Fix vulnerabilities

welldan97 · welldan97 · commit 1b96fd077427 · 2026-01-26T05:14:01.000Z
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -22,7 +22,7 @@
     "chai-as-promised": "^8.0.2",
     "chai-spies": "^1.1.0",
     "globals": "^15.4.0",
-    "mocha": "11.7.2",
+    "mocha": "11.7.5",
     "prettier": "^3.3.2",
     "tsx": "^4.16.2",
     "turbo": "^2.0.6",
@@ -37,7 +37,8 @@
     "wrap-ansi": "9.0.2",
     "ansi-styles": "6.2.3",
     "supports-color": "10.2.2",
-    "log-symbols": "7.0.1"
+    "log-symbols": "7.0.1",
+    "diff": "8.0.3"
   },
   "workspaces": [
     "packages/*"
diff --git a/packages/avalanche/package.json b/packages/avalanche/package.json
@@ -36,9 +36,9 @@
     "@avalabs/avalanchejs": "^4.0.5",
     "@chorus-one/signer": "^1.0.0",
     "@chorus-one/utils": "^1.0.0",
+    "@noble/curves": "^1.9.2",
     "@noble/hashes": "^1.4.0",
     "ethers": "^6.13.0",
-    "secp256k1": "^5.0.0",
     "bignumber.js": "^9.1.2"
   }
 }
diff --git a/packages/avalanche/src/tx.ts b/packages/avalanche/src/tx.ts
@@ -1,16 +1,18 @@
 import { secp256k1 as avalancheSecp256k1, utils } from '@avalabs/avalanchejs'
 import { checkMaxDecimalPlaces } from '@chorus-one/utils'
 import { Context } from '@avalabs/avalanchejs'
-import secp256k1 from 'secp256k1'
+import { secp256k1 } from '@noble/curves/secp256k1'
 import { AvalancheAddressSet } from './types.d'
 import { BigNumber } from 'bignumber.js'
 
 /** @ignore */
 export function publicKeyToAddress (pk: Uint8Array, hrp: string): AvalancheAddressSet {
-  const pkUncompressed = secp256k1.publicKeyConvert(pk, false)
+  // Convert public key using @noble/curves
+  const point = secp256k1.Point.fromHex(pk)
+  const pkUncompressed = point.toBytes(false)
 
   // NOTE: avalanchejs publicKeyBytesToAddress expects compressed public key!!! (otherwise you get wrong address)
-  const pkCompressed = secp256k1.publicKeyConvert(pkUncompressed, true)
+  const pkCompressed = point.toBytes(true)
 
   // generate C-Chain and P-Chain addresses
   const addrBytes = avalancheSecp256k1.publicKeyBytesToAddress(pkCompressed)
diff --git a/packages/cosmos/package.json b/packages/cosmos/package.json
@@ -34,14 +34,14 @@
   "dependencies": {
     "@chorus-one/signer": "^1.0.0",
     "@chorus-one/utils": "^1.0.2",
-    "@cosmjs/amino": "^0.33.1",
-    "@cosmjs/crypto": "^0.33.1",
-    "@cosmjs/encoding": "^0.33.1",
-    "@cosmjs/math": "^0.33.1",
-    "@cosmjs/proto-signing": "^0.33.1",
-    "@cosmjs/stargate": "^0.33.1",
+    "@cosmjs/amino": "^0.38.1",
+    "@cosmjs/crypto": "^0.38.1",
+    "@cosmjs/encoding": "^0.38.1",
+    "@cosmjs/math": "^0.38.1",
+    "@cosmjs/proto-signing": "^0.38.1",
+    "@cosmjs/stargate": "^0.38.1",
+    "@noble/curves": "^1.9.2",
     "bignumber.js": "^9.1.2",
-    "cosmjs-types": "^0.9.0",
-    "secp256k1": "^5.0.0"
+    "cosmjs-types": "^0.9.0"
   }
 }
diff --git a/packages/cosmos/src/client.ts b/packages/cosmos/src/client.ts
@@ -19,7 +19,7 @@ import { connectComet, CometClient } from '@cosmjs/tendermint-rpc'
 
