bitcore-wallet-utils - npm Package Compare versions

Comparing version 0.0.14 to 0.0.15

lib/walletutils.js

@@ -6,2 +6,3 @@ 'use strict';
 var sjcl = require('sjcl');
+var Stringify = require('json-stable-stringify');
 
@@ -24,2 +25,6 @@ var Bitcore = require('bitcore');
 
+WalletUtils.MAX_TX_FEE = 0.1 * 1e8;
+WalletUtils.MIN_FEE_PER_KB = 1000;
+WalletUtils.MAX_FEE_PER_KB = 10000;
+
 /* TODO: It would be nice to be compatible with bitcoind signmessage. How
@@ -77,4 +82,12 @@ * the hash is calculated there? */
 
-WalletUtils.getProposalHash = function(toAddress, amount, message, payProUrl) {
-  return [toAddress, amount, (message || ''), (payProUrl || '')].join('|');
+WalletUtils.getProposalHash = function(proposalHeader) {
+  function getOldHash(toAddress, amount, message, payProUrl) {
+    return [toAddress, amount, (message || ''), (payProUrl || '')].join('|');
+  };
+
+  if (_.isString(proposalHeader)) {
+    return getOldHash.apply(this, arguments);
+  }
+
+  return Stringify(proposalHeader);
 };
@@ -154,9 +167,13 @@
 
+WalletUtils.newBitcoreTransaction = function() {
+  return new Bitcore.Transaction();
+};
+
 WalletUtils.buildTx = function(txp) {
   Bitcore.Transaction.FEE_SECURITY_MARGIN = 1;
 
-  var t = new Bitcore.Transaction();
+  var t = WalletUtils.newBitcoreTransaction();
 
   if (txp.feePerKb) {
-    $.checkArgument(txp.feePerKb <= 10000);
+    $.checkArgument(txp.feePerKb >= WalletUtils.MIN_FEE_PER_KB && txp.feePerKb <= WalletUtils.MAX_FEE_PER_KB);
     t.feePerKb(txp.feePerKb);
@@ -169,4 +186,4 @@ }
 
-  t.to(txp.toAddress, txp.amount)
-    .change(txp.changeAddress.address);
+  t.to(txp.toAddress, txp.amount);
+  t.change(txp.changeAddress.address);
 
@@ -183,2 +200,12 @@ // Shuffle outputs for improved privacy
 
+  // Validate inputs vs outputs independently of Bitcore
+  var totalInputs = _.reduce(txp.inputs, function(memo, i) {
+    return +i.satoshis + memo;
+  }, 0);
+  var totalOutputs = _.reduce(t.outputs, function(memo, o) {
+    return +o.satoshis + memo;
+  }, 0);
+
+  $.checkState(totalInputs - totalOutputs < WalletUtils.MAX_TX_FEE);
+
   return t;
@@ -185,0 +212,0 @@ };

package.json

@@ -5,3 +5,3 @@ {
   "author": "BitPay Inc",
-  "version": "0.0.14",
+  "version": "0.0.15",
   "main": "index.js",
@@ -25,2 +25,3 @@ "keywords": [
     "coveralls": "^2.11.2",
+    "json-stable-stringify": "^1.0.0",
     "lodash": "^3.3.1",
@@ -27,0 +28,0 @@ "preconditions": "^1.0.8",

test/walletutils.js

@@ -147,2 +147,37 @@ 'use strict';
 
