hd-wallet-wasm 2.1.1 → 2.1.2

package/dist/runtime/index.mjs

@@ -9,7 +9,7 @@
  * - Transaction building and signing
  *
  * @module hd-wallet-wasm
- * @version 2.1.1
+ * @version 2.1.2
  */
 
 // Import aligned API for batch operations
@@ -557,6 +557,59 @@ function decodeBech32Fallback(str) {
   return { hrp, data: out };
 }
 
+/** %TypedArray%.prototype.fill, captured at load (uses the internal length). */
+const TYPED_ARRAY_FILL = Object.getPrototypeOf(Uint8Array.prototype).fill;
+
+// Internal-slot getters, captured at load: they work on objects of any realm
+// and cannot be overridden by the object.
+const slotGetter = (prototype, name) => Object.getOwnPropertyDescriptor(prototype, name)?.get;
+const TYPED_ARRAY_SLOTS = ['buffer', 'byteOffset', 'byteLength']
+  .map((name) => slotGetter(Object.getPrototypeOf(Uint8Array.prototype), name));
+const DATA_VIEW_SLOTS = ['buffer', 'byteOffset', 'byteLength'].map((name) => slotGetter(DataView.prototype, name));
+const ARRAY_BUFFER_BYTE_LENGTH = slotGetter(ArrayBuffer.prototype, 'byteLength');
+const ARRAY_BUFFER_DETACHED = slotGetter(ArrayBuffer.prototype, 'detached');
+const SHARED_BUFFER_BYTE_LENGTH = typeof SharedArrayBuffer === 'function'
+  ? slotGetter(SharedArrayBuffer.prototype, 'byteLength')
+  : undefined;
+
+/**
+ * The bytes under binary data of any kind and realm: { buffer, offset,
+ * length, detached }, or null for anything that is not binary data.
+ */
+function binaryRegion(value) {
+  const read = (getters) => {
+    try {
+      const [buffer, offset, length] = getters.map((get) => get.call(value));
+      return { buffer, offset, length };
+    } catch {
+      return null;
+    }
+  };
+  let region = read(TYPED_ARRAY_SLOTS) ?? read(DATA_VIEW_SLOTS);
+  if (region === null) {
+    for (const byteLength of [ARRAY_BUFFER_BYTE_LENGTH, SHARED_BUFFER_BYTE_LENGTH]) {
+      if (!byteLength) continue;
+      try {
+        region = { buffer: value, offset: 0, length: byteLength.call(value) };
+        break;
+      } catch {
+        // Not that kind of buffer.
+      }
+    }
+  }
+  if (region === null) return null;
+  let detached = false;
+  try {
+    detached = ARRAY_BUFFER_DETACHED ? ARRAY_BUFFER_DETACHED.call(region.buffer) : false;
+  } catch {
+    detached = false;  // A SharedArrayBuffer cannot be detached.
+  }
+  return { ...region, detached };
+}
+
+/** The largest Ethereum chain ID (EIP-2294). */
+const ETH_MAX_CHAIN_ID = 9223372036854775771n;
+
 // =============================================================================
 // Memory Helpers
 // =============================================================================
@@ -565,19 +618,23 @@ function decodeBech32Fallback(str) {
  * Allocate memory and copy data
  * @param {WebAssembly.Module} wasm - WASM module
  * @param {Uint8Array} data - Data to copy
- * @returns {number} Pointer to allocated memory
+ * @returns {{ptr: number, len: number}} Heap pointer and the copied length
  */
 function allocAndCopy(wasm, data) {
   // Only binary data reaches the heap (a string or array would be coerced).
   V.bytes(data, 'data');
+  // One copy from the array's own bytes and length: the caller's `length`
+  // (a subclass getter, an own property) is never read again. Callers pass
+  // the returned `len` to native code.
+  const copy = new Uint8Array(data);
+  const len = copy.length;
   // Many C++ implementations assume pointers are non-null even when `len == 0`.
   // Allocate a 1-byte placeholder in that case to avoid passing NULL into WASM.
-  const len = data.length;
-  const allocLen = len === 0 ? 1 : len;
-  const ptr = wasm._hd_alloc(allocLen);
+  const ptr = wasm._hd_alloc(len === 0 ? 1 : len);
   if (!ptr) throw new HDWalletError(ErrorCode.OUT_OF_MEMORY);
-  if (len > 0) wasm.HEAPU8.set(data, ptr);
-  return ptr;
+  wasm.HEAPU8.set(copy, ptr);
+  copy.fill(0);
+  return { ptr, len };
 }
 
 /**
@@ -714,17 +771,10 @@ function callDynamicStringResult(wasm, invoke, options = {}) {
   }
 }
 
+// Binary data is a Uint8Array in every family: a DataView, an ArrayBuffer or
+// another typed array is refused, as everywhere else.
 function toUint8Array(data, name = 'data') {
-  if (data instanceof Uint8Array) {
-    return data;
-  }
-  if (ArrayBuffer.isView(data)) {
-    return new Uint8Array(data.buffer, data.byteOffset, data.byteLength).slice();
-  }
-  if (data instanceof ArrayBuffer) {
-    return new Uint8Array(data.slice(0));
-  }
-  throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, `${name} must be binary data`);
+  return V.bytes(data, name);
 }
 
