Merge pull request #1357 from rsksmart/security/3.2

alexjavabraz · web-flow · commit 5931fdd81e62 · 2025-12-18T09:48:06.000-03:00
Security fixes
diff --git a/.env.local.test b/.env.local.test
@@ -29,6 +29,7 @@ NODE_ENV=test
 VUE_APP_FLYOVER_GET_PROVIDERS_TIMEOUT=5000
 VUE_APP_API_RESPONSE_TIMEOUT=5000
 VUE_APP_FLYOVER_PEGOUT_QUOTE_DIFF_PERCENTAGE=2
+VUE_APP_FLYOVER_DEPOSIT_PEGOUT_GAS=410700
 VUE_APP_RECAPTCHA_NEW_TOKEN_TIME=30
 
 VUE_APP_CSP=https://staging.lps.tekscapital.com
diff --git a/.github/workflows/deploy_MainNet_UI.yml b/.github/workflows/deploy_MainNet_UI.yml
@@ -60,6 +60,7 @@ jobs:
           VUE_APP_CSP=https://lps.tekscapital.com
           VUE_APP_API_RESPONSE_TIMEOUT=10000
           VUE_APP_REOWN_PROJECT_ID=${{ secrets.MAINNET_VUE_APP_REOWN_PROJECT_ID }}
+          VUE_APP_FLYOVER_DEPOSIT_PEGOUT_GAS=410700
           npm run-script build
 
       - name: Configure AWS credentials
diff --git a/.github/workflows/deploy_TestNet_UI.yml b/.github/workflows/deploy_TestNet_UI.yml
@@ -60,6 +60,7 @@ jobs:
           VUE_APP_CSP=https://staging.lps.tekscapital.com
           VUE_APP_API_RESPONSE_TIMEOUT=10000
           VUE_APP_REOWN_PROJECT_ID=${{ secrets.TESTNET_VUE_APP_REOWN_PROJECT_ID }}
+          VUE_APP_FLYOVER_DEPOSIT_PEGOUT_GAS=410700
           npm run-script build
 
       - name: Configure AWS credentials
diff --git a/.github/workflows/deploy_staging_MainNet_UI.yml b/.github/workflows/deploy_staging_MainNet_UI.yml
@@ -60,6 +60,7 @@ jobs:
           VUE_APP_CSP=https://lps.tekscapital.com
           VUE_APP_API_RESPONSE_TIMEOUT=10000
           VUE_APP_REOWN_PROJECT_ID=${{ secrets.STAGING_MAINNET_VUE_APP_REOWN_PROJECT_ID }}
+          VUE_APP_FLYOVER_DEPOSIT_PEGOUT_GAS=410700
           npm run-script build
 
       - name: Configure AWS credentials
diff --git a/.github/workflows/deploy_staging_TestNet_UI.yml b/.github/workflows/deploy_staging_TestNet_UI.yml
@@ -56,10 +56,11 @@ jobs:
           VUE_APP_FLYOVER_PEGOUT_QUOTE_DIFF_PERCENTAGE=20
           VUE_APP_RECAPTCHA_NEW_TOKEN_TIME=30
           VUE_APP_FLYOVER_PROVIDER_ID=2
-          VUE_APP_FLYOVER_NETWORK=Development
+          VUE_APP_FLYOVER_NETWORK=Testnet
           VUE_APP_CSP=https://staging.lps.tekscapital.com
           VUE_APP_API_RESPONSE_TIMEOUT=10000
           VUE_APP_REOWN_PROJECT_ID=${{ secrets.STAGING_TESTNET_VUE_APP_REOWN_PROJECT_ID }}
+          VUE_APP_FLYOVER_DEPOSIT_PEGOUT_GAS=410700
           npm run-script build
 
       - name: Configure AWS credentials
diff --git a/ENV_VARIABLES.md b/ENV_VARIABLES.md
@@ -28,5 +28,6 @@ The value of these variables are used in **environment-variables.ts** file.
 |VUE_APP_API_RESPONSE_TIMEOUT                 | `10000` | Sets a timeout for calls made to API on search transaction.                 |
 |VUE_APP_REOWN_PROJECT_ID  | `PROJECT_ID` | Reown's AppKit project Id follow [this](https://reown.com/blog/how-to-get-started-with-appkit) instructions to get one. |
 |VUE_APP_FLYOVER_NETWORK                      | `Testnet` | The network to use for Flyover service. Valid values: `Mainnet`, `Testnet`, `Regtest`, `Alphanet`, `Development`. |
+|VUE_APP_FLYOVER_DEPOSIT_PEGOUT_GAS          | `410700` | Gas units to use for deposit pegout transactions (replaces dynamic gas estimation) |
 