+  describe('#getProposalHash', function() {
+    it('should compute hash for old style proposals', function() {
+      var hash = WalletUtils.getProposalHash('msj42CCGruhRsFrGATiUuh25dtxYtnpbTx', 1234, 'the message');
+      hash.should.equal('msj42CCGruhRsFrGATiUuh25dtxYtnpbTx|1234|the message|');
+    });
+    it('should compute hash for arbitrary proposal', function() {
+      var header1 = {
+        type: 'simple',
+        version: '1.0',
+        toAddress: 'msj42CCGruhRsFrGATiUuh25dtxYtnpbTx',
+        amount: 1234,
+        message: {
+          one: 'one',
+          two: 'two'
+        },
+      };
+
+      var header2 = {
+        toAddress: 'msj42CCGruhRsFrGATiUuh25dtxYtnpbTx',
+        type: 'simple',
+        version: '1.0',
+        message: {
+          two: 'two',
+          one: 'one'
+        },
+        amount: 1234,
+      };
+
+      var hash1 = WalletUtils.getProposalHash(header1);
+      var hash2 = WalletUtils.getProposalHash(header2);
+
+      hash1.should.equal(hash2);
+    });
+  });
+
   describe('#getNetworkFromXPubKey', function() {
@@ -253,6 +288,7 @@ it('should check correctly', function() {
         },
-        feePerKb: 15000,
         requiredSignatures: 1,
         outputOrder: [0, 1]
       };
+
+      txp.feePerKb = 100;
       (function() {
@@ -262,4 +298,8 @@ WalletUtils.buildTx(txp);
 
+      txp.feePerKb = 15000;
+      (function() {
+        WalletUtils.buildTx(txp);
+      }).should.throw('Illegal Argument');
+
       txp.feePerKb = 5000;
-
       var t = WalletUtils.buildTx(txp);
@@ -272,2 +312,46 @@ var bitcoreError = t.getSerializationError({
     });
+
+    it('should protect from creating excessive fee', function() {
+      var hdPrivateKey = new Bitcore.HDPrivateKey('tprv8ZgxMBicQKsPdPLE72pfSo7CvzTsWddGHdwSuMNrcerr8yQZKdaPXiRtP9Ew8ueSe9M7jS6RJsp4DiAVS2xmyxcCC9kZV6X1FMsX7EQX2R5');
+      var derivedPrivateKey = hdPrivateKey.derive(WalletUtils.PATHS.BASE_ADDRESS_DERIVATION);
+
+      var toAddress = 'msj42CCGruhRsFrGATiUuh25dtxYtnpbTx';
+      var changeAddress = 'msj42CCGruhRsFrGATiUuh25dtxYtnpbTx';
+
+      var publicKeyRing = [{
+        xPubKey: new Bitcore.HDPublicKey(derivedPrivateKey)
+      }];
+
+      var utxos = helpers.generateUtxos(publicKeyRing, 'm/1/0', 1, [1, 2]);
+      var txp = {
+        inputs: utxos,
+        toAddress: toAddress,
+        amount: 1.2,
+        changeAddress: {
+          address: changeAddress
+        },
+        requiredSignatures: 1,
+        outputOrder: [0, 1]
+      };
+
+
+      var x = WalletUtils.newBitcoreTransaction;
+
+      WalletUtils.newBitcoreTransaction = function() {
+        return {
+          from: sinon.stub(),
+          to: sinon.stub(),
+          change: sinon.stub(),
+          outputs: [{
+            satoshis: 1000,
+          }],
+        }
+      };
+
+      (function() {
+        var t = WalletUtils.buildTx(txp);
+      }).should.throw('Illegal State');
+
+      WalletUtils.newBitcoreTransaction = x;
+    });
   });
@@ -274,0 +358,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

26229

increased by14.39%

Lines of code

604

increased by17.74%

Worsened metrics

Dependency count

7

increased by16.67%

Dependency changes

• + Addedjson-stable-stringify@^1.0.0

• + Addedcall-bind@1.0.7(transitive)

• + Addeddefine-data-property@1.1.4(transitive)

• + Addedes-define-property@1.0.0(transitive)

• + Addedes-errors@1.3.0(transitive)

• + Addedfunction-bind@1.1.2(transitive)

• + Addedget-intrinsic@1.2.4(transitive)

• + Addedgopd@1.0.1(transitive)

• + Addedhas-property-descriptors@1.0.2(transitive)

• + Addedhas-proto@1.0.3(transitive)

• + Addedhas-symbols@1.0.3(transitive)

• + Addedhasown@2.0.2(transitive)

• + Addedisarray@2.0.5(transitive)

• + Addedjson-stable-stringify@1.1.1(transitive)

• + Addedjsonify@0.0.1(transitive)

• + Addedobject-keys@1.1.1(transitive)

• + Addedset-function-length@1.2.2(transitive)