quantumcoin 7.0.14 → 8.0.0

package/test/security/malformed-input.test.js

@@ -1,330 +0,0 @@
-/**
- * @testCategory security
- * @blockchainRequired false
- * @transactional false
- * @description Security tests for malformed input, edge cases, and invalid values.
- * Run with VERBOSE=1 for test names.
- */
-
-const { describe, it } = require("node:test");
-const assert = require("node:assert/strict");
-
-const { Initialize } = require("../../config");
-const qc = require("../../index");
-const { logSuite, logTest } = require("../verbose-logger");
-
-describe("Security: Malformed Input", () => {
-  logSuite("Security: Malformed Input");
-  it("rejects invalid address length and characters", async () => {
-    logTest("rejects invalid address length and characters", {});
-    await Initialize(null);
-    assert.equal(qc.isAddress("0x1234"), false);
-    assert.equal(qc.isAddress("not-an-address"), false);
-    assert.throws(() => qc.getAddress("0x1234"), /invalid address/i);
-  });
-
-  it("rejects too-long bytes32 strings", () => {
-    logTest("rejects too-long bytes32 strings", {});
-    assert.throws(() => qc.encodeBytes32String("x".repeat(33)), /max 32/i);
-  });
-
-  it("rejects invalid parseUnits inputs", () => {
-    logTest("rejects invalid parseUnits inputs", {});
-    assert.throws(() => qc.parseUnits("", 18), /invalid/i);
-    assert.throws(() => qc.parseUnits("1.234", 2), /exceeds decimals/i);
-  });
-});
-
-describe("Security: Private key enumeration protection", () => {
-  logSuite("Security: Private key enumeration protection");
-
-  it("JSON.stringify(wallet) must NOT contain privateKey or seed", async () => {
-    logTest("JSON.stringify(wallet) must NOT contain privateKey or seed", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    const json = JSON.stringify(w);
-    const parsed = JSON.parse(json);
-
-    assert.ok(!("privateKey" in parsed), "privateKey must not appear in JSON");
-    assert.ok(!("seed" in parsed), "seed must not appear in JSON");
-    assert.ok(!("signingKey" in parsed), "signingKey must not appear in JSON");
-    assert.ok(!("_qcWallet" in parsed), "_qcWallet must not appear in JSON");
-    assert.ok(!("_seed" in parsed), "_seed must not appear in JSON");
-    assert.ok(!("privateKeyBytes" in parsed), "privateKeyBytes must not appear in JSON");
-
-    assert.ok("address" in parsed, "address should be in JSON");
-  });
-
-  it("Object.keys(wallet) must not include secret properties", async () => {
-    logTest("Object.keys(wallet) must not include secret properties", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    const keys = Object.keys(w);
-
-    assert.ok(!keys.includes("privateKey"), "privateKey must not be enumerable");
-    assert.ok(!keys.includes("seed"), "seed must not be enumerable");
-    assert.ok(!keys.includes("signingKey"), "signingKey must not be enumerable");
-    assert.ok(!keys.includes("_qcWallet"), "_qcWallet must not be enumerable");
-    assert.ok(!keys.includes("_seed"), "_seed must not be enumerable");
-  });
-
-  it("privateKey and seed are still accessible directly", async () => {
-    logTest("privateKey and seed are still accessible directly", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    assert.equal(typeof w.privateKey, "string");
-    assert.ok(w.privateKey.startsWith("0x"));
-    assert.equal(typeof w.seed, "string");
-  });
-});
-
-describe("Security: Wallet.connect() preserves state", () => {
-  logSuite("Security: Wallet.connect() preserves state");
-
-  it("connect() preserves seed", async () => {
-    logTest("connect() preserves seed", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    const seedBefore = w.seed;
-
-    const provider = new qc.JsonRpcProvider("http://127.0.0.1:9999", 123123);
-    const connected = w.connect(provider);
-
-    assert.equal(connected.seed, seedBefore, "seed must survive connect()");
-    assert.equal(connected.address, w.address, "address must survive connect()");
-  });
-});
-
-describe("Security: KDF string password handling", () => {
-  logSuite("Security: KDF string password handling");
-
-  it("pbkdf2 with plain string password does not crash", async () => {
-    logTest("pbkdf2 with plain string password does not crash", {});
-    const result = qc.pbkdf2("password123", "salt123", 1000, 32, "sha256");
-    assert.equal(typeof result, "string");
-    assert.ok(result.startsWith("0x"));
-  });
-
