edge-currency-plugins 3.11.0 → 3.13.0

package/lib/common/utxobased/info/ufo.js

@@ -63,7 +63,7 @@ const engineInfo = {
   segwit: true,
   coinType: 202,
   prefixes: {
-    messagePrefix: ['\x18Bitcoin Signed Message:\n'],
+    messagePrefix: ['\x14UFO Signed Message:\n'],
     wif: [0x9b],
     legacyXPriv: [0x0488ade4],
     legacyXPub: [0x0488b21e],

package/lib/common/utxobased/info/vertcoin.js

@@ -48,7 +48,7 @@ const currencyInfo = {
 const engineInfo = {
   serverConfigs: [
     {
-      type: 'blockbook-nownode',
+      type: 'blockbook',
       uris: ['https://vtc-wusa1.edge.app']
     }
   ],
@@ -77,6 +77,7 @@ const engineInfo = {
   segwit: true,
   coinType: 28,
   prefixes: {
+    // Vertcoin Core genuinely uses Bitcoin's magic; not an oversight.
     messagePrefix: ['\x18Bitcoin Signed Message:\n'],
     wif: [0x80],
     legacyXPriv: [0x0488ade4],

package/lib/common/utxobased/info/zcoin.js

@@ -45,7 +45,7 @@ var _commonInfo = require('./commonInfo');
  const engineInfo = {
   serverConfigs: [
     {
-      type: 'blockbook-nownode',
+      type: 'blockbook',
       uris: ['https://firo-eusa1.edge.app']
     },
     {
@@ -78,7 +78,7 @@ var _commonInfo = require('./commonInfo');
   segwit: false,
   coinType: 136,
   prefixes: {
-    messagePrefix: ['\x18Zcoin Signed Message:\n'],
+    messagePrefix: ['\x16Zcoin Signed Message:\n'],
     wif: [0xd2],
     legacyXPriv: [0x0488ade4],
     legacyXPub: [0x0488b21e],

package/lib/common/utxobased/keymanager/keymanager.js

@@ -21,6 +21,12 @@ var _undefinedIfEmptyString = require('../../../util/undefinedIfEmptyString');
 
 
 
+
+
+
+
+
+
 var _bip69 = require('./bip69');
 
 
@@ -938,14 +944,62 @@ const wifToPrivateKeyEncodingInternal = (
   }).publicKey.toString('hex')
 } exports.privateKeyEncodingToPubkey = privateKeyEncodingToPubkey;
 
- function signMessageBase64(message, privateKey) {
+/**
+ * The `segwitType` to hand `bitcoinjs-message`, or `undefined` to leave the
+ * header byte in the legacy Electrum range. Only the BIP137 encoding cares
+ * about the derivation purpose, so only it resolves one.
+ */
+function getBip137SegwitType(
+  signatureFormat,
+  format
+) {
+  if (signatureFormat !== 'bip137') return undefined
+  const purposeType = bip43PurposeNumberToTypeEnum(
+    parseInt(format.replace('bip', ''))
+  )
+  switch (purposeType) {
+    case BIP43PurposeTypeEnum.Segwit:
+      return 'p2wpkh'
+    case BIP43PurposeTypeEnum.WrappedSegwit:
+      return 'p2sh(p2wpkh)'
+    default:
+      return undefined
+  }
+}
+
+ function signMessageBase64(
+  message,
+  privateKey,
+  format,
+  coin,
+  signatureFormat = 'electrum'
+) {
   const ECPair = getECPair()
   const keyPair = ECPair.fromPrivateKey(Buffer.from(privateKey, 'hex'))
   if (keyPair.privateKey == null) {
     throw new Error('Address could not sign message')
   }
+  // BIP137 encodes the address type in the signature's header byte. Native
+  // SegWit (bip84 / P2WPKH) and nested SegWit (bip49 / P2SH-P2WPKH) each have
+  // their own header range; verifiers such as Bringin reject a SegWit address
+  // whose message was signed with a legacy (bip44) header byte. The derivation
+  // path is what tells us the script type, so no caller has to infer it from
+  // the address string. Callers opt in, since emitting a BIP137 header to a
+  // verifier that expects the legacy Electrum encoding is just as broken.
+  // The purpose lookup stays inside the BIP137 branch on purpose:
+  // `bip43PurposeNumberToTypeEnum` throws on a purpose it does not map, so
+  // computing it unconditionally would let a future `CurrencyFormat` (bip86
+  // Taproot being the obvious candidate) break the default Electrum path,
+  // which never needs it.
+  const segwitType = getBip137SegwitType(signatureFormat, format)
+  // Magic-hash the message with the coin's own prefix (e.g. "Litecoin Signed
+  // Message:\n") so the signature verifies against that coin's addresses.
+  // Every UTXO coin routes through here, not just Bitcoin.
+  const messagePrefix = _coinmapper.getCoinFromString.call(void 0, coin).prefixes.messagePrefix[0]
   return _bitcoinjsmessage2.default
-    .sign(message, keyPair.privateKey, keyPair.compressed)
+    .sign(message, keyPair.privateKey, keyPair.compressed, messagePrefix, {
+      segwitType
+    })
     .toString('base64')
 } exports.signMessageBase64 = signMessageBase64;
 

