From 8bf36a1ff8d8d4c9bbb0ede298c079412aab61d1 Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:04:09 -0400 Subject: [PATCH 1/9] chore: update yarn.lock TICKET: WP-6461 --- yarn.lock | 260 ++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 231 insertions(+), 29 deletions(-) diff --git a/yarn.lock b/yarn.lock index f5206face0..cac5c26195 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3537,7 +3537,7 @@ dependencies: "@noble/hashes" "1.8.0" -"@noble/curves@^1.0.0", "@noble/curves@^1.2.0", "@noble/curves@^1.3.0", "@noble/curves@^1.6.0", "@noble/curves@^1.7.0", "@noble/curves@^1.8.1", "@noble/curves@~1.9.0": +"@noble/curves@^1.0.0", "@noble/curves@^1.2.0", "@noble/curves@^1.3.0", "@noble/curves@^1.6.0", "@noble/curves@^1.7.0", "@noble/curves@^1.8.1", "@noble/curves@^1.9.6", "@noble/curves@~1.9.0": version "1.9.7" resolved "https://registry.npmjs.org/@noble/curves/-/curves-1.9.7.tgz#79d04b4758a43e4bca2cbdc62e7771352fa6b951" integrity sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw== @@ -5295,6 +5295,34 @@ dependencies: "@stablelib/int" "^1.0.1" +"@stablelib/blake2b@^1.0.1": + version "1.0.1" + resolved "https://registry.npmjs.org/@stablelib/blake2b/-/blake2b-1.0.1.tgz#0045a77e182c4cf3260bc9b533fc4cd5c287f8ea" + integrity sha512-B3KyKoBAjkIFeH7romcF96i+pVFYk7K2SBQ1pZvaxV+epSBXJ+n0C66esUhyz6FF+5FbdQVm77C5fzGFcEZpKA== + dependencies: + "@stablelib/binary" "^1.0.1" + "@stablelib/hash" "^1.0.1" + "@stablelib/wipe" "^1.0.1" + +"@stablelib/bytes@^1.0.1": + version "1.0.1" + resolved "https://registry.npmjs.org/@stablelib/bytes/-/bytes-1.0.1.tgz#0f4aa7b03df3080b878c7dea927d01f42d6a20d8" + integrity sha512-Kre4Y4kdwuqL8BR2E9hV/R5sOrUj6NanZaZis0V6lX5yzqC3hBuVSDXUIBqQv/sCpmuWRiHLwqiT1pqqjuBXoQ== + +"@stablelib/constant-time@^1.0.1": + version "1.0.1" + resolved "https://registry.npmjs.org/@stablelib/constant-time/-/constant-time-1.0.1.tgz#bde361465e1cf7b9753061b77e376b0ca4c77e35" + integrity sha512-tNOs3uD0vSJcK6z1fvef4Y+buN7DXhzHDPqRLSXUel1UfqMB1PWNsnnAezrKfEwTLpN0cGH2p9NNjs6IqeD0eg== + +"@stablelib/ed25519@^1.0.3": + version "1.0.3" + resolved "https://registry.npmjs.org/@stablelib/ed25519/-/ed25519-1.0.3.tgz#f8fdeb6f77114897c887bb6a3138d659d3f35996" + integrity sha512-puIMWaX9QlRsbhxfDc5i+mNPMY+0TmQEskunY1rZEBPi1acBCVQAhnsk/1Hk50DGPtVsZtAWQg4NHGlVaO9Hqg== + dependencies: + "@stablelib/random" "^1.0.2" + "@stablelib/sha512" "^1.0.1" + "@stablelib/wipe" "^1.0.1" + "@stablelib/hash@^1.0.1": version "1.0.1" resolved "https://registry.npmjs.org/@stablelib/hash/-/hash-1.0.1.tgz" @@ -5305,11 +5333,73 @@ resolved "https://registry.npmjs.org/@stablelib/hex/-/hex-1.0.1.tgz" integrity sha512-PQOEChVBjhYGgAD+ehO2ow1gSj1slre3jW4oMD4kV8VrhYhzmtsQDWDZej3BQO8qkVezdczDvISxVSF24PuYNA== +"@stablelib/hmac@^1.0.1": + version "1.0.1" + resolved "https://registry.npmjs.org/@stablelib/hmac/-/hmac-1.0.1.tgz#3d4c1b8cf194cb05d28155f0eed8a299620a07ec" + integrity sha512-V2APD9NSnhVpV/QMYgCVMIYKiYG6LSqw1S65wxVoirhU/51ACio6D4yDVSwMzuTJXWZoVHbDdINioBwKy5kVmA== + dependencies: + "@stablelib/constant-time" "^1.0.1" + "@stablelib/hash" "^1.0.1" + "@stablelib/wipe" "^1.0.1" + "@stablelib/int@^1.0.1": version "1.0.1" resolved "https://registry.npmjs.org/@stablelib/int/-/int-1.0.1.tgz" integrity sha512-byr69X/sDtDiIjIV6m4roLVWnNNlRGzsvxw+agj8CIEazqWGOQp2dTYgQhtyVXV9wpO6WyXRQUzLV/JRNumT2w== +"@stablelib/keyagreement@^1.0.1": + version "1.0.1" + resolved "https://registry.npmjs.org/@stablelib/keyagreement/-/keyagreement-1.0.1.tgz#4612efb0a30989deb437cd352cee637ca41fc50f" + integrity sha512-VKL6xBwgJnI6l1jKrBAfn265cspaWBPAPEc62VBQrWHLqVgNRE09gQ/AnOEyKUWrrqfD+xSQ3u42gJjLDdMDQg== + dependencies: + "@stablelib/bytes" "^1.0.1" + +"@stablelib/nacl@^1.0.4": + version "1.0.4" + resolved "https://registry.npmjs.org/@stablelib/nacl/-/nacl-1.0.4.tgz#b63e0a1b87eccb13ad91dd46b2382112acfa417e" + integrity