') {
         return false;
     }
+    // SECURITY: Only allow URL parameter debugging on localhost
+    // This prevents attackers from enabling debug mode in production via URL manipulation
+    if (location.hostname !== 'localhost' && location.hostname !== '127.0.0.1') {
+        return false;
+    }
     // Only check once to avoid repeated URL parsing
     if (urlParamChecked) {
         return false;
@@ -162,7 +168,7 @@ export function installDebugCommands() {
             console.log(`[PRIVACY-CASH-DEBUG] Status: ${enabled ? 'ENABLED' : 'DISABLED'}`);
             console.log(`[PRIVACY-CASH-DEBUG] Verbose: ${verbose ? 'ENABLED' : 'DISABLED'}`);
             console.log(`[PRIVACY-CASH-DEBUG] Mode: ${mode}`);
-            console.log('[PRIVACY-CASH-DEBUG] To enable: window.privacyCashDebug.enable() or add ?privacy_cash_debug=1 to URL');
+            console.log('[PRIVACY-CASH-DEBUG] To enable: window.privacyCashDebug.enable() (or ?privacy_cash_debug=1 on localhost)');
             console.log('[PRIVACY-CASH-DEBUG] For verbose: window.privacyCashDebug.verbose() or set PRIVACY_CASH_VERBOSE=1');
         }
     };
@@ -179,7 +185,7 @@ if (typeof window !== 'undefined') {
  * 2. PRIVACY_CASH_DEBUG environment variable is set to 'true' or '1'
  * 3. window.PRIVACY_CASH_DEBUG is set to true, 'true', or '1'
  * 4. Running in development mode (NODE_ENV=development or localhost)
- * 5. URL contains ?privacy_cash_debug=true or ?privacy_cash_debug=1 (production feature)
+ * 5. URL contains ?privacy_cash_debug=true or ?privacy_cash_debug=1 (localhost only)
  */
 export function isDebugEnabled() {
     return debugEnabled || checkEnvDebugEnabled() || isDevelopmentMode() || checkUrlParamDebugEnabled();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velumdotcash/sdk",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "TypeScript SDK for private payments on Solana using Zero-Knowledge proofs",
   "main": "dist/index.js",
   "exports": {