package/lib/common/utxobased/keymanager/types.js

@@ -1,6 +1,17 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});var _cleaners = require('cleaners');
 var _types = require('edge-core-js/types');
 
+/**
+ * How to encode the header byte of a signed message.
+ *  - `electrum`: the legacy format, whose header carries only the recovery id
+ *    and key compression. Every verifier understands it, but it says nothing
+ *    about the script type.
+ *  - `bip137`: additionally encodes the signing address' script type, which
+ *    verifiers such as Bringin require for SegWit addresses.
+ */
+ const asUtxoSignatureFormat = _cleaners.asValue.call(void 0, 'electrum', 'bip137'); exports.asUtxoSignatureFormat = asUtxoSignatureFormat
+
+
 
 
 
@@ -27,6 +38,22 @@ function asMaybeError(name) {
   }
 }
 
+/**
+ * The wallet cannot sign for the requested address: either it does not derive
+ * it, or the string is not an address of this chain at all. Callers get a
+ * stable `name` to branch on instead of matching against the message prose.
+ */
+ class AddressNotOwnedError extends Error {
+  constructor() {
+    super('Wallet does not own the address to sign with')
+    this.name = 'AddressNotOwnedError'
+  }
+} exports.AddressNotOwnedError = AddressNotOwnedError;
+
+ const asMaybeAddressNotOwnedError = asMaybeError(
+  'AddressNotOwnedError'
+); exports.asMaybeAddressNotOwnedError = asMaybeAddressNotOwnedError
+
  const asMaybeInsufficientFundsErrorPlus = asMaybeError(
   // Share the same name because this error type is a subtype of
   // InsufficientFundsError and therefore backwards compatible

package/lib/common/utxobased/network/Blockbook.js

@@ -177,8 +177,16 @@ var _Socket = require('./Socket');
 
 
  {
-        const value = yield { ...message }
-        deferred.resolve(value)
+        try {
+          const value = yield { ...message }
+          deferred.resolve(value)
+        } catch (error) {
+          // The socket reports a failed request (an error response, the
+          // request timeout, the socket closing) by throwing into this
+          // generator. Without this catch the deferred stays pending forever
+          // and the caller hangs instead of seeing the failure.
+          deferred.reject(error)
+        }
         return false
       }
       const generator = taskGeneratorFn()

package/lib/src/common/plugin/types.d.ts

@@ -116,7 +116,13 @@ export interface EngineInfo {
     txSpecificHandling?: (tx: TransactionData, specialTx: unknown) => TransactionData;
 }
 export interface ServerConfig {
-    type: 'blockbook-nownode';
+    /**
+     * - `blockbook`: a public Blockbook HTTP server. No credentials are sent.
+     * - `blockbook-nownode`: a NOWNodes Blockbook HTTP server. Requests carry
+     *   the `nowNodesApiKey` init option as the `api-key` header, and the
+     *   server is skipped when no key is configured.
+     */
+    type: 'blockbook' | 'blockbook-nownode';
     uris: string[];
 }
 /**

