From fcbb68ffb9fa03101f1704dfdd59d4cc783d2425 Mon Sep 17 00:00:00 2001 From: Prajwal U Date: Tue, 14 Jul 2026 07:00:35 +0000 Subject: [PATCH] fix(sdk-coin-stx): verify recipient and amount in native STX verifyTransaction Previously, Stx.verifyTransaction was a near no-op: it only checked that the recipient count was <= 1. A compromised prebuild could redirect native STX sends to any address or alter the amount, and local verification would still pass. Port the full decode-and-compare pattern from Sip10Token.verifyTransaction into Stx.verifyTransaction. The new implementation: - Decodes the prebuild txHex via explainTransaction - Compares the decoded recipient address (stripping memoId) and amount against txParams.recipients[0] - Compares the memo (from txParams.memo or embedded in the recipient address) against the decoded transaction memo - Validates that the total output amount matches the declared total This closes the gap where the SIP10 token path already had full recipient validation but native STX did not, matching the pattern described in CSHLD-839. Ticket: CSHLD-839 Session-Id: 7de30368-fc1b-4b09-9d2e-55be78e462dc Task-Id: 2203e736-35f2-4e2f-8cde-6cdbd0d3e2b6 --- modules/sdk-coin-stx/CHANGELOG.md | 253 +------------------------- modules/sdk-coin-stx/src/stx.ts | 55 +++++- modules/sdk-coin-stx/test/unit/stx.ts | 98 ++++++++++ 3 files changed, 161 insertions(+), 245 deletions(-) diff --git a/modules/sdk-coin-stx/CHANGELOG.md b/modules/sdk-coin-stx/CHANGELOG.md index 216c40214e..435f50ed07 100644 --- a/modules/sdk-coin-stx/CHANGELOG.md +++ b/modules/sdk-coin-stx/CHANGELOG.md @@ -7,481 +7,248 @@ See [Conventional Commits](https://conventionalcommits.org) for commit guideline **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - # [4.0.0](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.9...@bitgo/sdk-coin-stx@4.0.0) (2026-07-07) - ### Features -* make encrypt/decrypt async ([7e845c3](https://github.com/BitGo/BitGoJS/commit/7e845c3041a08f8e7ade472eb43a5b997507d9ec)) - +- make encrypt/decrypt async ([7e845c3](https://github.com/BitGo/BitGoJS/commit/7e845c3041a08f8e7ade472eb43a5b997507d9ec)) ### BREAKING CHANGES -* synchronous encrypt/decrypt callsites have been removed +- synchronous encrypt/decrypt callsites have been removed Ticket: WCN-174 - - - - ## [3.14.9](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.8...@bitgo/sdk-coin-stx@3.14.9) (2026-07-02) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.14.8](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.7...@bitgo/sdk-coin-stx@3.14.8) (2026-06-30) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.14.7](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.6...@bitgo/sdk-coin-stx@3.14.7) (2026-06-25) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.14.6](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.5...@bitgo/sdk-coin-stx@3.14.6) (2026-06-23) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.14.5](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.4...@bitgo/sdk-coin-stx@3.14.5) (2026-06-18) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.14.4](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.3...@bitgo/sdk-coin-stx@3.14.4) (2026-06-16) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.14.3](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.2...@bitgo/sdk-coin-stx@3.14.3) (2026-06-09) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.14.2](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.1...@bitgo/sdk-coin-stx@3.14.2) (2026-06-04) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.14.1](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.14.0...@bitgo/sdk-coin-stx@3.14.1) (2026-06-03) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - # [3.14.0](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.13.3...@bitgo/sdk-coin-stx@3.14.0) (2026-06-02) - ### Features -* use decryptAsync/encryptAsync for remaining WRW flows ([195ecdf](https://github.com/BitGo/BitGoJS/commit/195ecdf2ac6fde20bfb18e49ba49f41c391dfba9)) - - - - +- use decryptAsync/encryptAsync for remaining WRW flows ([195ecdf](https://github.com/BitGo/BitGoJS/commit/195ecdf2ac6fde20bfb18e49ba49f41c391dfba9)) ## [3.13.3](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.13.2...@bitgo/sdk-coin-stx@3.13.3) (2026-05-28) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.13.2](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.13.1...@bitgo/sdk-coin-stx@3.13.2) (2026-05-26) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.13.1](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.13.0...