starknet 11.0.0-beta.13 → 11.0.0-beta.14

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+# [11.0.0-beta.14](https://github.com/starknet-io/starknet.js/compare/v11.0.0-beta.13...v11.0.0-beta.14) (2026-09-10)
+
+### Bug Fixes
+
+- **deps:** bump @noble/[@scure](https://github.com/scure) crypto libs to 2.4.0 ([5c448fe](https://github.com/starknet-io/starknet.js/commit/5c448febcbd16e2d1e27a4f32ec09cfd83e35dca))
+
 # [11.0.0-beta.13](https://github.com/starknet-io/starknet.js/compare/v11.0.0-beta.12...v11.0.0-beta.13) (2026-09-03)
 
 ### Features

package/dist/index.global.js

@@ -2369,6 +2369,14 @@ ${indent}}` : "}";
     if (value === null || typeof value !== "object" || Array.isArray(value))
       throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
   };
+  var aopts = (value, label) => {
+    aobject(value, label);
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null)
+      throw new TypeError(`"${label}" expected plain object`);
+    if (Object.hasOwn(value, "__proto__"))
+      throw new TypeError(`"${label}.__proto__" is not allowed`);
+  };
   function aexists(instance, checkFinished = true) {
     if (instance.destroyed)
       throw new Error("hash was destroyed");
@@ -2457,7 +2465,12 @@ ${indent}}` : "}";
   function utf8ToBytes(str) {
     if (typeof str !== "string")
       throw new TypeError("string expected");
-    return new Uint8Array(new TextEncoder().encode(str));
+    const encoded = new TextEncoder().encode(str);
+    try {
+      return new Uint8Array(encoded);
+    } finally {
+      clean(encoded);
+    }
   }
   function concatBytes(...arrays) {
     let sum = 0;
@@ -2475,10 +2488,10 @@ ${indent}}` : "}";
     return res;
   }
   function checkOpts(defaults, opts, title = "opts") {
-    aobject(defaults, "defaults");
+    aopts(defaults, "defaults");
     if (opts !== void 0)
-      aobject(opts, title);
-    const merged = Object.assign(defaults, opts);
+      aopts(opts, title);
+    const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
     return merged;
   }
   function createHasher(hashCons, info = {}) {
@@ -4728,8 +4741,13 @@ ${indent}}` : "}";
         return bytesToNumberBE(data);
       }
     },
-    toSig(bytes) {
+    toSig(bytes, maxScalarBytes) {
       const { Err: E, _int: int, _tlv: tlv } = _DER;
+      if (maxScalarBytes !== void 0) {
+        asafenumber(maxScalarBytes, "maxScalarBytes");
+        if (maxScalarBytes < 1)
+          throw new E("invalid signature: maxScalarBytes must be positive");
+      }
       const data = abytes3(bytes, void 0, "signature");
       const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
       if (seqLeftBytes.length)
@@ -4738,6 +4756,8 @@ ${indent}}` : "}";
       const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
       if (sLeftBytes.length)
         throw new E("invalid signature: left bytes after parsing");
+      if (maxScalarBytes !== void 0 && (rBytes.length > maxScalarBytes || sBytes.length > maxScalarBytes))
+        throw new E("invalid signature: integer too large");
       return { r: int.decode(rBytes), s: int.decode(sBytes) };
     },
     hexFromSig(sig) {
@@ -4813,21 +4833,28 @@ ${indent}}` : "}";
       endo: "object",
       randomBytes: "function"
     });
-    const { endo, allowInfinityPoint } = extraOpts;
+    const { endo: endoOpts, allowInfinityPoint, clearCofactor, isTorsionFree, fromBytes, toBytes: toBytes2 } = extraOpts;
     const randomBytes3 = extraOpts.randomBytes === void 0 ? randomBytes2 : extraOpts.randomBytes;
-    if (endo) {
-      if (!Fp.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
+    if (endoOpts) {
+      if (!Fp.is0(CURVE.a) || typeof endoOpts.beta !== "bigint" || !Array.isArray(endoOpts.basises)) {
         throw new Error('invalid endo: expected "beta": bigint and "basises": array');
       }
     }
+    const endo = endoOpts ? {
+      beta: endoOpts.beta,
+      basises: endoOpts.basises.map((basis) => [...basis])
