Skip to content

Fix vulnerabilities #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
welldan97 merged 5 commits into from
Jan 28, 2026
Merged

Fix vulnerabilities #120

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1b96fd0
Fix vulnerabilities
welldan97 Jan 26, 2026
c9d94e2
Bump package versions
welldan97 Jan 26, 2026
839cedc
Fix linting issues
welldan97 Jan 26, 2026
c32324e
Remove verbose comments
welldan97 Jan 26, 2026
3ee506f
Update cosmjs-types
welldan97 Jan 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2,020 changes: 806 additions & 1,214 deletions package-lock.json
View file
Open in desktop

Large diffs are not rendered by default.

15 changes: 8 additions & 7 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
"chai-as-promised": "^8.0.2",
"chai-spies": "^1.1.0",
"globals": "^15.4.0",
"mocha": "11.7.2",
"mocha": "11.7.5",
"prettier": "^3.3.2",
"tsx": "^4.16.2",
"turbo": "^2.0.6",
Expand All @@ -32,12 +32,13 @@
"typescript-eslint": "^7.13.0"
},
"overrides": {
"chalk": "5.6.2",
"strip-ansi": "7.1.2",
"wrap-ansi": "9.0.2",
"ansi-styles": "6.2.3",
"supports-color": "10.2.2",
"log-symbols": "7.0.1"
"chalk": "4.1.2",
Copy link
Copy Markdown
Contributor

@Pessina Pessina Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm curious, why downgrading those packages?

Isn't better to upgrade to a maintained version?

Copy link
Copy Markdown
Contributor Author

@welldan97 welldan97 Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Pessina, something changed with ESLint - it started failing, and then these versions worked

"strip-ansi": "6.0.1",
"wrap-ansi": "7.0.0",
"ansi-styles": "4.3.0",
"supports-color": "8.1.1",
"log-symbols": "4.1.0",
"diff": "8.0.3"
},
"workspaces": [
"packages/*"
Expand Down
4 changes: 2 additions & 2 deletions packages/avalanche/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@chorus-one/avalanche",
"version": "1.0.0",
"version": "1.0.1",
"description": "All-in-one toolkit for building staking dApps on Avalanche",
"scripts": {
"build": "rm -fr dist/* && tsc -p tsconfig.mjs.json --outDir dist/mjs && tsc -p tsconfig.cjs.json --outDir dist/cjs && bash ../../scripts/fix-package-json"
Expand Down Expand Up @@ -36,9 +36,9 @@
"@avalabs/avalanchejs": "^4.0.5",
"@chorus-one/signer": "^1.0.0",
"@chorus-one/utils": "^1.0.0",
"@noble/curves": "^1.9.2",
"@noble/hashes": "^1.4.0",
"ethers": "^6.13.0",
"secp256k1": "^5.0.0",
"bignumber.js": "^9.1.2"
}
}
6 changes: 3 additions & 3 deletions packages/avalanche/src/tx.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
import { secp256k1 as avalancheSecp256k1, utils } from '@avalabs/avalanchejs'
import { checkMaxDecimalPlaces } from '@chorus-one/utils'
import { Context } from '@avalabs/avalanchejs'
import secp256k1 from 'secp256k1'
import { secp256k1 } from '@noble/curves/secp256k1'
import { AvalancheAddressSet } from './types.d'
import { BigNumber } from 'bignumber.js'

/** @ignore */
export function publicKeyToAddress (pk: Uint8Array, hrp: string): AvalancheAddressSet {
const pkUncompressed = secp256k1.publicKeyConvert(pk, false)
const point = secp256k1.Point.fromHex(pk)

// NOTE: avalanchejs publicKeyBytesToAddress expects compressed public key!!! (otherwise you get wrong address)
const pkCompressed = secp256k1.publicKeyConvert(pkUncompressed, true)
const pkCompressed = point.toBytes(true)

