hodl-wallet 1.9.2 → 1.9.6

package/README.md

@@ -92,7 +92,7 @@ We've carefully selected trusted and well-maintained dependencies for this proje
   - **cli-table3**: For creating formatted CLI tables.
   - **ora**: For displaying progress bars.
   - **deepbase**: For persistent storage.
-  - **crypto-js**: For JSON encryption.
+  - **node:crypto**: Native encryption for JSON storage.
   - **bip39**: For generating and handling mnemonic phrases.
 - Web3
   - **web3**: The Ethereum JavaScript API for blockchain interactions.
@@ -102,7 +102,6 @@ We've carefully selected trusted and well-maintained dependencies for this proje
   - **bip32**: For handling hierarchical deterministic (HD) keys.
   - **ecpair**: For elliptic curve pairings.
   - **tiny-secp256k1**: For elliptic curve secp256k1 operations.
-  - **axios**: For making HTTP requests.
 
 ⚠️ **Important Notice**: HODL Wallet is a personal project created with the best intentions. While we strive for security, it may contain security flaws or vulnerabilities. Use at your own risk and always exercise caution with your crypto assets.
 

package/network/btc.js

@@ -5,6 +5,6 @@ export default {
     name: '[BTC] Bitcoin',
     url: 'https://blockstream.info/api',
     nativeToken: 'BTC',
-    explorer: 'https://blockstream.info/tx/',
+    explorer: 'https://btcscan.org/tx/',
     tokens: {}
 }; 

package/network/lib/BitcoinNetwork.js

@@ -4,7 +4,6 @@ import bip39 from 'bip39';
 import * as ecc from 'tiny-secp256k1';
 import { BIP32Factory } from 'bip32';
 import { ECPairFactory } from 'ecpair';
-import axios from 'axios';
 
 const bip32 = BIP32Factory(ecc);
 const ECPair = ECPairFactory(ecc);
@@ -19,9 +18,9 @@ export default class BitcoinNetwork extends BaseNetwork {
 
     async getBalance(address) {
         try {
-            const response = await axios.get(`${this.url}/address/${address}`);
-            const chainStats = response.data.chain_stats;
-            const mempoolStats = response.data.mempool_stats;
+            const data = await this.fetchFromApi(`/address/${address}`);
+            const chainStats = data.chain_stats;
+            const mempoolStats = data.mempool_stats;
             const balance = (chainStats.funded_txo_sum - chainStats.spent_txo_sum) +
                 (mempoolStats.funded_txo_sum - mempoolStats.spent_txo_sum);
             return this.satoshisToBTC(balance);
@@ -118,8 +117,7 @@ export default class BitcoinNetwork extends BaseNetwork {
     // Add this helper method to get full transaction data
     async getTransaction(txid) {
         try {
-            const response = await axios.get(`${this.url}/tx/${txid}/hex`);
-            return response.data;
+            return await this.fetchFromApi(`/tx/${txid}/hex`, {}, 'text');
         } catch (error) {
             throw new Error(`Failed to get transaction: ${error.message}`);
         }
@@ -211,8 +209,7 @@ export default class BitcoinNetwork extends BaseNetwork {
 
     async getUTXOs(address) {
         try {
-            const response = await axios.get(`${this.url}/address/${address}/utxo`);
-            return response.data;
+            return await this.fetchFromApi(`/address/${address}/utxo`);
         } catch (error) {
             throw new Error(`Failed to get UTXOs: ${error.message}`);
         }
@@ -224,10 +221,32 @@ export default class BitcoinNetwork extends BaseNetwork {
 
     async sendSignedTransaction(signedTx) {
         try {
-            const response = await axios.post(`${this.url}/tx`, signedTx);
-            return { transactionHash: response.data };
+            const txHash = await this.fetchFromApi(
+                '/tx',
+                {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'text/plain'
+                    },
+                    body: signedTx
+                },
+                'text'
+            );
+            return { transactionHash: txHash };
         } catch (error) {
             throw new Error(`Failed to broadcast transaction: ${error.message}`);
         }
     }
+
+    async fetchFromApi(path, options = {}, responseType = 'json') {
+        const response = await fetch(`${this.url}${path}`, options);
+
+        if (!response.ok) {
+            const errorBody = await response.text();
+            const details = errorBody ? ` - ${errorBody}` : '';
+            throw new Error(`${response.status} ${response.statusText}${details}`);
+        }
+
+        return responseType === 'text' ? response.text() : response.json();
+    }
 } 