 function curveToName(curve) {
@@ -981,7 +1031,7 @@ class HDKey {
   publicKeyUncompressed() {
     this._checkDestroyed();
     const compressed = this.publicKey();
-    const inPtr = allocAndCopy(this._wasm, compressed);
+    const { ptr: inPtr, len: inLen } = allocAndCopy(this._wasm, compressed);
     const outPtr = this._wasm._hd_alloc(65);
     try {
       const result = this._wasm._hd_curve_decompress_pubkey(inPtr, Curve.SECP256K1, outPtr, 65);
@@ -1133,11 +1183,11 @@ class HDKey {
   peerId() {
     this._checkDestroyed();
     const pubKey = this.publicKey();
-    const pubPtr = allocAndCopy(this._wasm, pubKey);
+    const { ptr: pubPtr, len: pubLen } = allocAndCopy(this._wasm, pubKey);
     const outPtr = this._wasm._hd_alloc(64);
     try {
       const result = checkLengthWithin(
-        this._wasm._hd_libp2p_peer_id(pubPtr, pubKey.length, this.curve, outPtr, 64), 1, 64);
+        this._wasm._hd_libp2p_peer_id(pubPtr, pubLen, this.curve, outPtr, 64), 1, 64);
       return readBytes(this._wasm, outPtr, result);
     } finally {
       this._wasm._hd_dealloc(pubPtr);
@@ -1152,10 +1202,10 @@ class HDKey {
   peerIdString() {
     this._checkDestroyed();
     const pubKey = this.publicKey();
-    const pubPtr = allocAndCopy(this._wasm, pubKey);
+    const { ptr: pubPtr, len: pubLen } = allocAndCopy(this._wasm, pubKey);
     const outPtr = this._wasm._hd_alloc(128);
     try {
-      const result = this._wasm._hd_libp2p_peer_id_string(pubPtr, pubKey.length, this.curve, outPtr, 128);
+      const result = this._wasm._hd_libp2p_peer_id_string(pubPtr, pubLen, this.curve, outPtr, 128);
       checkResult(result);
       return readString(this._wasm, outPtr);
     } finally {
@@ -1171,10 +1221,10 @@ class HDKey {
   ipnsHash() {
     this._checkDestroyed();
     const pubKey = this.publicKey();
-    const pubPtr = allocAndCopy(this._wasm, pubKey);
+    const { ptr: pubPtr, len: pubLen } = allocAndCopy(this._wasm, pubKey);
     const outPtr = this._wasm._hd_alloc(128);
     try {
-      const result = this._wasm._hd_libp2p_ipns_hash(pubPtr, pubKey.length, this.curve, outPtr, 128);
+      const result = this._wasm._hd_libp2p_ipns_hash(pubPtr, pubLen, this.curve, outPtr, 128);
       checkResult(result);
       return readString(this._wasm, outPtr);
     } finally {
@@ -1434,15 +1484,15 @@ function createModule(wasm) {
     fromEntropy(entropy, language = Language.ENGLISH) {
       V.bytes(entropy, 'entropy', ErrorCode.INVALID_ENTROPY_LENGTH);
       V.integer(language, 'language', 0, 0x7fffffff);
-      const entropyPtr = allocAndCopy(wasm, entropy);
+      const { ptr: entropyPtr, len: entropyLen } = allocAndCopy(wasm, entropy);
       const outputPtr = wasm._hd_alloc(1024);
       try {
-        const result = wasm._hd_entropy_to_mnemonic(entropyPtr, entropy.length, language, outputPtr, 1024);
+        const result = wasm._hd_entropy_to_mnemonic(entropyPtr, entropyLen, language, outputPtr, 1024);
         checkResult(result);
         return readString(wasm, outputPtr);
       } finally {
         // SECURITY FIX [HIGH-04]: Wipe sensitive data before deallocation
-        wasm._hd_secure_wipe(entropyPtr, entropy.length);
+        wasm._hd_secure_wipe(entropyPtr, entropyLen);
         wasm._hd_dealloc(entropyPtr);
         // Wipe mnemonic output buffer
         wasm._hd_secure_wipe(outputPtr, 1024);
@@ -1530,15 +1580,15 @@ function createModule(wasm) {
       // BIP-32 allows 128-512 bits (16-64 bytes)
       V.bytesInRange(seed, 16, 64, 'Seed', ErrorCode.INVALID_SEED);
       V.curve(curve);
-      const seedPtr = allocAndCopy(wasm, seed);
+      const { ptr: seedPtr, len: seedLen } = allocAndCopy(wasm, seed);
       try {
-        const handle = wasm._hd_key_from_seed(seedPtr, seed.length, curve);
+        const handle = wasm._hd_key_from_seed(seedPtr, seedLen, curve);
         if (!handle) {
           throw new HDWalletError(ErrorCode.INVALID_SEED);
         }
         return new HDKey(wasm, handle, 'm');
       } finally {
-        wasm._hd_secure_wipe(seedPtr, seed.length);
+        wasm._hd_secure_wipe(seedPtr, seedLen);
         wasm._hd_dealloc(seedPtr);
       }
     },
@@ -1659,7 +1709,7 @@ function createModule(wasm) {
       publicKeyFromPrivate(privateKey, curve) {
         const pubFromPrivFn = requireWasmFunction(wasm, '_hd_curve_pubkey_from_privkey');
         V.privateKey(wasm, privateKey, curve);
-        const privPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: privPtr, len: privLen } = allocAndCopy(wasm, privateKey);
         const pubPtr = wasm._hd_alloc(65);
         try {
           // Returns the key length; a private key outside 0 < d < n fails.
@@ -1667,7 +1717,7 @@ function createModule(wasm) {
           checkLength(pubFromPrivFn(privPtr, curve, pubPtr, 65), expectedLen);
           return readBytes(wasm, pubPtr, expectedLen);
         } finally {
-          wasm._hd_secure_wipe(privPtr, privateKey.length);
+          wasm._hd_secure_wipe(privPtr, privLen);
           wasm._hd_dealloc(privPtr);
           wasm._hd_dealloc(pubPtr);
         }
@@ -1702,7 +1752,7 @@ function createModule(wasm) {
         const decompressFn = requireWasmFunction(wasm, '_hd_curve_decompress_pubkey');
         // The export reads exactly 33 bytes: a valid compressed key only.
         V.publicKey(wasm, publicKey, curve, 'publicKey', [curve === Curve.P384 ? 49 : 33]);
-        const inPtr = allocAndCopy(wasm, publicKey);
+        const { ptr: inPtr, len: inLen } = allocAndCopy(wasm, publicKey);
         const outPtr = wasm._hd_alloc(97);
         try {
           // Status export: 0 on success (secp256k1 only), -Error otherwise.
@@ -1732,17 +1782,17 @@ function createModule(wasm) {
       V.curve(curve, [Curve.SECP256K1, Curve.P256, Curve.P384, Curve.X25519]);
       V.privateKey(wasm, privateKey, curve);
       V.publicKey(wasm, publicKey, curve);
-      const privPtr = allocAndCopy(wasm, privateKey);
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: privPtr, len: privLen } = allocAndCopy(wasm, privateKey);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       const secretSize = curve === Curve.P384 ? 48 : 32;
       const secretPtr = wasm._hd_alloc(secretSize);
       try {
-        const result = ecdhFn(curve, privPtr, privateKey.length, pubPtr, publicKey.length, secretPtr, secretSize);
+        const result = ecdhFn(curve, privPtr, privLen, pubPtr, pubLen, secretPtr, secretSize);
         // Returns the secret length (the curve's field size); -1 on failure.
         if (result !== secretSize) throw new HDWalletError(ErrorCode.INTERNAL, 'ECDH key exchange failed');
         return readBytes(wasm, secretPtr, secretSize);
       } finally {
-        wasm._hd_secure_wipe(privPtr, privateKey.length);
+        wasm._hd_secure_wipe(privPtr, privLen);
         wasm._hd_secure_wipe(secretPtr, secretSize);
         wasm._hd_dealloc(privPtr);
         wasm._hd_dealloc(pubPtr);
@@ -1766,12 +1816,12 @@ function createModule(wasm) {
       sign(message, privateKey) {
         V.bytes(message, 'message');
         V.privateKey(wasm, privateKey, Curve.SECP256K1);
-        const msgPtr = allocAndCopy(wasm, message);
-        const keyPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
         const sigPtr = wasm._hd_alloc(72);
         try {
           // Returns 64 (compact r||s); a private key outside 0 < d < n fails.
-          checkLength(wasm._hd_secp256k1_sign(msgPtr, message.length, keyPtr, sigPtr, 72), 64);
+          checkLength(wasm._hd_secp256k1_sign(msgPtr, msgLen, keyPtr, sigPtr, 72), 64);
           return readBytes(wasm, sigPtr, 64);
         } finally {
           wasm._hd_secure_wipe(keyPtr, 32);
@@ -1793,14 +1843,14 @@ function createModule(wasm) {
         const signRecoverableFn = requireWasmFunction(wasm, '_hd_secp256k1_sign_recoverable');
         V.bytesOfLength(message, 32, 'message hash');
         V.privateKey(wasm, privateKey, Curve.SECP256K1);
-        const msgPtr = allocAndCopy(wasm, message);
-        const keyPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
         const sigPtr = wasm._hd_alloc(65);
         try {
           // C signature: int32_t hd_secp256k1_sign_recoverable(hash, hash_len, privkey, out_sig65)
           // Returns 65 on success (bytes written), -Error on failure.
           // out_sig65 = r[32] + s[32] + v[1], recovery ID is at byte[64].
-          checkLength(signRecoverableFn(msgPtr, message.length, keyPtr, sigPtr), 65);
+          checkLength(signRecoverableFn(msgPtr, msgLen, keyPtr, sigPtr), 65);
           const recoveryId = wasm.HEAPU8[sigPtr + 64];
           if (recoveryId > 3) throw new HDWalletError(ErrorCode.INVALID_SIGNATURE);
           const signature = readBytes(wasm, sigPtr, 64);
@@ -1826,14 +1876,14 @@ function createModule(wasm) {
         V.bytes(signature, 'signature');
         V.bytes(publicKey, 'publicKey');
         // Compact r||s (64 bytes) or DER (8-72 bytes); a key of either SEC1 size.
-        if (signature.length < 8 || signature.length > 72 || !V.hasLength(publicKey, [33, 65])) {
+        if (V.byteLength(signature) < 8 || V.byteLength(signature) > 72 || !V.hasLength(publicKey, [33, 65])) {
           return false;
         }
-        const msgPtr = allocAndCopy(wasm, message);
-        const sigPtr = allocAndCopy(wasm, signature);
-        const pubPtr = allocAndCopy(wasm, publicKey);
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, signature);
+        const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
         try {
-          const result = wasm._hd_secp256k1_verify(msgPtr, message.length, sigPtr, signature.length, pubPtr, publicKey.length);
+          const result = wasm._hd_secp256k1_verify(msgPtr, msgLen, sigPtr, sigLen, pubPtr, pubLen);
           return result === 1;
         } finally {
           wasm._hd_dealloc(msgPtr);
@@ -1857,18 +1907,18 @@ function createModule(wasm) {
         if (!Number.isInteger(recoveryId) || recoveryId < 0 || recoveryId > 3) {
           throw new HDWalletError(ErrorCode.INVALID_SIGNATURE, 'recoveryId must be 0, 1, 2 or 3');
         }
-        const msgPtr = allocAndCopy(wasm, message);
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
         // Build 65-byte sig buffer: r[32] + s[32] + v[1]
         // C signature: int32_t hd_secp256k1_recover(hash, hash_len, sig65, out_pubkey33)
         const sig65 = new Uint8Array(65);
         sig65.set(signature.subarray(0, 64));
         sig65[64] = recoveryId;
-        const sigPtr = allocAndCopy(wasm, sig65);
+        const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, sig65);
         const pubPtr = wasm._hd_alloc(33);
         try {
           // Returns 33 on success; a signature no key recovers from (ids 2
           // and 3 when r + n >= p included) fails, so this throws.
-          checkLength(recoverFn(msgPtr, message.length, sigPtr, pubPtr), 33);
+          checkLength(recoverFn(msgPtr, msgLen, sigPtr, pubPtr), 33);
           return readBytes(wasm, pubPtr, 33);
         } finally {
           wasm._hd_dealloc(msgPtr);
@@ -1886,11 +1936,11 @@ function createModule(wasm) {
       ecdh(privateKey, publicKey) {
         V.privateKey(wasm, privateKey, Curve.SECP256K1);
         V.publicKey(wasm, publicKey, Curve.SECP256K1);
-        const privPtr = allocAndCopy(wasm, privateKey);
-        const pubPtr = allocAndCopy(wasm, publicKey);
+        const { ptr: privPtr, len: privLen } = allocAndCopy(wasm, privateKey);
+        const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
         const secretPtr = wasm._hd_alloc(32);
         try {
-          checkLength(wasm._hd_ecdh_secp256k1(privPtr, pubPtr, publicKey.length, secretPtr, 32), 32);
+          checkLength(wasm._hd_ecdh_secp256k1(privPtr, pubPtr, pubLen, secretPtr, 32), 32);
           return readBytes(wasm, secretPtr, 32);
         } finally {
           wasm._hd_secure_wipe(privPtr, 32);
@@ -1913,7 +1963,7 @@ function createModule(wasm) {
        */
       publicKeyFromSeed(seed) {
         V.privateKey(wasm, seed, Curve.ED25519, 'seed');
-        const seedPtr = allocAndCopy(wasm, seed);
+        const { ptr: seedPtr, len: seedLen } = allocAndCopy(wasm, seed);
         const pubPtr = wasm._hd_alloc(32);
         try {
           checkResult(wasm._hd_ed25519_pubkey_from_seed(seedPtr, pubPtr, 32));
@@ -1934,11 +1984,11 @@ function createModule(wasm) {
       sign(message, privateKey) {
         V.bytes(message, 'message');
         V.privateKey(wasm, privateKey, Curve.ED25519);
-        const msgPtr = allocAndCopy(wasm, message);
-        const keyPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
         const sigPtr = wasm._hd_alloc(64);
         try {
-          checkLength(wasm._hd_ed25519_sign(msgPtr, message.length, keyPtr, sigPtr, 64), 64);
+          checkLength(wasm._hd_ed25519_sign(msgPtr, msgLen, keyPtr, sigPtr, 64), 64);
           return readBytes(wasm, sigPtr, 64);
         } finally {
           wasm._hd_secure_wipe(keyPtr, 32);
@@ -1959,13 +2009,13 @@ function createModule(wasm) {
         V.bytes(message, 'message');
         V.bytes(signature, 'signature');
         V.bytes(publicKey, 'publicKey');
-        if (signature.length !== 64 || publicKey.length !== 32) return false;
-        const msgPtr = allocAndCopy(wasm, message);
-        const sigPtr = allocAndCopy(wasm, signature);
-        const pubPtr = allocAndCopy(wasm, publicKey);
+        if (V.byteLength(signature) !== 64 || V.byteLength(publicKey) !== 32) return false;
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, signature);
+        const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
         try {
           // RFC 8032 strict: S < L, A and R canonical and not of small order.
-          const result = wasm._hd_ed25519_verify(msgPtr, message.length, sigPtr, signature.length, pubPtr, publicKey.length);
+          const result = wasm._hd_ed25519_verify(msgPtr, msgLen, sigPtr, sigLen, pubPtr, pubLen);
           return result === 1;
         } finally {
           wasm._hd_dealloc(msgPtr);
@@ -1989,11 +2039,11 @@ function createModule(wasm) {
       sign(message, privateKey) {
         V.bytes(message, 'message');
         V.privateKey(wasm, privateKey, Curve.P256);
-        const msgPtr = allocAndCopy(wasm, message);
-        const keyPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
         const sigPtr = wasm._hd_alloc(72);
         try {
-          checkLength(wasm._hd_p256_sign(msgPtr, message.length, keyPtr, sigPtr, 72), 64);
+          checkLength(wasm._hd_p256_sign(msgPtr, msgLen, keyPtr, sigPtr, 72), 64);
           return readBytes(wasm, sigPtr, 64);
         } finally {
           wasm._hd_secure_wipe(keyPtr, 32);
@@ -2015,13 +2065,13 @@ function createModule(wasm) {
         V.bytes(message, 'message');
         V.bytes(signature, 'signature');
         // The export reads exactly 64 signature bytes and takes no length.
-        if (signature.length !== 64 || !V.isPublicKey(wasm, publicKey, Curve.P256)) return false;
-        const msgPtr = allocAndCopy(wasm, message);
-        const sigPtr = allocAndCopy(wasm, signature);
-        const pubPtr = allocAndCopy(wasm, publicKey);
+        if (V.byteLength(signature) !== 64 || !V.isPublicKey(wasm, publicKey, Curve.P256)) return false;
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, signature);
+        const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
         try {
           // C: hd_p256_verify(message, message_len, public_key, public_key_len, signature)
-          return verifyFn(msgPtr, message.length, pubPtr, publicKey.length, sigPtr) === 0;
+          return verifyFn(msgPtr, msgLen, pubPtr, pubLen, sigPtr) === 0;
         } finally {
           wasm._hd_dealloc(msgPtr);
           wasm._hd_dealloc(sigPtr);
@@ -2032,11 +2082,11 @@ function createModule(wasm) {
       ecdh(privateKey, publicKey) {
         V.privateKey(wasm, privateKey, Curve.P256);
         V.publicKey(wasm, publicKey, Curve.P256);
-        const privPtr = allocAndCopy(wasm, privateKey);
-        const pubPtr = allocAndCopy(wasm, publicKey);
+        const { ptr: privPtr, len: privLen } = allocAndCopy(wasm, privateKey);
+        const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
         const secretPtr = wasm._hd_alloc(32);
         try {
-          checkLength(wasm._hd_ecdh_p256(privPtr, pubPtr, publicKey.length, secretPtr, 32), 32);
+          checkLength(wasm._hd_ecdh_p256(privPtr, pubPtr, pubLen, secretPtr, 32), 32);
           return readBytes(wasm, secretPtr, 32);
         } finally {
           wasm._hd_secure_wipe(privPtr, 32);
@@ -2062,11 +2112,11 @@ function createModule(wasm) {
       sign(message, privateKey) {
         V.bytes(message, 'message');
         V.privateKey(wasm, privateKey, Curve.P384);
-        const msgPtr = allocAndCopy(wasm, message);
-        const keyPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
         const sigPtr = wasm._hd_alloc(104);
         try {
-          checkLength(wasm._hd_p384_sign(msgPtr, message.length, keyPtr, sigPtr, 104), 96);
+          checkLength(wasm._hd_p384_sign(msgPtr, msgLen, keyPtr, sigPtr, 104), 96);
           return readBytes(wasm, sigPtr, 96);
         } finally {
           wasm._hd_secure_wipe(keyPtr, 48);
@@ -2088,13 +2138,13 @@ function createModule(wasm) {
         V.bytes(message, 'message');
         V.bytes(signature, 'signature');
         // The export reads exactly 96 signature bytes and takes no length.
-        if (signature.length !== 96 || !V.isPublicKey(wasm, publicKey, Curve.P384)) return false;
-        const msgPtr = allocAndCopy(wasm, message);
-        const sigPtr = allocAndCopy(wasm, signature);
-        const pubPtr = allocAndCopy(wasm, publicKey);
+        if (V.byteLength(signature) !== 96 || !V.isPublicKey(wasm, publicKey, Curve.P384)) return false;
+        const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+        const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, signature);
+        const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
         try {
           // C: hd_p384_verify(message, message_len, public_key, public_key_len, signature)
-          return verifyFn(msgPtr, message.length, pubPtr, publicKey.length, sigPtr) === 0;
+          return verifyFn(msgPtr, msgLen, pubPtr, pubLen, sigPtr) === 0;
         } finally {
           wasm._hd_dealloc(msgPtr);
           wasm._hd_dealloc(sigPtr);
@@ -2105,11 +2155,11 @@ function createModule(wasm) {
       ecdh(privateKey, publicKey) {
         V.privateKey(wasm, privateKey, Curve.P384);
         V.publicKey(wasm, publicKey, Curve.P384);
-        const privPtr = allocAndCopy(wasm, privateKey);
-        const pubPtr = allocAndCopy(wasm, publicKey);
+        const { ptr: privPtr, len: privLen } = allocAndCopy(wasm, privateKey);
+        const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
         const secretPtr = wasm._hd_alloc(48);
         try {
-          checkLength(wasm._hd_ecdh_p384(privPtr, pubPtr, publicKey.length, secretPtr, 48), 48);
+          checkLength(wasm._hd_ecdh_p384(privPtr, pubPtr, pubLen, secretPtr, 48), 48);
           return readBytes(wasm, secretPtr, 48);
         } finally {
           wasm._hd_secure_wipe(privPtr, 48);
@@ -2132,7 +2182,7 @@ function createModule(wasm) {
        */
       publicKey(privateKey) {
         V.privateKey(wasm, privateKey, Curve.X25519);
-        const privPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: privPtr, len: privLen } = allocAndCopy(wasm, privateKey);
         const pubPtr = wasm._hd_alloc(32);
         try {
           checkResult(wasm._hd_x25519_pubkey(privPtr, pubPtr, 32));
@@ -2153,8 +2203,8 @@ function createModule(wasm) {
       ecdh(privateKey, publicKey) {
         V.privateKey(wasm, privateKey, Curve.X25519);
         V.publicKey(wasm, publicKey, Curve.X25519);
-        const privPtr = allocAndCopy(wasm, privateKey);
-        const pubPtr = allocAndCopy(wasm, publicKey);
+        const { ptr: privPtr, len: privLen } = allocAndCopy(wasm, privateKey);
+        const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
         const secretPtr = wasm._hd_alloc(32);
         try {
           checkResult(wasm._hd_ecdh_x25519(privPtr, pubPtr, secretPtr, 32));
@@ -2233,10 +2283,10 @@ function createModule(wasm) {
       const fn = requireWasmFunction(wasm, '_hd_coin_address_from_pubkey');
       publicKey = coinPublicKey(coinType, publicKey);
       V.oneOf(network, [Network.MAINNET, Network.TESTNET], 'network');
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       const outPtr = wasm._hd_alloc(128);
       try {
-        const result = fn(coinType, network, pubPtr, publicKey.length, outPtr, 128);
+        const result = fn(coinType, network, pubPtr, pubLen, outPtr, 128);
         checkResult(result);
         return readString(wasm, outPtr);
       } finally {
@@ -2276,20 +2326,20 @@ function createModule(wasm) {
       const fn = requireWasmFunction(wasm, '_hd_coin_sign_message');
       V.bytes(message, 'message');
       V.privateKey(wasm, privateKey, coinCurve(coinType));
-      const msgPtr = allocAndCopy(wasm, message);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const sigLenPtr = wasm._hd_alloc(4);
       // Pre-allocate enough for the largest possible signature (65 bytes for ECDSA recoverable)
       const maxSigLen = 128;
       wasm.setValue(sigLenPtr, maxSigLen, 'i32');
       const sigPtr = wasm._hd_alloc(maxSigLen);
       try {
-        const result = fn(coinType, msgPtr, message.length, keyPtr, sigPtr, sigLenPtr);
+        const result = fn(coinType, msgPtr, msgLen, keyPtr, sigPtr, sigLenPtr);
         checkResult(result);
         const actualLen = checkLengthWithin(wasm.getValue(sigLenPtr, 'i32'), 1, maxSigLen);
         return readBytes(wasm, sigPtr, actualLen);
       } finally {
-        wasm._hd_secure_wipe(keyPtr, privateKey.length);
+        wasm._hd_secure_wipe(keyPtr, keyLen);
         wasm._hd_dealloc(msgPtr);
         wasm._hd_dealloc(keyPtr);
         wasm._hd_dealloc(sigPtr);
@@ -2311,13 +2361,13 @@ function createModule(wasm) {
       V.bytes(message, 'message');
       V.bytes(signature, 'signature');
       V.bytes(publicKey, 'publicKey');
-      const msgPtr = allocAndCopy(wasm, message);
-      const sigPtr = allocAndCopy(wasm, signature);
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+      const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, signature);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       try {
         // The export takes every length: any failure (a malformed signature
         // or key included) is "not verified".
-        return fn(coinType, msgPtr, message.length, sigPtr, signature.length, pubPtr, publicKey.length) === 1;
+        return fn(coinType, msgPtr, msgLen, sigPtr, sigLen, pubPtr, pubLen) === 1;
       } finally {
         wasm._hd_dealloc(msgPtr);
         wasm._hd_dealloc(sigPtr);
@@ -2370,7 +2420,7 @@ function createModule(wasm) {
         default:
           throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'Invalid address type');
       }
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       const outPtr = wasm._hd_alloc(128);
       try {
         let fnName;
@@ -2394,7 +2444,7 @@ function createModule(wasm) {
             throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'Invalid address type');
         }
         const addressFn = requireWasmFunction(wasm, fnName);
-        const result = addressFn(pubPtr, publicKey.length, network, outPtr, 128);
+        const result = addressFn(pubPtr, pubLen, network, outPtr, 128);
         checkResult(result);
         return readString(wasm, outPtr);
       } finally {
@@ -2462,7 +2512,7 @@ function createModule(wasm) {
       const toWifFn = requireWasmFunction(wasm, '_hd_btc_to_wif');
       V.privateKey(wasm, privateKey, Curve.SECP256K1);
       V.oneOf(network, [Network.MAINNET, Network.TESTNET], 'network');
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const outPtr = wasm._hd_alloc(64);
       try {
         const result = toWifFn(keyPtr, compressed ? 1 : 0, network, outPtr, 64);
@@ -2500,7 +2550,7 @@ function createModule(wasm) {
       V.string(message, 'message');
       V.privateKey(wasm, privateKey, Curve.SECP256K1);
       const msgPtr = allocString(wasm, message);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const sigPtr = wasm._hd_alloc(65);
       try {
         const result = signFn(msgPtr, keyPtr, compressed ? 1 : 0, sigPtr, 65);
@@ -2528,12 +2578,12 @@ function createModule(wasm) {
       } catch {
         return false;
       }
-      if (sigBytes.length !== 65) return false;
+      if (V.byteLength(sigBytes) !== 65) return false;
       const msgPtr = allocString(wasm, message);
-      const sigPtr = allocAndCopy(wasm, sigBytes);
+      const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, sigBytes);
       const addrPtr = allocString(wasm, address);
       try {
-        const result = verifyFn(msgPtr, sigPtr, sigBytes.length, addrPtr, network);
+        const result = verifyFn(msgPtr, sigPtr, sigLen, addrPtr, network);
         return result === 1;
       } finally {
         wasm._hd_dealloc(msgPtr);
@@ -2556,26 +2606,28 @@ function createModule(wasm) {
             if (input === null || typeof input !== 'object') {
               throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'input must be an object');
             }
+            // Each field is read once; only these values are used below.
+            const { txid, vout, amount: amountArg, scriptType: scriptTypeArg, sequence: sequenceArg, pubkey } = input;
             // The txid: 32 bytes as 64 hex digits, in the given byte order.
-            const txidBytes = typeof input.txid === 'string' && input.txid.length === 64
-              ? hexOrNull(input.txid)
+            const txidBytes = typeof txid === 'string' && txid.length === 64
+              ? hexOrNull(txid)
               : null;
             if (txidBytes === null) {
               throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'txid must be 64 hex digits');
             }
-            V.uint32(input.vout, 'vout');
-            const amount = V.unsignedBigInt(input.amount, 'amount', 64);
-            const scriptType = input.scriptType || 0;
+            V.uint32(vout, 'vout');
+            const amount = V.unsignedBigInt(amountArg, 'amount', 64);
+            const scriptType = scriptTypeArg || 0;
             V.integer(scriptType, 'scriptType', 0, BitcoinScriptType.MULTISIG);
-            const sequence = input.sequence || 0xffffffff;
+            const sequence = sequenceArg || 0xffffffff;
             V.uint32(sequence, 'sequence');
             // The export reads a 33-byte compressed key.
-            V.publicKey(wasm, input.pubkey, Curve.SECP256K1, 'pubkey', [33]);
-            const txidPtr = allocAndCopy(wasm, txidBytes);
-            const pubPtr = allocAndCopy(wasm, input.pubkey);
+            V.publicKey(wasm, pubkey, Curve.SECP256K1, 'pubkey', [33]);
+            const { ptr: txidPtr } = allocAndCopy(wasm, txidBytes);
+            const { ptr: pubPtr } = allocAndCopy(wasm, pubkey);
             try {
               const result = addInputFn(
-                this._handle, txidPtr, input.vout,
+                this._handle, txidPtr, vout,
                 amount, scriptType,
                 pubPtr, sequence
               );
@@ -2591,6 +2643,9 @@ function createModule(wasm) {
           addOutput(address, amount, network = Network.MAINNET) {
             V.string(address, 'address');
             amount = V.unsignedBigInt(amount, 'amount', 64);
+            // The address must be of this network: a mainnet transaction never
+            // pays a testnet address, or the reverse. Regtest is not supported.
+            V.oneOf(network, [Network.MAINNET, Network.TESTNET], 'network');
             // Use address-based output helper: decode address to script internally
             const addP2wpkhFn = getWasmFunction(wasm, '_hd_btc_tx_add_p2wpkh_output');
             const addP2pkhFn = getWasmFunction(wasm, '_hd_btc_tx_add_p2pkh_output');
@@ -2610,8 +2665,14 @@ function createModule(wasm) {
                 checkResult(decResult);
                 const addrType = wasm.getValue(typePtr, 'i32');
                 const hashLen = checkLengthWithin(wasm.getValue(hashLenPtr, 'i32'), 1, 32);
-                // The P2WPKH/P2PKH helpers read a 20-byte key hash.
-                if ((addrType === 2 || addrType === 0) && hashLen !== 20) {
+                if (wasm.getValue(networkPtr, 'i32') !== network) {
+                  throw new HDWalletError(ErrorCode.INVALID_ADDRESS, 'address is not of this transaction\'s network');
+                }
+                // The native decoder types an address by witness version and
+                // program length together; each type has one payload length
+                // (the P2WPKH/P2PKH helpers read a 20-byte key hash).
+                const payloadLength = [20, 20, 20, 32, 32][addrType];
+                if (payloadLength === undefined || hashLen !== payloadLength) {
                   throw new HDWalletError(ErrorCode.INVALID_ADDRESS);
                 }
                 // P2WPKH = 2, P2PKH = 0
@@ -2640,9 +2701,9 @@ function createModule(wasm) {
                 } else {
                   throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'Unsupported address type');
                 }
-                const scriptPtr = allocAndCopy(wasm, script);
+                const { ptr: scriptPtr, len: scriptLen } = allocAndCopy(wasm, script);
                 try {
-                  const result = addOutputFn(this._handle, BigInt(amount), scriptPtr, script.length);
+                  const result = addOutputFn(this._handle, BigInt(amount), scriptPtr, scriptLen);
                   checkResult(result);
                 } finally {
                   wasm._hd_dealloc(scriptPtr);
@@ -2662,7 +2723,7 @@ function createModule(wasm) {
           sign(privateKey) {
             const signFn = requireWasmFunction(wasm, '_hd_btc_tx_sign');
             V.privateKey(wasm, privateKey, Curve.SECP256K1);
-            const keyPtr = allocAndCopy(wasm, privateKey);
+            const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
             try {
               // Sign all inputs
               for (let i = 0; i < this._inputCount; i++) {
@@ -2750,9 +2811,9 @@ function createModule(wasm) {
       parse(data) {
         const parseFn = requireWasmFunction(wasm, '_hd_btc_tx_parse');
         V.bytes(data, 'data');
-        const dataPtr = allocAndCopy(wasm, data);
+        const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
         try {
-          const handle = parseFn(dataPtr, data.length);
+          const handle = parseFn(dataPtr, dataLen);
           if (!handle) throw new HDWalletError(ErrorCode.INVALID_TRANSACTION);
           return this._makeTxObj(handle);
         } finally {
@@ -2785,7 +2846,7 @@ function createModule(wasm) {
     getAddress(publicKey) {
       const getAddressFn = requireWasmFunction(wasm, '_hd_eth_address');
       V.bytesOfLength(publicKey, [33, 64, 65], 'publicKey', ErrorCode.INVALID_PUBLIC_KEY);
-      if (publicKey.length === 64) {
+      if (V.byteLength(publicKey) === 64) {
         // Raw x || y: valid when 04 || x || y is a point.
         const sec1 = new Uint8Array(65);
         sec1[0] = 0x04;
@@ -2794,10 +2855,10 @@ function createModule(wasm) {
       } else {
         V.publicKey(wasm, publicKey, Curve.SECP256K1);
       }
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       const outPtr = wasm._hd_alloc(64);
       try {
-        const result = getAddressFn(pubPtr, publicKey.length, outPtr, 64);
+        const result = getAddressFn(pubPtr, pubLen, outPtr, 64);
         checkResult(result);
         return readString(wasm, outPtr);
       } finally {
@@ -2852,11 +2913,11 @@ function createModule(wasm) {
       const signFn = requireWasmFunction(wasm, '_hd_eth_sign_message');
       const msgBytes = ethereumMessageBytes(message);
       V.privateKey(wasm, privateKey, Curve.SECP256K1);
-      const msgPtr = allocAndCopy(wasm, msgBytes);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, msgBytes);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const sigPtr = wasm._hd_alloc(65);
       try {
-        const result = signFn(msgPtr, msgBytes.length, keyPtr, sigPtr, 65);
+        const result = signFn(msgPtr, msgLen, keyPtr, sigPtr, 65);
         checkResult(result);
         const sigBytes = readBytes(wasm, sigPtr, 65);
         return '0x' + encodeHexFallback(sigBytes);
@@ -2888,10 +2949,10 @@ function createModule(wasm) {
       // keccak256 via WASM
       function k256(data) {
         const d = data instanceof Uint8Array ? data : new TextEncoder().encode(data);
-        const dPtr = allocAndCopy(wasm, d);
+        const { ptr: dPtr, len: dLen } = allocAndCopy(wasm, d);
         const hPtr = wasm._hd_alloc(32);
         try {
-          checkLength(wasm._hd_hash_keccak256(dPtr, d.length, hPtr, 32), 32);
+          checkLength(wasm._hd_hash_keccak256(dPtr, dLen, hPtr, 32), 32);
           return readBytes(wasm, hPtr, 32);
         } finally {
           wasm._hd_dealloc(dPtr);
@@ -2983,8 +3044,8 @@ function createModule(wasm) {
       const namePtr = allocString(wasm, domain.name || '');
       const versionPtr = allocString(wasm, domain.version || '');
       const contractPtr = allocString(wasm, domain.verifyingContract || '');
-      const structHashPtr = allocAndCopy(wasm, structHash);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: structHashPtr, len: structHashLen } = allocAndCopy(wasm, structHash);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const sigPtr = wasm._hd_alloc(65);
       try {
         const result = signTypedDataFn(namePtr, versionPtr, BigInt(domain.chainId || 0), contractPtr, structHashPtr, keyPtr, sigPtr, 65);
@@ -3017,14 +3078,14 @@ function createModule(wasm) {
       const msgBytes = ethereumMessageBytes(message);
       V.string(signature, 'signature');
       const sigBytes = hexOrNull(signature);
-      if (sigBytes === null || sigBytes.length !== 65 || ![0, 1, 27, 28].includes(sigBytes[64])) {
+      if (sigBytes === null || V.byteLength(sigBytes) !== 65 || ![0, 1, 27, 28].includes(sigBytes[64])) {
         throw new HDWalletError(ErrorCode.INVALID_SIGNATURE, 'signature must be 65 bytes r || s || v with v 0, 1, 27 or 28');
       }
-      const msgPtr = allocAndCopy(wasm, msgBytes);
-      const sigPtr = allocAndCopy(wasm, sigBytes);
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, msgBytes);
+      const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, sigBytes);
       const addrPtr = wasm._hd_alloc(64);
       try {
-        const result = recoverFn(msgPtr, msgBytes.length, sigPtr, sigBytes.length, addrPtr, 64);
+        const result = recoverFn(msgPtr, msgLen, sigPtr, sigLen, addrPtr, 64);
         checkResult(result);
         return readString(wasm, addrPtr);
       } finally {
@@ -3047,10 +3108,10 @@ function createModule(wasm) {
     hashMessage(message) {
       const hashFn = requireWasmFunction(wasm, '_hd_eth_hash_message');
       const msgBytes = ethereumMessageBytes(message);
-      const msgPtr = allocAndCopy(wasm, msgBytes);
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, msgBytes);
       const hashPtr = wasm._hd_alloc(32);
       try {
-        const result = hashFn(msgPtr, msgBytes.length, hashPtr);
+        const result = hashFn(msgPtr, msgLen, hashPtr);
         checkResult(result);
         return readBytes(wasm, hashPtr, 32);
       } finally {
@@ -3067,7 +3128,7 @@ function createModule(wasm) {
           sign(privateKey) {
             const signFn = requireWasmFunction(wasm, '_hd_eth_tx_sign');
             V.privateKey(wasm, privateKey, Curve.SECP256K1);
-            const keyPtr = allocAndCopy(wasm, privateKey);
+            const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
             try {
               const result = signFn(this._handle, keyPtr);
               checkResult(result);
@@ -3116,31 +3177,54 @@ function createModule(wasm) {
         };
       },
 
