Harden Bitcoin address validation (#725)

#Refs: #715.
This PR adds additional validation of Bitcoin addresses for recovery and
redemption.

typescript/src/services/deposits/deposits-service.ts

@@ -8,6 +8,7 @@ import {
   BitcoinClient,
   BitcoinHashUtils,
   BitcoinLocktimeUtils,
+  BitcoinScriptUtils,
 } from "../../lib/bitcoin"
 import { Hex } from "../../lib/utils"
 import { Deposit } from "./deposit"
@@ -80,9 +81,17 @@ export class DepositsService {
 
     const bitcoinNetwork = await this.bitcoinClient.getNetwork()
 
-    // TODO: Only P2(W)PKH addresses can be used for recovery. The below conversion
-    //       function ensures that but, it would be good to check it here as well
-    //       in case the converter implementation changes.
+    const recoveryOutputScript = BitcoinAddressConverter.addressToOutputScript(
+      bitcoinRecoveryAddress,
+      bitcoinNetwork
+    )
+    if (
+      !BitcoinScriptUtils.isP2PKHScript(recoveryOutputScript) &&
+      !BitcoinScriptUtils.isP2WPKHScript(recoveryOutputScript)
+    ) {
+      throw new Error("Bitcoin recovery address must be P2PKH or P2WPKH")
+    }
+
     const refundPublicKeyHash = BitcoinAddressConverter.addressToPublicKeyHash(
       bitcoinRecoveryAddress,
       bitcoinNetwork

typescript/src/services/redemptions/redemptions-service.ts

@@ -7,6 +7,7 @@ import {
   BitcoinAddressConverter,
   BitcoinClient,
   BitcoinNetwork,
+  BitcoinScriptUtils,
   BitcoinTxOutput,
   BitcoinUtxo,
 } from "../../lib/bitcoin"
@@ -57,8 +58,14 @@ export class RedemptionsService {
       bitcoinRedeemerAddress,
       bitcoinNetwork
     )
-
-    // TODO: Validate the given script is supported for redemption.
+    if (
+      !BitcoinScriptUtils.isP2PKHScript(redeemerOutputScript) &&
+      !BitcoinScriptUtils.isP2WPKHScript(redeemerOutputScript) &&
+      !BitcoinScriptUtils.isP2SHScript(redeemerOutputScript) &&
+      !BitcoinScriptUtils.isP2WSHScript(redeemerOutputScript)
+    ) {
+      throw new Error("Redeemer output script must be of standard type")
+    }
 
     const { walletPublicKey, mainUtxo } = await this.findWalletForRedemption(
       redeemerOutputScript,