Skip to content

fix: validate raw seed length alignment - #86

Closed
localhost41 wants to merge 1 commit into
tetherto:mainfrom
localhost41:fix/raw-seed-length-alignment
Closed

localhost41 wants to merge 1 commit into
tetherto:mainfrom
localhost41:fix/raw-seed-length-alignment

Conversation

@localhost41

Copy link
Copy Markdown

Fixes #84

Raw seed validation currently accepts any Uint8Array from 16 through 64 bytes, including lengths that cannot represent a whole number of 32-bit words. Require byte length to be a multiple of 4 while preserving the existing 16–64-byte bounds.

Verification:

  • npm test -- --runInBand (161 tests passed)
  • npm run lint
  • npm run build:types

@nulllpc
nulllpc self-requested a review September 18, 2026 13:09
@nulllpc

nulllpc commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Thanks @localhost41 Added this on my watchlist, I'll review it asap

@nulllpc nulllpc left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Uint8Array case here is a raw BIP-32 seed, not BIP-39 entropy - BIP-32 only requires 128-512 bits, with no multiple-of-32-bits constraint, so the added % 4 check rejects valid seeds (e.g. 17, 33, 63 bytes).
The constructor's JSDoc wasn't clear on this - it labeled both the mnemonic-string and raw-bytes cases as "BIP-39 seed phrase," which is likely what led to this mix-up

I opened a PR for that here:
tetherto/wdk-wallet#74

@nulllpc

nulllpc commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

After some discussion, I realize that the check was correct to begin with, this issue incorrectly assumed the shape of the seed bytes, so I don't think we need to change at all. Sorry for wasting your time @localhost41 thanks for the effort!

@nulllpc nulllpc closed this Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Ensure Raw Seed Length Is a Multiple of 32 Bits​

3 participants