 Example for [.env.local.test](https://github.com/rsksmart/2wp-app/blob/main/.env.local.test) file.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -21,12 +21,11 @@
     "@ledgerhq/hw-transport-webusb": "6.27.1",
     "@mdi/font": "^7.2.96",
     "@mdi/js": "^6.9.96",
-    "@reown/appkit": "^1.7.8",
-    "@reown/appkit-adapter-bitcoin": "^1.7.8",
-    "@reown/appkit-adapter-ethers5": "^1.7.8",
+    "@reown/appkit": "^1.8.15",
+    "@reown/appkit-adapter-bitcoin": "^1.8.15",
+    "@reown/appkit-adapter-ethers5": "^1.8.15",
     "@rsksmart/bridges-core-sdk": "^0.5.0",
     "@rsksmart/flyover-sdk": "^1.8.0",
-    "@rsksmart/pmt-builder": "^3.0.1",
     "@rsksmart/rlogin": "^1.6.1",
     "@rsksmart/rlogin-ledger-provider": "^1.0.5-alpha",
     "@rsksmart/rlogin-trezor-provider": "^1.0.6",
diff --git a/src/common/components/exchange/BtcWalletDialog.vue b/src/common/components/exchange/BtcWalletDialog.vue
@@ -222,7 +222,7 @@ export default defineComponent({
       walletType.value = wallet;
     }
 
-    function connectReown(): Promise<void> {
+    function connectReown(): Promise<void | { hash: string }> {
       const { walletProvider } = useAppKitProvider<BitcoinConnector>('bip122');
       const { open: openModal } = useAppKit();
       return new Promise((resolve, reject) => {
@@ -235,7 +235,7 @@ export default defineComponent({
             .then(resolve)
             .catch(reject);
         } else {
-          reject(new Error('Reown aleready connected'));
+          reject(new Error('Reown already connected'));
         }
       });
     }
diff --git a/src/common/components/status/TxPegin.vue b/src/common/components/status/TxPegin.vue
@@ -47,7 +47,7 @@ export default defineComponent({
     const txPeginSummary = computed((): NormalizedSummary => {
       const status = txDetails.value as PeginStatus;
       const total = new SatoshiBig(status.btc.amountTransferred, 'btc')
-        .minus(new SatoshiBig(status.btc.fees, 'btc'));
+        .safeMinus(new SatoshiBig(status.btc.fees, 'btc'));
       return {
         amountFromString: status.btc.amountTransferred.toString(),
         amountReceivedString: total.toBTCTrimmedString(),
diff --git a/src/common/composables/useWallet.ts b/src/common/composables/useWallet.ts
@@ -46,7 +46,7 @@ export function useWallet() {
     });
   }
 
-  function connect(): Promise<void> {
+  function connect(): Promise<void | { hash: string }> {
     return new Promise((resolve) => {
       if (!isWeb3Connected.value) {
         openModal(
diff --git a/src/common/services/FlyoverService.ts b/src/common/services/FlyoverService.ts
@@ -1,5 +1,5 @@
 import {
-  BlockchainConnection, decodeBtcAddress, estimateGas, Network,
+  BlockchainConnection, Network,
 } from '@rsksmart/bridges-core-sdk';
 import {
   AcceptedPegoutQuote, Flyover,
@@ -12,9 +12,8 @@ import {
   LiquidityProvider2WP, PeginQuote, QuotePegOut2WP, WeiBig, SatoshiBig,
 } from '@/common/types';
 import {
-  Wallet, providers, Contract, BigNumber,
+  Wallet, providers,
 } from 'ethers';
-import lbcAbi from '@/common/abis/lbc';
 import { EnvironmentAccessorService } from './enviroment-accessor.service';
 import {
   getBtcAddressType,
@@ -595,56 +594,12 @@ export default class FlyoverService {
     });
   }
 