-      // Validate the fields every transaction type shares. The native setters
-      // take uint64 (a 256-bit value as 32 bytes); a larger or negative number
-      // would wrap modulo 2^64, so it is refused here.
-      _commonFields(params) {
+      // Read each field of `params` once (a getter or a Uint8Array subclass
+      // could answer differently on a second read: a longer `length` put heap
+      // bytes into the signed data) and check it. The nonce and the chain ID
+      // have no defaults: a missing nonce signed nonce 0, a missing chain ID
+      // chain 1. The native setters take uint64 (a 256-bit value as 32 bytes);
+      // a larger or negative number would wrap modulo 2^64, so it is refused.
+      _readParams(params) {
         if (params === null || typeof params !== 'object') {
           throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'params must be an object');
         }
-        if (params.to !== undefined && params.to !== null && params.to !== '') V.string(params.to, 'to');
-        if (params.data !== undefined && params.data !== null) V.bytes(params.data, 'data');
-        return {
-          nonce: V.unsignedBigInt(params.nonce || 0, 'nonce', 64),
-          gasLimit: params.gasLimit === undefined ? undefined : V.unsignedBigInt(params.gasLimit, 'gasLimit', 64),
-          value: params.value === undefined ? undefined : V.unsignedBigInt(params.value, 'value', 256),
+        const {
+          nonce, chainId, gasLimit, gasPrice, maxFeePerGas, maxPriorityFeePerGas, to, value, data,
+        } = params;
+        if (nonce === undefined || nonce === null) {
+          throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'nonce is required');
+        }
+        if (chainId === undefined || chainId === null) {
+          throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'chainId is required');
+        }
+        const fields = {
+          nonce: V.unsignedBigInt(nonce, 'nonce', 64),
+          chainId: V.unsignedBigInt(chainId, 'chainId', 64),
+          gasLimit: gasLimit === undefined ? undefined : V.unsignedBigInt(gasLimit, 'gasLimit', 64),
+          gasPrice: gasPrice === undefined ? undefined : V.unsignedBigInt(gasPrice, 'gasPrice', 64),
+          maxFeePerGas,
+          maxPriorityFeePerGas,
+          to: to === undefined || to === null || to === '' ? undefined : V.string(to, 'to'),
+          value: value === undefined ? undefined : V.unsignedBigInt(value, 'value', 256),
+          // A copy made from the array's own bytes and length.
+          data: data === undefined || data === null ? undefined : new Uint8Array(V.bytes(data, 'data')),
         };
+        // EIP-2294: 1 <= chainId <= floor(MAX_UINT64 / 2) - 36, so a legacy
+        // v = 2 * chainId + 35 + recovery id fits 64 bits.
+        if (fields.chainId === 0n || fields.chainId > ETH_MAX_CHAIN_ID) {
+          throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, `chainId must be from 1 to ${ETH_MAX_CHAIN_ID}`);
+        }
+        return fields;
       },
 