@bitgo/sdk-coin-stx@3.13.1) (2026-05-22) - ### Bug Fixes -* **sdk-coin-stx:** remove incorrect hashbytes padding in sbtc withdraw ([e8e09b3](https://github.com/BitGo/BitGoJS/commit/e8e09b33967cf7308e117363aa301a6ba9c72449)) - - - - +- **sdk-coin-stx:** remove incorrect hashbytes padding in sbtc withdraw ([e8e09b3](https://github.com/BitGo/BitGoJS/commit/e8e09b33967cf7308e117363aa301a6ba9c72449)) # [3.13.0](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.12.7...@bitgo/sdk-coin-stx@3.13.0) (2026-05-14) - ### Features -* **sdk-coin-stx:** add getEncodedPrincipal util for Clarity standard principals ([c531a39](https://github.com/BitGo/BitGoJS/commit/c531a39cda9865351bffc4289bd8e90d5b6033d0)) -* **sdk-coin-stx:** add sBTC withdrawal transaction builder ([02193be](https://github.com/BitGo/BitGoJS/commit/02193be6e686dfcccb92df2200e5d85e180e4816)) - - - - +- **sdk-coin-stx:** add getEncodedPrincipal util for Clarity standard principals ([c531a39](https://github.com/BitGo/BitGoJS/commit/c531a39cda9865351bffc4289bd8e90d5b6033d0)) +- **sdk-coin-stx:** add sBTC withdrawal transaction builder ([02193be](https://github.com/BitGo/BitGoJS/commit/02193be6e686dfcccb92df2200e5d85e180e4816)) ## [3.12.7](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.12.6...@bitgo/sdk-coin-stx@3.12.7) (2026-05-05) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.12.6](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.12.5...@bitgo/sdk-coin-stx@3.12.6) (2026-04-29) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.12.5](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.12.4...@bitgo/sdk-coin-stx@3.12.5) (2026-04-28) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.12.4](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.12.3...@bitgo/sdk-coin-stx@3.12.4) (2026-04-22) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.12.3](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.12.2...@bitgo/sdk-coin-stx@3.12.3) (2026-04-14) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.12.2](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.12.1...@bitgo/sdk-coin-stx@3.12.2) (2026-04-10) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.12.1](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.12.0...@bitgo/sdk-coin-stx@3.12.1) (2026-04-08) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - # [3.12.0](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.9...@bitgo/sdk-coin-stx@3.12.0) (2026-03-29) - ### Features -* **root:** remove node engine upper bound ([9ef2ade](https://github.com/BitGo/BitGoJS/commit/9ef2adee1e8de4db6b194521a8000eb676a09db0)) - - - - +- **root:** remove node engine upper bound ([9ef2ade](https://github.com/BitGo/BitGoJS/commit/9ef2adee1e8de4db6b194521a8000eb676a09db0)) ## [3.11.9](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.8...@bitgo/sdk-coin-stx@3.11.9) (2026-03-27) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.11.8](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.7...@bitgo/sdk-coin-stx@3.11.8) (2026-03-18) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.11.7](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.6...@bitgo/sdk-coin-stx@3.11.7) (2026-03-10) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.11.6](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.5...@bitgo/sdk-coin-stx@3.11.6) (2026-03-05) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.11.5](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.4...@bitgo/sdk-coin-stx@3.11.5) (2026-03-03) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.11.4](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.3...@bitgo/sdk-coin-stx@3.11.4) (2026-02-27) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.11.3](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.2...@bitgo/sdk-coin-stx@3.11.3) (2026-02-24) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.11.2](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.1...@bitgo/sdk-coin-stx@3.11.2) (2026-02-13) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.11.1](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.11.0...@bitgo/sdk-coin-stx@3.11.1) (2026-02-12) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - # [3.11.0](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.24...@bitgo/sdk-coin-stx@3.11.0) (2026-01-30) - ### Features -* support node 24 ([b998bd1](https://github.com/BitGo/BitGoJS/commit/b998bd1bdb7e267e8e2f33b3599643a5c85c21d2)) - - - - +- support node 24 ([b998bd1](https://github.com/BitGo/BitGoJS/commit/b998bd1bdb7e267e8e2f33b3599643a5c85c21d2)) ## [3.10.24](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.23...@bitgo/sdk-coin-stx@3.10.24) (2026-01-22) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.23](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.22...@bitgo/sdk-coin-stx@3.10.23) (2026-01-19) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.22](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.21...