-  private static toContractPegoutQuote({ quote: detail }: QuotePegOut2WP) {
-    return {
-      lbcAddress: detail.lbcAddress.toLowerCase(),
-      lpRskAddress: detail.liquidityProviderRskAddress.toLowerCase(),
-      btcRefundAddress: decodeBtcAddress(detail.btcRefundAddress),
-      rskRefundAddress: detail.rskRefundAddress.toLowerCase(),
-      lpBtcAddress: decodeBtcAddress(detail.lpBtcAddr),
-      callFee: detail.callFee,
-      penaltyFee: detail.penaltyFee,
-      nonce: detail.nonce,
-      deposityAddress: decodeBtcAddress(detail.depositAddr),
-      value: detail.value,
-      agreementTimestamp: detail.agreementTimestamp,
-      depositDateLimit: detail.depositDateLimit,
-      depositConfirmations: detail.depositConfirmations,
-      transferConfirmations: detail.transferConfirmations,
-      transferTime: detail.transferTime,
-      expireDate: detail.expireDate,
-      expireBlock: detail.expireBlocks,
-      productFeeAmount: detail.productFeeAmount,
-      gasFee: detail.gasFee,
-    };
-  }
-
-  public estimateDepositPegoutGas(
-    balance: WeiBig,
-    btcRecipientAddress: string,
-    rskRefundAddress: string,
-  ): Promise<WeiBig> {
-    return new Promise<WeiBig>((resolve, reject) => {
-      this.getPegoutQuotes(rskRefundAddress, btcRecipientAddress, btcRecipientAddress, balance)
-        .then(([quote]: QuotePegOut2WP[]) => {
-          const amountToTransfer = this.calculateFinalAmountToTransfer(quote.quoteHash);
-          const signatureBytes = '0x';
-          const provider = new providers.JsonRpcProvider(this.providerUrl);
-          const lbcContract = new Contract(this.lbcAddress, lbcAbi, provider);
-          const lbcPegoutQuote = FlyoverService.toContractPegoutQuote(quote);
-          return estimateGas(lbcContract, 'depositPegout', lbcPegoutQuote, signatureBytes, { value: amountToTransfer });
-        })
-        .then((gas: BigNumber | bigint) => {
-          resolve(new WeiBig(gas as bigint, 'wei'));
-        })
-        .catch((error: Error) => {
-          reject(new ServiceError(
-            'FlyoverService',
-            'estimateDepositPegoutGas',
-            'There was an error estimating the gas for the deposit peg-out transaction',
-            error.message,
-          ));
-        });
-    });
+  public static async getDepositPegoutGas(): Promise<WeiBig> {
+    const gasValue = EnvironmentAccessorService.getEnvironmentVariables().flyoverDepositPegoutGas;
+    const provider = new providers.JsonRpcProvider(
+      EnvironmentAccessorService.getEnvironmentVariables().vueAppRskNodeHost,
+    );
+    const gasPrice = await provider.getGasPrice();
+    return new WeiBig(BigInt(gasValue) * BigInt(gasPrice.toBigInt()), 'wei');
   }
 }
diff --git a/src/common/services/ReownService.ts b/src/common/services/ReownService.ts
@@ -31,7 +31,7 @@ export default class ReownService extends WalletService {
         signInputs: reownTx.inputs,
         broadcast: false,
       })
-        .then((signature) => {
+        .then((signature: { psbt: string }) => {
           const signedPsbt = bitcoin.Psbt.fromBase64(signature.psbt || '');
           if (!signedPsbt.validateSignaturesOfAllInputs()) {
             reject(new Error('Invalid signature provided'));
@@ -41,7 +41,7 @@ export default class ReownService extends WalletService {
             });
           }
         })
-        .catch((error) => reject(error));
+        .catch(reject);
     });
   }
 
diff --git a/src/common/store/constants.ts b/src/common/store/constants.ts
@@ -196,6 +196,7 @@ export const FLYOVER_PEGIN_SET_SELECTED_QUOTE = 'FLYOVER_PEGIN_SET_SELECTED_QUOT
 export const FLYOVER_PEGIN_PROVIDERS_SET_AVAILABLE_LIQUIDITY = 'FLYOVER_PEGIN_PROVIDERS_SET_AVAILABLE_LIQUIDITY';
 export const FLYOVER_PEGIN_SET_ACCEPTED_QUOTE_SIGNATURE = 'FLYOVER_PEGIN_SET_ACCEPTED_QUOTE_SIGNATURE';
 export const FLYOVER_PEGIN_SET_QR_DESTINATION_ADDRESS = 'FLYOVER_PEGIN_SET_QR_DESTINATION_ADDRESS';
+export const FLYOVER_PEGIN_SET_MAX_VALUES = 'FLYOVER_PEGIN_SET_MAX_VALUES';
 
