Merge branch 'master' into DX-1556-Address-Karma-Cross-Site-Scripting-Vulnerability-GHSA-7x7c-qm48-pq9c

TICKET: DX-1556

Author: koralkulacoglu

.github/workflows/ci.yml

@@ -134,6 +134,43 @@ jobs:
         if: matrix.check == 'audit'
         run: yarn run improved-yarn-audit --min-severity high
 
+  license-analysis:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup node 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: restore lerna dependencies
+        id: lerna-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
+        with:
+          path: |
+            node_modules
+            modules/*/node_modules
+          key: ${{ runner.os }}-node22-${{ hashFiles('yarn.lock') }}-${{ hashFiles('tsconfig.packages.json') }}-${{ hashFiles('package.json') }}
+
+      - name: Install Packages
+        if: steps.lerna-cache.outputs.cache-hit != 'true'
+        run: yarn install --with-frozen-lockfile --ignore-scripts
+
+      - name: build packages
+        env:
+          # Workaround for https://github.com/nodejs/node/issues/51555
+          DISABLE_V8_COMPILE_CACHE: '1'
+        run: yarn run postinstall
+
+      - name: Run Fossa Analysis
+        uses: fossas/fossa-action@3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac # v1.7.0
+        with:
+          api-key: ${{ secrets.FOSSA_API_KEY }}
+          branch: ${{ github.head_ref || github.ref_name }}
+          project: BitGo/BitGoJS
+
   browser-test:
     runs-on: ubuntu-22.04
 

modules/abstract-eth/src/lib/transactionBuilder.ts

@@ -248,7 +248,7 @@ export abstract class TransactionBuilder extends BaseTransactionBuilder {
       case TransactionType.FlushERC721:
         this.setContract(transactionJson.to);
         const erc721Data = decodeFlushERC721TokensData(transactionJson.data, transactionJson.to);
-        if (erc721Data.forwarderVersion >= 4) {
+        if (erc721Data.forwarderVersion === 4) {
           this.forwarderVersion(erc721Data.forwarderVersion);
         }
         this.forwarderAddress(erc721Data.forwarderAddress);
@@ -258,7 +258,7 @@ export abstract class TransactionBuilder extends BaseTransactionBuilder {
       case TransactionType.FlushERC1155:
         this.setContract(transactionJson.to);
         const erc1155Data = decodeFlushERC1155TokensData(transactionJson.data, transactionJson.to);
-        if (erc1155Data.forwarderVersion >= 4) {
+        if (erc1155Data.forwarderVersion === 4) {
           this.forwarderVersion(erc1155Data.forwarderVersion);
         }
         this.forwarderAddress(erc1155Data.forwarderAddress);

modules/abstract-eth/src/lib/utils.ts

@@ -259,7 +259,7 @@ export function decodeFlushERC721TokensData(
   forwarderAddress: string;
   tokenAddress: string;
   tokenId: string;
-  forwarderVersion: number;
+  forwarderVersion?: number;
 } {
   if (data.startsWith(flushERC721ForwarderTokensMethodIdV4)) {
     if (!to) {
@@ -284,7 +284,6 @@ export function decodeFlushERC721TokensData(
       forwarderAddress: addHexPrefix(forwarderAddress as string),
       tokenAddress: addHexPrefix(tokenAddress as string),
       tokenId: new BigNumber(bufferToHex(tokenId as Buffer)).toFixed(),
-      forwarderVersion: 0,
     };
   }
   throw new BuildTransactionError(`Invalid flush ERC721 bytecode: ${data}`);
@@ -332,7 +331,7 @@ export function decodeFlushERC1155TokensData(
   forwarderAddress: string;
   tokenAddress: string;
   tokenId: string;
-  forwarderVersion: number;
+  forwarderVersion?: number;
 } {
   if (data.startsWith(flushERC1155ForwarderTokensMethodIdV4)) {
     if (!to) {
@@ -357,7 +356,6 @@ export function decodeFlushERC1155TokensData(
       forwarderAddress: addHexPrefix(forwarderAddress as string),
       tokenAddress: addHexPrefix(tokenAddress as string),
       tokenId: new BigNumber(bufferToHex(tokenId as Buffer)).toFixed(),
-      forwarderVersion: 0,
     };
   }
   throw new BuildTransactionError(`Invalid flush ERC1155 bytecode: ${data}`);

