smartledger-bsv 3.4.5 → 4.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/CHANGELOG.md +122 -0
  2. package/README.md +40 -40
  3. package/SECURITY.md +6 -3
  4. package/bsv-covenant.min.js +3 -3
  5. package/bsv-ecies.min.js +1 -1
  6. package/bsv-gdaf.min.js +3 -3
  7. package/bsv-ltp.min.js +3 -3
  8. package/bsv-smartcontract.min.js +3 -3
  9. package/bsv.bundle.js +3 -3
  10. package/bsv.min.js +3 -3
  11. package/docs/COVENANT_DEVELOPMENT_RESOLVED.md +2 -2
  12. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  13. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  14. package/docs/getting-started/INSTALLATION.md +25 -25
  15. package/docs/getting-started/QUICK_START.md +7 -7
  16. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  17. package/lib/crypto/ecdsa.js +10 -27
  18. package/lib/ecies/electrum-ecies.js +12 -1
  19. package/lib/gdaf/attestation-signer.js +37 -2
  20. package/lib/gdaf/attestation-verifier.js +48 -10
  21. package/package.json +1 -4
  22. package/utilities/wallet.json +0 -30
package/CHANGELOG.md CHANGED
@@ -5,6 +5,128 @@ All notable changes to SmartLedger-BSV will be documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [4.0.0] - 2026-05-31
9
+
10
+ ### Security
11
+
12
+ This release fixes three critical vulnerabilities in the GDAF Verifiable
13
+ Credential signing/verification path. **Any credential signed by a version
14
+ prior to 4.0.0 should be considered unprotected and re-issued, and any
15
+ verification result produced by a prior version should be considered
16
+ untrustworthy.** See the Breaking Changes note below.
17
+
18
+ - **Credential signatures now cover the entire credential body, including
19
+ nested claims (e.g. `credentialSubject`).** `AttestationSigner._canonicalizeJSON`
20
+ previously called `JSON.stringify(obj, Object.keys(obj).sort())`. The second
21
+ argument is the JSON.stringify *replacer array*, which whitelists keys at
22
+ **every** nesting level to the top-level key set; every nested object
23
+ therefore serialized to `{}` and was excluded from the signed hash. An
24
+ attacker could rewrite the subject's identity and claims without
25
+ invalidating the proof. Canonicalization is now a recursive, depth-complete
26
+ key sort (`AttestationSigner._sortValue`).
27
+
28
+ - **The signature is now actually checked during verification.**
29
+ `AttestationVerifier._verifySignature` and `_verifyPresentationSignature`
30
+ assigned `var valid = ecdsa.verify()`. `ECDSA.prototype.verify()` returns the
31
+ ECDSA *instance* (always truthy), not a boolean, so the `if (valid)` branch
32
+ always passed — credentials and presentations were accepted regardless of
33
+ whether the signature was valid, or present at all. Both sites now read
34
+ `ecdsa.verify().verified`.
35
+
36
+ - **The signing key is now bound to the claimed issuer (issuer-spoofing fix).**
37
+ `_verifySignature` resolved the public key from the attacker-controlled
38
+ `proof.verificationMethod` and never compared it to `credential.issuer`. A
39
+ valid signature from any DID was accepted while the credential named a
40
+ different (e.g. trusted) authority as issuer. Verification now requires the
41
+ DID owning `proof.verificationMethod` to equal the credential issuer
42
+ (`AttestationVerifier._normalizeDID`, supporting both string and `{ id }`
43
+ issuer forms).
44
+
45
+ - **Removed a live private key from the published package.**
46
+ `utilities/wallet.json` shipped a valid mainnet WIF
47
+ (`KwbaQqFU…`, address `15XJXD7CSMqHL2ivFCu8PZTACQQ8MPbWY9`). The file has
48
+ been deleted and removed from the `files` allow-list. The dev utilities that
49
+ used it (`utilities/wallet-setup.js`, `utxo-manager.js`, `blockchain-state.js`)
50
+ already generate/import a local `wallet.json` at runtime and tolerate its
51
+ absence. **The published key must be considered compromised — do not reuse
52
+ it or send funds to that address.**
53
+
54
+ - **`trustedIssuers` is now enforced instead of advisory.** When a
55
+ `trustedIssuers` allow-list is passed to `verifyCredential`, an issuer outside
56
+ the list is now a hard verification failure (previously only a warning, so the
57
+ list had no effect). Comparison is done on normalized DIDs.
58
+
59
+ Regression coverage added in `test/gdaf/canonicalize.js` (8 tests): nested-key
60