-      _setCommonFields(handle, params, fields) {
+      _setCommonFields(handle, fields) {
         requireWasmFunction(wasm, '_hd_eth_tx_set_nonce')(handle, fields.nonce);
         if (fields.gasLimit !== undefined) {
           requireWasmFunction(wasm, '_hd_eth_tx_set_gas_limit')(handle, fields.gasLimit);
         }
 
-        if (params.to) {
+        if (fields.to !== undefined) {
           const setToFn = requireWasmFunction(wasm, '_hd_eth_tx_set_to_hex');
-          const toPtr = allocString(wasm, params.to);
+          const toPtr = allocString(wasm, fields.to);
           try {
             // An address that does not parse fails here. Without a recipient
             // the transaction does not serialize or sign (it would otherwise
@@ -3156,7 +3240,7 @@ function createModule(wasm) {
           const setValueFn = requireWasmFunction(wasm, '_hd_eth_tx_set_value_256');
           const valueBytes = new Uint8Array(32);
           for (let i = 31, v = fields.value; i >= 0 && v > 0n; i--, v >>= 8n) valueBytes[i] = Number(v & 0xffn);
-          const valuePtr = allocAndCopy(wasm, valueBytes);
+          const { ptr: valuePtr, len: valueLen } = allocAndCopy(wasm, valueBytes);
           try {
             setValueFn(handle, valuePtr);
           } finally {
@@ -3164,31 +3248,32 @@ function createModule(wasm) {
           }
         }
 
-        if (params.data) {
+        if (fields.data !== undefined) {
           const setDataFn = requireWasmFunction(wasm, '_hd_eth_tx_set_data');
-          const dataPtr = allocAndCopy(wasm, params.data);
+          const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, fields.data);
           try {
-            setDataFn(handle, dataPtr, params.data.length);
+            setDataFn(handle, dataPtr, dataLen);
           } finally {
             wasm._hd_dealloc(dataPtr);
           }
         }
       },
 
+      // EIP-1559 transaction. nonce, chainId (>= 1), gasLimit, maxFeePerGas
+      // and maxPriorityFeePerGas are required.
       createEIP1559(params) {
         const createFn = requireWasmFunction(wasm, '_hd_eth_tx_create_eip1559');
-        const fields = this._commonFields(params);
+        const fields = this._readParams(params);
         if (fields.gasLimit === undefined) {
           throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'gasLimit is required');
         }
-        const chainId = V.unsignedBigInt(params.chainId, 'chainId', 64);
-        const maxPriorityFeePerGas = V.unsignedBigInt(params.maxPriorityFeePerGas, 'maxPriorityFeePerGas', 64);
-        const maxFeePerGas = V.unsignedBigInt(params.maxFeePerGas, 'maxFeePerGas', 64);
-        const handle = createFn(chainId, maxPriorityFeePerGas, maxFeePerGas);
+        const maxPriorityFeePerGas = V.unsignedBigInt(fields.maxPriorityFeePerGas, 'maxPriorityFeePerGas', 64);
+        const maxFeePerGas = V.unsignedBigInt(fields.maxFeePerGas, 'maxFeePerGas', 64);
+        const handle = createFn(fields.chainId, maxPriorityFeePerGas, maxFeePerGas);
         if (!handle) throw new HDWalletError(ErrorCode.NOT_SUPPORTED);
 
         try {
-          this._setCommonFields(handle, params, fields);
+          this._setCommonFields(handle, fields);
         } catch (error) {
           requireWasmFunction(wasm, '_hd_eth_tx_destroy')(handle);
           throw error;
@@ -3197,19 +3282,18 @@ function createModule(wasm) {
         return this._makeTxObj(handle);
       },
 
-      // Legacy (EIP-155) transaction. Before 2.1.1 every field but chainId was
-      // ignored, so the declared to/value/gasPrice never reached the signed bytes.
+      // Legacy (EIP-155) transaction. nonce and chainId (>= 1) are required.
+      // Before 2.1.1 every field but chainId was ignored, so the declared
+      // to/value/gasPrice never reached the signed bytes.
       create(params = {}) {
         const createFn = requireWasmFunction(wasm, '_hd_eth_tx_create');
-        const fields = this._commonFields(params);
-        const chainId = V.unsignedBigInt(params.chainId || 1, 'chainId', 64);
-        const gasPrice = params.gasPrice === undefined ? undefined : V.unsignedBigInt(params.gasPrice, 'gasPrice', 64);
-        const handle = createFn(chainId);
+        const fields = this._readParams(params);
+        const handle = createFn(fields.chainId);
         if (!handle) throw new HDWalletError(ErrorCode.NOT_SUPPORTED);
 
