@xchainjs/xchain-radix 1.1.8 → 2.0.1

package/lib/index.esm.js

@@ -3558,7 +3558,7 @@ function requireBn () {
 var elliptic = {};
 
 var name = "elliptic";
-var version = "6.5.4";
+var version = "6.5.7";
 var description = "EC cryptography";
 var main = "lib/elliptic.js";
 var files = [
@@ -3740,12 +3740,15 @@ function requireUtils$1 () {
 		// Represent num in a w-NAF form
 		function getNAF(num, w, bits) {
 		  var naf = new Array(Math.max(num.bitLength(), bits) + 1);
-		  naf.fill(0);
+		  var i;
+		  for (i = 0; i < naf.length; i += 1) {
+		    naf[i] = 0;
+		  }
 
 		  var ws = 1 << (w + 1);
 		  var k = num.clone();
 
-		  for (var i = 0; i < naf.length; i++) {
+		  for (i = 0; i < naf.length; i++) {
 		    var z;
 		    var mod = k.andln(ws - 1);
 		    if (k.isOdd()) {
@@ -8553,6 +8556,10 @@ function requireSignature$1 () {
 	    return false;
 	  }
 
+	  if(buf[p.place] === 0x00) {
+	    return false;
+	  }
+
 	  var val = 0;
 	  for (var i = 0, off = p.place; i < octetLen; i++, off++) {
 	    val <<= 8;
@@ -8601,6 +8608,9 @@ function requireSignature$1 () {
 	  if (rlen === false) {
 	    return false;
 	  }
+	  if ((data[p.place] & 128) !== 0) {
+	    return false;
+	  }
 	  var r = data.slice(p.place, rlen + p.place);
 	  p.place += rlen;
 	  if (data[p.place++] !== 0x02) {
@@ -8613,6 +8623,9 @@ function requireSignature$1 () {
 	  if (data.length !== slen + p.place) {
 	    return false;
 	  }
+	  if ((data[p.place] & 128) !== 0) {
+	    return false;
+	  }
 	  var s = data.slice(p.place, slen + p.place);
 	  if (r[0] === 0) {
 	    if (r[1] & 0x80) {
@@ -9064,6 +9077,7 @@ function requireSignature () {
 	    sig = parseBytes(sig);
 
 	  if (Array.isArray(sig)) {
+	    assert(sig.length === eddsa.encodingLength * 2, 'Signature has invalid size');
 	    sig = {
 	      R: sig.slice(0, eddsa.encodingLength),
 	      S: sig.slice(eddsa.encodingLength),
@@ -9168,6 +9182,9 @@ function requireEddsa () {
 	EDDSA.prototype.verify = function verify(message, sig, pub) {
 	  message = parseBytes(message);
 	  sig = this.makeSignature(sig);
+	  if (sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()) {
+	    return false;
+	  }
 	  var key = this.keyFromPublic(pub);
 	  var h = this.hashInt(sig.Rencoded(), key.pubBytes(), message);
 	  var SG = this.g.mul(sig.S());

package/lib/index.js

@@ -3568,7 +3568,7 @@ function requireBn () {
 var elliptic = {};
 
 var name = "elliptic";
-var version = "6.5.4";
+var version = "6.5.7";
 var description = "EC cryptography";
 var main = "lib/elliptic.js";
 var files = [
@@ -3750,12 +3750,15 @@ function requireUtils$1 () {
 		// Represent num in a w-NAF form
 		function getNAF(num, w, bits) {
 		  var naf = new Array(Math.max(num.bitLength(), bits) + 1);
-		  naf.fill(0);
+		  var i;
+		  for (i = 0; i < naf.length; i += 1) {
+		    naf[i] = 0;
+		  }
 
 		  var ws = 1 << (w + 1);
 		  var k = num.clone();
 
-		  for (var i = 0; i < naf.length; i++) {
+		  for (i = 0; i < naf.length; i++) {
 		    var z;
 		    var mod = k.andln(ws - 1);
 		    if (k.isOdd()) {
@@ -8563,6 +8566,10 @@ function requireSignature$1 () {
 	    return false;
 	  }
 
+	  if(buf[p.place] === 0x00) {
+	    return false;
+	  }
+
 	  var val = 0;
 	  for (var i = 0, off = p.place; i < octetLen; i++, off++) {
 	    val <<= 8;
@@ -8611,6 +8618,9 @@ function requireSignature$1 () {
 	  if (rlen === false) {
 	    return false;
 	  }
+	  if ((data[p.place] & 128) !== 0) {
+	    return false;
+	  }
 	  var r = data.slice(p.place, rlen + p.place);
 	  p.place += rlen;
 	  if (data[p.place++] !== 0x02) {
@@ -8623,6 +8633,9 @@ function requireSignature$1 () {
 	  if (data.length !== slen + p.place) {
 	    return false;
 	  }
+	  if ((data[p.place] & 128) !== 0) {
+	    return false;
+	  }
 	  var s = data.slice(p.place, slen + p.place);
 	  if (r[0] === 0) {
 	    if (r[1] & 0x80) {
@@ -9074,6 +9087,7 @@ function requireSignature () {
 	    sig = parseBytes(sig);
 
 	  if (Array.isArray(sig)) {
+	    assert(sig.length === eddsa.encodingLength * 2, 'Signature has invalid size');
 	    sig = {
 	      R: sig.slice(0, eddsa.encodingLength),
 	      S: sig.slice(eddsa.encodingLength),
@@ -9178,6 +9192,9 @@ function requireEddsa () {
 	EDDSA.prototype.verify = function verify(message, sig, pub) {
 	  message = parseBytes(message);
 	  sig = this.makeSignature(sig);
+	  if (sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()) {
+	    return false;
+	  }
 	  var key = this.keyFromPublic(pub);
 	  var h = this.hashInt(sig.Rencoded(), key.pubBytes(), message);
 	  var SG = this.g.mul(sig.S());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xchainjs/xchain-radix",
-  "version": "1.1.8",
+  "version": "2.0.1",
   "description": "Custom Radix client and utilities used by XChainJS clients",
   "keywords": [
     "XRD",
@@ -40,9 +40,9 @@
   "dependencies": {
     "@radixdlt/babylon-gateway-api-sdk": "^1.4.1",
     "@radixdlt/radix-engine-toolkit": "^1.0.3",
-    "@xchainjs/xchain-client": "1.0.10",
-    "@xchainjs/xchain-crypto": "0.3.7",
-    "@xchainjs/xchain-util": "1.0.8",
+    "@xchainjs/xchain-client": "2.0.1",
+    "@xchainjs/xchain-crypto": "1.0.0",
+    "@xchainjs/xchain-util": "2.0.0",
     "bech32": "^2.0.0",
     "bip32": "^4.0.0",
     "bip39": "^3.1.0",