// generate C-Chain and P-Chain addresses
const addrBytes = avalancheSecp256k1.publicKeyBytesToAddress(pkCompressed)
Expand Down
18 changes: 9 additions & 9 deletions packages/cosmos/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@chorus-one/cosmos",
"version": "1.3.6",
"version": "1.3.7",
"description": "All-in-one toolkit for building staking dApps on Cosmos SDK based networks",
"scripts": {
"build": "rm -fr dist/* && tsc -p tsconfig.mjs.json --outDir dist/mjs && tsc -p tsconfig.cjs.json --outDir dist/cjs && bash ../../scripts/fix-package-json"
Expand Down Expand Up @@ -34,14 +34,14 @@
"dependencies": {
"@chorus-one/signer": "^1.0.0",
"@chorus-one/utils": "^1.0.2",
"@cosmjs/amino": "^0.33.1",
"@cosmjs/crypto": "^0.33.1",
"@cosmjs/encoding": "^0.33.1",
"@cosmjs/math": "^0.33.1",
"@cosmjs/proto-signing": "^0.33.1",
"@cosmjs/stargate": "^0.33.1",
"@cosmjs/amino": "^0.38.1",
"@cosmjs/crypto": "^0.38.1",
"@cosmjs/encoding": "^0.38.1",
"@cosmjs/math": "^0.38.1",
"@cosmjs/proto-signing": "^0.38.1",
"@cosmjs/stargate": "^0.38.1",
"@noble/curves": "^1.9.2",
"bignumber.js": "^9.1.2",
"cosmjs-types": "^0.9.0",
"secp256k1": "^5.0.0"
"cosmjs-types": "^0.9.0"
}
}
2 changes: 1 addition & 1 deletion packages/cosmos/src/client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ import { connectComet, CometClient } from '@cosmjs/tendermint-rpc'

/** @ignore */
export class CosmosClient extends StargateClient {
static async create (tmClient: CometClient, options: StargateClientOptions): Promise<CosmosClient> {
static create (tmClient: CometClient, options: StargateClientOptions): CosmosClient {
return new CosmosClient(tmClient, options)
}

Expand Down
8 changes: 5 additions & 3 deletions packages/cosmos/src/tx.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ import type { Signature, Signer } from '@chorus-one/signer'
import type { CosmosNetworkConfig, CosmosSigningData } from './types'
import { Sha256, keccak256, Secp256k1 } from '@cosmjs/crypto'

import secp256k1 from 'secp256k1'
import { secp256k1 } from '@noble/curves/secp256k1'
import { SafeJSONStringify, checkMaxDecimalPlaces } from '@chorus-one/utils'
import { CosmosClient } from './client'
import BigNumber from 'bignumber.js'
Expand Down Expand Up @@ -380,14 +380,16 @@ export async function getEthermintAccount (lcdUrl: string, address: string): Pro

/** @ignore */
export function publicKeyToAddress (pk: Uint8Array, bechPrefix: string): string {
const pkCompressed = secp256k1.publicKeyConvert(pk, true)
const point = secp256k1.Point.fromHex(pk)
const pkCompressed = point.toBytes(true)

return toBech32(bechPrefix, rawSecp256k1PubkeyToRawAddress(pkCompressed))
}

/** @ignore */
export function publicKeyToEthBasedAddress (pk: Uint8Array, bechPrefix: string): string {
const pkUncompressed = secp256k1.publicKeyConvert(pk, false)
const point = secp256k1.Point.fromHex(pk)
const pkUncompressed = point.toBytes(false)