+ coverage, key-order independence, array-order significance, tamper-detection at
61
+ the hash level, an untampered sign/verify round-trip, rejection of an
62
+ issuer-spoofed credential, enforcement of the `trustedIssuers` allow-list, and
63
+ rejection of a post-signing nested-claim tamper.
64
+
65
+ ### Changed
66
+
67
+ - **Constant-time MAC comparison in Electrum/BIE1 ECIES** (`lib/ecies/electrum-ecies.js`).
68
+ The decrypt path compared the authentication tag with `Buffer.equals()`, which
69
+ short-circuits on the first differing byte and can leak how many leading bytes
70
+ matched. Replaced with an unconditional byte-wise compare (matching the
71
+ existing loop in `bitcore-ecies.js`). Behaviour is unchanged for valid and
72
+ invalid tags.
73
+ - **Simplified ECDSA signature verification** (`lib/crypto/ecdsa.js#sigError`).
74
+ Removed a redundant s-canonicalization step and an unreachable
75
+ "backwards-compatibility" retry branch (because `(r, s)` and `(r, n - s)`
76
+ always verify identically, the retry could never succeed where the primary
77
+ check failed). Out-of-range rejection of `r`/`s` is retained. Accept/reject
78
+ results are byte-for-byte identical to 3.4.5; low-S is still enforced at
79
+ signing time via `ECDSA.toLowS`.
80
+
81
+ ### Removed
82
+
83
+ - Dropped the inaccurate `vulnerability-free` and `security-hardened` npm
84
+ keywords. `bsv.isHardened` and `bsv.securityFeatures` remain but only describe
85
+ opt-in helpers, as documented in `index.js` and the README Security section.
86
+
87
+ ### Tests / Tooling
88
+
89
+ - **The test runner now executes the whole suite.** mocha 8 dropped support for
90
+ `test/mocha.opts`, so its `--recursive` flag was silently ignored and
91
+ `npm test` only ran the 10 top-level `test/*.js` files (534 tests) — the ~40
92
+ files under `test/crypto`, `test/script`, `test/transaction`, `test/gdaf`,
93
+ etc. never ran in CI. Added `.mocharc.json` (`recursive`, `spec:
94
+ test/**/*.js`) and removed the defunct `test/mocha.opts`. `npm test` now runs
95
+ the full suite (4172 passing, 0 failing), including the new GDAF security
96
+ tests.
97
+ - **Repaired `test/crypto/security.js`.** It was 0 passing / 8 failing in 3.4.5
98
+ (missing `require('chai').should()`, plus calls to a non-existent
99
+ `SmartVerify.verifySignature`, `Signature.validate()` used as if it returned a
100
+ boolean rather than throwing, and an invalid TXID fixture). Rewritten against
101
+ the real API (`SmartVerify.smartVerify`, `Signature#validate/isCanonical/
102
+ toCanonical`); now 12 passing.
103
+ - **Fixed the 18 pre-existing failures that recursion surfaced** (all failed on
104
+ a pristine 3.4.5 checkout; the full suite is now green at 4172 passing):
105
+ - 3 in `test/crypto/ecdsa.js` — `ECDSA#sigError` did not reject negative
106
+ `r`/`s`. Tightened the range check to `[1, n-1]` (`lte(0)` now covers
107
+ negative and zero); negative-value DER vectors are correctly rejected as
108
+ 'r and s not in range'. (Real correctness fix, in `lib/crypto/ecdsa.js`.)
109
+ - 14 in `test/script/interpreter.js` — stale upstream Bitcoin Core vectors
110
+ asserting `DISABLED_OPCODE` for CAT/SPLIT/NUM2BIN/BIN2NUM/AND/OR/XOR/DIV/MOD
111
+ (re-enabled in BSV at Genesis) and `BAD_OPCODE` for `0xba` (which is OP_NOP8
112
+ in this build). The vendored `script_tests.json` is left untouched; a
113
+ documented `BSV_DIVERGENCES` override in the harness records each divergence
114
+ and asserts the correct BSV result.
115
+ - 1 in `test/script/script.js` — expected byte `0xba` to disassemble as raw
116
+ hex, but `0xba` is `OP_NOP8` in this build's opcode table; updated to the
117
+ correct disassembly with an explanatory comment.
118
+
119
+ ### Breaking Changes
120
+
121
+ - The bytes that get signed have changed (nested claims are now included), so
122
+ credentials and presentations signed by **≤ 3.4.5 will no longer verify**
123
+ under 4.0.0. This is intentional: the previous signatures did not protect
124
+ those bytes. Re-issue affected credentials with 4.0.0.
125
+ - Verification is now strict: callers relying on the previous (broken)
126
+ behaviour where verification effectively always succeeded will see
127
+ legitimate failures for unsigned, mis-signed, or issuer-mismatched
128
+ credentials.
129
+
8
130
  ## [3.4.5] - 2026-05-29
9
131
 