         try {
-          if (gasPrice !== undefined) requireWasmFunction(wasm, '_hd_eth_tx_set_gas_price')(handle, gasPrice);
-          this._setCommonFields(handle, params, fields);
+          if (fields.gasPrice !== undefined) requireWasmFunction(wasm, '_hd_eth_tx_set_gas_price')(handle, fields.gasPrice);
+          this._setCommonFields(handle, fields);
         } catch (error) {
           requireWasmFunction(wasm, '_hd_eth_tx_destroy')(handle);
           throw error;
@@ -3221,9 +3305,9 @@ function createModule(wasm) {
       parse(data) {
         const parseFn = requireWasmFunction(wasm, '_hd_eth_tx_parse');
         V.bytes(data, 'data');
-        const dataPtr = allocAndCopy(wasm, data);
+        const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
         try {
-          const handle = parseFn(dataPtr, data.length);
+          const handle = parseFn(dataPtr, dataLen);
           if (!handle) throw new HDWalletError(ErrorCode.INVALID_TRANSACTION);
           return this._makeTxObj(handle);
         } finally {
@@ -3246,11 +3330,11 @@ function createModule(wasm) {
       const getAddressFn = requireWasmFunction(wasm, '_hd_cosmos_address');
       V.publicKey(wasm, publicKey, Curve.SECP256K1, 'publicKey', [33]);
       V.string(prefix, 'prefix');
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       const prefixPtr = allocString(wasm, prefix);
       const outPtr = wasm._hd_alloc(128);
       try {
-        const result = getAddressFn(pubPtr, publicKey.length, prefixPtr, outPtr, 128);
+        const result = getAddressFn(pubPtr, pubLen, prefixPtr, outPtr, 128);
         checkResult(result);
         return readString(wasm, outPtr);
       } finally {
@@ -3301,11 +3385,11 @@ function createModule(wasm) {
       const jsonStr = JSON.stringify(doc);
       const enc = new TextEncoder();
       const docBytes = enc.encode(jsonStr);
-      const docPtr = allocAndCopy(wasm, docBytes);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: docPtr, len: docLen } = allocAndCopy(wasm, docBytes);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const sigPtr = wasm._hd_alloc(64);
       try {
-        const result = signAminoFn(docPtr, docBytes.length, keyPtr, sigPtr, 64);
+        const result = signAminoFn(docPtr, docLen, keyPtr, sigPtr, 64);
         checkResult(result);
         return readBytes(wasm, sigPtr, 64);
       } finally {
@@ -3324,11 +3408,11 @@ function createModule(wasm) {
         const [signDocBytes, privateKey] = args;
         V.bytes(signDocBytes, 'signDocBytes');
         V.privateKey(wasm, privateKey, Curve.SECP256K1);
-        const docPtr = allocAndCopy(wasm, signDocBytes);
-        const keyPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: docPtr, len: docLen } = allocAndCopy(wasm, signDocBytes);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
         const sigPtr = wasm._hd_alloc(64);
         try {
-          const result = signDirectFn(docPtr, signDocBytes.length, keyPtr, sigPtr, 64);
+          const result = signDirectFn(docPtr, docLen, keyPtr, sigPtr, 64);
           checkResult(result);
           return readBytes(wasm, sigPtr, 64);
         } finally {
@@ -3342,9 +3426,10 @@ function createModule(wasm) {
         if (args.length !== 5) {
           throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'signDirect takes (signDocBytes, privateKey) or (bodyBytes, authInfoBytes, chainId, accountNumber, privateKey)');
         }
-        const [bodyBytes, authInfoBytes, chainId, accountNumber, privateKey] = args;
-        V.bytes(bodyBytes, 'bodyBytes');
-        V.bytes(authInfoBytes, 'authInfoBytes');
+        const [bodyArg, authInfoArg, chainId, accountNumber, privateKey] = args;
+        // Copies read once: the lengths below size the SignDoc.
+        const bodyBytes = V.snapshot(bodyArg, 'bodyBytes');
+        const authInfoBytes = V.snapshot(authInfoArg, 'authInfoBytes');
         V.string(chainId, 'chainId');
         V.unsignedBigInt(accountNumber, 'accountNumber', 64);
         V.privateKey(wasm, privateKey, Curve.SECP256K1);
@@ -3366,11 +3451,11 @@ function createModule(wasm) {
         for (let i = 0; i < 8; i++) {
           signDoc[off + i] = Number((accNum >> BigInt(i * 8)) & 0xFFn);
         }
-        const docPtr = allocAndCopy(wasm, signDoc);
-        const keyPtr = allocAndCopy(wasm, privateKey);
+        const { ptr: docPtr, len: docLen } = allocAndCopy(wasm, signDoc);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
         const sigPtr = wasm._hd_alloc(64);
         try {
-          const result = signDirectFn(docPtr, signDoc.length, keyPtr, sigPtr, 64);
+          const result = signDirectFn(docPtr, docLen, keyPtr, sigPtr, 64);
           checkResult(result);
           return readBytes(wasm, sigPtr, 64);
         } finally {
@@ -3387,12 +3472,12 @@ function createModule(wasm) {
       V.bytes(message, 'message');
       V.bytes(signature, 'signature');
       V.bytes(publicKey, 'publicKey');
-      if (signature.length !== 64 || publicKey.length !== 33) return false;
-      const msgPtr = allocAndCopy(wasm, message);
-      const sigPtr = allocAndCopy(wasm, signature);
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      if (V.byteLength(signature) !== 64 || V.byteLength(publicKey) !== 33) return false;
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+      const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, signature);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       try {
-        return verifyFn(msgPtr, message.length, sigPtr, signature.length, pubPtr, publicKey.length) === 1;
+        return verifyFn(msgPtr, msgLen, sigPtr, sigLen, pubPtr, pubLen) === 1;
       } finally {
         wasm._hd_dealloc(msgPtr);
         wasm._hd_dealloc(sigPtr);
@@ -3418,10 +3503,10 @@ function createModule(wasm) {
       const getAddressFn = requireWasmFunction(wasm, '_hd_sol_address');
       // Any 32 bytes: Solana addresses include off-curve program addresses.
       V.bytesOfLength(publicKey, 32, 'publicKey', ErrorCode.INVALID_PUBLIC_KEY);
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       const outPtr = wasm._hd_alloc(64);
       try {
-        const result = getAddressFn(pubPtr, publicKey.length, outPtr, 64);
+        const result = getAddressFn(pubPtr, pubLen, outPtr, 64);
         checkResult(result);
         return readString(wasm, outPtr);
       } finally {
@@ -3445,11 +3530,11 @@ function createModule(wasm) {
       const signFn = requireWasmFunction(wasm, '_hd_sol_sign_message');
       V.bytes(message, 'message');
       V.privateKey(wasm, privateKey, Curve.ED25519);
-      const msgPtr = allocAndCopy(wasm, message);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const sigPtr = wasm._hd_alloc(64);
       try {
-        const result = signFn(msgPtr, message.length, keyPtr, sigPtr, 64);
+        const result = signFn(msgPtr, msgLen, keyPtr, sigPtr, 64);
         checkResult(result);
         return readBytes(wasm, sigPtr, 64);
       } finally {
@@ -3465,12 +3550,12 @@ function createModule(wasm) {
       V.bytes(message, 'message');
       V.bytes(signature, 'signature');
       V.bytes(publicKey, 'publicKey');
-      if (signature.length !== 64 || publicKey.length !== 32) return false;
-      const msgPtr = allocAndCopy(wasm, message);
-      const sigPtr = allocAndCopy(wasm, signature);
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      if (V.byteLength(signature) !== 64 || V.byteLength(publicKey) !== 32) return false;
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+      const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, signature);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       try {
-        return verifyFn(msgPtr, message.length, sigPtr, signature.length, pubPtr, publicKey.length) === 1;
+        return verifyFn(msgPtr, msgLen, sigPtr, sigLen, pubPtr, pubLen) === 1;
       } finally {
         wasm._hd_dealloc(msgPtr);
         wasm._hd_dealloc(sigPtr);
@@ -3495,7 +3580,7 @@ function createModule(wasm) {
     derivePubkey(privateKey) {
       const fn = requireWasmFunction(wasm, '_hd_sol_derive_pubkey');
       V.privateKey(wasm, privateKey, Curve.ED25519);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const outPtr = wasm._hd_alloc(32);
       try {
         const result = fn(keyPtr, outPtr, 32);
@@ -3513,25 +3598,31 @@ function createModule(wasm) {
       // The export reads a 32-byte program id; Solana allows up to 16 seeds
       // of up to 32 bytes.
       V.bytesOfLength(programId, 32, 'programId', ErrorCode.INVALID_PUBLIC_KEY);
-      if (!Array.isArray(seeds) || seeds.length > 16) {
+      // The array and each seed are read once (an array or a Proxy could
+      // answer a second read differently): the copies' lengths go to the heap.
+      const count = Array.isArray(seeds) ? seeds.length : -1;
+      if (!Number.isInteger(count) || count < 0 || count > 16) {
         throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'seeds must be an array of at most 16 seeds');
       }
-      for (const seed of seeds) V.bytesInRange(seed, 0, 32, 'seed');
-      const progPtr = allocAndCopy(wasm, programId);
+      const seedCopies = [];
+      for (let i = 0; i < count; i++) {
+        seedCopies.push(V.snapshot(V.bytesInRange(seeds[i], 0, 32, 'seed'), 'seed'));
+      }
+      const { ptr: progPtr } = allocAndCopy(wasm, programId);
       let totalLen = 0;
-      for (const s of seeds) totalLen += s.length;
+      for (const s of seedCopies) totalLen += s.length;
       const flatSeeds = new Uint8Array(totalLen);
       let off = 0;
-      for (const s of seeds) { flatSeeds.set(s, off); off += s.length; }
-      const seedsPtr = totalLen > 0 ? allocAndCopy(wasm, flatSeeds) : 0;
-      const seedLensPtr = wasm._hd_alloc(seeds.length * 4);
-      for (let i = 0; i < seeds.length; i++) {
-        wasm.setValue(seedLensPtr + i * 4, seeds[i].length, 'i32');
+      for (const s of seedCopies) { flatSeeds.set(s, off); off += s.length; }
+      const { ptr: seedsPtr } = totalLen > 0 ? allocAndCopy(wasm, flatSeeds) : { ptr: 0 };
+      const seedLensPtr = wasm._hd_alloc(seedCopies.length * 4);
+      for (let i = 0; i < seedCopies.length; i++) {
+        wasm.setValue(seedLensPtr + i * 4, seedCopies[i].length, 'i32');
       }
       const addrPtr = wasm._hd_alloc(64);
       const bumpPtr = wasm._hd_alloc(1);
       try {
-        const result = fn(progPtr, seedsPtr || 0, totalLen, seedLensPtr, seeds.length, addrPtr, 64, bumpPtr);
+        const result = fn(progPtr, seedsPtr || 0, totalLen, seedLensPtr, seedCopies.length, addrPtr, 64, bumpPtr);
         checkResult(result);
         return {
           address: readString(wasm, addrPtr),
@@ -3576,10 +3667,10 @@ function createModule(wasm) {
       const getAddressFn = requireWasmFunction(wasm, '_hd_dot_address');
       V.bytesOfLength(publicKey, 32, 'publicKey', ErrorCode.INVALID_PUBLIC_KEY);
       V.integer(ss58Prefix, 'ss58Prefix', 0, 16383);
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       const outPtr = wasm._hd_alloc(64);
       try {
-        const result = getAddressFn(pubPtr, publicKey.length, ss58Prefix, outPtr, 64);
+        const result = getAddressFn(pubPtr, pubLen, ss58Prefix, outPtr, 64);
         checkResult(result);
         return readString(wasm, outPtr);
       } finally {
@@ -3637,7 +3728,7 @@ function createModule(wasm) {
     derivePubkey(privateKey) {
       const fn = requireWasmFunction(wasm, '_hd_dot_derive_pubkey');
       V.privateKey(wasm, privateKey, Curve.ED25519);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const outPtr = wasm._hd_alloc(32);
       try {
         const result = fn(keyPtr, outPtr, 32);
@@ -3654,11 +3745,11 @@ function createModule(wasm) {
       const signFn = requireWasmFunction(wasm, '_hd_dot_sign_message');
       V.bytes(message, 'message');
       V.privateKey(wasm, privateKey, Curve.ED25519);
-      const msgPtr = allocAndCopy(wasm, message);
-      const keyPtr = allocAndCopy(wasm, privateKey);
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, privateKey);
       const sigPtr = wasm._hd_alloc(64);
       try {
-        const result = signFn(msgPtr, message.length, keyPtr, sigPtr, 64);
+        const result = signFn(msgPtr, msgLen, keyPtr, sigPtr, 64);
         checkResult(result);
         return readBytes(wasm, sigPtr, 64);
       } finally {
@@ -3674,12 +3765,12 @@ function createModule(wasm) {
       V.bytes(message, 'message');
       V.bytes(signature, 'signature');
       V.bytes(publicKey, 'publicKey');
-      if (signature.length !== 64 || publicKey.length !== 32) return false;
-      const msgPtr = allocAndCopy(wasm, message);
-      const sigPtr = allocAndCopy(wasm, signature);
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      if (V.byteLength(signature) !== 64 || V.byteLength(publicKey) !== 32) return false;
+      const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
+      const { ptr: sigPtr, len: sigLen } = allocAndCopy(wasm, signature);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       try {
-        return verifyFn(msgPtr, message.length, sigPtr, signature.length, pubPtr, publicKey.length) === 1;
+        return verifyFn(msgPtr, msgLen, sigPtr, sigLen, pubPtr, pubLen) === 1;
       } finally {
         wasm._hd_dealloc(msgPtr);
         wasm._hd_dealloc(sigPtr);
@@ -3775,10 +3866,10 @@ function createModule(wasm) {
 
           async signTransaction(path, transaction) {
             const pathPtr = allocString(wasm, path);
-            const txPtr = allocAndCopy(wasm, transaction);
+            const { ptr: txPtr, len: txLen } = allocAndCopy(wasm, transaction);
             const sigPtr = wasm._hd_alloc(128);
             try {
-              const result = wasm._hd_hw_sign_transaction(this._handle, pathPtr, txPtr, transaction.length, sigPtr, 128);
+              const result = wasm._hd_hw_sign_transaction(this._handle, pathPtr, txPtr, txLen, sigPtr, 128);
               checkResult(result);
               return readBytes(wasm, sigPtr, 64);
             } finally {
@@ -3843,13 +3934,13 @@ function createModule(wasm) {
         addWallet(seed, name) {
           const addWalletFn = getWasmFunction(wasm, '_hd_keyring_add_wallet');
           if (!addWalletFn) return '';
-          const seedPtr = allocAndCopy(wasm, seed);
+          const { ptr: seedPtr, len: seedLen } = allocAndCopy(wasm, seed);
           const namePtr = name ? allocString(wasm, name) : 0;
           try {
-            const ptr = addWalletFn(this._handle, seedPtr, seed.length, namePtr);
+            const ptr = addWalletFn(this._handle, seedPtr, seedLen, namePtr);
             return readString(wasm, ptr);
           } finally {
-            wasm._hd_secure_wipe(seedPtr, seed.length);
+            wasm._hd_secure_wipe(seedPtr, seedLen);
             wasm._hd_dealloc(seedPtr);
             if (namePtr) wasm._hd_dealloc(namePtr);
           }
@@ -3887,10 +3978,10 @@ function createModule(wasm) {
           const signTransactionFn = requireWasmFunction(wasm, '_hd_keyring_sign_transaction', ErrorCode.NOT_SUPPORTED, 'Keyring is not available in the WASM build');
           const idPtr = allocString(wasm, walletId);
           const pathPtr = allocString(wasm, path);
-          const txPtr = allocAndCopy(wasm, transaction);
+          const { ptr: txPtr, len: txLen } = allocAndCopy(wasm, transaction);
           const sigPtr = wasm._hd_alloc(128);
           try {
-            const result = signTransactionFn(this._handle, idPtr, pathPtr, txPtr, transaction.length, sigPtr, 128);
+            const result = signTransactionFn(this._handle, idPtr, pathPtr, txPtr, txLen, sigPtr, 128);
             checkResult(result);
             return readBytes(wasm, sigPtr, 64);
           } finally {
@@ -3905,10 +3996,10 @@ function createModule(wasm) {
           const signMessageFn = requireWasmFunction(wasm, '_hd_keyring_sign_message', ErrorCode.NOT_SUPPORTED, 'Keyring is not available in the WASM build');
           const idPtr = allocString(wasm, walletId);
           const pathPtr = allocString(wasm, path);
-          const msgPtr = allocAndCopy(wasm, message);
+          const { ptr: msgPtr, len: msgLen } = allocAndCopy(wasm, message);
           const sigPtr = wasm._hd_alloc(128);
           try {
-            const result = signMessageFn(this._handle, idPtr, pathPtr, msgPtr, message.length, sigPtr, 128);
+            const result = signMessageFn(this._handle, idPtr, pathPtr, msgPtr, msgLen, sigPtr, 128);
             checkResult(result);
             return readBytes(wasm, sigPtr, 64);
           } finally {
@@ -3943,10 +4034,10 @@ function createModule(wasm) {
   const utils = {
     // Hashing
     sha256(data) {
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       const hashPtr = wasm._hd_alloc(32);
       try {
-        checkLength(wasm._hd_hash_sha256(dataPtr, data.length, hashPtr, 32), 32);
+        checkLength(wasm._hd_hash_sha256(dataPtr, dataLen, hashPtr, 32), 32);
         return readBytes(wasm, hashPtr, 32);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -3955,10 +4046,10 @@ function createModule(wasm) {
     },
 
