mirror of
https://github.com/luxfi/connect.git
synced 2026-10-30 16:59:20 +00:00
zeekay
0403d39c62
Every verifier + the dispatcher now fails closed under any malformed/ adversarial input, never throws/panics, and resists DoS. No new dependency; prod runtime tree stays 4 deps, all MIT (zero copyleft). - src/limits.ts <-> go/walletconnect/limits.go: single bounds module — size caps (message/sig/pubkey/address/extra/lines) + chain<->scheme table (chainAllowsScheme) that rejects every illegitimate (chain,scheme) pair up front, closing cross-chain scheme confusion by construction. sig cap = 20 KiB so it clears a Cardano COSE_Sign1 (embeds the payload, ~2x the message) for a large-but-legal message. - dispatcher gate() + total backstop (TS try/catch, Go defer recover) around verifyProof / verifyProofAsync so any throw/panic below -> rejected proof. - per-verifier input bounds before any hash/decode (verifiers are exported, so each is independently safe, not just via dispatch). - caip122 parse: bound message size + line count before split. - strict base64 in bytes.ts (was lenient atob) — also kills a latent TS/Go divergence (Go StdEncoding is strict). - CBOR depth cap (MAX_CBOR_DEPTH=16) + declared-length<=remaining guard both langs; in Go a stack overflow is fatal/non-recoverable so this is load-bearing. - TON workchain range-checked to int32 in TS (Go already did). Tests: 160 TS (was 112) incl fuzz.test.ts (47, 30k+ random inputs) + Go property/corpus + 3 native Fuzz* (610k/1.2M/1.0M execs clean). Invariants: (A) never throws/panics, (B) never ok for a non-valid proof, with a ranCrypto>0 gate proving the fuzzers reach the crypto layer. All prior tests stay green. Bump @luxwallet/connect 0.1.0 -> 0.1.1.
132 lines
3.2 KiB
JSON
132 lines
3.2 KiB
JSON
{
|
|
"name": "@luxwallet/connect",
|
|
"version": "0.1.1",
|
|
"description": "Multi-chain wallet connect + Sign-In-With-X (CAIP-122) for EVM, Solana, Bitcoin, TON, XRP, Polkadot, Cardano. MIT, zero GPL.",
|
|
"license": "MIT",
|
|
"type": "module",
|
|
"main": "./dist/index.js",
|
|
"module": "./dist/index.js",
|
|
"types": "./dist/index.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"default": "./dist/index.js"
|
|
},
|
|
"./verify": {
|
|
"types": "./dist/verify.d.ts",
|
|
"default": "./dist/verify.js"
|
|
},
|
|
"./caip122": {
|
|
"types": "./dist/caip122.d.ts",
|
|
"default": "./dist/caip122.js"
|
|
},
|
|
"./connectors": {
|
|
"types": "./dist/connectors.d.ts",
|
|
"default": "./dist/connectors.js"
|
|
},
|
|
"./login": {
|
|
"types": "./dist/login.d.ts",
|
|
"default": "./dist/login.js"
|
|
},
|
|
"./evm/connect": {
|
|
"types": "./dist/evm/connect.d.ts",
|
|
"default": "./dist/evm/connect.js"
|
|
},
|
|
"./solana/connect": {
|
|
"types": "./dist/solana/connect.d.ts",
|
|
"default": "./dist/solana/connect.js"
|
|
},
|
|
"./bitcoin/connect": {
|
|
"types": "./dist/bitcoin/connect.d.ts",
|
|
"default": "./dist/bitcoin/connect.js"
|
|
},
|
|
"./ton/connect": {
|
|
"types": "./dist/ton/connect.d.ts",
|
|
"default": "./dist/ton/connect.js"
|
|
},
|
|
"./xrp/connect": {
|
|
"types": "./dist/xrp/connect.d.ts",
|
|
"default": "./dist/xrp/connect.js"
|
|
},
|
|
"./polkadot/connect": {
|
|
"types": "./dist/polkadot/connect.d.ts",
|
|
"default": "./dist/polkadot/connect.js"
|
|
},
|
|
"./polkadot/verify": {
|
|
"types": "./dist/polkadot/verify.d.ts",
|
|
"default": "./dist/polkadot/verify.js"
|
|
},
|
|
"./cardano/connect": {
|
|
"types": "./dist/cardano/connect.d.ts",
|
|
"default": "./dist/cardano/connect.js"
|
|
},
|
|
"./cardano/verify": {
|
|
"types": "./dist/cardano/verify.d.ts",
|
|
"default": "./dist/cardano/verify.js"
|
|
}
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"src"
|
|
],
|
|
"scripts": {
|
|
"build": "tsc -p tsconfig.build.json",
|
|
"prepare": "tsc -p tsconfig.build.json",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"typecheck": "tsc --noEmit",
|
|
"lint": "tsc --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"@noble/curves": "^1.6.0",
|
|
"@noble/hashes": "^1.5.0",
|
|
"bs58": "^6.0.0"
|
|
},
|
|
"peerDependencies": {
|
|
"@crossmarkio/sdk": "^0.4.0",
|
|
"@polkadot/util": "^14.0.0",
|
|
"@polkadot/util-crypto": "^14.0.0",
|
|
"@tonconnect/sdk": "^4.0.0",
|
|
"sats-connect": "^4.2.1",
|
|
"viem": "^2.53.1"
|
|
},
|
|
"peerDependenciesMeta": {
|
|
"viem": {
|
|
"optional": true
|
|
},
|
|
"sats-connect": {
|
|
"optional": true
|
|
},
|
|
"@tonconnect/sdk": {
|
|
"optional": true
|
|
},
|
|
"@crossmarkio/sdk": {
|
|
"optional": true
|
|
},
|
|
"@polkadot/util": {
|
|
"optional": true
|
|
},
|
|
"@polkadot/util-crypto": {
|
|
"optional": true
|
|
}
|
|
},
|
|
"devDependencies": {
|
|
"@crossmarkio/sdk": "^0.4.0",
|
|
"@polkadot/util": "^14.0.3",
|
|
"@polkadot/util-crypto": "^14.0.3",
|
|
"@tonconnect/sdk": "^4.0.0",
|
|
"@types/node": "^26.0.0",
|
|
"sats-connect": "^4.2.1",
|
|
"typescript": "^5.6.0",
|
|
"viem": "^2.53.1",
|
|
"vitest": "^2.1.0"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/luxwallet/connect.git"
|
|
},
|
|
"publishConfig": {
|
|
"access": "public"
|
|
}
|
|
}
|