-  it("computeHmac with plain string key/data does not crash", async () => {
-    logTest("computeHmac with plain string key/data does not crash", {});
-    const result = qc.computeHmac("sha256", "mykey", "mydata");
-    assert.equal(typeof result, "string");
-    assert.ok(result.startsWith("0x"));
-  });
-
-  it("scryptSync with plain string password does not crash", async () => {
-    logTest("scryptSync with plain string password does not crash", {});
-    const result = qc.scryptSync("password123", "salt123", 1024, 8, 1, 32);
-    assert.equal(typeof result, "string");
-    assert.ok(result.startsWith("0x"));
-  });
-});
-
-describe("Security: Numeric precision in signTransaction", () => {
-  logSuite("Security: Numeric precision in signTransaction");
-
-  it("rejects number value above MAX_SAFE_INTEGER", async () => {
-    logTest("rejects number value above MAX_SAFE_INTEGER", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    await assert.rejects(
-      () => w.signTransaction({ to: w.address, value: Number.MAX_SAFE_INTEGER + 1, nonce: 0, chainId: 123123 }),
-      /overflow/i,
-    );
-  });
-
-  it("accepts bigint value for large amounts", async () => {
-    logTest("accepts bigint value for large amounts", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    const raw = await w.signTransaction({
-      to: w.address,
-      value: 999999999999999999999n,
-      nonce: 0,
-      chainId: 123123,
-    });
-    assert.equal(typeof raw, "string");
-    assert.ok(raw.startsWith("0x"));
-  });
-
-  it("accepts string value '0x' as zero", async () => {
-    logTest("accepts string value '0x' as zero", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    const raw = await w.signTransaction({ to: w.address, value: "0x", nonce: 0, chainId: 123123 });
-    assert.equal(typeof raw, "string");
-  });
-});
-
-describe("Security: Password strength enforcement", () => {
-  logSuite("Security: Password strength enforcement");
-
-  it("encryptSync rejects password shorter than 12 characters", async () => {
-    logTest("encryptSync rejects password shorter than 12 characters", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    assert.throws(() => w.encryptSync("short"), /password must be at least 12 characters/);
-  });
-
-  it("encryptSync accepts password of 12+ characters", async () => {
-    logTest("encryptSync accepts password of 12+ characters", {});
-    await Initialize(null);
-    const w = qc.Wallet.createRandom();
-    const json = w.encryptSync("abcdefghijkl");
-    assert.equal(typeof json, "string");
-    assert.ok(json.length > 0);
-  });
-});
-
-describe("Security: Message signing removed", () => {
-  logSuite("Security: Message signing removed");
-
-  it("hashMessage is not exported", () => {
-    logTest("hashMessage is not exported", {});
-    assert.equal(qc.hashMessage, undefined, "hashMessage should not be exported");
-  });
-
-  it("verifyMessage is not exported", () => {
-    logTest("verifyMessage is not exported", {});
-    assert.equal(qc.verifyMessage, undefined, "verifyMessage should not be exported");
-  });
-
-  it("recoverAddress is not exported", () => {
-    logTest("recoverAddress is not exported", {});
-    assert.equal(qc.recoverAddress, undefined, "recoverAddress should not be exported");
-  });
-
-  it("MessagePrefix is not exported", () => {
-    logTest("MessagePrefix is not exported", {});
-    assert.equal(qc.MessagePrefix, undefined, "MessagePrefix should not be exported");
-  });
-});
-
-describe("Security: Error messages do not leak secrets", () => {
-  logSuite("Security: Error messages do not leak secrets");
-
-  it("fromKeys error does not contain actual key bytes", async () => {
-    logTest("fromKeys error does not contain actual key bytes", {});
-    await Initialize(null);
-    const fakeKey = "0xdeadbeef";
-    try {
-      qc.Wallet.fromKeys(fakeKey, fakeKey);
-      assert.fail("should have thrown");
-    } catch (e) {
-      assert.ok(!e.message.includes("deadbeef"), "error must not contain key material");
-      assert.ok(e.message.includes("[REDACTED]") || !e.message.includes("0x"), "value should be redacted");
-    }
-  });
-});
-
-describe("Security: _hexToBigInt handles '0x'", () => {
-  logSuite("Security: _hexToBigInt handles '0x'");
-
-  it("getBalance does not crash on '0x' response", async () => {
-    logTest("getBalance does not crash on '0x' response", {});