     sha512(data) {
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       const hashPtr = wasm._hd_alloc(64);
       try {
-        checkLength(wasm._hd_hash_sha512(dataPtr, data.length, hashPtr, 64), 64);
+        checkLength(wasm._hd_hash_sha512(dataPtr, dataLen, hashPtr, 64), 64);
         return readBytes(wasm, hashPtr, 64);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -3967,10 +4058,10 @@ function createModule(wasm) {
     },
 
     keccak256(data) {
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       const hashPtr = wasm._hd_alloc(32);
       try {
-        checkLength(wasm._hd_hash_keccak256(dataPtr, data.length, hashPtr, 32), 32);
+        checkLength(wasm._hd_hash_keccak256(dataPtr, dataLen, hashPtr, 32), 32);
         return readBytes(wasm, hashPtr, 32);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -3979,10 +4070,10 @@ function createModule(wasm) {
     },
 
     ripemd160(data) {
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       const hashPtr = wasm._hd_alloc(20);
       try {
-        checkLength(wasm._hd_hash_ripemd160(dataPtr, data.length, hashPtr, 20), 20);
+        checkLength(wasm._hd_hash_ripemd160(dataPtr, dataLen, hashPtr, 20), 20);
         return readBytes(wasm, hashPtr, 20);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -3991,10 +4082,10 @@ function createModule(wasm) {
     },
 
     hash160(data) {
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       const hashPtr = wasm._hd_alloc(20);
       try {
-        checkLength(wasm._hd_hash_hash160(dataPtr, data.length, hashPtr, 20), 20);
+        checkLength(wasm._hd_hash_hash160(dataPtr, dataLen, hashPtr, 20), 20);
         return readBytes(wasm, hashPtr, 20);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -4005,10 +4096,10 @@ function createModule(wasm) {
     blake2b(data, outputLength = 32) {
       // The export checks the size against its 64-byte buffer.
       V.integer(outputLength, 'outputLength', 0, 0x7fffffff);
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       const hashPtr = wasm._hd_alloc(64);
       try {
-        checkLength(wasm._hd_hash_blake2b(dataPtr, data.length, hashPtr, 64, outputLength), outputLength);
+        checkLength(wasm._hd_hash_blake2b(dataPtr, dataLen, hashPtr, 64, outputLength), outputLength);
         return readBytes(wasm, hashPtr, outputLength);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -4019,10 +4110,10 @@ function createModule(wasm) {
     blake2s(data, outputLength = 32) {
       // The export checks the size against its 32-byte buffer.
       V.integer(outputLength, 'outputLength', 0, 0x7fffffff);
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       const hashPtr = wasm._hd_alloc(32);
       try {
-        checkLength(wasm._hd_hash_blake2s(dataPtr, data.length, hashPtr, 32, outputLength), outputLength);
+        checkLength(wasm._hd_hash_blake2s(dataPtr, dataLen, hashPtr, 32, outputLength), outputLength);
         return readBytes(wasm, hashPtr, outputLength);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -4037,15 +4128,15 @@ function createModule(wasm) {
       V.bytes(info, 'info');
       // The export refuses more than 255 blocks of output.
       V.integer(length, 'length', 1, 0x3fffffff);
-      const ikmPtr = allocAndCopy(wasm, ikm);
-      const saltPtr = allocAndCopy(wasm, salt);
-      const infoPtr = allocAndCopy(wasm, info);
+      const { ptr: ikmPtr, len: ikmLen } = allocAndCopy(wasm, ikm);
+      const { ptr: saltPtr, len: saltLen } = allocAndCopy(wasm, salt);
+      const { ptr: infoPtr, len: infoLen } = allocAndCopy(wasm, info);
       const outPtr = wasm._hd_alloc(length);
       try {
-        checkLength(wasm._hd_kdf_hkdf(ikmPtr, ikm.length, saltPtr, salt.length, infoPtr, info.length, outPtr, length), length);
+        checkLength(wasm._hd_kdf_hkdf(ikmPtr, ikmLen, saltPtr, saltLen, infoPtr, infoLen, outPtr, length), length);
         return readBytes(wasm, outPtr, length);
       } finally {
-        wasm._hd_secure_wipe(ikmPtr, ikm.length);
+        wasm._hd_secure_wipe(ikmPtr, ikmLen);
         wasm._hd_dealloc(ikmPtr);
         wasm._hd_dealloc(saltPtr);
         wasm._hd_dealloc(infoPtr);
@@ -4069,30 +4160,30 @@ function createModule(wasm) {
         V.bytesOfLength(iv, 12, 'IV');
         V.bytes(aad, 'aad');
 
-        const keyPtr = allocAndCopy(wasm, key);
-        const ptPtr = allocAndCopy(wasm, plaintext);
-        const ivPtr = allocAndCopy(wasm, iv);
-        const aadPtr = aad.length > 0 ? allocAndCopy(wasm, aad) : 0;
-        const ctPtr = wasm._hd_alloc(plaintext.length);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, key);
+        const { ptr: ptPtr, len: ptLen } = allocAndCopy(wasm, plaintext);
+        const { ptr: ivPtr, len: ivLen } = allocAndCopy(wasm, iv);
+        const { ptr: aadPtr, len: aadLen } = V.byteLength(aad) > 0 ? allocAndCopy(wasm, aad) : { ptr: 0, len: 0 };
+        const ctPtr = wasm._hd_alloc(ptLen);
         const tagPtr = wasm._hd_alloc(16);
 
         try {
           const result = wasm._hd_aes_gcm_encrypt(
-            keyPtr, key.length,
-            ptPtr, plaintext.length,
-            ivPtr, iv.length,
-            aadPtr, aad.length,
+            keyPtr, keyLen,
+            ptPtr, ptLen,
+            ivPtr, ivLen,
+            aadPtr, aadLen,
             ctPtr, tagPtr
           );
-          checkLength(result, plaintext.length);
+          checkLength(result, ptLen);
 
           return {
-            ciphertext: readBytes(wasm, ctPtr, plaintext.length),
+            ciphertext: readBytes(wasm, ctPtr, ptLen),
             tag: readBytes(wasm, tagPtr, 16)
           };
         } finally {
-          wasm._hd_secure_wipe(keyPtr, key.length);
-          wasm._hd_secure_wipe(ptPtr, plaintext.length);
+          wasm._hd_secure_wipe(keyPtr, keyLen);
+          wasm._hd_secure_wipe(ptPtr, ptLen);
           wasm._hd_dealloc(keyPtr);
           wasm._hd_dealloc(ptPtr);
           wasm._hd_dealloc(ivPtr);
@@ -4119,22 +4210,22 @@ function createModule(wasm) {
         V.bytesOfLength(iv, 12, 'IV');
         V.bytes(aad, 'aad');
 
-        const keyPtr = allocAndCopy(wasm, key);
-        const ctPtr = allocAndCopy(wasm, ciphertext);
-        const ivPtr = allocAndCopy(wasm, iv);
-        const tagPtr = allocAndCopy(wasm, tag);
-        const aadPtr = aad.length > 0 ? allocAndCopy(wasm, aad) : 0;
-        const ptPtr = wasm._hd_alloc(ciphertext.length);
+        const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, key);
+        const { ptr: ctPtr, len: ctLen } = allocAndCopy(wasm, ciphertext);
+        const { ptr: ivPtr, len: ivLen } = allocAndCopy(wasm, iv);
+        const { ptr: tagPtr, len: tagLen } = allocAndCopy(wasm, tag);
+        const { ptr: aadPtr, len: aadLen } = V.byteLength(aad) > 0 ? allocAndCopy(wasm, aad) : { ptr: 0, len: 0 };
+        const ptPtr = wasm._hd_alloc(ctLen);
 
         try {
           const result = wasm._hd_aes_gcm_decrypt(
-            keyPtr, key.length,
-            ctPtr, ciphertext.length,
-            ivPtr, iv.length,
-            aadPtr, aad.length,
+            keyPtr, keyLen,
+            ctPtr, ctLen,
+            ivPtr, ivLen,
+            aadPtr, aadLen,
             tagPtr, ptPtr
           );
-          if (result !== ciphertext.length) {
+          if (result !== ctLen) {
             const code = nativeErrorCode(result);
             throw new HDWalletError(
               code,
@@ -4142,15 +4233,15 @@ function createModule(wasm) {
             );
           }
 
-          return readBytes(wasm, ptPtr, ciphertext.length);
+          return readBytes(wasm, ptPtr, ctLen);
         } finally {
-          wasm._hd_secure_wipe(keyPtr, key.length);
+          wasm._hd_secure_wipe(keyPtr, keyLen);
           wasm._hd_dealloc(keyPtr);
           wasm._hd_dealloc(ctPtr);
           wasm._hd_dealloc(ivPtr);
           wasm._hd_dealloc(tagPtr);
           if (aadPtr) wasm._hd_dealloc(aadPtr);
-          wasm._hd_secure_wipe(ptPtr, ciphertext.length);
+          wasm._hd_secure_wipe(ptPtr, ctLen);
           wasm._hd_dealloc(ptPtr);
         }
       }
@@ -4186,14 +4277,14 @@ function createModule(wasm) {
       V.bytes(salt, 'salt');
       V.integer(iterations, 'iterations', 1, 0x7fffffff);
       V.integer(length, 'length', 1, 0x3fffffff);
-      const pwdPtr = allocAndCopy(wasm, password);
-      const saltPtr = allocAndCopy(wasm, salt);
+      const { ptr: pwdPtr, len: pwdLen } = allocAndCopy(wasm, password);
+      const { ptr: saltPtr, len: saltLen } = allocAndCopy(wasm, salt);
       const outPtr = wasm._hd_alloc(length);
       try {
-        checkLength(wasm._hd_kdf_pbkdf2(pwdPtr, password.length, saltPtr, salt.length, iterations, outPtr, length), length);
+        checkLength(wasm._hd_kdf_pbkdf2(pwdPtr, pwdLen, saltPtr, saltLen, iterations, outPtr, length), length);
         return readBytes(wasm, outPtr, length);
       } finally {
-        wasm._hd_secure_wipe(pwdPtr, password.length);
+        wasm._hd_secure_wipe(pwdPtr, pwdLen);
         wasm._hd_dealloc(pwdPtr);
         wasm._hd_dealloc(saltPtr);
         wasm._hd_dealloc(outPtr);
@@ -4207,14 +4298,14 @@ function createModule(wasm) {
       V.integer(r, 'r', 1, 0x7fffffff);
       V.integer(p, 'p', 1, 0x7fffffff);
       V.integer(length, 'length', 1, 0x3fffffff);
-      const pwdPtr = allocAndCopy(wasm, password);
-      const saltPtr = allocAndCopy(wasm, salt);
+      const { ptr: pwdPtr, len: pwdLen } = allocAndCopy(wasm, password);
+      const { ptr: saltPtr, len: saltLen } = allocAndCopy(wasm, salt);
       const outPtr = wasm._hd_alloc(length);
       try {
-        checkLength(wasm._hd_kdf_scrypt(pwdPtr, password.length, saltPtr, salt.length, BigInt(n), r, p, outPtr, length), length);
+        checkLength(wasm._hd_kdf_scrypt(pwdPtr, pwdLen, saltPtr, saltLen, BigInt(n), r, p, outPtr, length), length);
         return readBytes(wasm, outPtr, length);
       } finally {
-        wasm._hd_secure_wipe(pwdPtr, password.length);
+        wasm._hd_secure_wipe(pwdPtr, pwdLen);
         wasm._hd_dealloc(pwdPtr);
         wasm._hd_dealloc(saltPtr);
         wasm._hd_dealloc(outPtr);
@@ -4228,9 +4319,9 @@ function createModule(wasm) {
       if (!encodeBase58Fn) {
         return encodeBase58Fallback(data);
       }
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       try {
-        const ptr = encodeBase58Fn(dataPtr, data.length);
+        const ptr = encodeBase58Fn(dataPtr, dataLen);
         return readString(wasm, ptr);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -4264,14 +4355,14 @@ function createModule(wasm) {
       const encodeBase58CheckFn = getWasmFunction(wasm, '_hd_encode_base58check');
       if (!encodeBase58CheckFn) {
         const checksum = this.sha256(this.sha256(data)).slice(0, 4);
-        const payload = new Uint8Array(data.length + checksum.length);
+        const payload = new Uint8Array(V.byteLength(data) + checksum.length);
         payload.set(data, 0);
-        payload.set(checksum, data.length);
+        payload.set(checksum, V.byteLength(data));
         return encodeBase58Fallback(payload);
       }
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       try {
-        const ptr = encodeBase58CheckFn(dataPtr, data.length);
+        const ptr = encodeBase58CheckFn(dataPtr, dataLen);
         return readString(wasm, ptr);
       } finally {
         wasm._hd_dealloc(dataPtr);
@@ -4320,9 +4411,9 @@ function createModule(wasm) {
         return encodeBech32Fallback(hrp, data);
       }
       const hrpPtr = allocString(wasm, hrp);
-      const dataPtr = allocAndCopy(wasm, data);
+      const { ptr: dataPtr, len: dataLen } = allocAndCopy(wasm, data);
       try {
-        const ptr = encodeBech32Fn(hrpPtr, dataPtr, data.length);
+        const ptr = encodeBech32Fn(hrpPtr, dataPtr, dataLen);
         return readString(wasm, ptr);
       } finally {
         wasm._hd_dealloc(hrpPtr);
@@ -4374,13 +4465,22 @@ function createModule(wasm) {
     },
 