modules/abstract-eth/test/unit/utils.ts

@@ -39,7 +39,7 @@ describe('Abstract ETH Utils', () => {
       const forwarderAddress = '0x8f977e912ef500548a0c3be6ddde9899f1199b81';
       const tokenAddress = '0xdf7decb1baa8f529f0c8982cbb4be50357195299';
       const tokenId = '12345';
-      const forwarderVersion = 0;
+      const forwarderVersion = 2;
 
       const encoded = flushERC721TokensData(forwarderAddress, tokenAddress, tokenId, forwarderVersion);
       const decoded = decodeFlushERC721TokensData(encoded);
@@ -48,7 +48,7 @@ describe('Abstract ETH Utils', () => {
       decoded.forwarderAddress.toLowerCase().should.equal(forwarderAddress.toLowerCase());
       decoded.tokenAddress.toLowerCase().should.equal(tokenAddress.toLowerCase());
       decoded.tokenId.should.equal(tokenId);
-      decoded.forwarderVersion.should.equal(0);
+      should.not.exist(decoded.forwarderVersion);
     });
 
     it('should decode flush ERC721 data correctly for v4+', () => {
@@ -64,7 +64,8 @@ describe('Abstract ETH Utils', () => {
       decoded.forwarderAddress.toLowerCase().should.equal(forwarderAddress.toLowerCase());
       decoded.tokenAddress.toLowerCase().should.equal(tokenAddress.toLowerCase());
       decoded.tokenId.should.equal(tokenId);
-      decoded.forwarderVersion.should.equal(4);
+      should.exist(decoded.forwarderVersion);
+      should.equal(decoded.forwarderVersion, 4);
     });
 
     it('should handle large token IDs for ERC721', () => {
@@ -133,7 +134,7 @@ describe('Abstract ETH Utils', () => {
       const forwarderAddress = '0x8f977e912ef500548a0c3be6ddde9899f1199b81';
       const tokenAddress = '0xdf7decb1baa8f529f0c8982cbb4be50357195299';
       const tokenId = '99999';
-      const forwarderVersion = 0;
+      const forwarderVersion = 2;
 
       const encoded = flushERC1155TokensData(forwarderAddress, tokenAddress, tokenId, forwarderVersion);
       const decoded = decodeFlushERC1155TokensData(encoded);
@@ -142,7 +143,7 @@ describe('Abstract ETH Utils', () => {
       decoded.forwarderAddress.toLowerCase().should.equal(forwarderAddress.toLowerCase());
       decoded.tokenAddress.toLowerCase().should.equal(tokenAddress.toLowerCase());
       decoded.tokenId.should.equal(tokenId);
-      decoded.forwarderVersion.should.equal(0);
+      should.not.exist(decoded.forwarderVersion);
     });
 
     it('should decode flush ERC1155 data correctly for v4+', () => {
@@ -158,7 +159,8 @@ describe('Abstract ETH Utils', () => {
       decoded.forwarderAddress.toLowerCase().should.equal(forwarderAddress.toLowerCase());
       decoded.tokenAddress.toLowerCase().should.equal(tokenAddress.toLowerCase());
       decoded.tokenId.should.equal(tokenId);
-      decoded.forwarderVersion.should.equal(4);
+      should.exist(decoded.forwarderVersion);
+      should.equal(decoded.forwarderVersion, 4);
     });
 
     it('should handle token ID 0 for ERC1155', () => {

modules/abstract-substrate/src/lib/iface.ts

@@ -79,6 +79,10 @@ export const MethodNames = {
    * Transfer stake from one validator to another.
    */
   TransferStake: 'transferStake' as const,
+  /**
+   * Move stake from one hotkey to another.
+   */
+  MoveStake: 'moveStake' as const,
 } as const;
 