 // Session mutations
 export const SESSION_SET_ACCOUNT = 'SESSION_SET_ACCOUNT';
diff --git a/src/common/types/Flyover/FlyoverPegin.ts b/src/common/types/Flyover/FlyoverPegin.ts
@@ -3,6 +3,7 @@ import { LiquidityProvider2WP } from './Flyover';
 import SatoshiBig from '../SatoshiBig';
 import WeiBig from '../WeiBig';
 import PeginQuote from './PeginQuote';
+import { Utxo } from '../pegInTx';
 
 export interface FlyoverPeginState {
     amountToTransfer: SatoshiBig;
@@ -15,4 +16,8 @@ export interface FlyoverPeginState {
     txHash?: string;
     selectedQuoteHash: string;
     acceptedQuoteSignature: string;
+    isMaxSelected: boolean;
+    maxValueToSend: SatoshiBig;
+    maxFee: SatoshiBig;
+    maxSelectedUtxoList: Utxo[];
 }
diff --git a/src/common/types/SatoshiBig.ts b/src/common/types/SatoshiBig.ts
@@ -41,6 +41,14 @@ export default class SatoshiBig extends Big {
     return new SatoshiBig(super.minus(amount), 'satoshi');
   }
 
+  safeMinus(amount: SatoshiBig) {
+    const result = super.minus(amount);
+    if (result.lt(0)) {
+      throw new Error('SatoshiBig underflow: result cannot be negative');
+    }
+    return new SatoshiBig(result, 'satoshi');
+  }
+
   mul(amount: BigSource) {
     return new SatoshiBig(super.mul(amount), 'satoshi');
   }
diff --git a/src/common/types/WeiBig.ts b/src/common/types/WeiBig.ts
@@ -35,8 +35,12 @@ export default class WeiBig extends Big {
     return new WeiBig(super.plus(amount), 'wei');
   }
 
-  minus(amount: WeiBig) {
-    return new WeiBig(super.minus(amount), 'wei');
+  safeMinus(amount: WeiBig) {
+    const result = super.minus(amount);
+    if (result.lt(0)) {
+      throw new Error('WeiBig underflow: result cannot be negative');
+    }
+    return new WeiBig(result, 'wei');
   }
 
   mul(amount: BigSource) {
diff --git a/src/common/types/environment-variables.ts b/src/common/types/environment-variables.ts
@@ -51,6 +51,8 @@ export class EnvironmentVariables {
 
   public flyoverNetwork: Network;
 
+  public flyoverDepositPegoutGas: number;
+
   public minFeeSatPerByte: {
     fast: number;
     average: number;
@@ -119,6 +121,8 @@ export class EnvironmentVariables {
     this.reownProjectId = process.env.VUE_APP_REOWN_PROJECT_ID || '';
     this.flyoverNetwork = (process.env.VUE_APP_FLYOVER_NETWORK as Network)
       || defaultValues.flyoverNetwork;
+    this.flyoverDepositPegoutGas = Number(process.env.VUE_APP_FLYOVER_DEPOSIT_PEGOUT_GAS)
+      || defaultValues.flyoverDepositPegoutGas || 0;
   }
 
   public get chainId(): number {
diff --git a/src/common/utils/common.ts b/src/common/utils/common.ts
@@ -146,6 +146,10 @@ export const getClearFlyoverPeginState = (): FlyoverPeginState => ({
   flyoverService: markRaw(new FlyoverService()),
   selectedQuoteHash: '',
   acceptedQuoteSignature: '',
+  isMaxSelected: false,
+  maxValueToSend: new SatoshiBig(0, 'satoshi'),
+  maxFee: new SatoshiBig(0, 'satoshi'),
+  maxSelectedUtxoList: [],
 });
 