package/lib/src/common/utxobased/engine/ServerStates.d.ts

@@ -23,6 +23,11 @@ interface ServerStateConfig {
     pluginInfo: PluginInfo;
     pluginState: PluginState;
     walletInfo: SafeWalletInfo;
+    /**
+     * Upper bound on any single broadcast attempt. Defaults to the same 30
+     * seconds the socket layer uses for a request. Exposed for tests.
+     */
+    broadcastTimeoutMs?: number;
 }
 export interface ServerStates {
     setPickNextTaskCB: (callback: (uri: string) => AsyncGenerator<WsTask<unknown> | boolean>) => void;
@@ -46,5 +51,21 @@ export interface ServerStates {
     transactionSpecialQueryTask: (serverUri: string, txId: string) => WsTaskGenerator<unknown>;
     utxoListQueryTask: (serverUri: string, address: string) => WsTaskGenerator<AddressUtxosResponse>;
 }
+/**
+ * How long broadcastTx gives the first wave (our sockets and Edge's own HTTP
+ * servers) before it also sends the transaction to the NOWNodes HTTP servers.
+ * NOWNodes is a third party, so it should only see a transaction when our own
+ * infrastructure has not already carried it. A first wave that fails outright
+ * does not wait this long; the second wave fires as soon as it has all failed.
+ */
+export declare const NOWNODES_BROADCAST_DELAY_MS = 2000;
+/**
+ * Every broadcast attempt is counted toward "all attempts failed", so every
+ * attempt must settle. Sockets already expire a request after 30 seconds
+ * (Socket.ts); HTTP has no such bound of its own, and a server that accepts
+ * the connection and never answers would otherwise hold the whole broadcast
+ * open. This mirrors the socket figure.
+ */
+export declare const BROADCAST_ATTEMPT_TIMEOUT_MS = 30000;
 export declare function makeServerStates(config: ServerStateConfig): ServerStates;
 export {};

package/lib/src/common/utxobased/engine/UtxoWalletTools.d.ts

@@ -2,6 +2,7 @@ import { AddressPath, ChangePath, CurrencyFormat, PluginInfo } from '../../plugi
 import { ScriptTemplate } from '../info/scriptTemplates/types';
 import { PublicKey } from '../keymanager/cleaners';
 import { PrivateKeyEncoding } from '../keymanager/keymanager';
+import { UtxoSignatureFormat } from '../keymanager/types';
 import { CurrencyFormatKeys } from './utils';
 export interface WalletToolsConfig {
     pluginInfo: PluginInfo;
@@ -48,6 +49,7 @@ interface SignMessageArgs {
     path: AddressPath;
     message: string;
     xprivKeys: CurrencyFormatKeys;
+    signatureFormat: UtxoSignatureFormat;
 }
 export declare function makeUtxoWalletTools(config: WalletToolsConfig): UtxoWalletTools;
 export {};

package/lib/src/common/utxobased/engine/types.d.ts

@@ -23,6 +23,7 @@ export interface UtxoTxOtherParams {
 export declare type UtxoSignMessageOtherParams = ReturnType<typeof asUtxoSignMessageOtherParams>;
 export declare const asUtxoSignMessageOtherParams: import("cleaners").ObjectCleaner<{
     publicAddress: string;
+    signatureFormat: "electrum" | "bip137";
 }>;
 export declare type UtxoSpendInfoOtherParams = ReturnType<typeof asUtxoSpendInfoOtherParams>;
 export declare const asUtxoSpendInfoOtherParams: import("cleaners").ObjectCleaner<{

