Skip to content

feat(crypto): validate BTC/ETH address checksums - #11

Draft
ClaudiuCeia with Copilot wants to merge 3 commits into
mainfrom
copilot/validate-btc-eth-address-checksums
Draft

feat(crypto): validate BTC/ETH address checksums#11
ClaudiuCeia with Copilot wants to merge 3 commits into
mainfrom
copilot/validate-btc-eth-address-checksums

Conversation

Copilot AI commented Jul 25, 2026

Copy link
Copy Markdown

Crypto addresses were accepted on shape alone — a single-character mutation of a valid address still matched. This adds full cryptographic checksum validation as a post-shape guard, keeping regexes as cheap prefilters.

BTC P2PKH / P2SH (Base58Check)

  • Replaces length-only guard with full Base58 decode → 25-byte length check → version byte assertion (0x00/0x05) → double-SHA-256 checksum verification via @std/crypto digestSync

BTC Bech32 / Bech32m

  • Replaces length-only guard with full polymod check (Bech32 constant 1, Bech32m constant 0x2bc830a3)
  • Validates witness program length (20 or 32 bytes for v0, 32 for v1) and zero-padding of the final 5-bit group
  • Accepts all-uppercase or all-lowercase; rejects mixed case
  • Parser updated to match BC1Q… / BC1P… in addition to their lowercase forms

ETH (EIP-55)

  • All-lowercase and all-uppercase addresses accepted unconditionally
  • Mixed-case triggers Keccak-256(lowercase body) checksum: each alphabetic hex character must be upper iff the corresponding hash nibble ≥ 8

Dependency

  • Adds @std/crypto@1 for synchronous digestSync (SHA-256 and KECCAK-256)

Tests

  • Existing test vectors replaced with spec-sourced addresses (BIP-0173, BIP-0350, EIP-55 spec)
  • One-character mutation → reject for all four address types
  • Uppercase Bech32 (BC1QW508D6QEJXTDG4Y5R3ZARVARY0C5XW7KV8F3T4) → accept
  • All four EIP-55 spec addresses → accept; single case-bit flip → reject

Copilot AI added 2 commits July 25, 2026 13:27
- Add @std/crypto dependency for SHA-256 (Base58Check) and Keccak-256 (EIP-55)
- Replace length-only BTC Base58Check guard with full decode + double-SHA-256 checksum verification (version bytes 0x00/0x05)
- Replace length-only Bech32 guard with full polymod (Bech32 const=1, Bech32m const=0x2bc830a3), witness program length/padding checks
- Accept uppercase Bech32/Bech32m addresses (BC1Q.../BC1P...); reject mixed-case
- Add EIP-55 Keccak-256 checksum validation for mixed-case ETH addresses; accept all-lower/all-upper freely
- Use BIP-0173/BIP-0350/EIP-55 spec test vectors in tests
- Add one-char mutation rejection tests for P2PKH, P2SH, Bech32, Bech32m
- Add uppercase Bech32 acceptance test
- Add EIP-55 acceptance (spec addresses) and rejection (case-bit flip) tests
- Use regex + optional chaining for declarative leading-zeros count
- Build base58 byte array with push+reverse instead of repeated unshift
- Add comment explaining Bech32 padding constraint (BIP-0173/0350)
- Extract byteIndex variable to avoid duplicate Math.floor(i/2) in EIP-55 loop
Copilot AI changed the title [WIP] Validate BTC and ETH address checksums feat(crypto): validate BTC/ETH address checksums Jul 25, 2026
Copilot AI requested a review from ClaudiuCeia July 25, 2026 13:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

crypto: validate BTC/ETH address checksums

2 participants