10
132
  ### Fixed
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  **🚀 Complete Bitcoin SV Development Framework with W3C Verifiable Credentials, DID:web, Legal Compliance, and 16 Flexible Loading Options**
4
4
 
5
- [![Version](https://img.shields.io/badge/version-3.4.5-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
5
+ [![Version](https://img.shields.io/badge/version-4.0.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
  [![BSV](https://img.shields.io/badge/BSV-Compatible-orange.svg)](https://bitcoinsv.com/)
8
8
  [![Modular](https://img.shields.io/badge/Loading-Modular-purple.svg)](#loading-options)
@@ -25,8 +25,8 @@ The most comprehensive and flexible Bitcoin SV library available. **In v3.4.x**:
25
25
  ### **Quick Start - Issue Your First Verifiable Credential**
26
26
 
27
27
  ```bash
28
- # Install SmartLedger BSV v3.4.5
29
- npm install @smartledger/bsv@3.4.5
28
+ # Install SmartLedger BSV v4.0.0
29
+ npm install @smartledger/bsv@4.0.0
30
30
 
31
31
  # Initialize DID:web issuer (generates ES256 keys)
32
32
  npx smartledger-bsv didweb init --domain example.com --alg ES256
@@ -135,42 +135,42 @@ console.log('Status:', status) // 'revoked'
135
135
  ### **Core Modules**
136
136
  | Module | Size | Use Case | CDN |
137
137
  |--------|------|----------|-----|
138
- | **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js` |
139
- | **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@3.4.5/bsv.bundle.js` |
138
+ | **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js` |
139
+ | **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@4.0.0/bsv.bundle.js` |
140
140
 
141
141
  ### **🆕 W3C Verifiable Credentials (v3.4.x)**
142
142
  | Module | Size | Use Case | CDN |
143
143
  |--------|------|----------|-----|
144
- | **🟢 bsv-didweb.min.js** | 419KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@3.4.5/bsv-didweb.min.js` |
145
- | **🟢 bsv-vcjwt.min.js** | 419KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@3.4.5/bsv-vcjwt.min.js` |
146
- | **🟢 bsv-statuslist.min.js** | 487KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@3.4.5/bsv-statuslist.min.js` |
147
- | **🟢 bsv-anchor.min.js** | 418KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@3.4.5/bsv-anchor.min.js` |
144
+ | **🟢 bsv-didweb.min.js** | 419KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@4.0.0/bsv-didweb.min.js` |
145
+ | **🟢 bsv-vcjwt.min.js** | 419KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@4.0.0/bsv-vcjwt.min.js` |
146
+ | **🟢 bsv-statuslist.min.js** | 487KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@4.0.0/bsv-statuslist.min.js` |
147
+ | **🟢 bsv-anchor.min.js** | 418KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@4.0.0/bsv-anchor.min.js` |
148
148
 
149
149
  ### **Smart Contract & Development**
150
150
  | Module | Size | Use Case | CDN |
151
151
  |--------|------|----------|-----|
152
- | **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@3.4.5/bsv-smartcontract.min.js` |
153
- | **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@3.4.5/bsv-covenant.min.js` |
154
- | **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@3.4.5/bsv-script-helper.min.js` |
155
- | **bsv-security.min.js** | 26KB | Security enhancements | `unpkg.com/@smartledger/bsv@3.4.5/bsv-security.min.js` |
152
+ | **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@4.0.0/bsv-smartcontract.min.js` |
153
+ | **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@4.0.0/bsv-covenant.min.js` |
154
+ | **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@4.0.0/bsv-script-helper.min.js` |
155
+ | **bsv-security.min.js** | 26KB | Security enhancements | `unpkg.com/@smartledger/bsv@4.0.0/bsv-security.min.js` |
156
156
 
157
157
  ### **Legal & Compliance**
158