 /** @ignore */
 export class CosmosClient extends StargateClient {
-  static async create (tmClient: CometClient, options: StargateClientOptions): Promise<CosmosClient> {
+  static create (tmClient: CometClient, options: StargateClientOptions): CosmosClient {
     return new CosmosClient(tmClient, options)
   }
 
diff --git a/packages/cosmos/src/tx.ts b/packages/cosmos/src/tx.ts
@@ -30,7 +30,7 @@ import type { Signature, Signer } from '@chorus-one/signer'
 import type { CosmosNetworkConfig, CosmosSigningData } from './types'
 import { Sha256, keccak256, Secp256k1 } from '@cosmjs/crypto'
 
-import secp256k1 from 'secp256k1'
+import { secp256k1 } from '@noble/curves/secp256k1'
 import { SafeJSONStringify, checkMaxDecimalPlaces } from '@chorus-one/utils'
 import { CosmosClient } from './client'
 import BigNumber from 'bignumber.js'
@@ -380,14 +380,18 @@ export async function getEthermintAccount (lcdUrl: string, address: string): Pro
 
 /** @ignore */
 export function publicKeyToAddress (pk: Uint8Array, bechPrefix: string): string {
-  const pkCompressed = secp256k1.publicKeyConvert(pk, true)
+  // Convert public key to compressed format using @noble/curves
+  const point = secp256k1.Point.fromHex(pk)
+  const pkCompressed = point.toBytes(true)
 
   return toBech32(bechPrefix, rawSecp256k1PubkeyToRawAddress(pkCompressed))
 }
 
 /** @ignore */
 export function publicKeyToEthBasedAddress (pk: Uint8Array, bechPrefix: string): string {
-  const pkUncompressed = secp256k1.publicKeyConvert(pk, false)
+  // Convert public key to uncompressed format using @noble/curves
+  const point = secp256k1.Point.fromHex(pk)
+  const pkUncompressed = point.toBytes(false)
 
   const hash = keccak256(pkUncompressed.subarray(1))
   const ethAddress = hash.slice(-20)
diff --git a/packages/ethereum/package.json b/packages/ethereum/package.json
@@ -38,8 +38,8 @@
   "dependencies": {
     "@chorus-one/signer": "^1.0.0",
     "@chorus-one/utils": "^1.0.2",
+    "@noble/curves": "^1.9.2",
     "decimal.js": "^10.4.3",
-    "secp256k1": "^5.0.0",
     "viem": "^2.28.0"
   },
   "type": "module",
diff --git a/packages/ethereum/src/staker.ts b/packages/ethereum/src/staker.ts
@@ -1,5 +1,5 @@
 import type { Signer } from '@chorus-one/signer'
-import secp256k1 from 'secp256k1'
+import { secp256k1 } from '@noble/curves/secp256k1'
 import {
   Chain,
   createWalletClient,
@@ -67,7 +67,9 @@ export class EthereumStaker {
   static getAddressDerivationFn =
     () =>
     async (publicKey: Uint8Array): Promise<Array<string>> => {
-      const pkUncompressed = secp256k1.publicKeyConvert(publicKey, false)
+      // Convert public key to uncompressed format using @noble/curves
+      const point = secp256k1.Point.fromHex(publicKey)
+      const pkUncompressed = point.toBytes(false)
       const hash = keccak256(pkUncompressed.subarray(1))
       const ethAddress = hash.slice(-40)
       return [ethAddress]
diff --git a/packages/hyperliquid/package.json b/packages/hyperliquid/package.json
@@ -36,7 +36,7 @@
   "dependencies": {
     "@chorus-one/signer": "^1.0.0",
     "@chorus-one/utils": "^1.0.2",
-    "secp256k1": "^5.0.0",
+    "@noble/curves": "^1.9.2",
     "viem": "^2.28.0",
     "zod": "^3.25.76"
   },
diff --git a/packages/hyperliquid/src/staker.ts b/packages/hyperliquid/src/staker.ts
@@ -1,5 +1,5 @@
 import type { Signer } from '@chorus-one/signer'
-import secp256k1 from 'secp256k1'
+import { secp256k1 } from '@noble/curves/secp256k1'
 import { keccak256, hashTypedData, type Hex, type Address, TypedDataDefinition, parseUnits } from 'viem'
 import type {
   HyperliquidChain,
@@ -98,7 +98,9 @@ export class HyperliquidStaker {
   static getAddressDerivationFn =
     () =>
     async (publicKey: Uint8Array): Promise<Array<string>> => {
-      const pkUncompressed = secp256k1.publicKeyConvert(publicKey, false)
+      // Convert public key to uncompressed format using @noble/curves
+      const point = secp256k1.Point.fromHex(publicKey)
+      const pkUncompressed = point.toBytes(false)
       const hash = keccak256(pkUncompressed.subarray(1))
       const ethAddress = '0x' + hash.slice(-40)
       return [ethAddress]
diff --git a/packages/hyperliquid/test/staker.spec.ts b/packages/hyperliquid/test/staker.spec.ts
@@ -7,7 +7,7 @@ use(chaiAsPromised)
 
