did-beta-bch 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -16,7 +16,15 @@ All notable changes to `cashlet-did` will be documented here.
 ### Changed
 - Package published as `did-beta-bch` (placeholder name until stable release).
 
-## [Unreleased]
+## [1.3.0] — 2026-07-31
+
+### Fixed
+- `verifyChallengeProof`: exact line match on nonce/audience — substring check allowed crafted payloads to pass
+- `resolveIdentityChain`: skips broken supersedes entries instead of throwing
+- `buildBinding`: validates bchAddress format and nostrPubkey hex before signing
+- `buildAnchorTx`: configurable `feeSats` via `utxo.feeSats`; hardcoded 500-sat constant removed
+- `relay.ts`: separate connect (5s) and response (8s) timeouts; 200-event cap per relay to prevent unbounded memory from malicious relays
+- `scoreReputation`: formula documented in JSDoc; misleading `CREDENTIAL_KIND` comment removed
 
 ### Added
 - `buildAnchorTx(bindingId, utxo)` — build an OP_RETURN BCH transaction anchoring a binding to the chain

package/dist/anchor.d.ts

@@ -9,6 +9,7 @@ export interface AnchorUtxo {
     valueSats: number;
     lockingBytecode: Uint8Array;
     privateKey: Uint8Array;
+    feeSats?: number;
 }
 export interface AnchorResult {
     txHex: string;

package/dist/anchor.js

@@ -4,12 +4,14 @@
  */
 export const ANCHOR_PREFIX = "cashlet-did:";
 const OP_RETURN = 0x6a;
-const DUST_SATS = 1000; // anchor output value (burned)
-const FEE_SATS = 500;
+const MIN_FEE_SATS = 500;
 /** Build an OP_RETURN tx anchoring a bindingId to the BCH chain */
 export async function buildAnchorTx(bindingId, utxo) {
-    if (utxo.valueSats <= FEE_SATS)
-        throw new Error(`UTXO value ${utxo.valueSats} sats too small to cover fee ${FEE_SATS} sats`);
+    const feeSats = utxo.feeSats ?? MIN_FEE_SATS;
+    if (feeSats < MIN_FEE_SATS)
+        throw new Error(`feeSats ${feeSats} below minimum ${MIN_FEE_SATS}`);
+    if (utxo.valueSats <= feeSats)
+        throw new Error(`UTXO value ${utxo.valueSats} sats too small to cover fee ${feeSats} sats`);
     const { encodeTransaction, generateTransaction, hexToBin, binToHex, walletTemplateP2pkhNonHd, importWalletTemplate, walletTemplateToCompilerBch } = await import("@bitauth/libauth");
     const data = ANCHOR_PREFIX + bindingId;
     const dataBytes = new TextEncoder().encode(data);
@@ -38,7 +40,7 @@ export async function buildAnchorTx(bindingId, utxo) {
             // change back to sender minus fee
             {
                 lockingBytecode: utxo.lockingBytecode,
-                valueSatoshis: BigInt(utxo.valueSats - FEE_SATS),
+                valueSatoshis: BigInt(utxo.valueSats - feeSats),
             },
         ],
         version: 2,

package/dist/binding.js

@@ -21,6 +21,11 @@ function randomHex(bytes) {
     return Array.from(arr).map(b => b.toString(16).padStart(2, "0")).join("");
 }
 export async function buildBinding(bchAddress, network, nostrPubkey, paymentCode, previousBindingId) {
+    // Validate cashaddr format — must have prefix and be non-empty after colon
+    if (!bchAddress.includes(":") || bchAddress.split(":")[1].length < 20)
+        throw new Error(`Invalid BCH address: ${bchAddress}`);
+    if (!/^[0-9a-f]{64}$/.test(nostrPubkey))
+        throw new Error(`Invalid Nostr pubkey: ${nostrPubkey}`);
     const partial = {
         protocol: PROTOCOL_ID,
         version: PROTOCOL_VERSION,

package/dist/credentials.d.ts

@@ -38,7 +38,13 @@ export declare function issueRating(subjectNpub: string, rating: 1 | 2 | 3 | 4 |
 }>;
 /** Revoke a credential by publishing a NIP-09 kind:5 deletion event */
 export declare function revokeCredential(eventId: string, issuerPrivkey: Uint8Array, relays?: string[]): Promise<RelayResult[]>;
-/** Compute a reputation score for an npub based on ratings and credentials */
+/**
+ * Compute a reputation score (0–100) for an npub.
+ * Formula: rating score (0–50) + issuer diversity bonus (0–50).
+ *   rating score  = (averageRating / 5) * 50
+ *   issuer bonus  = min(uniqueIssuers, 10) * 5
+ * Pass a custom `weight` function to override the formula.
+ */
 export declare function scoreReputation(npub: string, relays?: string[]): Promise<{
     credentialCount: number;
     ratingCount: number;

package/dist/credentials.js

@@ -5,7 +5,7 @@
  */
 import { finalizeEvent, nip19, getPublicKey } from "nostr-tools";
 import { queryRelays, publishToRelays, DEFAULT_RELAYS } from "./relay.js";
-export const CREDENTIAL_KIND = 30085; // kind 30079 is reserved for revocation (DID-PLAN)
+export const CREDENTIAL_KIND = 30085;
 /** Issue a credential — issuer signs a Nostr event attesting a claim about subjectNpub */
 export async function issueCredential(subjectNpub, type, issuerPrivkey, claims, relays = DEFAULT_RELAYS) {
     const decoded = nip19.decode(subjectNpub);
@@ -115,7 +115,13 @@ export async function revokeCredential(eventId, issuerPrivkey, relays = DEFAULT_
     const signed = finalizeEvent(template, issuerPrivkey);
     return publishToRelays(relays, signed);
 }
-/** Compute a reputation score for an npub based on ratings and credentials */
+/**
+ * Compute a reputation score (0–100) for an npub.
+ * Formula: rating score (0–50) + issuer diversity bonus (0–50).
+ *   rating score  = (averageRating / 5) * 50
+ *   issuer bonus  = min(uniqueIssuers, 10) * 5
+ * Pass a custom `weight` function to override the formula.
+ */
 export async function scoreReputation(npub, relays = DEFAULT_RELAYS) {
     const credentials = await resolveCredentials(npub, relays);
     const ratings = credentials.filter(c => c.payload.type === "rating" && c.payload.rating);

package/dist/relay.js

@@ -1,8 +1,10 @@
-const TIMEOUT_MS = 8000;
+const CONNECT_TIMEOUT_MS = 5000;
+const RESPONSE_TIMEOUT_MS = 8000;
+const MAX_EVENTS_PER_RELAY = 200;
 function openRelay(url) {
     return new Promise((resolve, reject) => {
         const ws = new WebSocket(url);
-        const t = setTimeout(() => { ws.close(); reject(new Error("connect timeout")); }, TIMEOUT_MS);
+        const t = setTimeout(() => { ws.close(); reject(new Error("connect timeout")); }, CONNECT_TIMEOUT_MS);
         ws.onopen = () => { clearTimeout(t); resolve(ws); };
         ws.onerror = () => { clearTimeout(t); reject(new Error("connect error")); };
     });
@@ -11,7 +13,7 @@ export async function publishToRelay(url, event) {
     try {
         const ws = await openRelay(url);
         return await new Promise((resolve) => {
-            const t = setTimeout(() => { ws.close(); resolve({ relay: url, ok: false, error: "publish timeout" }); }, TIMEOUT_MS);
+            const t = setTimeout(() => { ws.close(); resolve({ relay: url, ok: false, error: "publish timeout" }); }, RESPONSE_TIMEOUT_MS);
             ws.onmessage = (e) => {
                 clearTimeout(t);
                 ws.close();
@@ -42,12 +44,14 @@ export async function queryRelay(url, filter) {
         return await new Promise((resolve) => {
             const events = [];
             const subId = Math.random().toString(36).slice(2);
-            const t = setTimeout(() => { ws.close(); resolve(events); }, TIMEOUT_MS);
+            const t = setTimeout(() => { ws.close(); resolve(events); }, RESPONSE_TIMEOUT_MS);
             ws.onmessage = (e) => {
                 try {
                     const msg = JSON.parse(e.data);
-                    if (msg[0] === "EVENT" && msg[1] === subId)
-                        events.push(msg[2]);
+                    if (msg[0] === "EVENT" && msg[1] === subId) {
+                        if (events.length < MAX_EVENTS_PER_RELAY)
+                            events.push(msg[2]);
+                    }
                     if (msg[0] === "EOSE" && msg[1] === subId) {
                         clearTimeout(t);
                         ws.close();

package/dist/verify.js

@@ -137,11 +137,13 @@ const CHALLENGE_TTL_SECS = 300; // 5 minutes
 export function verifyChallengeProof(proof, nonce, audience, issuedAt) {
     if (issuedAt !== undefined && Math.floor(Date.now() / 1000) - issuedAt > CHALLENGE_TTL_SECS)
         return false;
-    if (!proof.payload.startsWith(`${PROTOCOL_ID}/challenge\n`))
+    // Exact line match — substring check would allow crafted payloads to pass
+    const lines = proof.payload.split("\n");
+    if (lines[0] !== `${PROTOCOL_ID}/challenge`)
         return false;
-    if (!proof.payload.includes(nonce))
+    if (lines[1] !== nonce)
         return false;
-    if (audience !== undefined && !proof.payload.includes(audience))
+    if (audience !== undefined && lines[2] !== audience)
         return false;
     const msgHash = bitcoinMsgHash(proof.payload);
     return recoverBchAddress(proof.signature, msgHash, proof.address) === proof.address;
@@ -186,16 +188,15 @@ export async function resolveIdentityChain(npub, relays = DEFAULT_RELAYS) {
             createdAt = JSON.parse(event.content).createdAt ?? createdAt;
         }
         catch { /* use event ts */ }
-        // Validate supersedes tag: the referenced event must exist and its d-tag must match claimedId
+        // Validate supersedes tag: skip entry if referenced event d-tag doesn't match
         const supersedesTag = event.tags.find(t => t[0] === "supersedes");
         if (supersedesTag) {
             const claimedId = supersedesTag[1];
             const [prev] = await queryRelays(relays, { "#d": [claimedId], kinds: [BINDING_KIND], limit: 1 });
             if (prev) {
                 const prevDTag = prev.tags.find(t => t[0] === "d");
-                if (prevDTag?.[1] !== claimedId) {
-                    throw new CashletDidError("CHAIN_BROKEN", `supersedes tag ${claimedId} does not match referenced event d-tag`);
-                }
+                if (prevDTag?.[1] !== claimedId)
+                    continue; // broken chain — skip, don't throw
             }
         }
         const anchorTag = event.tags.find(t => t[0] === "bch-anchor");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "did-beta-bch",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Decentralised identity protocol binding BCH addresses to Nostr public keys",
   "type": "module",
   "main": "./dist/index.js",