quantumcoin 7.0.13 → 7.0.14

package/test/unit/address-wallet.test.js

@@ -890,3 +890,34 @@ describe("Address + Wallet (offline)", () => {
   });
 });
 
+describe("Security: universal key-pair verification", () => {
+  logSuite("Security: universal key-pair verification");
+
+  it("constructing a Wallet from a mismatched key pair throws (negative)", async () => {
+    logTest("constructing a Wallet from a mismatched key pair throws", {});
+    await Initialize(null);
+    const a = qc.Wallet.createRandom();
+    const b = qc.Wallet.createRandom();
+    // Private key of A paired with public key of B -> inconsistent key pair.
+    const mismatched = new qc.SigningKey(a.signingKey.privateKeyBytes, b.signingKey.publicKeyBytes);
+    assert.throws(() => new qc.Wallet(mismatched), /verifyWallet failed|invalid/i);
+  });
+
+  it("fromKeys still rejects a mismatched key pair (negative)", async () => {
+    logTest("fromKeys still rejects a mismatched key pair", {});
+    await Initialize(null);
+    const a = qc.Wallet.createRandom();
+    const b = qc.Wallet.createRandom();
+    assert.throws(() => qc.Wallet.fromKeys(a.privateKey, b.publicKey), /verifyWallet failed|invalid/i);
+  });
+
+  it("createRandom and fromKeys construct valid wallets (positive)", async () => {
+    logTest("createRandom and fromKeys construct valid wallets", {});
+    await Initialize(null);
+    const w = qc.Wallet.createRandom();
+    assert.ok(w.address.startsWith("0x"));
+    const w2 = qc.Wallet.fromKeys(w.privateKey, w.publicKey);
+    assert.equal(w2.address, w.address);
+  });
+});
+

package/test/unit/encoding-units-rlp.test.js

@@ -89,4 +89,39 @@
      assert.equal(decoded, "0x");
    });
  });
+
+describe("Security: RLP canonical encoding & length overflow", () => {
+  it("rejects a single byte < 0x80 encoded as a 1-byte string (negative)", () => {
+    // 0x81 0x00 = "short string of length 1 containing 0x00" — must be 0x00.
+    assert.throws(() => qc.decodeRlp("0x8100"), /non-canonical single byte/i);
+  });
+
+  it("rejects a long-string form whose length fits the short form (negative)", () => {
+    // 0xb8 (long string, lenOfLen=1) 0x01 0xff -> declared length 1 (<= 55).
+    assert.throws(() => qc.decodeRlp("0xb801ff"), /non-canonical long string/i);
+  });
+
+  it("rejects a length field with a leading zero byte (negative)", () => {
+    // 0xb9 (long string, lenOfLen=2) 0x00 0x38 -> leading zero in the length.
+    assert.throws(() => qc.decodeRlp("0xb9003800"), /leading zero/i);
+  });
+
+  it("rejects a length that overflows MAX_SAFE_INTEGER (negative)", () => {
+    // 0xbf (long string, lenOfLen=8) followed by an 8-byte length starting at 0x20.
+    assert.throws(() => qc.decodeRlp("0xbf2000000000000000"), /maximum safe integer/i);
+  });
+
+  it("round-trips a canonical long string (> 55 bytes) (positive)", () => {
+    const big = "0x" + "ab".repeat(60); // 60-byte string -> long-string form
+    const encoded = qc.encodeRlp(big);
+    const decoded = qc.decodeRlp(encoded);
+    assert.equal(decoded, big);
+  });
+
+  it("round-trips a canonical nested list (positive)", () => {
+    const encoded = qc.encodeRlp([["0x01", "0x02"], "0x03"]);
+    const decoded = qc.decodeRlp(encoded);
+    assert.deepEqual(decoded, [["0x01", "0x02"], "0x03"]);
+  });
+});
  

package/test/unit/populate-transaction.test.js

@@ -63,3 +63,36 @@ describe("populateTransaction + sendRawTransaction", () => {
   });
 });
 
+describe("Security: mandatory chainId for signing", () => {
+  logSuite("Security: mandatory chainId for signing");
+
+  it("offline signing without a chainId throws (negative)", async () => {
+    logTest("offline signing without a chainId throws", {});
+    await Initialize(null);
+    const w = qc.Wallet.createRandom(); // no provider connected
+    await assert.rejects(
+      () => w.signTransaction({ to: w.address, value: 0n, nonce: 0 }),
+      /chainId is required for signing/i,
+    );
+  });
+
+  it("offline signing with an explicit chainId succeeds (positive)", async () => {
+    logTest("offline signing with an explicit chainId succeeds", {});
+    await Initialize(null);
+    const w = qc.Wallet.createRandom();
+    const raw = await w.signTransaction({ to: w.address, value: 0n, nonce: 0, chainId: 123123 });
+    assert.equal(typeof raw, "string");
+    assert.ok(raw.startsWith("0x"));
+  });
+
+  it("signing resolves chainId from a connected provider (positive)", async () => {
+    logTest("signing resolves chainId from a connected provider", {});
+    await Initialize(null);
+    const provider = new qc.JsonRpcProvider("http://127.0.0.1:9999", 123123);
+    const w = qc.Wallet.createRandom().connect(provider);
+    const raw = await w.signTransaction({ to: w.address, value: 0n, nonce: 0 });
+    assert.equal(typeof raw, "string");
+    assert.ok(raw.startsWith("0x"));
+  });
+});
+