package/lib/src/common/utxobased/keymanager/keymanager.d.ts

@@ -1,7 +1,8 @@
 import { EdgeLog, EdgeMemo } from 'edge-core-js/types';
-import { ChangePath, FeeInfo } from '../../plugin/types';
+import { ChangePath, CurrencyFormat, FeeInfo } from '../../plugin/types';
 import { UtxoData } from '../db/types';
 import { ScriptTemplate, ScriptTemplates } from '../info/scriptTemplates/types';
+import { UtxoSignatureFormat } from './types';
 import * as utxopicker from './utxopicker';
 export declare enum BIP43PurposeTypeEnum {
     Airbitz = "airbitz",
@@ -202,7 +203,7 @@ export declare const xprivToPrivateKey: (args: XPrivToPrivateKeyArgs) => string;
 export declare function privateKeyToWIF(args: PrivateKeyToWIFArgs): string;
 export declare const wifToPrivateKeyEncoding: (args: WIFToPrivateKeyEncodingArgs) => PrivateKeyEncoding;
 export declare function privateKeyEncodingToPubkey(privateKeyEncoding: PrivateKeyEncoding): string;
-export declare function signMessageBase64(message: string, privateKey: string): string;
+export declare function signMessageBase64(message: string, privateKey: string, format: CurrencyFormat, coin: string, signatureFormat?: UtxoSignatureFormat): string;
 export declare function makeTx(args: MakeTxArgs): MakeTxReturn;
 export declare function signTx(args: SignTxArgs): Promise<SignTxReturn>;
 export {};

package/lib/src/common/utxobased/keymanager/types.d.ts

@@ -1,5 +1,15 @@
 import { Cleaner } from 'cleaners';
 import { EdgeTokenId, InsufficientFundsError } from 'edge-core-js/types';
+/**
+ * How to encode the header byte of a signed message.
+ *  - `electrum`: the legacy format, whose header carries only the recovery id
+ *    and key compression. Every verifier understands it, but it says nothing
+ *    about the script type.
+ *  - `bip137`: additionally encodes the signing address' script type, which
+ *    verifiers such as Bringin require for SegWit addresses.
+ */
+export declare const asUtxoSignatureFormat: Cleaner<"electrum" | "bip137">;
+export declare type UtxoSignatureFormat = ReturnType<typeof asUtxoSignatureFormat>;
 interface InsufficientFundsErrorOptsPlus {
     tokenId: EdgeTokenId;
     networkFee?: string;
@@ -9,5 +19,14 @@ export declare class InsufficientFundsErrorPlus extends InsufficientFundsError {
     networkFeeShortage?: string;
     constructor(opts: InsufficientFundsErrorOptsPlus);
 }
+/**
+ * The wallet cannot sign for the requested address: either it does not derive
+ * it, or the string is not an address of this chain at all. Callers get a
+ * stable `name` to branch on instead of matching against the message prose.
+ */
+export declare class AddressNotOwnedError extends Error {
+    constructor();
+}
+export declare const asMaybeAddressNotOwnedError: Cleaner<AddressNotOwnedError | undefined>;
 export declare const asMaybeInsufficientFundsErrorPlus: Cleaner<InsufficientFundsErrorPlus | undefined>;
 export {};

package/lib/test/common/utxobased/engine/ServerStates.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/test/common/utxobased/keymanager/coins/altcointestfixtures.d.ts

@@ -1,4 +1,6 @@
+import { CurrencyFormat } from '../../../../../src/common/plugin/types';
 import { AddressTypeEnum, BIP43PurposeTypeEnum, ScriptTypeEnum } from '../../../../../src/common/utxobased/keymanager/keymanager';
+import { UtxoSignatureFormat } from '../../../../../src/common/utxobased/keymanager/types';
 interface SeedToXPrivTests {
     xpriv: string;
     type: BIP43PurposeTypeEnum;
@@ -34,6 +36,9 @@ interface XPubToPubkeyTests {
 interface SignMessageTests {
     wif: string;
     message: string;
+    format: CurrencyFormat;
+    /** Omitted to exercise the default, which must stay `electrum`. */
+    signatureFormat?: UtxoSignatureFormat;
     signature: string;
 }
 interface Coin {

package/lib/test/common/utxobased/keymanager/messagePrefix.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edge-currency-plugins",
-  "version": "3.11.0",
+  "version": "3.13.0",
   "description": "Edge currency plugins to fetch and process wallet accounts, balances and transactions.",
   "homepage": "https://edge.app/",
   "repository": "https://github.com/EdgeApp/edge-currency-plugins",