Skip to content

fix(sdk-core): enforce recipient verification in EdDSA TSS signing#9071

Open
mrdanish26 wants to merge 1 commit into
masterfrom
WCN-196/security-issue
Open

fix(sdk-core): enforce recipient verification in EdDSA TSS signing#9071
mrdanish26 wants to merge 1 commit into
masterfrom
WCN-196/security-issue

Conversation

@mrdanish26

@mrdanish26 mrdanish26 commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

TICKET: WCN-196

Problem

EdDSA TSS signing paths have no recipient verification before signing:

  • eddsa.ts (MPC v1): No verifyTransaction call at all. After resolving the
    unsigned tx, the code proceeds directly to MPC signing rounds with zero verification
    that the transaction recipients match the intent.

  • eddsaMPCv2.ts (MPC v2): Has a verifyTransaction call but uses
    params.txParams || { recipients: [] }, which always falls back to an empty
    recipients array — making the recipient check in verifyTransaction a no-op.

This means an attacker who can manipulate the txPrebuild (the actual transaction bytes)
can substitute different recipient addresses without detection on any EdDSA coin
(SOL, ADA, SUI, TON, DOT, APT, NEAR, CANTON, IOTA, TAO).

This is the EdDSA counterpart to the ECDSA fix in #8924.

Fix

  • eddsa.ts: Add verifyTransaction call with resolveEffectiveTxParams to resolve
    recipients from txRequest.intent (server-side truth) and verify them against the
    txPrebuild before signing.

  • eddsaMPCv2.ts: Replace params.txParams || { recipients: [] } with
    resolveEffectiveTxParams(txRequest, params.txParams) so the existing
    verifyTransaction call receives actual recipients for comparison.

  • recipientUtils.ts: Add EdDSA-specific no-recipient transaction types to
    NO_RECIPIENT_TX_TYPES: closeAssociatedTokenAccount (SOL),
    voteDelegation (ADA), transferAcknowledge (CANTON).

Verification

  • Checked EdDSA intent types verified against production logs entries
  • recipientUtils unit tests passing (12/12).

@linear-code

linear-code Bot commented Jun 19, 2026

Copy link
Copy Markdown

WCN-196

@mrdanish26 mrdanish26 force-pushed the WCN-196/security-issue branch from 5c3c229 to 4a14137 Compare June 19, 2026 18:51
@mrdanish26 mrdanish26 marked this pull request as ready for review June 19, 2026 19:20
@mrdanish26 mrdanish26 requested review from a team as code owners June 19, 2026 19:20

@mohammadalfaiyazbitgo mohammadalfaiyazbitgo left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, but we should add some unit tests

@mrdanish26 mrdanish26 force-pushed the WCN-196/security-issue branch 2 times, most recently from 089706d to 9da68df Compare June 19, 2026 20:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants