wolverine-ai 5.0.3 → 5.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolverine-ai",
-  "version": "5.0.3",
+  "version": "5.0.5",
   "description": "Self-healing Node.js server framework powered by AI. Catches crashes, diagnoses errors, generates fixes, verifies, and restarts — automatically.",
   "main": "src/index.js",
   "bin": {

package/src/middleware/x402-fastify.js

@@ -186,6 +186,10 @@ async function _verifyPayment(paymentSig, price) {
     // Recover signer from EIP-712 typed data signature
     try {
       const { ethers } = require("ethers");
+      // Normalize all addresses to proper EIP-55 checksum format
+      const fromAddr = ethers.getAddress(auth.from.toLowerCase());
+      const toAddr = ethers.getAddress(auth.to.toLowerCase());
+
       const domain = {
         name: "USD Coin",
         version: "2",
@@ -203,8 +207,8 @@ async function _verifyPayment(paymentSig, price) {
         ],
       };
       const message = {
-        from: auth.from,
-        to: auth.to,
+        from: fromAddr,
+        to: toAddr,
         value: auth.value,
         validAfter: auth.validAfter,
         validBefore: auth.validBefore,
@@ -212,7 +216,7 @@ async function _verifyPayment(paymentSig, price) {
       };
 
       const recoveredAddress = ethers.verifyTypedData(domain, types, message, sig);
-      if (recoveredAddress.toLowerCase() !== auth.from.toLowerCase()) {
+      if (recoveredAddress.toLowerCase() !== fromAddr.toLowerCase()) {
         return { valid: false, reason: "Signature mismatch" };
       }
 

package/src/vault/wallet-ops.js

@@ -119,7 +119,15 @@ function _getCrypto() {
   const crypto = require("crypto");
 
   function keccak256(data) {
-    return crypto.createHash("sha3-256").update(data).digest();
+    // Ethereum uses keccak256 (NOT NIST SHA3-256)
+    try {
+      const { keccak256: k } = require("ethers");
+      const buf = data instanceof Uint8Array ? data : Buffer.from(data);
+      const hex = k(buf);
+      return Buffer.from(hex.slice(2), "hex");
+    } catch {
+      return crypto.createHash("sha3-256").update(data).digest();
+    }
   }
 
   function getPublicKey(privKeyBuf, compressed = false) {