@bitgo/sdk-coin-stx@3.10.22) (2026-01-14) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.21](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.20...@bitgo/sdk-coin-stx@3.10.21) (2026-01-07) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.20](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.19...@bitgo/sdk-coin-stx@3.10.20) (2025-12-23) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.19](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.18...@bitgo/sdk-coin-stx@3.10.19) (2025-12-17) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.18](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.17...@bitgo/sdk-coin-stx@3.10.18) (2025-12-11) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.17](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.16...@bitgo/sdk-coin-stx@3.10.17) (2025-12-05) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.16](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.15...@bitgo/sdk-coin-stx@3.10.16) (2025-12-04) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.15](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.14...@bitgo/sdk-coin-stx@3.10.15) (2025-11-26) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.14](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.13...@bitgo/sdk-coin-stx@3.10.14) (2025-11-19) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.13](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.12...@bitgo/sdk-coin-stx@3.10.13) (2025-11-13) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.12](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.11...@bitgo/sdk-coin-stx@3.10.12) (2025-11-12) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.11](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.10...@bitgo/sdk-coin-stx@3.10.11) (2025-11-06) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.10](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.9...@bitgo/sdk-coin-stx@3.10.10) (2025-10-31) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.9](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.8...@bitgo/sdk-coin-stx@3.10.9) (2025-10-29) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.8](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.7...@bitgo/sdk-coin-stx@3.10.8) (2025-10-24) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.7](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.6...@bitgo/sdk-coin-stx@3.10.7) (2025-10-21) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.6](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.5...@bitgo/sdk-coin-stx@3.10.6) (2025-10-16) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.5](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.4...@bitgo/sdk-coin-stx@3.10.5) (2025-10-13) **Note:** Version bump only for package @bitgo/sdk-coin-stx - - - - ## [3.10.4](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.3...@bitgo/sdk-coin-stx@3.10.4) (2025-10-09) - ### Bug Fixes -* run check-fmt on code files only ([9745196](https://github.com/BitGo/BitGoJS/commit/9745196b02b9678c740d290a4638ceb153a8fd75)) - - - - +- run check-fmt on code files only ([9745196](https://github.com/BitGo/BitGoJS/commit/9745196b02b9678c740d290a4638ceb153a8fd75)) ## [3.10.3](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.2...@bitgo/sdk-coin-stx@3.10.3) (2025-10-08) - ### Bug Fixes -* add explicit 'files' in package json ([3b00373](https://github.com/BitGo/BitGoJS/commit/3b0037396f6ac16bb9380bd85bf37f2b133068f4)) - - - - +- add explicit 'files' in package json ([3b00373](https://github.com/BitGo/BitGoJS/commit/3b0037396f6ac16bb9380bd85bf37f2b133068f4)) ## [3.10.2](https://github.com/BitGo/BitGoJS/compare/@bitgo/sdk-coin-stx@3.10.1...@bitgo/sdk-coin-stx@3.10.2) (2025-10-02) diff --git a/modules/sdk-coin-stx/src/stx.ts b/modules/sdk-coin-stx/src/stx.ts index eee65ca6b4..40bb6c150d 100644 --- a/modules/sdk-coin-stx/src/stx.ts +++ b/modules/sdk-coin-stx/src/stx.ts @@ -1,3 +1,4 @@ +import _ from 'lodash'; import { AuditDecryptedKeyParams, BaseCoin, @@ -40,7 +41,12 @@ import { ExplainTransactionOptions, StxSignTransactionOptions, StxTransactionExp import { StxLib } from '.'; import { TransactionBuilderFactory } from './lib'; import { TransactionBuilder } from './lib/transactionBuilder'; -import { findContractTokenNameUsingContract, findTokenNameByContract, getAddressDetails } from './lib/utils'; +import { + findContractTokenNameUsingContract, + findTokenNameByContract, + getAddressDetails, + getMemoIdAndBaseAddressFromAddress, +} from './lib/utils'; import { AddressDetails, NativeStxBalance, @@ -98,12 +104,57 @@ export class Stx extends BaseCoin { } async verifyTransaction(params: VerifyTransactionOptions): Promise { - const { txParams } = params; + const { txPrebuild, txParams } = params; + const { memo } = txParams; if (Array.isArray(txParams.recipients) && txParams.recipients.length > 1) { throw new Error( `${this.getChain()} doesn't support sending to more than 1 destination address within a single transaction. Try again, using only a single recipient.