sha512-PJ2U/MrkXSKUM8C4qFs87WeCNxri7KQwR8Cdwm9q2sweGuAtTvOJGuW0F3N+zn+ySLPJA98SYWSSpogMJ1gCmw== + dependencies: + "@stablelib/poly1305" "^1.0.1" + "@stablelib/random" "^1.0.2" + "@stablelib/wipe" "^1.0.1" + "@stablelib/x25519" "^1.0.3" + "@stablelib/xsalsa20" "^1.0.2" + +"@stablelib/pbkdf2@^1.0.1": + version "1.0.1" + resolved "https://registry.npmjs.org/@stablelib/pbkdf2/-/pbkdf2-1.0.1.tgz#ba4d4379385db3ca46fb48e504ff7933c451be1d" + integrity sha512-d5jwK6jW1DkMyzqY8D1Io+fRXcsUVr95lk5LKX9ghaUdAITTc1ZL0bff+R0IrwSixbHluxhnivG7vDw59AZ/Nw== + dependencies: + "@stablelib/binary" "^1.0.1" + "@stablelib/hash" "^1.0.1" + "@stablelib/hmac" "^1.0.1" + "@stablelib/wipe" "^1.0.1" + +"@stablelib/poly1305@^1.0.1": + version "1.0.1" + resolved "https://registry.npmjs.org/@stablelib/poly1305/-/poly1305-1.0.1.tgz#93bfb836c9384685d33d70080718deae4ddef1dc" + integrity sha512-1HlG3oTSuQDOhSnLwJRKeTRSAdFNVB/1djy2ZbS35rBSJ/PFqx9cf9qatinWghC2UbfOYD8AcrtbUQl8WoxabA== + dependencies: + "@stablelib/constant-time" "^1.0.1" + "@stablelib/wipe" "^1.0.1" + +"@stablelib/random@^1.0.2": + version "1.0.2" + resolved "https://registry.npmjs.org/@stablelib/random/-/random-1.0.2.tgz#2dece393636489bf7e19c51229dd7900eddf742c" + integrity sha512-rIsE83Xpb7clHPVRlBj8qNe5L8ISQOzjghYQm/dZ7VaM2KHYwMW5adjQjrzTZCchFnNCNhkwtnOBa9HTMJCI8w== + dependencies: + "@stablelib/binary" "^1.0.1" + "@stablelib/wipe" "^1.0.1" + +"@stablelib/salsa20@^1.0.2": + version "1.0.2" + resolved "https://registry.npmjs.org/@stablelib/salsa20/-/salsa20-1.0.2.tgz#95177331f89a59d1c90f153f53265c925d4de138" + integrity sha512-nfjKzw0KTKrrKBasEP+j7UP4I8Xudom8lVZIBCp0kQNARXq72IlSic0oabg2FC1NU68L4RdHrNJDd8bFwrphYA== + dependencies: + "@stablelib/binary" "^1.0.1" + "@stablelib/constant-time" "^1.0.1" + "@stablelib/wipe" "^1.0.1" + "@stablelib/sha384@^1.0.0": version "1.0.1" resolved "https://registry.npmjs.org/@stablelib/sha384/-/sha384-1.0.1.tgz" @@ -5331,6 +5421,24 @@ resolved "https://registry.npmjs.org/@stablelib/wipe/-/wipe-1.0.1.tgz" integrity sha512-WfqfX/eXGiAd3RJe4VU2snh/ZPwtSjLG4ynQ/vYzvghTh7dHFcI1wl+nrkWG6lGhukOxOsUHfv8dUXr58D0ayg== +"@stablelib/x25519@^1.0.3": + version "1.0.3" + resolved "https://registry.npmjs.org/@stablelib/x25519/-/x25519-1.0.3.tgz#13c8174f774ea9f3e5e42213cbf9fc68a3c7b7fd" + integrity sha512-KnTbKmUhPhHavzobclVJQG5kuivH+qDLpe84iRqX3CLrKp881cF160JvXJ+hjn1aMyCwYOKeIZefIH/P5cJoRw== + dependencies: + "@stablelib/keyagreement" "^1.0.1" + "@stablelib/random" "^1.0.2" + "@stablelib/wipe" "^1.0.1" + +"@stablelib/xsalsa20@^1.0.2": + version "1.0.2" + resolved "https://registry.npmjs.org/@stablelib/xsalsa20/-/xsalsa20-1.0.2.tgz#89efc22a7ba432880ef11d876fdeba13529ccdc4" + integrity sha512-7XdBGbcNgBShmuhDXv1G1WPVCkjZdkb1oPMzSidO7Fve0MHntH6TjFkj5bfLI+aRE+61weO076vYpP/jmaAYog== + dependencies: + "@stablelib/binary" "^1.0.1" + "@stablelib/salsa20" "^1.0.2" + "@stablelib/wipe" "^1.0.1" + "@stacks/common@^1.2.2": version "1.2.2" resolved "https://registry.npmjs.org/@stacks/common/-/common-1.2.2.tgz" @@ -5492,35 +5600,112 @@ dependencies: defer-to-connect "^2.0.0" -"@taquito/local-forging@6.3.5-beta.0": - version "6.3.5-beta.0" - resolved "https://registry.npmjs.org/@taquito/local-forging/-/local-forging-6.3.5-beta.0.tgz" - integrity sha512-p0E3Ww3kg+YQYPmp/XK4YKZpWdKqtIg1ZlDtptLn66nbDA3ivzbiFHe3LxceJsYnaCcoWTXl/sRf34VKTkMK3Q== +"@taquito/core@^23.0.3": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/core/-/core-23.0.3.tgz#81f0ac60d17bef17bfdbd301787569be52f06ec6" + integrity sha512-ivCR0kxMzJ53spPw7xm/wMMYI5rP7ADurq+us6R2Z8t5jwkCtXWBAqpvwMrJeaoNjjJvTaOXf0khLg8WsdDKgg== dependencies: - "@taquito/utils" "^6.3.5-beta.0" - bignumber.js "^9.0.0" + json-stringify-safe "^5.0.1" -"@taquito/signer@6.3.5-beta.0": - version "6.3.5-beta.0" - resolved "https://registry.npmjs.org/@taquito/signer/-/signer-6.3.5-beta.0.tgz" - integrity sha512-8f2XPXw8XveGuJGCiqj9vyAiATBepz+s/J6asYil4HGwjgAXZ2unBemuqNk7oQ9xSz9fCCbFxc4ZER1GtJ8Auw== +"@taquito/http-utils@^23.0.3": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/http-utils/-/http-utils-23.0.3.tgz#3181163dcc3e6ee43aeebfcbdbae337eb0ab84be" + integrity sha512-mTPFD7w8w/Gk5GY710DlJsBVY7lzBQ1mo8HoVkcaRMV/dLM84Z+fj3jXVJSJiEVRhAyTdNr4ufBIyPV5P/1SyQ== dependencies: - "@taquito/utils" "^6.3.5-beta.0" - bignumber.js "^9.0.0" - bip39 "^3.0.2" - elliptic "^6.5.2" - libsodium-wrappers "^0.7.6" - pbkdf2 "^3.0.17" - typedarray-to-buffer "^3.1.5" + "@taquito/core" "^23.0.3" + node-fetch "^2.7.0" -"@taquito/utils@^6.3.5-beta.0": - version "6.3.5-beta.0" - resolved "https://registry.npmjs.org/@taquito/utils/-/utils-6.3.5-beta.0.tgz" - integrity sha512-EFzDnTXMctbIEnt3yfgqPmogwxR2jTYnAZqxGOgfycYlZQWGNAfvgW5KFMlhYPAfYEAU/2euvE5BYMgnexBIOA== +"@taquito/local-forging@^23.0.2", "@taquito/local-forging@^23.0.3": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/local-forging/-/local-forging-23.0.3.tgz#6ced034eb940909ea6c6e20572acfe5045cb15ea" + integrity sha512-xT5h+rutSJSI0QfxZ1M1FiDXcQuFDqSwRDhdYx28twYGFAhsGvGfknXmtN3F5SiO9hkGXL7dZR5w8NpIdk8yEw== dependencies: - blakejs "^1.1.0" - bs58check "^2.1.2" - buffer "^5.6.0" + "@taquito/core" "^23.0.3" + "@taquito/utils" "^23.0.3" + bignumber.js "^9.1.2" + fast-text-encoding "^1.0.6" + +"@taquito/michel-codec@^23.0.3": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/michel-codec/-/michel-codec-23.0.3.tgz#cb35d3b3dbace5214c3e6ac5b31a3c8d37911542" + integrity sha512-V8PO7y0R6kt1gcHJcWfgWGXBtYlvwPZJyaT1/xBmtGGUTm2AT02jIIX90EydOqMupJZHzNs2GTQ337jtvba4aA== + dependencies: + "@taquito/core" "^23.0.3" + +"@taquito/michelson-encoder@^23.0.3": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/michelson-encoder/-/michelson-encoder-23.0.3.tgz#a3709ac98e7387a0e77a9a3f4788ca7d62defee0" + integrity sha512-PJ8bSvo7uQpmwdHh4unKQrmK4CgwYoV9b2pWua7zZ3aGVWppfkyIhH6lIz9dJj9dV5mAYMkOH+hNGBC//zooUw== + dependencies: + "@taquito/core" "^23.0.3" + "@taquito/rpc" "^23.0.3" + "@taquito/utils" "^23.0.3" + bignumber.js "^9.1.2" + elliptic "^6.6.1" + fast-json-stable-stringify "^2.1.0" + +"@taquito/rpc@^23.0.2", "@taquito/rpc@^23.0.3": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/rpc/-/rpc-23.0.3.tgz#deda64f23da4fae7f922c1dc1f903205c196a5c0" + integrity sha512-VI2KgVVi/ILtTvErKqKmWeBz3oXcSGF1jhWD32LyG3QQ4BFkitcmOm+eTdi8/07OLKtErbugcw+oDhyo01MZPA== + dependencies: + "@taquito/core" "^23.0.3" + "@taquito/http-utils" "^23.0.3" + "@taquito/utils" "^23.0.3" + bignumber.js "^9.1.2" + +"@taquito/signer@^23.0.2": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/signer/-/signer-23.0.3.tgz#f6c61e93f10e6d302e9301b1d600799e5527f3d7" + integrity sha512-uvnc6X2cXw5cyFG63UWtygj6Kgt4hMbG8hOxvgksfZgcIcplakrZxQshc2plCC93362n6ooKagYR2PEZ2qg8Gw== + dependencies: + "@noble/curves" "^1.9.6" + "@stablelib/blake2b" "^1.0.1" + "@stablelib/ed25519" "^1.0.3" + "@stablelib/hmac" "^1.0.1" + "@stablelib/nacl" "^1.0.4" + "@stablelib/pbkdf2" "^1.0.1" + "@stablelib/sha512" "^1.0.1" + "@taquito/core" "^23.0.3" + "@taquito/taquito" "^23.0.3" + "@taquito/utils" "^23.0.3" + "@types/bn.js" "^5.1.5" + bip39 "3.1.0" + elliptic "^6.6.1" + pbkdf2 "^3.1.2" + typedarray-to-buffer "^4.0.0" + +"@taquito/taquito@^23.0.3": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/taquito/-/taquito-23.0.3.tgz#001f63b5e2a7fea6e5d19a94fc19615249b0a651" + integrity sha512-abcZHRgM5WBF1foELinGnd/m96rZdBELIkHUz+KyU5URv1Hw5Qx8OLIwwojVmTW6PdK3NZhHGeKMLCnyZx8Cjg== + dependencies: + "@taquito/core" "^23.0.3" + "@taquito/http-utils" "^23.0.3" + "@taquito/local-forging" "^23.0.3" + "@taquito/michel-codec" "^23.0.3" + "@taquito/michelson-encoder" "^23.0.3" + "@taquito/rpc" "^23.0.3" + "@taquito/utils" "^23.0.3" + bignumber.js "^9.1.2" + rxjs "^7.8.2" + +"@taquito/utils@^23.0.3": + version "23.0.3" + resolved "https://registry.npmjs.org/@taquito/utils/-/utils-23.0.3.tgz#fde214523c945b44d5ecacaee22d9673afbabbac" + integrity sha512-7ef9V8d1z++wCODo03LlvGq6D3P8Gr0nc93nbzDNaKWS+wJfS7lNz2tlYSsVkvBmVOt9KVdFcVLZ1/heySfuOw== + dependencies: + "@noble/curves" "^1.9.6" + "@stablelib/blake2b" "^1.0.1" + "@stablelib/ed25519" "^1.0.3" + "@taquito/core" "^23.0.3" + "@types/bs58check" "^2.1.2" + bignumber.js "^9.1.2" + blakejs "^1.2.1" + bs58check "^3.0.1" + buffer "^6.0.3" + elliptic "^6.6.1" + typedarray-to-buffer "^4.0.0" "@testing-library/cypress@^10.0.1": version "10.0.3" @@ -5615,7 +5800,7 @@ resolved "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz" integrity sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw== -"@types/bn.js@*", "@types/bn.js@^5.1.0", "@types/bn.js@^5.1.6": +"@types/bn.js@*", "@types/bn.js@^5.1.0", "@types/bn.js@^5.1.5", "@types/bn.js@^5.1.6": version "5.2.0" resolved "https://registry.npmjs.org/@types/bn.js/-/bn.js-5.2.0.tgz#4349b9710e98f9ab3cdc50f1c5e4dcbd8ef29c80" integrity sha512-DLbJ1BPqxvQhIGbeu8VbUC1DiAiahHtAYvA0ZEAa4P31F7IaArc8z3C3BRQdWX4mtLQuABG4yzp76ZrS02Ui1Q== @@ -5652,6 +5837,13 @@ "@types/node" "*" base-x "^3.0.6" +"@types/bs58check@^2.1.2": + version "2.1.2" + resolved "https://registry.npmjs.org/@types/bs58check/-/bs58check-2.1.2.tgz#ca6264599cd9c0bdfeb839a0927f13a9cb77ba0f" + integrity sha512-xpXaQlOIY1KoXlA/ytHGHpEIU87PJt+g9SH7nC6HdCgaBwT2IEZIwBMHbjuX6BpnfbiUMlmwqurdLDwXpcdmSA== + dependencies: + "@types/node" "*" + "@types/cacheable-request@^6.0.1": version "6.0.3" resolved "https://registry.npmjs.org/@types/cacheable-request/-/cacheable-request-6.0.3.tgz" @@ -7610,9 +7802,9 @@ bip39@3.0.4: pbkdf2 "^3.0.9" randombytes "^2.0.1" -bip39@^3.0.2: +bip39@3.1.0: version "3.1.0" - resolved "https://registry.npmjs.org/bip39/-/bip39-3.1.0.tgz" + resolved "https://registry.npmjs.org/bip39/-/bip39-3.1.0.tgz#c55a418deaf48826a6ceb34ac55b3ee1577e18a3" integrity sha512-c9kiwdk45Do5GL0vJMe7tS95VjCii65mYAH7DfWl3uW8AVzXKQVUm64i3hzVybBDMp9r7j9iNxR85+ul8MdN/A== dependencies: "@noble/hashes" "^1.2.0" @@ -7683,7 +7875,7 @@ bl@^4.0.3: inherits "^2.0.4" readable-stream "^3.4.0" -blakejs@^1.1.0: +blakejs@^1.1.0, blakejs@^1.2.1: version "1.2.1" resolved "https://registry.npmjs.org/blakejs/-/blakejs-1.2.1.tgz" integrity sha512-QXUSXI3QVc/gJME0dBpXrag1kbzOqCjCX8/b54ntNyW6sjtoqxqRk3LTmXzaJoh71zMsDCjM+47jS7XiwN/+fQ== @@ -11256,6 +11448,11 @@ fast-stable-stringify@^1.0.0: resolved "https://registry.npmjs.org/fast-stable-stringify/-/fast-stable-stringify-1.0.0.tgz" integrity sha512-wpYMUmFu5f00Sm0cj2pfivpmawLZ0NKdviQ4w9zJeR8JVtOpOxHmLaJuj0vxvGqMJQWyP/COUkF75/57OKyRag== +fast-text-encoding@^1.0.6: + version "1.0.6" + resolved "https://registry.npmjs.org/fast-text-encoding/-/fast-text-encoding-1.0.6.tgz#0aa25f7f638222e3396d72bf936afcf1d42d6867" + integrity sha512-VhXlQgj9ioXCqGstD37E/HBeqEGV/qOD/kmbVG8h5xKBYvM1L3lR1Zn4555cQ8GkYbJa8aJSipLPndE1k6zK2w== + fast-uri@^3.0.1: version "3.1.0" resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz#66eecff6c764c0df9b762e62ca7edcfb53b4edfa" @@ -20090,6 +20287,11 @@ typedarray-to-buffer@^3.1.5: dependencies: is-typedarray "^1.0.0" +typedarray-to-buffer@^4.0.0: + version "4.0.0" + resolved "https://registry.npmjs.org/typedarray-to-buffer/-/typedarray-to-buffer-4.0.0.tgz#cdd2933c61dd3f5f02eda5d012d441f95bfeb50a" + integrity sha512-6dOYeZfS3O9RtRD1caom0sMxgK59b27+IwoNy8RDPsmslSGOyU+mpTamlaIW7aNKi90ZQZ9DFaZL3YRoiSCULQ== + typedarray@^0.0.6: version "0.0.6" resolved "https://registry.npmjs.org/typedarray/-/typedarray-0.0.6.tgz" From 2797f454b5592d9be761973c0e49d4cc11b9a9ff Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:04:57 -0400 Subject: [PATCH 2/9] feat: support mpcv2 address derivation TICKET: WP-6461 --- .../bitgo/utils/tss/addressVerification.ts | 31 ++++++++++++++----- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/modules/sdk-core/src/bitgo/utils/tss/addressVerification.ts b/modules/sdk-core/src/bitgo/utils/tss/addressVerification.ts index cc42b95f14..45d89097a7 100644 --- a/modules/sdk-core/src/bitgo/utils/tss/addressVerification.ts +++ b/modules/sdk-core/src/bitgo/utils/tss/addressVerification.ts @@ -1,3 +1,4 @@ +import { Ecdsa } from 'modules/sdk-core/src/account-lib/mpc'; import { TssVerifyAddressOptions } from '../../baseCoin/iBaseCoin'; import { InvalidAddressError } from '../../errors'; import { EDDSAMethods } from '../../tss'; @@ -43,18 +44,34 @@ export async function verifyEddsaTssWalletAddress( isValidAddress: (address: string) => boolean, getAddressFromPublicKey: (publicKey: string) => string ): Promise { - const { keychains, address, index } = params; + return verifyMPCWalletAddress({ ...params, keyCurve: 'ed25519' }, isValidAddress, getAddressFromPublicKey); +} +/** + * Verifies if an address belongs to a wallet using ECDSA TSS MPC derivation. + * This is a common implementation for ECDSA-based MPC coins (ETH, BTC, etc.) + * + * @param params - Verification options including keychains, address, and derivation index + * @param isValidAddress - Coin-specific function to validate address format + * @param getAddressFromPublicKey - Coin-specific function to convert public key to address + * @returns true if the address matches the derived address, false otherwise + * @throws {InvalidAddressError} if the address is invalid + * @throws {Error} if required parameters are missing or invalid + */ +export async function verifyMPCWalletAddress( + params: TssVerifyAddressOptions & { + keyCurve: 'secp256k1' | 'ed25519'; + }, + isValidAddress: (address: string) => boolean, + getAddressFromPublicKey: (publicKey: string) => string +): Promise { + const { keychains, address, index } = params; if (!isValidAddress(address)) { throw new InvalidAddressError(`invalid address: ${address}`); } - + const mpc = params.keyCurve === 'secp256k1' ? new Ecdsa() : await EDDSAMethods.getInitializedMpcInstance(); const commonKeychain = extractCommonKeychain(keychains); - - const MPC = await EDDSAMethods.getInitializedMpcInstance(); - const derivationPath = 'm/' + index; - const derivedPublicKey = MPC.deriveUnhardened(commonKeychain, derivationPath).slice(0, 64); + const derivedPublicKey = mpc.deriveUnhardened(commonKeychain, 'm/' + index); const expectedAddress = getAddressFromPublicKey(derivedPublicKey); - return address === expectedAddress; } From 865c83ce21e11642dc76467fb00298c5362b42d0 Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:06:21 -0400 Subject: [PATCH 3/9] fix: use correct type for address verification TICKET: WP-6461 --- .../sdk-core/src/bitgo/baseCoin/iBaseCoin.ts | 27 +++++++++++++++---- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/modules/sdk-core/src/bitgo/baseCoin/iBaseCoin.ts b/modules/sdk-core/src/bitgo/baseCoin/iBaseCoin.ts index 5d3c2b96cc..eaea3d8ec9 100644 --- a/modules/sdk-core/src/bitgo/baseCoin/iBaseCoin.ts +++ b/modules/sdk-core/src/bitgo/baseCoin/iBaseCoin.ts @@ -147,12 +147,18 @@ export interface VerifyAddressOptions { format?: CreateAddressFormat; address: string; addressType?: string; - keychains?: { - pub: string; - }[]; + /** + * Keychains containing the pub or commonKeychain for HD derivation. + */ + keychains?: Pick[]; error?: string; coinSpecific?: AddressCoinSpecific; impliedForwarderVersion?: number; + /** + * Derivation index for the address. + * Used to derive child addresses from the root keychain via HD derivation path: m/{index} + */ + index?: number | string; } /** @@ -168,12 +174,23 @@ export interface TssVerifyAddressOptions { * For MPC wallets, the commonKeychain (combined public key from MPC key generation) * should be identical across all keychains (user, backup, bitgo). */ - keychains: Keychain[]; + keychains: Pick[]; /** * Derivation index for the address. * Used to derive child addresses from the root keychain via HD derivation path: m/{index} */ - index: string; + index: number | string; +} + +export function isTssVerifyAddressOptions( + params: T +): params is T & TssVerifyAddressOptions { + return !!( + 'keychains' in params && + 'index' in params && + 'address' in params && + params.keychains?.some((kc) => 'commonKeychain' in kc && !!kc.commonKeychain) + ); } export interface TransactionParams { From a1728c9a02c47395817e00007379b2e291c24ab3 Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:07:06 -0400 Subject: [PATCH 4/9] chore(abstract-utxo): use updated address verification type TICKET: WP-6461 --- modules/abstract-utxo/src/abstractUtxoCoin.ts | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/modules/abstract-utxo/src/abstractUtxoCoin.ts b/modules/abstract-utxo/src/abstractUtxoCoin.ts index 20daac7be6..25d518311f 100644 --- a/modules/abstract-utxo/src/abstractUtxoCoin.ts +++ b/modules/abstract-utxo/src/abstractUtxoCoin.ts @@ -706,17 +706,23 @@ export abstract class AbstractUtxoCoin extends BaseCoin { throw new InvalidAddressError(`invalid address: ${address}`); } + if (!keychains || !keychains.every((kc) => !!kc.pub)) { + throw new Error('missing required param keychains or public key'); + } + if (wallet && isDescriptorWallet(wallet)) { - if (!keychains) { - throw new Error('missing required param keychains'); - } if (!isTriple(keychains)) { throw new Error('keychains must be a triple'); } + assertDescriptorWalletAddress( this.network, params, - getDescriptorMapFromWallet(wallet, toBip32Triple(keychains), getPolicyForEnv(this.bitgo.env)) + getDescriptorMapFromWallet( + wallet, + toBip32Triple(keychains as Triple<{ pub: string }>), + getPolicyForEnv(this.bitgo.env) + ) ); return true; } @@ -727,13 +733,9 @@ export abstract class AbstractUtxoCoin extends BaseCoin { ); } - if (!keychains) { - throw new Error('missing required param keychains'); - } - assertFixedScriptWalletAddress(this.network, { address, - keychains, + keychains: keychains as { pub: string }[], format: params.format ?? 'base58', addressType: params.addressType, chain, From 5aac4eec39caa4e2c8369e9c1675fbdba469304c Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:07:40 -0400 Subject: [PATCH 5/9] chore(sdk-coin-stx): use updated address verification type TICKET: WP-6461 --- modules/sdk-coin-stx/src/stx.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/sdk-coin-stx/src/stx.ts b/modules/sdk-coin-stx/src/stx.ts index b9e1c537b0..ca853b141f 100644 --- a/modules/sdk-coin-stx/src/stx.ts +++ b/modules/sdk-coin-stx/src/stx.ts @@ -115,10 +115,11 @@ export class Stx extends BaseCoin { * @param {String} params.baseAddress - the base address from the wallet */ async isWalletAddress(params: VerifyAddressOptions): Promise { - const { address, keychains } = params; - if (!keychains || keychains.length !== 3) { - throw new Error('Invalid keychains'); + const { address, keychains: unvalidatedKeychains } = params; + if (!unvalidatedKeychains || unvalidatedKeychains.length !== 3 || !unvalidatedKeychains.every((kc) => !!kc.pub)) { + throw new Error('missing required param keychains or public key'); } + const keychains = unvalidatedKeychains as { pub: string }[]; const pubs = keychains.map((keychain) => StxLib.Utils.xpubToSTXPubkey(keychain.pub)); const addressVersion = StxLib.Utils.getAddressVersion(address); const baseAddress = StxLib.Utils.getSTXAddressFromPubKeys(pubs, addressVersion).address; From 358f4fdbc75674bfbd6e14279cf16f40c22ae2e2 Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:08:11 -0400 Subject: [PATCH 6/9] chore(sdk-coin-flrp): use updated address verification type TICKET: WP-6461 --- modules/sdk-coin-flrp/src/flrp.