 /**
@@ -195,6 +199,14 @@ export interface TransferStakeArgs extends Args {
   alphaAmount: string;
 }
 
+export interface MoveStakeArgs extends Args {
+  originHotkey: string;
+  destinationHotkey: string;
+  originNetuid: string;
+  destinationNetuid: string;
+  alphaAmount: string;
+}
+
 /**
  * Decoded TxMethod from a transaction hex
  */
@@ -211,7 +223,8 @@ export interface TxMethod {
     | UnbondArgs
     | WithdrawUnbondedArgs
     | BatchArgs
-    | TransferStakeArgs;
+    | TransferStakeArgs
+    | MoveStakeArgs;
   name: MethodNamesValues;
   pallet: string;
 }

modules/abstract-substrate/src/lib/txnSchema.ts

@@ -65,3 +65,11 @@ export const TransferStakeTransactionSchema = joi.object({
   destinationNetuid: joi.string().required(),
   alphaAmount: joi.string().required(),
 });
+
+export const MoveStakeTransactionSchema = joi.object({
+  originHotkey: addressSchema.required(),
+  destinationHotkey: addressSchema.required(),
+  originNetuid: joi.string().required(),
+  destinationNetuid: joi.string().required(),
+  alphaAmount: joi.string().required(),
+});

modules/abstract-substrate/src/lib/utils.ts

@@ -8,7 +8,7 @@ import { hexToU8a, isHex, u8aToHex, u8aToU8a } from '@polkadot/util';
 import { base64Decode, signatureVerify } from '@polkadot/util-crypto';
 import { UnsignedTransaction } from '@substrate/txwrapper-core';
 import { DecodedSignedTx, DecodedSigningPayload, TypeRegistry } from '@substrate/txwrapper-core/lib/types';
-import { construct } from '@substrate/txwrapper-polkadot';
+import { construct, decode } from '@substrate/txwrapper-polkadot';
 import bs58 from 'bs58';
 import base32 from 'hi-base32';
 import nacl from 'tweetnacl';
@@ -28,7 +28,9 @@ import {
   UnbondArgs,
   WithdrawUnbondedArgs,
   BatchArgs,
+  MoveStakeArgs,
 } from './iface';
+import { SingletonRegistry } from './singletonRegistry';
 
 export class Utils implements BaseUtils {
   /** @inheritdoc */
@@ -263,6 +265,16 @@ export class Utils implements BaseUtils {
     return (arg as BatchArgs).calls !== undefined && Array.isArray((arg as BatchArgs).calls);
   }
 
+  isMoveStake(arg: TxMethod['args']): arg is MoveStakeArgs {
+    return (
+      (arg as MoveStakeArgs).originHotkey !== undefined &&
+      (arg as MoveStakeArgs).destinationHotkey !== undefined &&
+      (arg as MoveStakeArgs).originNetuid !== undefined &&
+      (arg as MoveStakeArgs).destinationNetuid !== undefined &&
+      (arg as MoveStakeArgs).alphaAmount !== undefined
+    );
+  }
+
   /**
    * extracts and returns the signature in hex format given a raw signed transaction
    *
@@ -306,6 +318,31 @@ export class Utils implements BaseUtils {
   getMaterial(networkType: NetworkType): Material {
     throw new Error('Method not implemented.');
   }
+
+  /**
+   * Decodes a substrate transaction from raw transaction hex
+   *
+   * @param {string} txHex - The raw transaction hex string to decode (signed or unsigned)
+   * @param {Material} material - Network material containing metadata and chain information
+   * @param {boolean} [isImmortalEra] - Whether the transaction uses immortal era (optional)
+   * @returns {DecodedSignedTx | DecodedSigningPayload} The decoded transaction object
+   */
+  decodeTransaction(txHex: string, material: Material, isImmortalEra = false): DecodedSignedTx | DecodedSigningPayload {
+    try {
+      const registry = SingletonRegistry.getInstance(material);
+
+      // Attempt to decode as a signed transaction or unsigned transaction
+      const decoded = decode(txHex, {
+        metadataRpc: material.metadata,
+        registry,
+        isImmortalEra,
+      });
+
+      return decoded;
+    } catch (error) {
+      throw new Error(`Failed to decode transaction: ${error}`);
+    }
+  }
 }
 