package/package.json

@@ -1,75 +1,73 @@
 {
-    "name": "hodl-wallet",
-    "version": "1.9.2",
-    "description": "🧊 HODL Wallet - Fast CLI crypto wallet!",
-    "author": "Martin Clasen",
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/clasen/HODL.git"
-    },
-    "license": "MIT",
-    "bugs": {
-        "url": "https://github.com/clasen/HODL/issues"
-    },
-    "homepage": "https://github.com/clasen/HODL#readme",
-    "main": "index.js",
-    "bin": {
-        "hodl": "index.js"
-    },
-    "scripts": {
-        "start": "node ./index.js",
-        "test": "node ./test/test-all.js",
-        "test:network": "node ./test/test.js",
-        "test:integration": "node ./test/test-integration.js",
-        "test:quick": "node ./test/test.js --quick"
-    },
-    "keywords": [
-        "hodl",
-        "wallet",
-        "crypto",
-        "ethereum",
-        "bsc20",
-        "bep20",
-        "bnb",
-        "eth",
-        "binance",
-        "trust",
-        "blockchain",
-        "bitcoin",
-        "usdt",
-        "stable",
-        "coin",
-        "evm",
-        "polygon",
-        "matic",
-        "arbitrum",
-        "fantom",
-        "optimism",
-        "avalanche",
-        "avax",
-        "clasen"
-    ],
-    "dependencies": {
-        "axios": "^1.13.2",
-        "bip32": "^4.0.0",
-        "bip39": "3.1.0",
-        "bitcoinjs-lib": "6.1.7",
-        "cli-table3": "0.6.5",
-        "crypto-js": "4.2.0",
-        "deepbase": "1.5.2",
-        "ecpair": "2.1.0",
-        "external-editor": "3.1.0",
-        "hdkey": "^0.6.0",
-        "inquirer": "9.3.7",
-        "inquirer-autocomplete-prompt": "3.0.1",
-        "inquirer-fuzzy-path": "2.3.0",
-        "ora": "8.1.1",
-        "tiny-secp256k1": "2.2.3",
-        "tmp": "0.2.4",
-        "web3": "4.14.0"
-    },
-    "overrides": {
-        "tmp": "0.2.4"
-    },
-    "type": "module"
-}
+  "name": "hodl-wallet",
+  "version": "1.9.6",
+  "description": "🧊 HODL Wallet - Fast CLI crypto wallet!",
+  "author": "Martin Clasen",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/clasen/HODL.git"
+  },
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/clasen/HODL/issues"
+  },
+  "homepage": "https://github.com/clasen/HODL#readme",
+  "main": "index.js",
+  "bin": {
+    "hodl": "index.js"
+  },
+  "keywords": [
+    "hodl",
+    "wallet",
+    "crypto",
+    "ethereum",
+    "bsc20",
+    "bep20",
+    "bnb",
+    "eth",
+    "binance",
+    "trust",
+    "blockchain",
+    "bitcoin",
+    "usdt",
+    "stable",
+    "coin",
+    "evm",
+    "polygon",
+    "matic",
+    "arbitrum",
+    "fantom",
+    "optimism",
+    "avalanche",
+    "avax",
+    "clasen"
+  ],
+  "dependencies": {
+    "bip32": "^4.0.0",
+    "bip39": "3.1.0",
+    "bitcoinjs-lib": "6.1.7",
+    "cli-table3": "0.6.5",
+    "deepbase": "1.5.2",
+    "ecpair": "2.1.0",
+    "external-editor": "3.1.0",
+    "hdkey": "^0.6.0",
+    "inquirer": "9.3.7",
+    "inquirer-autocomplete-prompt": "3.0.1",
+    "inquirer-fuzzy-path": "2.3.0",
+    "ora": "8.1.1",
+    "tiny-secp256k1": "2.2.3",
+    "tmp": "0.2.4",
+    "web3": "4.14.0"
+  },
+  "overrides": {
+    "tmp": "0.2.4"
+  },
+  "type": "module",
+  "scripts": {
+    "start": "node ./index.js",
+    "test": "node ./test/test-all.js",
+    "test:network": "node ./test/test.js",
+    "test:integration": "node ./test/test-integration.js",
+    "test:quick": "node ./test/test.js --quick"
+  }
+}