-    assert.equal(typeof qc.JsonRpcProvider, "function");
-  });
-});
-
-describe("Security: RLP depth limit", () => {
-  logSuite("Security: RLP depth limit");
-
-  it("rejects deeply nested RLP (depth > 64)", () => {
-    logTest("rejects deeply nested RLP (depth > 64)", {});
-    let inner = [];
-    for (let i = 0; i < 70; i++) {
-      inner = [inner];
-    }
-    const encoded = qc.encodeRlp(inner);
-    assert.throws(() => qc.decodeRlp(encoded), /maximum nesting depth exceeded/);
-  });
-
-  it("accepts RLP within depth limit", () => {
-    logTest("accepts RLP within depth limit", {});
-    const encoded = qc.encodeRlp([["hello", "world"], "test"]);
-    const decoded = qc.decodeRlp(encoded);
-    assert.ok(Array.isArray(decoded));
-  });
-});
-
-describe("Security: Seed phrase with invalid words", () => {
-  logSuite("Security: Seed phrase with invalid words");
-
-  it("rejects gibberish words of correct count", async () => {
-    logTest("rejects gibberish words of correct count", {});
-    await Initialize(null);
-    const gibberish = new Array(32).fill("xyzzyplugh");
-    assert.throws(
-      () => qc.Wallet.fromPhrase(gibberish),
-      { message: /failed/i },
-    );
-  });
-
-  it("rejects empty string words of correct count", async () => {
-    logTest("rejects empty string words of correct count", {});
-    await Initialize(null);
-    const empty = new Array(32).fill("");
-    assert.throws(() => qc.Wallet.fromPhrase(empty));
-  });
-});
-
-describe("Security: Keccak-256 test vectors", () => {
-  logSuite("Security: Keccak-256 test vectors");
-
-  it("keccak256 of empty bytes matches known digest", async () => {
-    logTest("keccak256 of empty bytes matches known digest", {});
-    const result = qc.keccak256(new Uint8Array(0));
-    assert.equal(result, "0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470");
-  });
-
-  it("keccak256 of 'hello' matches known digest", async () => {
-    logTest("keccak256 of 'hello' matches known digest", {});
-    const bytes = new TextEncoder().encode("hello");
-    const result = qc.keccak256(bytes);
-    assert.equal(result, "0x1c8aff950685c2ed4bc3174f3472287b56d9517b9c948127319a09a7a36deac8");
-  });
-
-  it("sha256 produces correct length output", () => {
-    logTest("sha256 produces correct length output", {});
-    const result = qc.sha256(new Uint8Array([1, 2, 3]));
-    assert.equal(typeof result, "string");
-    assert.equal(result.length, 66);
-  });
-});
-
-describe("Security: BigInt in provider params", () => {
-  logSuite("Security: BigInt in provider params");
-
-  it("JsonRpcProvider serializes BigInt params without crashing", async (t) => {
-    logTest("JsonRpcProvider serializes BigInt params without crashing", {});
-    if (typeof fetch !== "function") {
-      t.skip("global fetch not available");
-      return;
-    }
-    const originalFetch = fetch;
-    global.fetch = async (_url, init) => {
-      const body = JSON.parse(init.body);
-      assert.equal(body.params[0].value, "0x3e8");
-      const responseBody = JSON.stringify({ jsonrpc: "2.0", id: body.id, result: "0x1" });
-      return { ok: true, text: async () => responseBody, json: async () => JSON.parse(responseBody) };
-    };
-    try {
-      const p = new qc.JsonRpcProvider("http://example.invalid", 123123);
-      await p._perform("eth_call", [{ to: "0x" + "00".repeat(32), value: 1000n }]);
-    } finally {
-      global.fetch = originalFetch;
-    }
-  });
-});
-
-describe("Security: Per-instance RPC IDs", () => {
-  logSuite("Security: Per-instance RPC IDs");
-
-  it("different provider instances have independent ID counters", () => {
-    logTest("different provider instances have independent ID counters", {});
-    const p1 = new qc.JsonRpcProvider("http://a.invalid", 1);
-    const p2 = new qc.JsonRpcProvider("http://b.invalid", 1);
-    assert.equal(p1._rpcId, 1);
-    assert.equal(p2._rpcId, 1);
-  });
-});

package/test/security/malformed-input.test.ts

@@ -1,35 +0,0 @@
-/**
- * @testCategory security
- * @blockchainRequired false
- * @transactional false
- * @description Security tests for malformed input, edge cases, and invalid values
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-
-import { Initialize } from "../../config";
-import qc from "../../index";
-import { logSuite, logTest } from "../verbose-logger";
-
-describe("Security: Malformed Input", () => {
-  logSuite("Security: Malformed Input");
