From 4ad8faa6ddcc66620507714f572c35dbea0308e7 Mon Sep 17 00:00:00 2001
From: Shubham Damkondwar <shubhamdamkondwar036@bitgo.com>
Date: Sat, 20 Jun 2026 17:23:43 +0530
Subject: [PATCH] fix(sdk-coin-starknet): normalize signableHex and widen
 verifyTransaction guard

Node's hex decoder under Node 24+ rejects '0x' prefixes in Buffer.from,
producing empty buffers. This caused the Starknet deploy account
signing path to send empty hashes to the keyserver, resulting in 400
validation errors.

- Stripped '0x' prefix and left-padded signableHex to 64 characters to
  conform with standard BitGo raw hex convention.
- Widened verifyTransaction short-circuit to support raw 64-character
  hex hashes, preventing runtime JSON parsing crashes.
- Updated builder unit tests and added verification test case.

TICKET: CECHO-1376
---
 modules/sdk-coin-starknet/src/lib/transaction.ts         | 4 +++-
 modules/sdk-coin-starknet/src/starknet.ts                | 2 +-
 modules/sdk-coin-starknet/test/unit/starknet.ts          | 9 +++++++++
 modules/sdk-coin-starknet/test/unit/transferBuilder.ts   | 2 +-
 .../test/unit/walletInitializationBuilder.ts             | 2 +-
 5 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/modules/sdk-coin-starknet/src/lib/transaction.ts b/modules/sdk-coin-starknet/src/lib/transaction.ts
index 95466f8c45..0cf348b20b 100644
--- a/modules/sdk-coin-starknet/src/lib/transaction.ts
+++ b/modules/sdk-coin-starknet/src/lib/transaction.ts
@@ -50,7 +50,9 @@ export class Transaction extends BaseTransaction {
   }
 
   get signableHex(): string {
-    return this._starknetTransactionData?.transactionHash || '';
+    const hash = this._starknetTransactionData?.transactionHash;
+    if (!hash) return '';
+    return hash.replace(/^0x/i, '').padStart(64, '0');
   }
 
   get signedTransaction(): string | undefined {
diff --git a/modules/sdk-coin-starknet/src/starknet.ts b/modules/sdk-coin-starknet/src/starknet.ts
index 66e26c0dfa..d89c24c57b 100644
--- a/modules/sdk-coin-starknet/src/starknet.ts
+++ b/modules/sdk-coin-starknet/src/starknet.ts
@@ -74,7 +74,7 @@ export class Starknet extends BaseCoin {
     // 0x-prefixed txHex means this is the Starknet transaction hash (signableHex), not the
     // full serialized transaction. Recipient verification already happened in prebuildAndSignTransaction
     // using serializedTxHex — nothing to verify from a hash alone.
-    if (!txHex || txHex.startsWith('0x')) {
+    if (!txHex || txHex.startsWith('0x') || /^[0-9a-f]{64}$/i.test(txHex)) {
       return true;
     }
 
diff --git a/modules/sdk-coin-starknet/test/unit/starknet.ts b/modules/sdk-coin-starknet/test/unit/starknet.ts
index 97e0942ad1..4552e4be55 100644
--- a/modules/sdk-coin-starknet/test/unit/starknet.ts
+++ b/modules/sdk-coin-starknet/test/unit/starknet.ts
@@ -126,6 +126,15 @@ describe('Starknet', function () {
       result.should.equal(true);
     });
 
+    it('should return true when txHex is a 64-character unprefixed signableHex', async function () {
+      const result = await basecoin.verifyTransaction({
+        txParams: { recipients: [] },
+        txPrebuild: { txHex: 'deadbeefcafe1234567890abcdefdeadbeefcafe1234567890abcdef12345678' },
+        wallet: {} as any,
+      });
+      result.should.equal(true);
+    });
+
     it('should return true when txHex is absent', async function () {
       const result = await basecoin.verifyTransaction({
         txParams: { recipients: [] },
diff --git a/modules/sdk-coin-starknet/test/unit/transferBuilder.ts b/modules/sdk-coin-starknet/test/unit/transferBuilder.ts
index f7278228ad..ca817457ca 100644
--- a/modules/sdk-coin-starknet/test/unit/transferBuilder.ts
+++ b/modules/sdk-coin-starknet/test/unit/transferBuilder.ts
@@ -39,7 +39,7 @@ describe('Starknet TransferBuilder', () => {
         .amount('1000000000000000000');
 
       const tx = (await builder.build()) as Transaction;
-      tx.signableHex.should.equal(tx.starknetTransactionData.transactionHash);
+      tx.signableHex.should.equal(tx.starknetTransactionData.transactionHash!.replace(/^0x/i, '').padStart(64, '0'));
       tx.id.should.equal(tx.starknetTransactionData.transactionHash);
     });
 
diff --git a/modules/sdk-coin-starknet/test/unit/walletInitializationBuilder.ts b/modules/sdk-coin-starknet/test/unit/walletInitializationBuilder.ts
index 0998a67c11..6497ba963c 100644
--- a/modules/sdk-coin-starknet/test/unit/walletInitializationBuilder.ts
+++ b/modules/sdk-coin-starknet/test/unit/walletInitializationBuilder.ts
@@ -37,7 +37,7 @@ describe('Starknet WalletInitializationBuilder', () => {
       builder.fromPublicKey(Accounts.account1.publicKey).nonce('0x0').chainId(chainId);
 
       const tx = (await builder.build()) as Transaction;
-      tx.signableHex.should.equal(tx.starknetTransactionData.transactionHash);
+      tx.signableHex.should.equal(tx.starknetTransactionData.transactionHash!.replace(/^0x/i, '').padStart(64, '0'));
       tx.id.should.equal(tx.starknetTransactionData.transactionHash);
     });