package/persist.js

@@ -1,5 +1,10 @@
 import Deepbase from 'deepbase';
-import CryptoJS from 'crypto-js';
+import crypto from 'node:crypto';
+
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const SALT_LENGTH = 16;
 
 class Persist extends Deepbase {
     constructor(opts) {
@@ -10,16 +15,84 @@ class Persist extends Deepbase {
     }
 
     static encrypt(obj, encryptionKey) {
-        const iv = CryptoJS.lib.WordArray.random(128 / 8);
-        const encrypted = CryptoJS.AES.encrypt(JSON.stringify(obj), encryptionKey, { iv });
-        return iv.toString(CryptoJS.enc.Hex) + ':' + encrypted.toString();
+        const salt = crypto.randomBytes(SALT_LENGTH);
+        const iv = crypto.randomBytes(IV_LENGTH);
+        const key = crypto.scryptSync(encryptionKey, salt, KEY_LENGTH);
+
+        const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+        const encrypted = Buffer.concat([
+            cipher.update(JSON.stringify(obj), 'utf8'),
+            cipher.final()
+        ]);
+        const authTag = cipher.getAuthTag();
+
+        return `v2:${salt.toString('hex')}:${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted.toString('hex')}`;
     }
 
     static decrypt(encryptedData, encryptionKey) {
-        const [ivHex, encrypted] = encryptedData.split(':');
-        const iv = CryptoJS.enc.Hex.parse(ivHex);
-        const bytes = CryptoJS.AES.decrypt(encrypted, encryptionKey, { iv });
-        return JSON.parse(bytes.toString(CryptoJS.enc.Utf8));
+        const parts = encryptedData.split(':');
+
+        if (parts[0] === 'v2' && parts.length === 5) {
+            const [, saltHex, ivHex, authTagHex, encryptedHex] = parts;
+            const salt = Buffer.from(saltHex, 'hex');
+            const iv = Buffer.from(ivHex, 'hex');
+            const authTag = Buffer.from(authTagHex, 'hex');
+            const encrypted = Buffer.from(encryptedHex, 'hex');
+            const key = crypto.scryptSync(encryptionKey, salt, KEY_LENGTH);
+            const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+            decipher.setAuthTag(authTag);
+
+            const decrypted = Buffer.concat([
+                decipher.update(encrypted),
+                decipher.final()
+            ]);
+
+            return JSON.parse(decrypted.toString('utf8'));
+        }
+
+        return Persist.decryptLegacy(encryptedData, encryptionKey);
+    }
+
+    static decryptLegacy(encryptedData, encryptionKey) {
+        const [, encrypted] = encryptedData.split(':');
+        const payload = Buffer.from(encrypted, 'base64');
+
+        const saltedPrefix = payload.subarray(0, 8).toString('utf8');
+        if (saltedPrefix !== 'Salted__') {
+            throw new Error('Unsupported encrypted payload format');
+        }
+
+        const salt = payload.subarray(8, 16);
+        const ciphertext = payload.subarray(16);
+        const { key, iv } = Persist.evpBytesToKey(
+            Buffer.from(encryptionKey, 'utf8'),
+            salt,
+            KEY_LENGTH,
+            16
+        );
+
+        const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return JSON.parse(decrypted.toString('utf8'));
+    }
+
+    static evpBytesToKey(password, salt, keyLen, ivLen) {
+        let derived = Buffer.alloc(0);
+        let block = Buffer.alloc(0);
+
+        while (derived.length < keyLen + ivLen) {
+            const hash = crypto.createHash('md5');
+            hash.update(block);
+            hash.update(password);
+            hash.update(salt);
+            block = hash.digest();
+            derived = Buffer.concat([derived, block]);
+        }
+
+        return {
+            key: derived.subarray(0, keyLen),
+            iv: derived.subarray(keyLen, keyLen + ivLen)
+        };
     }
 }
 

package/pnpm-workspace.yaml

@@ -0,0 +1,7 @@
+minimumReleaseAgeExclude:
+  - tmp@0.2.4
+  - lodash@4.17.24
+  - ws@8.20.1
+
+overrides:
+  tmp: 0.2.4