 const utils = new Utils();

modules/bitgo/src/v2/coinFactory.ts

@@ -37,6 +37,7 @@ import {
   VetTokenConfig,
   TaoTokenConfig,
   PolyxTokenConfig,
+  JettonTokenConfig,
 } from '@bitgo/statics';
 import {
   Ada,
@@ -99,6 +100,7 @@ import {
   Injective,
   Iota,
   Islm,
+  JettonToken,
   Lnbtc,
   Ltc,
   Mon,
@@ -528,6 +530,10 @@ export function registerCoinConstructors(coinFactory: CoinFactory, coinMap: Coin
     ({ name, coinConstructor }) => coinFactory.register(name, coinConstructor)
   );
 
+  JettonToken.createTokenConstructors([...tokens.bitcoin.ton.tokens, ...tokens.testnet.ton.tokens]).forEach(
+    ({ name, coinConstructor }) => coinFactory.register(name, coinConstructor)
+  );
+
   VetToken.createTokenConstructors().forEach(({ name, coinConstructor }) =>
     coinFactory.register(name, coinConstructor)
   );
@@ -971,6 +977,9 @@ export function getTokenConstructor(tokenConfig: TokenConfig): CoinConstructor |
     case 'flr':
     case 'tflr':
       return FlrToken.createTokenConstructor(tokenConfig as EthLikeTokenConfig);
+    case 'ton':
+    case 'tton':
+      return JettonToken.createTokenConstructor(tokenConfig as JettonTokenConfig);
     default:
       return undefined;
   }

modules/bitgo/src/v2/coins/index.ts

@@ -60,7 +60,7 @@ import { Stx, Tstx, Sip10Token } from '@bitgo/sdk-coin-stx';
 import { Sui, Tsui, SuiToken } from '@bitgo/sdk-coin-sui';
 import { Tao, Ttao, TaoToken } from '@bitgo/sdk-coin-tao';
 import { Tia, Ttia } from '@bitgo/sdk-coin-tia';
-import { Ton, Tton } from '@bitgo/sdk-coin-ton';
+import { Ton, Tton, JettonToken } from '@bitgo/sdk-coin-ton';
 import { Trx, Ttrx } from '@bitgo/sdk-coin-trx';
 import { StellarToken, Txlm, Xlm } from '@bitgo/sdk-coin-xlm';
 import { Vet, Tvet, VetToken } from '@bitgo/sdk-coin-vet';
@@ -131,7 +131,7 @@ export { Stx, Tstx, Sip10Token };
 export { Sui, Tsui, SuiToken };
 export { Tao, Ttao, TaoToken };
 export { Tia, Ttia };
-export { Ton, Tton };
+export { Ton, Tton, JettonToken };
 export { Bld, Tbld };
 export { Sei, Tsei };
 export { Injective, Tinjective };

modules/bitgo/test/browser/browser.spec.ts

@@ -57,6 +57,7 @@ describe('Coins', () => {
       EthLikeErc20Token: 1,
       HashToken: 1,
       FlrToken: 1,
+      JettonToken: 1,
     };
     Object.keys(BitGoJS.Coin)
       .filter((coinName) => !excludedKeys[coinName])