158
  | Module | Size | Use Case | CDN |
159
159
  |--------|------|----------|-----|
160
- | **bsv-ltp.min.js** | 1184KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@3.4.5/bsv-ltp.min.js` |
161
- | **bsv-gdaf.min.js** | 1184KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@3.4.5/bsv-gdaf.min.js` |
160
+ | **bsv-ltp.min.js** | 1184KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@4.0.0/bsv-ltp.min.js` |
161
+ | **bsv-gdaf.min.js** | 1184KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@4.0.0/bsv-gdaf.min.js` |
162
162
 
163
163
  ### **Advanced Cryptography**
164
164
  | Module | Size | Use Case | CDN |
165
165
  |--------|------|----------|-----|
166
- | **bsv-shamir.min.js** | 432KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@3.4.5/bsv-shamir.min.js` |
166
+ | **bsv-shamir.min.js** | 432KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@4.0.0/bsv-shamir.min.js` |
167
167
 
168
168
  ### **Utilities**
169
169
  | Module | Size | Use Case | CDN |
170
170
  |--------|------|----------|-----|
171
- | **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@3.4.5/bsv-ecies.min.js` |
172
- | **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@3.4.5/bsv-message.min.js` |
173
- | **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@3.4.5/bsv-mnemonic.min.js` |
171
+ | **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@4.0.0/bsv-ecies.min.js` |
172
+ | **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@4.0.0/bsv-message.min.js` |
173
+ | **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@4.0.0/bsv-mnemonic.min.js` |
174
174
 
175
175
  ## ⚡ **2-Minute Quick Start**
176
176
 
@@ -181,7 +181,7 @@ Get started with Bitcoin SV development in under 2 minutes:
181
181
  npm install @smartledger/bsv
182
182
 
183
183
  # Or include in HTML
184
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
184
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js"></script>
185
185
  ```
186
186
 
187
187
  > **🔧 v3.4.x:** Legally-recognizable W3C Verifiable Credentials with DID:web + VC-JWT toolkit. ES256/ES256K support, StatusList2021 revocation, and privacy-preserving BSV anchoring. Complete CLI tooling included! v3.4.1 ensures these bundles ship to npm consumers; see CHANGELOG.
@@ -276,8 +276,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
276
276
 
277
277
  ### 🔧 **Basic Development** (~963KB total)
278
278
  ```html
279
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
280
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-script-helper.min.js"></script>
279
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js"></script>
280
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-script-helper.min.js"></script>
281
281
  <script>
282
282
  const privateKey = new bsv.PrivateKey();
283
283
  const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -286,9 +286,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
286
286
 
287
287
  ### 🔒 **Smart Contract Development** (~2.7MB total — each bundle re-embeds core BSV)
288
288
  ```html
289
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
290
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-covenant.min.js"></script>
291
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-smartcontract.min.js"></script>
289
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js"></script>
290
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-covenant.min.js"></script>
291
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-smartcontract.min.js"></script>
292
292
  <script>
293
293
  const covenant = bsv.SmartContract.createCovenantBuilder()
294
294
  .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -298,9 +298,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
298
298
 