-  it("rejects invalid address length and characters", async () => {
-    logTest("rejects invalid address length and characters", {});
-    await Initialize(null);
-    assert.equal(qc.isAddress("0x1234"), false);
-    assert.equal(qc.isAddress("not-an-address"), false);
-    assert.throws(() => qc.getAddress("0x1234"), /invalid address/i);
-  });
-
-  it("rejects too-long bytes32 strings", () => {
-    logTest("rejects too-long bytes32 strings", {});
-    assert.throws(() => qc.encodeBytes32String("x".repeat(33)), /max 32/i);
-  });
-
-  it("rejects invalid parseUnits inputs", () => {
-    logTest("rejects invalid parseUnits inputs", {});
-    assert.throws(() => qc.parseUnits("", 18), /invalid/i);
-    assert.throws(() => qc.parseUnits("1.234", 2), /exceeds decimals/i);
-  });
-});

package/test/security/rpc-numeric-bounds.test.js

@@ -1,81 +0,0 @@
-/**
- * @testCategory security
- * @blockchainRequired false
- * @transactional false
- * @description RPC quantities are untrusted. A value above
- *              Number.MAX_SAFE_INTEGER must fail loudly instead of being silently
- *              truncated by Number(BigInt(...)). The decoder keeps returning a
- *              `number` (no signature change); only out-of-range values throw.
- */
-
-const { describe, it } = require("node:test");
-const assert = require("node:assert/strict");
-
-const { Initialize } = require("../../config");
-const qc = require("../../index");
-const { logSuite, logTest } = require("../verbose-logger");
-
-// 2^53 = 9007199254740992 = one past Number.MAX_SAFE_INTEGER.
-const UNSAFE_HEX = "0x20000000000000";
-const TX_HASH = "0x" + "aa".repeat(32);
-
-class NumProvider extends qc.AbstractProvider {
-  constructor(map) {
-    super();
-    this._map = map;
-  }
-  async _perform(method) {
-    return Object.prototype.hasOwnProperty.call(this._map, method) ? this._map[method] : null;
-  }
-}
-
-describe("Security: untrusted RPC quantity bounds", () => {
-  logSuite("Security: untrusted RPC quantity bounds");
-
-  it("getBlockNumber throws for a value above MAX_SAFE_INTEGER (negative)", async () => {
-    logTest("getBlockNumber rejects an out-of-range quantity", {});
-    await Initialize(null);
-    const p = new NumProvider({ eth_blockNumber: UNSAFE_HEX });
-    await assert.rejects(() => p.getBlockNumber(), /safe integer range/i);
-  });
-
-  it("getBlock throws when block.number exceeds MAX_SAFE_INTEGER (negative)", async () => {
-    logTest("getBlock rejects an out-of-range block number", {});
-    await Initialize(null);
-    const p = new NumProvider({
-      eth_getBlockByNumber: { hash: "0x" + "11".repeat(32), number: UNSAFE_HEX, timestamp: "0x1", transactions: [] },
-    });
-    await assert.rejects(() => p.getBlock("latest"), /safe integer range/i);
-  });
-
-  it("getTransactionReceipt throws when a quantity exceeds MAX_SAFE_INTEGER (negative)", async () => {
-    logTest("getTransactionReceipt rejects an out-of-range quantity", {});
-    await Initialize(null);
-    const p = new NumProvider({
-      eth_getTransactionReceipt: { transactionHash: TX_HASH, blockNumber: UNSAFE_HEX, status: "0x1" },
-    });
-    await assert.rejects(() => p.getTransactionReceipt(TX_HASH), /safe integer range/i);
-  });
-
-  it("decodes normal in-range quantities to the correct number (positive)", async () => {
-    logTest("decodes in-range quantities correctly", {});
-    await Initialize(null);
-    const p = new NumProvider({
-      eth_blockNumber: "0x10",
-      eth_getTransactionReceipt: {
-        transactionHash: TX_HASH,
-        blockNumber: "0x5",
-        transactionIndex: "0x0",
-        status: "0x1",
-      },
-    });
-    const bn = await p.getBlockNumber();
-    assert.equal(bn, 16);
-    assert.equal(typeof bn, "number");
-
-    const receipt = await p.getTransactionReceipt(TX_HASH);
-    assert.equal(receipt.blockNumber, 5);
-    assert.equal(typeof receipt.blockNumber, "number");
-    assert.equal(receipt.status, 1);
-  });
-});

package/test/security/rpc-trust.test.js

@@ -1,202 +0,0 @@
-/**
- * @testCategory security
- * @blockchainRequired false
- * @transactional false
- * @description Do not trust the RPC node. A broadcast must be rejected if
- *              the node returns a transaction hash different from the one we
- *              signed, and event logs from foreign contract addresses must be
- *              dropped from getLogs results.