 /**
diff --git a/src/pegin/components/create/BtcInput.vue b/src/pegin/components/create/BtcInput.vue
@@ -30,7 +30,7 @@
             <v-chip variant="outlined" density="compact" @click="setMin">
               {{ boundaries.minValue.toBTCString().slice(0,5) }} MIN
             </v-chip>
-            <v-chip v-if="false" variant="outlined" density="compact" @click="setMax">
+            <v-chip variant="outlined" density="compact" @click="setMax">
               <v-progress-circular v-if="loadingMax"
                 :size="12"
                 :width="2"
@@ -85,7 +85,7 @@ export default defineComponent({
     const boundaries = computed(() => {
       const minValue: SatoshiBig = new SatoshiBig(peginConfiguration.value.minValue, 'btc');
       return {
-        minValue,
+        minValue: minValue.plus(new SatoshiBig(1, 'satoshi')),
       };
     });
     const isComposing = ref(false);
diff --git a/src/pegin/components/create/ConfirmTx.vue b/src/pegin/components/create/ConfirmTx.vue
@@ -149,7 +149,6 @@ export default defineComponent({
               signedTx,
             );
           }
-          console.log('signedTx', signedTx);
           return ApiService.broadcast(signedTx);
         })
         .then((id) => {
diff --git a/src/pegin/components/create/PegInForm.vue b/src/pegin/components/create/PegInForm.vue
@@ -43,13 +43,13 @@
            <v-row no-gutters v-if="flyoverIsEnabled && peginQuotes.length === 0">
             <pegin-option-card :option-type="peginType.FLYOVER" flyover-not-available>
               <template v-slot>
-                <h4 v-if="countdown === recaptchanNewTokenTime">
+                <h4 v-if="countdown === recaptchanNewTokenTime && enoughFlyoverLiquidity">
                   <span class="text-orange">Fast Mode</span> no quotes available for this amount.
                 </h4>
                 <h4 v-else-if="!enoughFlyoverLiquidity">
                   <span class="text-orange">Fast Mode</span>
                   There is not enough liquidity for this amount.
-                  <a href="mailto:support@rootstocklabs.com?subject=Liquidity Provider Issue">
+                  <a href="mailto:flyover@rootstocklabs.com?subject=Insufficient Liquidity">
                     Contact support</a> if you want to use the fast mode.
                 </h4>
               </template>
diff --git a/src/pegin/components/create/PeginOptionCard.vue b/src/pegin/components/create/PeginOptionCard.vue
@@ -1,5 +1,5 @@
 <template>
-  <v-card :ripple="false" :disabled="flyoverNotAvailable"
+  <v-card :ripple="false"
     @click="selectOption" rounded="lg" flat variant="outlined"
     :class="{
       'selected': selected,
@@ -133,7 +133,7 @@ export default defineComponent({
         totalFee: () => selectedFee.value,
         amountToTransfer: () => pegInTxState.value.amountToTransfer
           .plus(selectedFee.value),
-        valueToReceive: () => pegInTxState.value.amountToTransfer.minus(selectedFee.value),
+        valueToReceive: () => pegInTxState.value.amountToTransfer.safeMinus(selectedFee.value),
       },
       FLYOVER: {
         title: PowPegMode.FAST,
diff --git a/src/pegin/components/create/SendBitcoin.vue b/src/pegin/components/create/SendBitcoin.vue
diff --git a/src/pegin/services/PeginTxService.ts b/src/pegin/services/PeginTxService.ts
diff --git a/src/pegin/store/FlyoverPegin/actions.ts b/src/pegin/store/FlyoverPegin/actions.ts
diff --git a/src/pegin/store/FlyoverPegin/mutations.ts b/src/pegin/store/FlyoverPegin/mutations.ts
diff --git a/src/pegin/store/PeginTx/actions.ts b/src/pegin/store/PeginTx/actions.ts
diff --git a/src/pegout/components/PegoutForm.vue b/src/pegout/components/PegoutForm.vue
diff --git a/src/pegout/components/PegoutOption.vue b/src/pegout/components/PegoutOption.vue
diff --git a/src/pegout/components/RbtcInputAmount.vue b/src/pegout/components/RbtcInputAmount.vue
diff --git a/src/pegout/store/FlyoverPegout/actions.ts b/src/pegout/store/FlyoverPegout/actions.ts
diff --git a/src/pegout/store/pegoutTx/getters.ts b/src/pegout/store/pegoutTx/getters.ts

Original file line number	Diff line number	Diff line change
`@@ -222,7 +222,7 @@ export default defineComponent({`
`222`	`222`	`walletType.value = wallet;`
`223`	`223`	`}`
`224`	`224`
`225`		`- function connectReown(): Promise<void> {`
	`225`	`+ function connectReown(): Promise<void \| { hash: string }> {`
`226`	`226`	`const { walletProvider } = useAppKitProvider<BitcoinConnector>('bip122');`
`227`	`227`	`const { open: openModal } = useAppKit();`
`228`	`228`	`return new Promise((resolve, reject) => {`
`@@ -235,7 +235,7 @@ export default defineComponent({`
`235`	`235`	`.then(resolve)`
`236`	`236`	`.catch(reject);`
`237`	`237`	`} else {`
`238`		`- reject(new Error('Reown aleready connected'));`
	`238`	`+ reject(new Error('Reown already connected'));`
`239`	`239`	`}`
`240`	`240`	`});`
`241`	`241`	`}`