299
299
  ### 🆕 **Legal & Identity Development** (~3.2MB total — each bundle re-embeds core BSV)
300
300
  ```html
301
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
302
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-ltp.min.js"></script>
303
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-gdaf.min.js"></script>
301
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js"></script>
302
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-ltp.min.js"></script>
303
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-gdaf.min.js"></script>
304
304
  <script>
305
305
  // Legal Token Protocol
306
306
  const propertyToken = bsv.createPropertyToken({
@@ -314,9 +314,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
314
314
 
315
315
  ### 🆕 **Security & Cryptography** (~1.4MB total)
316
316
  ```html
317
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
318
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-security.min.js"></script>
319
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-shamir.min.js"></script>
317
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js"></script>
318
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-security.min.js"></script>
319
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-shamir.min.js"></script>
320
320
  <script>
321
321
  // Threshold Cryptography
322
322
  const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -328,7 +328,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
328
328
 
329
329
  ### 🎯 **Everything Bundle** (937KB)
330
330
  ```html
331
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.bundle.js"></script>
331
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.bundle.js"></script>
332
332
  <script>
333
333
  // Everything available immediately
334
334
  const shares = bsv.splitSecret('secret', 5, 3); // Shamir Secret Sharing
@@ -408,8 +408,8 @@ const contractTx = covenant.createCovenantTransaction({
408
408
 
409
409
  #### 1. **Minimal Setup** - Core + Script Helper (~963KB)
410
410
  ```html
411
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
412
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-script-helper.min.js"></script>
411
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js"></script>
412
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-script-helper.min.js"></script>
413
413
  <script>
414
414
  const tx = new bsv.Transaction();
415
415
  const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -418,9 +418,9 @@ const contractTx = covenant.createCovenantTransaction({
418
418
 
419
419
  #### 2. **DeFi Development** - Core + Covenants + Debug (~2.7MB — each bundle re-embeds core BSV)
420
420
  ```html
421
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
422
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-covenant.min.js"></script>
423
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-smartcontract.min.js"></script>
421
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js"></script>
422
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-covenant.min.js"></script>
423
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-smartcontract.min.js"></script>
424
424
  <script>
425
425
  const covenant = new bsvCovenant.CovenantInterface();
426
426
  const debugInfo = SmartContract.interpretScript(script);
@@ -430,8 +430,8 @@ const contractTx = covenant.createCovenantTransaction({
430
430
 
431
431
  #### 3. **Security First** - Core + Enhanced Security (~963KB)
432
432
  ```html
433
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
434
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-security.min.js"></script>
433
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.min.js"></script>
434
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv-security.min.js"></script>
435
435
  <script>
436
436
  const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
437
437
  const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -440,7 +440,7 @@ const contractTx = covenant.createCovenantTransaction({
440
440
 
441
441
  #### 4. **Everything Bundle** - One File Solution (937KB)
442
442
  ```html
443
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.bundle.js"></script>
443
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.0/bsv.bundle.js"></script>
444
444
  <script>
445
445
  // Everything available under bsv namespace
446
446
  const keys = bsv.SmartLedgerBundle.generateKeys();
package/SECURITY.md CHANGED
@@ -4,12 +4,15 @@ Thank you for helping keep `@smartledger/bsv` and its users safe.
4
4
 
5
5
  ## Supported Versions
6
6
 
7
- Security fixes are applied to the latest minor release line. Earlier releases
8
- are not patched; please upgrade.
7
+ Security fixes are applied to the latest major release line. Earlier releases
8
+ are not patched; please upgrade. **Versions ≤ 3.4.5 contain three known,
9
+ exploitable vulnerabilities in the GDAF credential verification path (see
10
+ CHANGELOG `## [4.0.0]`); upgrade to 4.x is strongly recommended.**
9
11
 
10
12
  | Version | Supported |
11
13
  | ------- | ------------------ |
12
- | 3.4.x | :white_check_mark: |
14
+ | 4.x | :white_check_mark: |
15
+ | 3.4.x | :x: (contains known credential-verification vulnerabilities; upgrade to 4.x) |
13
16
  | < 3.4 | :x: |
14
17
 
15
18
  ## Reporting a Vulnerability