     // Memory
+    /**
+     * Zero, in place, the bytes under any typed array, DataView, ArrayBuffer
+     * or SharedArrayBuffer (any realm), read from its internal slots, never
+     * from overridable properties. Throws INVALID_ARGUMENT for anything else
+     * and for a detached buffer (its bytes are no longer here to wipe).
+     */
     secureWipe(data) {
-      if (data instanceof Uint8Array) {
-        // Wipe in-place
-        for (let i = 0; i < data.length; i++) {
-          data[i] = 0;
-        }
+      const region = binaryRegion(data);
+      if (region === null) {
+        throw new HDWalletError(ErrorCode.INVALID_ARGUMENT,
+          'secureWipe takes a typed array, DataView, ArrayBuffer or SharedArrayBuffer');
+      }
+      if (region.detached) {
+        throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'secureWipe: the buffer is detached');
       }
+      TYPED_ARRAY_FILL.call(new Uint8Array(region.buffer, region.offset, region.length), 0);
     }
   };
 
@@ -4411,15 +4511,15 @@ function createModule(wasm) {
     exportPrivateKeyPem(curve, privateKey) {
       const fn = requireWasmFunction(wasm, '_hd_x509_export_private_key_pem');
       const keyBytes = V.privateKey(wasm, toUint8Array(privateKey, 'privateKey'), curve);
-      const keyPtr = allocAndCopy(wasm, keyBytes);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, keyBytes);
       try {
         return callDynamicStringResult(
           wasm,
-          (outPtr, outLenPtr) => fn(curve, keyPtr, keyBytes.length, outPtr, outLenPtr),
+          (outPtr, outLenPtr) => fn(curve, keyPtr, keyLen, outPtr, outLenPtr),
           { wipeOutput: true }
         );
       } finally {
-        wasm._hd_secure_wipe(keyPtr, keyBytes.length);
+        wasm._hd_secure_wipe(keyPtr, keyLen);
         wasm._hd_dealloc(keyPtr);
       }
     },
@@ -4448,7 +4548,7 @@ function createModule(wasm) {
       const optionsLen = wasm.lengthBytesUTF8(optionsSpec) + 1;
       const keyBytes = V.privateKey(wasm, toUint8Array(certificatePrivateKey, 'certificatePrivateKey'),
         certificateCurve, 'certificatePrivateKey');
-      const keyPtr = allocAndCopy(wasm, keyBytes);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, keyBytes);
 
       try {
         const bytes = callDynamicBytesResult(
@@ -4457,7 +4557,7 @@ function createModule(wasm) {
             optionsPtr,
             certificateCurve,
             keyPtr,
-            keyBytes.length,
+            keyLen,
             outputEncoding,
             outPtr,
             outLenPtr
@@ -4466,7 +4566,7 @@ function createModule(wasm) {
         return decodeX509CertificateOutput(bytes, outputEncoding);
       } finally {
         wasm._hd_secure_wipe(optionsPtr, optionsLen);
-        wasm._hd_secure_wipe(keyPtr, keyBytes.length);
+        wasm._hd_secure_wipe(keyPtr, keyLen);
         wasm._hd_dealloc(optionsPtr);
         wasm._hd_dealloc(keyPtr);
       }
@@ -4489,16 +4589,16 @@ function createModule(wasm) {
       const optionsLen = wasm.lengthBytesUTF8(optionsSpec) + 1;
       const issuerKeyBytes = V.privateKey(wasm, toUint8Array(issuerPrivateKey, 'issuerPrivateKey'),
         issuerCurve, 'issuerPrivateKey');
-      const issuerKeyPtr = allocAndCopy(wasm, issuerKeyBytes);
+      const { ptr: issuerKeyPtr, len: issuerKeyLen } = allocAndCopy(wasm, issuerKeyBytes);
       const issuerCertBytes = normalizeX509CertificateInput(
         issuerCertificate,
         issuerCertificateEncoding,
         'issuerCertificate'
       );
-      const issuerCertPtr = allocAndCopy(wasm, issuerCertBytes);
+      const { ptr: issuerCertPtr, len: issuerCertLen } = allocAndCopy(wasm, issuerCertBytes);
       const subjectKeyBytes = V.privateKey(wasm, toUint8Array(subjectPrivateKey, 'subjectPrivateKey'),
         subjectCurve, 'subjectPrivateKey');
-      const subjectKeyPtr = allocAndCopy(wasm, subjectKeyBytes);
+      const { ptr: subjectKeyPtr, len: subjectKeyLen } = allocAndCopy(wasm, subjectKeyBytes);
 
       try {
         const bytes = callDynamicBytesResult(
@@ -4507,13 +4607,13 @@ function createModule(wasm) {
             optionsPtr,
             issuerCurve,
             issuerKeyPtr,
-            issuerKeyBytes.length,
+            issuerKeyLen,
             issuerCertPtr,
-            issuerCertBytes.length,
+            issuerCertLen,
             issuerCertificateEncoding,
             subjectCurve,
             subjectKeyPtr,
-            subjectKeyBytes.length,
+            subjectKeyLen,
             outputEncoding,
             outPtr,
             outLenPtr
@@ -4522,8 +4622,8 @@ function createModule(wasm) {
         return decodeX509CertificateOutput(bytes, outputEncoding);
       } finally {
         wasm._hd_secure_wipe(optionsPtr, optionsLen);
-        wasm._hd_secure_wipe(issuerKeyPtr, issuerKeyBytes.length);
-        wasm._hd_secure_wipe(subjectKeyPtr, subjectKeyBytes.length);
+        wasm._hd_secure_wipe(issuerKeyPtr, issuerKeyLen);
+        wasm._hd_secure_wipe(subjectKeyPtr, subjectKeyLen);
         wasm._hd_dealloc(optionsPtr);
         wasm._hd_dealloc(issuerKeyPtr);
         wasm._hd_dealloc(issuerCertPtr);
@@ -4536,14 +4636,14 @@ function createModule(wasm) {
       assertX509CertificateEncoding(outputEncoding, 'outputEncoding');
       const fn = requireWasmFunction(wasm, '_hd_x509_convert_certificate');
       const certBytes = normalizeX509CertificateInput(certificate, inputEncoding);
-      const certPtr = allocAndCopy(wasm, certBytes);
+      const { ptr: certPtr, len: certLen } = allocAndCopy(wasm, certBytes);
 
       try {
         const bytes = callDynamicBytesResult(
           wasm,
           (outPtr, outLenPtr) => fn(
             certPtr,
-            certBytes.length,
+            certLen,
             inputEncoding,
             outputEncoding,
             outPtr,
@@ -4560,13 +4660,13 @@ function createModule(wasm) {
       assertX509CertificateEncoding(inputEncoding, 'inputEncoding');
       const fn = requireWasmFunction(wasm, '_hd_x509_parse_certificate_json');
       const certBytes = normalizeX509CertificateInput(certificate, inputEncoding);
-      const certPtr = allocAndCopy(wasm, certBytes);
+      const { ptr: certPtr, len: certLen } = allocAndCopy(wasm, certBytes);
 
       try {
         return normalizeParsedCertificateJson(JSON.parse(
           callDynamicStringResult(
             wasm,
-            (outPtr, outLenPtr) => fn(certPtr, certBytes.length, inputEncoding, outPtr, outLenPtr)
+            (outPtr, outLenPtr) => fn(certPtr, certLen, inputEncoding, outPtr, outLenPtr)
           )
         ));
       } finally {
@@ -4578,10 +4678,10 @@ function createModule(wasm) {
       assertX509CertificateEncoding(inputEncoding, 'inputEncoding');
       const fn = requireWasmFunction(wasm, '_hd_x509_verify_wallet_attestation');
       const certBytes = normalizeX509CertificateInput(certificate, inputEncoding);
-      const certPtr = allocAndCopy(wasm, certBytes);
+      const { ptr: certPtr, len: certLen } = allocAndCopy(wasm, certBytes);
 
       try {
-        const result = fn(certPtr, certBytes.length, inputEncoding);
+        const result = fn(certPtr, certLen, inputEncoding);
         if (result < 0) {
           throw new HDWalletError(result);
         }
@@ -4603,38 +4703,38 @@ function createModule(wasm) {
       assertX509CertificateEncoding(certificateEncoding, 'certificateEncoding');
       const fn = requireWasmFunction(wasm, '_hd_x509_export_pkcs12');
       const certBytes = normalizeX509CertificateInput(certificate, certificateEncoding);
-      const certPtr = allocAndCopy(wasm, certBytes);
+      const { ptr: certPtr, len: certLen } = allocAndCopy(wasm, certBytes);
       const keyBytes = V.privateKey(wasm, toUint8Array(privateKey, 'privateKey'), privateKeyCurve);
       V.string(password, 'password');
       V.string(friendlyName, 'friendlyName');
-      const keyPtr = allocAndCopy(wasm, keyBytes);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, keyBytes);
       const passwordPtr = allocString(wasm, password);
       const passwordLen = wasm.lengthBytesUTF8(password) + 1;
       const friendlyNamePtr = allocString(wasm, friendlyName);
       const chainBytes = normalizePemInput(chainPem, 'chainPem');
-      const chainPtr = chainBytes.length > 0 ? allocAndCopy(wasm, chainBytes) : 0;
+      const { ptr: chainPtr, len: chainLen } = V.byteLength(chainBytes) > 0 ? allocAndCopy(wasm, chainBytes) : { ptr: 0, len: 0 };
 
       try {
         return callDynamicBytesResult(
           wasm,
           (outPtr, outLenPtr) => fn(
             certPtr,
-            certBytes.length,
+            certLen,
             certificateEncoding,
             privateKeyCurve,
             keyPtr,
-            keyBytes.length,
+            keyLen,
             passwordPtr,
             friendlyNamePtr,
             chainPtr,
-            chainBytes.length,
+            chainLen,
             outPtr,
             outLenPtr
           ),
           { wipeOutput: true }
         );
       } finally {
-        wasm._hd_secure_wipe(keyPtr, keyBytes.length);
+        wasm._hd_secure_wipe(keyPtr, keyLen);
         wasm._hd_secure_wipe(passwordPtr, passwordLen);
         wasm._hd_dealloc(certPtr);
         wasm._hd_dealloc(keyPtr);
@@ -4650,7 +4750,7 @@ function createModule(wasm) {
       const fn = requireWasmFunction(wasm, '_hd_x509_import_pkcs12_json');
       const bundleBytes = toUint8Array(pkcs12Bundle, 'pkcs12Bundle');
       V.string(password, 'password');
-      const bundlePtr = allocAndCopy(wasm, bundleBytes);
+      const { ptr: bundlePtr, len: bundleLen } = allocAndCopy(wasm, bundleBytes);
       const passwordPtr = allocString(wasm, password);
       const passwordLen = wasm.lengthBytesUTF8(password) + 1;
 