 const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
 
-describe.only('HyperliquidStaker', () => {
+describe('HyperliquidStaker', () => {
   let staker: HyperliquidStaker
   const delegatorAddress = '0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266'
 
diff --git a/packages/monad/package.json b/packages/monad/package.json
@@ -36,7 +36,7 @@
   "dependencies": {
     "@chorus-one/signer": "^1.0.0",
     "@chorus-one/utils": "^1.0.2",
-    "secp256k1": "^5.0.0",
+    "@noble/curves": "^1.9.2",
     "viem": "^2.28.0"
   },
   "devDependencies": {
diff --git a/packages/monad/src/staker.ts b/packages/monad/src/staker.ts
@@ -15,7 +15,7 @@ import {
   type Chain,
   type GetContractReturnType
 } from 'viem'
-import secp256k1 from 'secp256k1'
+import { secp256k1 } from '@noble/curves/secp256k1'
 import type { Signer } from '@chorus-one/signer'
 import type { DelegatorInfo, WithdrawalRequestInfo, EpochInfo, Transaction, MonadTxStatus } from './types.d'
 import { isValidValidatorId, isValidWithdrawalId } from './utils'
@@ -83,7 +83,9 @@ export class MonadStaker {
   static getAddressDerivationFn =
     () =>
     async (publicKey: Uint8Array): Promise<Array<string>> => {
-      const pkUncompressed = secp256k1.publicKeyConvert(publicKey, false)
+      // Convert public key to uncompressed format using @noble/curves
+      const point = secp256k1.Point.fromHex(publicKey)
+      const pkUncompressed = point.toBytes(false)
       const hash = keccak256(pkUncompressed.subarray(1))
       const ethAddress = hash.slice(-40)
       return [ethAddress]

Original file line number	Diff line number	Diff line change
`@@ -36,9 +36,9 @@`
`36`	`36`	`"@avalabs/avalanchejs": "^4.0.5",`
`37`	`37`	`"@chorus-one/signer": "^1.0.0",`
`38`	`38`	`"@chorus-one/utils": "^1.0.0",`
	`39`	`+ "@noble/curves": "^1.9.2",`
`39`	`40`	`"@noble/hashes": "^1.4.0",`
`40`	`41`	`"ethers": "^6.13.0",`
`41`		`- "secp256k1": "^5.0.0",`
`42`	`42`	`"bignumber.js": "^9.1.2"`
`43`	`43`	`}`
`44`	`44`	`}`
Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ import { connectComet, CometClient } from '@cosmjs/tendermint-rpc'`
`19`	`19`
`20`	`20`	`/** @ignore */`
`21`	`21`	`export class CosmosClient extends StargateClient {`
`22`		`- static async create (tmClient: CometClient, options: StargateClientOptions): Promise<CosmosClient> {`
	`22`	`+ static create (tmClient: CometClient, options: StargateClientOptions): CosmosClient {`
`23`	`23`	`return new CosmosClient(tmClient, options)`
`24`	`24`	`}`
`25`	`25`