- */
-
-const { describe, it } = require("node:test");
-const assert = require("node:assert/strict");
-
-const { Initialize } = require("../../config");
-const qc = require("../../index");
-const { logSuite, logTest } = require("../verbose-logger");
-
-const SIGNED_HASH = "0x" + "aa".repeat(32);
-
-class SendProvider extends qc.AbstractProvider {
-  constructor(returnedHash) {
-    super();
-    this._returnedHash = returnedHash;
-  }
-  async _perform(method) {
-    if (method === "eth_sendRawTransaction") return this._returnedHash;
-    if (method === "eth_getTransactionByHash") return { hash: this._returnedHash };
-    return null;
-  }
-}
-
-describe("Security: RPC broadcast hash verification", () => {
-  logSuite("Security: RPC broadcast hash verification");
-
-  it("throws when the node returns a different hash than the signed tx (negative)", async () => {
-    logTest("throws when the node returns a different hash than the signed tx", {});
-    await Initialize(null);
-    const p = new SendProvider("0x" + "bb".repeat(32));
-    await assert.rejects(
-      () => p.sendTransaction("0xrawsigned", { expectedHash: SIGNED_HASH }),
-      /does not match the signed transaction/i,
-    );
-  });
-
-  it("returns the response when the node hash matches (positive, case-insensitive)", async () => {
-    logTest("returns the response when the node hash matches", {});
-    await Initialize(null);
-    const p = new SendProvider(SIGNED_HASH);
-    const resp = await p.sendTransaction("0xrawsigned", { expectedHash: SIGNED_HASH.toUpperCase() });
-    assert.ok(resp && typeof resp.hash === "string");
-    assert.equal(resp.hash.toLowerCase(), SIGNED_HASH);
-  });
-
-  it("without expectedHash, sendTransaction stays backward compatible", async () => {
-    logTest("without expectedHash, sendTransaction stays backward compatible", {});
-    await Initialize(null);
-    const p = new SendProvider(SIGNED_HASH);
-    const resp = await p.sendTransaction("0xrawsigned");
-    assert.equal(resp.hash, SIGNED_HASH);
-  });
-});
-
-class LogProvider extends qc.AbstractProvider {
-  constructor(logs) {
-    super();
-    this._logs = logs;
-  }
-  async _perform(method) {
-    if (method === "eth_getLogs") return this._logs;
-    return null;
-  }
-}
-
-describe("Security: event-log provenance", () => {
-  logSuite("Security: event-log provenance");
-
-  it("drops logs whose address does not match the filter (negative) and keeps matching ones (positive)", async () => {
-    logTest("drops foreign-address logs and keeps matching ones", {});
-    await Initialize(null);
-    const target = "0x" + "11".repeat(32);
-    const foreign = "0x" + "99".repeat(32);
-    const p = new LogProvider([
-      { address: target, topics: [], data: "0x", blockNumber: "0x1" },
-      { address: foreign, topics: [], data: "0x", blockNumber: "0x1" },
-      { address: target.toUpperCase(), topics: [], data: "0x", blockNumber: "0x1" },
-    ]);
-
-    const logs = await p.getLogs({ address: target });
-    assert.equal(logs.length, 2, "only logs from the requested address survive");
-    for (const l of logs) {
-      assert.equal(l.address.toLowerCase(), target.toLowerCase());
-    }
-  });
-
-  it("returns all logs when no address filter is given (positive)", async () => {
-    logTest("returns all logs when no address filter is given", {});
-    await Initialize(null);
-    const p = new LogProvider([
-      { address: "0x" + "11".repeat(32), topics: [], data: "0x" },
-      { address: "0x" + "99".repeat(32), topics: [], data: "0x" },
-    ]);
-    const logs = await p.getLogs({ fromBlock: 0 });
-    assert.equal(logs.length, 2);
-  });
-});
-
-const AA = "0x" + "aa".repeat(32);
-const BB = "0x" + "bb".repeat(32);
-
-class HashProvider extends qc.AbstractProvider {