@@ -4658,12 +4758,12 @@ function createModule(wasm) {
         return normalizePkcs12ImportJson(JSON.parse(
           callDynamicStringResult(
             wasm,
-            (outPtr, outLenPtr) => fn(bundlePtr, bundleBytes.length, passwordPtr, outPtr, outLenPtr),
+            (outPtr, outLenPtr) => fn(bundlePtr, bundleLen, passwordPtr, outPtr, outLenPtr),
             { wipeOutput: true }
           )
         ));
       } finally {
-        wasm._hd_secure_wipe(bundlePtr, bundleBytes.length);
+        wasm._hd_secure_wipe(bundlePtr, bundleLen);
         wasm._hd_secure_wipe(passwordPtr, passwordLen);
         wasm._hd_dealloc(bundlePtr);
         wasm._hd_dealloc(passwordPtr);
@@ -4698,18 +4798,18 @@ function createModule(wasm) {
       if (!Number.isInteger(overhead) || overhead <= 0) {
         throw new HDWalletError(ErrorCode.NOT_SUPPORTED, 'ECIES is not supported on this curve');
       }
-      const outSize = plaintext.length + overhead;
-      const pubPtr = allocAndCopy(wasm, recipientPublicKey);
-      const ptPtr = allocAndCopy(wasm, plaintext);
-      const aadPtr = aad.length > 0 ? allocAndCopy(wasm, aad) : 0;
+      const outSize = V.byteLength(plaintext) + overhead;
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, recipientPublicKey);
+      const { ptr: ptPtr, len: ptLen } = allocAndCopy(wasm, plaintext);
+      const { ptr: aadPtr, len: aadLen } = V.byteLength(aad) > 0 ? allocAndCopy(wasm, aad) : { ptr: 0, len: 0 };
       const outPtr = wasm._hd_alloc(outSize);
       try {
-        const result = checkLength(encryptFn(curveId, pubPtr, recipientPublicKey.length,
-          ptPtr, plaintext.length, aadPtr, aad.length, outPtr, outSize), outSize);
+        const result = checkLength(encryptFn(curveId, pubPtr, pubLen,
+          ptPtr, ptLen, aadPtr, aadLen, outPtr, outSize), outSize);
         return readBytes(wasm, outPtr, result);
       } finally {
         wasm._hd_dealloc(pubPtr);
-        wasm._hd_secure_wipe(ptPtr, plaintext.length);
+        wasm._hd_secure_wipe(ptPtr, ptLen);
         wasm._hd_dealloc(ptPtr);
         if (aadPtr) wasm._hd_dealloc(aadPtr);
         wasm._hd_dealloc(outPtr);
@@ -4722,20 +4822,20 @@ function createModule(wasm) {
       V.bytes(ciphertext, 'ciphertext');
       V.bytes(aad, 'aad');
       const decryptFn = requireWasmFunction(wasm, '_hd_ecies_decrypt');
-      const privPtr = allocAndCopy(wasm, recipientPrivateKey);
-      const ctPtr = allocAndCopy(wasm, ciphertext);
-      const aadPtr = aad.length > 0 ? allocAndCopy(wasm, aad) : 0;
-      const outPtr = wasm._hd_alloc(ciphertext.length);
+      const { ptr: privPtr, len: privLen } = allocAndCopy(wasm, recipientPrivateKey);
+      const { ptr: ctPtr, len: ctLen } = allocAndCopy(wasm, ciphertext);
+      const { ptr: aadPtr, len: aadLen } = V.byteLength(aad) > 0 ? allocAndCopy(wasm, aad) : { ptr: 0, len: 0 };
+      const outPtr = wasm._hd_alloc(ctLen);
       try {
-        const result = checkLengthWithin(decryptFn(curveId, privPtr, recipientPrivateKey.length,
-          ctPtr, ciphertext.length, aadPtr, aad.length, outPtr, ciphertext.length), 0, ciphertext.length);
+        const result = checkLengthWithin(decryptFn(curveId, privPtr, privLen,
+          ctPtr, ctLen, aadPtr, aadLen, outPtr, ctLen), 0, ctLen);
         return readBytes(wasm, outPtr, result);
       } finally {
-        wasm._hd_secure_wipe(privPtr, recipientPrivateKey.length);
+        wasm._hd_secure_wipe(privPtr, privLen);
         wasm._hd_dealloc(privPtr);
         wasm._hd_dealloc(ctPtr);
         if (aadPtr) wasm._hd_dealloc(aadPtr);
-        wasm._hd_secure_wipe(outPtr, ciphertext.length);
+        wasm._hd_secure_wipe(outPtr, ctLen);
         wasm._hd_dealloc(outPtr);
       }
     }
@@ -4751,16 +4851,16 @@ function createModule(wasm) {
       V.bytesOfLength(key, [16, 24, 32], 'key');
       V.bytes(plaintext, 'plaintext');
       V.bytesOfLength(iv, 16, 'iv');
-      const keyPtr = allocAndCopy(wasm, key);
-      const ptPtr = allocAndCopy(wasm, plaintext);
-      const ivPtr = allocAndCopy(wasm, iv);
-      const outPtr = wasm._hd_alloc(plaintext.length);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, key);
+      const { ptr: ptPtr, len: ptLen } = allocAndCopy(wasm, plaintext);
+      const { ptr: ivPtr, len: ivLen } = allocAndCopy(wasm, iv);
+      const outPtr = wasm._hd_alloc(ptLen);
       try {
-        checkLength(encryptFn(keyPtr, key.length, ptPtr, plaintext.length, ivPtr, iv.length, outPtr, plaintext.length), plaintext.length);
-        return readBytes(wasm, outPtr, plaintext.length);
+        checkLength(encryptFn(keyPtr, keyLen, ptPtr, ptLen, ivPtr, ivLen, outPtr, ptLen), ptLen);
+        return readBytes(wasm, outPtr, ptLen);
       } finally {
-        wasm._hd_secure_wipe(keyPtr, key.length);
-        wasm._hd_secure_wipe(ptPtr, plaintext.length);
+        wasm._hd_secure_wipe(keyPtr, keyLen);
+        wasm._hd_secure_wipe(ptPtr, ptLen);
         wasm._hd_dealloc(keyPtr);
         wasm._hd_dealloc(ptPtr);
         wasm._hd_dealloc(ivPtr);
@@ -4773,19 +4873,19 @@ function createModule(wasm) {
       V.bytesOfLength(key, [16, 24, 32], 'key');
       V.bytes(ciphertext, 'ciphertext');
       V.bytesOfLength(iv, 16, 'iv');
-      const keyPtr = allocAndCopy(wasm, key);
-      const ctPtr = allocAndCopy(wasm, ciphertext);
-      const ivPtr = allocAndCopy(wasm, iv);
-      const outPtr = wasm._hd_alloc(ciphertext.length);
+      const { ptr: keyPtr, len: keyLen } = allocAndCopy(wasm, key);
+      const { ptr: ctPtr, len: ctLen } = allocAndCopy(wasm, ciphertext);
+      const { ptr: ivPtr, len: ivLen } = allocAndCopy(wasm, iv);
+      const outPtr = wasm._hd_alloc(ctLen);
       try {
-        checkLength(decryptFn(keyPtr, key.length, ctPtr, ciphertext.length, ivPtr, iv.length, outPtr, ciphertext.length), ciphertext.length);
-        return readBytes(wasm, outPtr, ciphertext.length);
+        checkLength(decryptFn(keyPtr, keyLen, ctPtr, ctLen, ivPtr, ivLen, outPtr, ctLen), ctLen);
+        return readBytes(wasm, outPtr, ctLen);
       } finally {
-        wasm._hd_secure_wipe(keyPtr, key.length);
+        wasm._hd_secure_wipe(keyPtr, keyLen);
         wasm._hd_dealloc(keyPtr);
         wasm._hd_dealloc(ctPtr);
         wasm._hd_dealloc(ivPtr);
-        wasm._hd_secure_wipe(outPtr, ciphertext.length);
+        wasm._hd_secure_wipe(outPtr, ctLen);
         wasm._hd_dealloc(outPtr);
       }
     }
@@ -4800,19 +4900,19 @@ function createModule(wasm) {
       const deriveFn = requireWasmFunction(wasm, '_hd_slip10_ed25519_derive_path');
       V.bytesOfLength(seed, 64, 'seed', ErrorCode.INVALID_SEED);
       V.string(path, 'path');
-      const seedPtr = allocAndCopy(wasm, seed);
+      const { ptr: seedPtr, len: seedLen } = allocAndCopy(wasm, seed);
       const pathPtr = allocString(wasm, path);
       const keyPtr = wasm._hd_alloc(32);
       const chainCodePtr = wasm._hd_alloc(32);
       try {
-        const result = deriveFn(seedPtr, seed.length, pathPtr, keyPtr, chainCodePtr);
+        const result = deriveFn(seedPtr, seedLen, pathPtr, keyPtr, chainCodePtr);
         checkResult(result);
         return {
           privateKey: readBytes(wasm, keyPtr, 32),
           chainCode: readBytes(wasm, chainCodePtr, 32)
         };
       } finally {
-        wasm._hd_secure_wipe(seedPtr, seed.length);
+        wasm._hd_secure_wipe(seedPtr, seedLen);
         wasm._hd_secure_wipe(keyPtr, 32);
         wasm._hd_dealloc(seedPtr);
         wasm._hd_dealloc(pathPtr);
@@ -4838,11 +4938,11 @@ function createModule(wasm) {
       V.curve(curve, [Curve.SECP256K1, Curve.ED25519, Curve.P256]);
       V.publicKey(wasm, publicKey, curve, 'publicKey',
         curve === Curve.SECP256K1 ? [33] : V.publicKeyLengths(curve));
-      const pubPtr = allocAndCopy(wasm, publicKey);
+      const { ptr: pubPtr, len: pubLen } = allocAndCopy(wasm, publicKey);
       const outPtr = wasm._hd_alloc(64);
       try {
         const result = checkLengthWithin(
-          wasm._hd_libp2p_peer_id(pubPtr, publicKey.length, curve, outPtr, 64), 1, 64);
+          wasm._hd_libp2p_peer_id(pubPtr, pubLen, curve, outPtr, 64), 1, 64);
         return readBytes(wasm, outPtr, result);
       } finally {
         wasm._hd_dealloc(pubPtr);
@@ -4872,16 +4972,16 @@ function createModule(wasm) {
       // pre-computed peerID bytes and just do the CID wrapping + encoding here.
       // We still use WASM for base36 encoding.
       // A peer ID multihash: identity or SHA-256, at most 64 bytes.
-      V.bytesInRange(peerIdBytes, 2, 64, 'peerIdBytes');
+      const peerId = V.snapshot(V.bytesInRange(peerIdBytes, 2, 64, 'peerIdBytes'), 'peerIdBytes');
       const outPtr = wasm._hd_alloc(128);
       // Build CID in JS (trivial: 2-byte prefix + multihash)
-      const cid = new Uint8Array(2 + peerIdBytes.length);
+      const cid = new Uint8Array(2 + peerId.length);
       cid[0] = 0x01; // CIDv1
       cid[1] = 0x72; // libp2p-key codec
-      cid.set(peerIdBytes, 2);
-      const cidPtr = allocAndCopy(wasm, cid);
+      cid.set(peerId, 2);
+      const { ptr: cidPtr, len: cidLen } = allocAndCopy(wasm, cid);
       try {
-        const result = wasm._hd_encode_base36lower(cidPtr, cid.length, outPtr, 128);
+        const result = wasm._hd_encode_base36lower(cidPtr, cidLen, outPtr, 128);
         checkResult(result);
         return 'k' + readString(wasm, outPtr);
       } finally {
@@ -4896,15 +4996,15 @@ function createModule(wasm) {
      * @returns {string}
      */
     ipnsHashBase32(peerIdBytes) {
-      V.bytesInRange(peerIdBytes, 2, 64, 'peerIdBytes');
-      const cid = new Uint8Array(2 + peerIdBytes.length);
+      const peerId = V.snapshot(V.bytesInRange(peerIdBytes, 2, 64, 'peerIdBytes'), 'peerIdBytes');
+      const cid = new Uint8Array(2 + peerId.length);
       cid[0] = 0x01; // CIDv1
       cid[1] = 0x72; // libp2p-key codec
-      cid.set(peerIdBytes, 2);
-      const cidPtr = allocAndCopy(wasm, cid);
+      cid.set(peerId, 2);
+      const { ptr: cidPtr, len: cidLen } = allocAndCopy(wasm, cid);
       const outPtr = wasm._hd_alloc(128);
       try {
-        const result = wasm._hd_encode_base32lower(cidPtr, cid.length, outPtr, 128);
+        const result = wasm._hd_encode_base32lower(cidPtr, cidLen, outPtr, 128);
         checkResult(result);
         return 'b' + readString(wasm, outPtr);
       } finally {
@@ -4995,11 +5095,11 @@ function createModule(wasm) {
     // Entropy
     injectEntropy(entropy) {
       V.bytesInRange(entropy, 1, 0x100000, 'entropy');
-      const entropyPtr = allocAndCopy(wasm, entropy);
+      const { ptr: entropyPtr, len: entropyLen } = allocAndCopy(wasm, entropy);
       try {
-        wasm._hd_inject_entropy(entropyPtr, entropy.length);
+        wasm._hd_inject_entropy(entropyPtr, entropyLen);
       } finally {
-        wasm._hd_secure_wipe(entropyPtr, entropy.length);
+        wasm._hd_secure_wipe(entropyPtr, entropyLen);
         wasm._hd_dealloc(entropyPtr);
       }
     },