const hash = keccak256(pkUncompressed.subarray(1))
const ethAddress = hash.slice(-20)
Expand Down
4 changes: 2 additions & 2 deletions packages/ethereum/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@chorus-one/ethereum",
"version": "2.0.14",
"version": "2.0.15",
"description": "All-in-one toolkit for building staking dApps on Ethereum network",
"scripts": {
"build": "rm -fr dist/* && tsc -p tsconfig.mjs.json --outDir dist/mjs && tsc -p tsconfig.cjs.json --outDir dist/cjs && bash ../../scripts/fix-package-json",
Expand Down Expand Up @@ -38,8 +38,8 @@
"dependencies": {
"@chorus-one/signer": "^1.0.0",
"@chorus-one/utils": "^1.0.2",
"@noble/curves": "^1.9.2",
"decimal.js": "^10.4.3",
"secp256k1": "^5.0.0",
"viem": "^2.28.0"
},
"type": "module",
Expand Down
5 changes: 3 additions & 2 deletions packages/ethereum/src/staker.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import type { Signer } from '@chorus-one/signer'
import secp256k1 from 'secp256k1'
import { secp256k1 } from '@noble/curves/secp256k1'
import {
Chain,
createWalletClient,
Expand Down Expand Up @@ -67,7 +67,8 @@ export class EthereumStaker {
static getAddressDerivationFn =
() =>
async (publicKey: Uint8Array): Promise<Array<string>> => {
const pkUncompressed = secp256k1.publicKeyConvert(publicKey, false)
const point = secp256k1.Point.fromHex(publicKey)
const pkUncompressed = point.toBytes(false)
const hash = keccak256(pkUncompressed.subarray(1))
const ethAddress = hash.slice(-40)
return [ethAddress]
Expand Down
4 changes: 2 additions & 2 deletions packages/hyperliquid/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@chorus-one/hyperliquid",
"version": "1.0.0",
"version": "1.0.1",
"description": "All-in-one toolkit for building staking dApps on hyperliquid network",
"scripts": {
"build": "rm -fr dist/* && tsc -p tsconfig.mjs.json --outDir dist/mjs && tsc -p tsconfig.cjs.json --outDir dist/cjs && bash ../../scripts/fix-package-json",
Expand Down Expand Up @@ -36,7 +36,7 @@
"dependencies": {
"@chorus-one/signer": "^1.0.0",
"@chorus-one/utils": "^1.0.2",
"secp256k1": "^5.0.0",
"@noble/curves": "^1.9.2",
"viem": "^2.28.0",
"zod": "^3.25.76"
},
Expand Down
5 changes: 3 additions & 2 deletions packages/hyperliquid/src/staker.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import type { Signer } from '@chorus-one/signer'
import secp256k1 from 'secp256k1'
import { secp256k1 } from '@noble/curves/secp256k1'
import { keccak256, hashTypedData, type Hex, type Address, TypedDataDefinition, parseUnits } from 'viem'
import type {
HyperliquidChain,
Expand Down Expand Up @@ -98,7 +98,8 @@ export class HyperliquidStaker {
static getAddressDerivationFn =
() =>
async (publicKey: Uint8Array): Promise<Array<string>> => {
const pkUncompressed = secp256k1.publicKeyConvert(publicKey, false)
const point = secp256k1.Point.fromHex(publicKey)
const pkUncompressed = point.toBytes(false)
const hash = keccak256(pkUncompressed.subarray(1))
const ethAddress = '0x' + hash.slice(-40)
return [ethAddress]
Expand Down
2 changes: 1 addition & 1 deletion packages/hyperliquid/test/staker.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ use(chaiAsPromised)

const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))

describe.only('HyperliquidStaker', () => {
describe('HyperliquidStaker', () => {
let staker: HyperliquidStaker
const delegatorAddress = '0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266'

Expand Down
4 changes: 2 additions & 2 deletions packages/monad/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@chorus-one/monad",
"version": "1.0.2",
"version": "1.0.3",
"description": "All-in-one toolkit for building staking dApps on monad network",
"scripts": {
"build": "rm -fr dist/* && tsc -p tsconfig.mjs.json --outDir dist/mjs && tsc -p tsconfig.cjs.json --outDir dist/cjs && bash ../../scripts/fix-package-json",
Expand Down Expand Up @@ -36,7 +36,7 @@
"dependencies": {
"@chorus-one/signer": "^1.0.0",
"@chorus-one/utils": "^1.0.2",
"secp256k1": "^5.0.0",
"@noble/curves": "^1.9.2",
"viem": "^2.28.0"
},
"devDependencies": {
Expand Down
5 changes: 3 additions & 2 deletions packages/monad/src/staker.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ import {
type Chain,
type GetContractReturnType
} from 'viem'
import secp256k1 from 'secp256k1'
import { secp256k1 } from '@noble/curves/secp256k1'
import type { Signer } from '@chorus-one/signer'
import type { DelegatorInfo, WithdrawalRequestInfo, EpochInfo, Transaction, MonadTxStatus } from './types.d'
import { isValidValidatorId, isValidWithdrawalId } from './utils'
Expand Down Expand Up @@ -83,7 +83,8 @@ export class MonadStaker {
static getAddressDerivationFn =
() =>
async (publicKey: Uint8Array): Promise<Array<string>> => {
const pkUncompressed = secp256k1.publicKeyConvert(publicKey, false)
const point = secp256k1.Point.fromHex(publicKey)
const pkUncompressed = point.toBytes(false)
const hash = keccak256(pkUncompressed.subarray(1))
const ethAddress = hash.slice(-40)
return [ethAddress]
Expand Down