+    } : void 0;
     const lengths = getWLengths(Fp, Fn);
     function assertCompressionIsSupported() {
       if (!Fp.isOdd)
         throw new Error("compression is not supported: Field does not have .isOdd()");
     }
     function pointToBytes(_c, point, isCompressed) {
-      if (allowInfinityPoint && point.is0())
+      if (point.is0()) {
+        if (!allowInfinityPoint)
+          throw new Error("bad point: ZERO");
         return Uint8Array.of(0);
+      }
       const { x, y } = point.toAffine();
       const bx = Fp.toBytes(x);
       abool2(isCompressed, "isCompressed");
@@ -4876,8 +4903,8 @@ ${indent}}` : "}";
         throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
       }
     }
-    const encodePoint = extraOpts.toBytes === void 0 ? pointToBytes : extraOpts.toBytes;
-    const decodePoint = extraOpts.fromBytes === void 0 ? pointFromBytes : extraOpts.fromBytes;
+    const encodePoint = toBytes2 === void 0 ? pointToBytes : toBytes2;
+    const decodePoint = fromBytes === void 0 ? pointFromBytes : fromBytes;
     const b3 = Fp.mul(CURVE.b, _3n2);
     const mulA = Fp.is0(CURVE.a) ? (_) => Fp.ZERO : (x) => Fp.mul(CURVE.a, x);
     function weierstrassEquation(x) {
@@ -4899,7 +4926,7 @@ ${indent}}` : "}";
     function acoord(title, n, banZero = false) {
       if (!Fp.isValid(n) || banZero && Fp.is0(n))
         throw new Error(`bad point coordinate ${title}`);
-      return n;
+      return typeof n === "object" && n !== null ? Fp.create(n) : n;
     }
     function aprjpoint(other) {
       if (!(other instanceof Point2))
@@ -4981,7 +5008,7 @@ ${indent}}` : "}";
       assertValidity() {
         const p = this;
         if (p.is0()) {
-          if (extraOpts.allowInfinityPoint && Fp.is0(p.X) && Fp.eql(p.Y, Fp.ONE) && Fp.is0(p.Z))
+          if (allowInfinityPoint && Fp.is0(p.X) && Fp.eql(p.Y, Fp.ONE) && Fp.is0(p.Z))
             return;
           throw new Error("bad point: ZERO");
         }
@@ -5193,7 +5220,6 @@ ${indent}}` : "}";
        * Always torsion-free for cofactor=1 curves.
        */
       isTorsionFree() {
-        const { isTorsionFree } = extraOpts;
         if (cofactor === _1n4)
           return true;
         if (isTorsionFree)
@@ -5201,7 +5227,6 @@ ${indent}}` : "}";
         return wnaf.mulUnsafe(this, CURVE_ORDER2).is0();
       }
       clearCofactor() {
-        const { clearCofactor } = extraOpts;
         if (cofactor === _1n4)
           return this;
         if (clearCofactor)
@@ -5270,7 +5295,7 @@ ${indent}}` : "}";
           return false;
         if (isCompressed === false && l !== publicKeyUncompressed)
           return false;
-        return !!Point2.fromBytes(publicKey);
+        return !Point2.fromBytes(publicKey).is0();
       } catch (error) {
         return false;
       }
@@ -5301,6 +5326,8 @@ ${indent}}` : "}";
         throw new Error("second arg must be public key");
       const s = Fn.fromBytes(secretKeyA);
       const b = Point2.fromBytes(publicKeyB);
+      if (b.is0())
+        throw new Error("invalid public key: point at infinity");
       return b.multiply(s).toBytes(isCompressed);
     }
     const utils2 = {
@@ -5385,7 +5412,9 @@ ${indent}}` : "}";
         validateSigLength(bytes, format);
         let recid;
         if (format === "der") {
-          const { r: r2, s: s2 } = DER.toSig(abytes3(bytes));
+          if (bytes.length > 2 * Fn.BYTES + 16)
+            throw new DER.Err("invalid signature: DER signature too long");
+          const { r: r2, s: s2 } = DER.toSig(abytes3(bytes), Fn.BYTES + 1);
           return new Signature2(r2, s2);
         }
         if (format === "recovered") {
@@ -5535,6 +5564,8 @@ ${indent}}` : "}";
       try {
         const sig = Signature2.fromBytes(signature, format);
         const P = Point2.fromBytes(publicKey);
+        if (P.is0())
+          return false;
         if (lowS && sig.hasHighS())
           return false;
         const { r, s } = sig;