-  constructor(obj) {
-    super();
-    this._obj = obj;
-  }
-  async _perform(method) {
-    if (method === "eth_getTransactionByHash") return this._obj;
-    if (method === "eth_getTransactionReceipt") return this._obj;
-    return null;
-  }
-}
-
-describe("Security: read-back / confirmation hash verification", () => {
-  logSuite("Security: read-back / confirmation hash verification");
-
-  it("getTransaction throws when the returned hash differs from the requested hash (negative)", async () => {
-    logTest("getTransaction rejects a mismatched returned hash", {});
-    await Initialize(null);
-    const p = new HashProvider({ hash: BB });
-    await assert.rejects(() => p.getTransaction(AA), /does not match the requested hash/i);
-  });
-
-  it("getTransaction returns the response when the hash matches (positive)", async () => {
-    logTest("getTransaction accepts a matching hash", {});
-    await Initialize(null);
-    const p = new HashProvider({ hash: AA });
-    const tx = await p.getTransaction(AA);
-    assert.equal(tx.hash, AA);
-  });
-
-  it("getTransactionReceipt throws when transactionHash differs (negative)", async () => {
-    logTest("getTransactionReceipt rejects a mismatched receipt", {});
-    await Initialize(null);
-    const p = new HashProvider({ transactionHash: BB, blockNumber: "0x1" });
-    await assert.rejects(() => p.getTransactionReceipt(AA), /does not match the requested hash/i);
-  });
-
-  it("wait() rejects when the node returns a receipt for a different tx (negative)", async () => {
-    logTest("wait() rejects a mismatched receipt", {});
-    await Initialize(null);
-    const p = new HashProvider({ transactionHash: BB, blockNumber: "0x1" });
-    const resp = new qc.TransactionResponse({ hash: AA }, p);
-    await assert.rejects(() => resp.wait(1, 5000), /does not match the requested hash/i);
-  });
-});
-
-describe("Security: event-log topic binding", () => {
-  logSuite("Security: event-log topic binding");
-
-  const eventAbi = [
-    {
-      type: "event",
-      name: "Transfer",
-      anonymous: false,
-      inputs: [
-        { name: "from", type: "address", indexed: true },
-        { name: "to", type: "address", indexed: true },
-        { name: "value", type: "uint256", indexed: false },
-      ],
-    },
-  ];
-
-  it("getLogs drops logs whose topic0 does not match the requested topic (negative+positive)", async () => {
-    logTest("getLogs filters by topic0", {});
-    await Initialize(null);
-    const addr = "0x" + "11".repeat(32);
-    const wanted = "0x" + "cc".repeat(32);
-    const other = "0x" + "dd".repeat(32);
-    const p = new LogProvider([
-      { address: addr, topics: [wanted], data: "0x", blockNumber: "0x1" },
-      { address: addr, topics: [other], data: "0x", blockNumber: "0x1" },
-    ]);
-    const logs = await p.getLogs({ address: addr, topics: [wanted] });
-    assert.equal(logs.length, 1);
-    assert.equal(logs[0].topics[0], wanted);
-  });
-
-  it("queryFilter only returns logs matching the event's topic0 (negative+positive)", async () => {
-    logTest("queryFilter binds results to the event topic", {});
-    await Initialize(null);
-    const addr = "0x" + "11".repeat(32);
-    const topic0 = new qc.Interface(eventAbi).getEventTopic("Transfer");
-    const wrong = "0x" + "ee".repeat(32);
-    const p = new LogProvider([
-      { address: addr, topics: [topic0], data: "0x", blockNumber: "0x1" },
-      { address: addr, topics: [wrong], data: "0x", blockNumber: "0x1" },
-    ]);
-    const contract = new qc.Contract(addr, eventAbi, p);
-    const events = await contract.queryFilter("Transfer", 0, "latest");
-    assert.equal(events.length, 1, "only the matching-topic log survives");
-    assert.equal(events[0].topics[0], topic0);
-  });
-});