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/sdk-coin-flrp/src/flrp.ts b/modules/sdk-coin-flrp/src/flrp.ts index f42b7e434b..f8348aeca3 100644 --- a/modules/sdk-coin-flrp/src/flrp.ts +++ b/modules/sdk-coin-flrp/src/flrp.ts @@ -199,14 +199,15 @@ export class Flrp extends BaseCoin { * @param params.keychains public keys to generate the wallet */ async isWalletAddress(params: VerifyAddressOptions): Promise { - const { address, keychains } = params; + const { address, keychains: unvalidatedKeychains } = params; if (!this.isValidAddress(address)) { throw new InvalidAddressError(`invalid address: ${address}`); } - if (!keychains || keychains.length !== 3) { - throw new Error('Invalid keychains'); + if (!unvalidatedKeychains || unvalidatedKeychains.length !== 3 || !unvalidatedKeychains.every((kc) => !!kc.pub)) { + throw new Error('missing required param keychains or public key'); } + const keychains = unvalidatedKeychains as { pub: string }[]; // multisig addresses are separated by ~ const splitAddresses = address.split('~'); From 768d86d84a754ef4a36b99ed20b07816c1d5a064 Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:09:04 -0400 Subject: [PATCH 7/9] chore(sdk-coin-avaxp): use updated address verification type TICKET: WP-6461 --- modules/sdk-coin-avaxp/src/avaxp.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/sdk-coin-avaxp/src/avaxp.ts b/modules/sdk-coin-avaxp/src/avaxp.ts index c7ad2c4caf..ddebcaa1b6 100644 --- a/modules/sdk-coin-avaxp/src/avaxp.ts +++ b/modules/sdk-coin-avaxp/src/avaxp.ts @@ -202,14 +202,15 @@ export class AvaxP extends BaseCoin { * @param params.keychains public keys to generate the wallet */ async isWalletAddress(params: VerifyAddressOptions): Promise { - const { address, keychains } = params; + const { address, keychains: unvalidatedKeychains } = params; if (!this.isValidAddress(address)) { throw new InvalidAddressError(`invalid address: ${address}`); } - if (!keychains || keychains.length !== 3) { - throw new Error('Invalid keychains'); + if (!unvalidatedKeychains || unvalidatedKeychains.length !== 3 || !unvalidatedKeychains.every((kc) => !!kc.pub)) { + throw new Error('missing required param keychains or public key'); } + const keychains = unvalidatedKeychains as { pub: string }[]; // multisig addresses are separated by ~ const splitAddresses = address.split('~'); From f4e4d4e48c5d70e5760474c37f4a519b2715d313 Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:10:24 -0400 Subject: [PATCH 8/9] chore(sdk-coin-algo): use updated address verification type TICKET: WP-6461 --- modules/sdk-coin-algo/src/algo.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/sdk-coin-algo/src/algo.ts b/modules/sdk-coin-algo/src/algo.ts index 54f1b60011..0074385671 100644 --- a/modules/sdk-coin-algo/src/algo.ts +++ b/modules/sdk-coin-algo/src/algo.ts @@ -555,7 +555,7 @@ export class Algo extends BaseCoin { async isWalletAddress(params: VerifyAlgoAddressOptions): Promise { const { address, - keychains, + keychains: unvalidatedKeychains, coinSpecific: { bitgoPubKey }, } = params; @@ -563,9 +563,10 @@ export class Algo extends BaseCoin { throw new InvalidAddressError(`invalid address: ${address}`); } - if (!keychains) { - throw new Error('missing required param keychains'); + if (!unvalidatedKeychains || !unvalidatedKeychains.every((kc) => !!kc.pub)) { + throw new Error('missing required param keychains or public key'); } + const keychains = unvalidatedKeychains as { pub: string }[]; const effectiveKeychain = bitgoPubKey ? keychains.slice(0, -1).concat([{ pub: bitgoPubKey }]) : keychains; const pubKeys = effectiveKeychain.map((key) => this.stellarAddressToAlgoAddress(key.pub)); From 8c82c2f40d5c94dab9106e6c5fe0617479dd4dce Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Wed, 29 Oct 2025 23:11:45 -0400 Subject: [PATCH 9/9] feat(abstract-eth): implement isWalletAddress for ethlike mpc TICKET: WP-6461 --- .../src/abstractEthLikeNewCoins.ts | 43 +++++++++++++------ 1 file changed, 29 insertions(+), 14 deletions(-) diff --git a/modules/abstract-eth/src/abstractEthLikeNewCoins.ts b/modules/abstract-eth/src/abstractEthLikeNewCoins.ts index c77f6e1d0c..fc33d65bb3 100644 --- a/modules/abstract-eth/src/abstractEthLikeNewCoins.ts +++ b/modules/abstract-eth/src/abstractEthLikeNewCoins.ts @@ -40,6 +40,9 @@ import { VerifyAddressOptions as BaseVerifyAddressOptions, VerifyTransactionOptions, Wallet, + verifyMPCWalletAddress, + TssVerifyAddressOptions, + isTssVerifyAddressOptions, } from '@bitgo/sdk-core'; import { getDerivationPath } from '@bitgo/sdk-lib-mpc'; import { bip32 } from '@bitgo/secp256k1'; @@ -402,8 +405,11 @@ export interface VerifyEthAddressOptions extends BaseVerifyAddressOptions { baseAddress: string; coinSpecific: EthAddressCoinSpecifics; forwarderVersion: number; + walletVersion?: number; } +export type TssVerifyEthAddressOptions = TssVerifyAddressOptions & VerifyEthAddressOptions; + const debug = debugLib('bitgo:v2:ethlike'); export const optionalDeps = { @@ -2731,32 +2737,41 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin { * @throws {UnexpectedAddressError} * @returns {boolean} True iff address is a wallet address */ - async isWalletAddress(params: VerifyEthAddressOptions): Promise { + async isWalletAddress(params: VerifyEthAddressOptions | TssVerifyEthAddressOptions): Promise { const ethUtil = optionalDeps.ethUtil; let expectedAddress; let actualAddress; - const { address, coinSpecific, baseAddress, impliedForwarderVersion = coinSpecific?.forwarderVersion } = params; + const { address, impliedForwarderVersion } = params; if (address && !this.isValidAddress(address)) { throw new InvalidAddressError(`invalid address: ${address}`); } - - // base address is required to calculate the salt which is used in calculateForwarderV1Address method - if (_.isUndefined(baseAddress) || !this.isValidAddress(baseAddress)) { - throw new InvalidAddressError('invalid base address'); + if (impliedForwarderVersion === 0) { + return true; } + // Verify MPC wallet address for wallet version 3 and 6 (MPC receive address) + if (isTssVerifyAddressOptions(params) && params.walletVersion !== 5) { + return verifyMPCWalletAddress({ ...params, keyCurve: 'secp256k1' }, this.isValidAddress, (pubKey) => { + const derivedPublicKey = Buffer.from(pubKey, 'hex').subarray(0, 33).toString('hex'); + return new KeyPairLib({ pub: derivedPublicKey }).getAddress(); + }); + } else { + // Verify forwarder receive address + const { coinSpecific, baseAddress } = params; - if (!_.isObject(coinSpecific)) { - throw new InvalidAddressVerificationObjectPropertyError( - 'address validation failure: coinSpecific field must be an object' - ); - } + // base address is required to calculate the salt which is used in calculateForwarderV1Address method + if (_.isUndefined(baseAddress) || !this.isValidAddress(baseAddress)) { + throw new InvalidAddressError('invalid base address'); + } + + if (!_.isObject(coinSpecific)) { + throw new InvalidAddressVerificationObjectPropertyError( + 'address validation failure: coinSpecific field must be an object' + ); + } - if (impliedForwarderVersion === 0 || impliedForwarderVersion === 3 || impliedForwarderVersion === 5) { - return true; - } else { const ethNetwork = this.getNetwork(); const forwarderFactoryAddress = ethNetwork?.forwarderFactoryAddress as string; const forwarderImplementationAddress = ethNetwork?.forwarderImplementationAddress as string;