` ); } + const rawTx = txPrebuild?.txHex; + if (!rawTx) { + throw new Error('missing required tx prebuild property txHex'); + } + const explainedTx = await this.explainTransaction({ txHex: rawTx, feeInfo: { fee: '' } }); + if (txParams.recipients !== undefined && explainedTx) { + const filteredRecipients = txParams.recipients.map((recipient) => { + const addressDetails = getMemoIdAndBaseAddressFromAddress(recipient.address); + return { + address: addressDetails.address, + amount: BigInt(recipient.amount), + }; + }); + const filteredOutputs = explainedTx.outputs.map((output) => ({ + address: output.address, + amount: BigInt(output.amount), + })); + if (!_.isEqual(filteredOutputs, filteredRecipients)) { + throw new Error('Tx outputs does not match with expected txParams recipients'); + } + // compare memo + let memoInput = ''; + let memoOutput = ''; + if (memo && memo.value) { + memoInput = memo.value; + } else if (txParams.recipients.length) { + const addressDetails = getMemoIdAndBaseAddressFromAddress(txParams.recipients[0].address); + memoInput = addressDetails.memoId ? addressDetails.memoId : ''; + } + if (explainedTx.memo) { + memoOutput = explainedTx.memo; + } + if (!_.isEqual(memoInput, memoOutput)) { + throw new Error('Tx memo does not match with expected txParams recipient memo'); + } + // compare send amount + let totalAmount = new BigNumber(0); + for (const recipient of txParams.recipients) { + totalAmount = totalAmount.plus(recipient.amount); + } + if (!totalAmount.isEqualTo(explainedTx.outputAmount)) { + throw new Error('Tx total amount does not match with expected total amount field'); + } + } return true; } diff --git a/modules/sdk-coin-stx/test/unit/stx.ts b/modules/sdk-coin-stx/test/unit/stx.ts index 7e6d95efc2..3ffb040668 100644 --- a/modules/sdk-coin-stx/test/unit/stx.ts +++ b/modules/sdk-coin-stx/test/unit/stx.ts @@ -324,6 +324,8 @@ describe('STX:', function () { describe('Verify Transaction', function () { const address1 = '0x174cfd823af8ce27ed0afee3fcf3c3ba259116be'; const address2 = '0x7e85bdc27c050e3905ebf4b8e634d9ad6edd0de6'; + const txPrebuild = { txHex: testData.txForExplainTransfer, txInfo: {} }; + it('should reject a txPrebuild with more than one recipient', async function () { const wallet = new Wallet(bitgo, basecoin, {}); @@ -342,6 +344,102 @@ describe('STX:', function () { `tstx doesn't support sending to more than 1 destination address within a single transaction. Try again, using only a single recipient.` ); }); + + it('should reject when txPrebuild is missing txHex', async function () { + const wallet = new Wallet(bitgo, basecoin, {}); + const txParams = { + recipients: [{ amount: '1000', address: testData.txExplainedTransfer.recipient }], + wallet, + walletPassphrase: 'fakeWalletPassphrase', + }; + await basecoin + .verifyTransaction({ txPrebuild: {}, txParams }) + .should.be.rejectedWith('missing required tx prebuild property txHex'); + }); + + it('should succeed to verify a native STX transfer with matching recipient and amount', async function () { + const wallet = new Wallet(bitgo, basecoin, {}); + const txParams = { + recipients: [ + { + address: testData.txExplainedTransfer.recipient, + amount: testData.txExplainedTransfer.outputAmount, + }, + ], + memo: { type: '', value: testData.txExplainedTransfer.memo }, + wallet, + }; + const result = await basecoin.verifyTransaction({ txPrebuild, txParams }); + result.should.equal(true); + }); + + it('should succeed to verify when memo is passed inside recipient address', async function () { + const wallet = new Wallet(bitgo, basecoin, {}); + const txParams = { + recipients: [ + { + address: `${testData.txExplainedTransfer.recipient}?memoId=${encodeURIComponent( + testData.txExplainedTransfer.memo + )}`, + amount: testData.txExplainedTransfer.outputAmount, + }, + ], + wallet, + }; + const result = await basecoin.verifyTransaction({ txPrebuild, txParams }); + result.should.equal(true); + }); + + it('should fail to verify transaction with wrong recipient address', async function () { + const wallet = new Wallet(bitgo, basecoin, {}); + const txParams = { + recipients: [ + { + address: 'ST11NJTTKGVT6D1HY4NJRVQWMQM7TVAR091EJ8P2Y', + amount: testData.txExplainedTransfer.outputAmount, + }, + ], + memo: { type: '', value: testData.txExplainedTransfer.memo }, + wallet, + }; + await basecoin + .verifyTransaction({ txPrebuild, txParams }) + .should.be.rejectedWith('Tx outputs does not match with expected txParams recipients'); + }); + + it('should fail to verify transaction with wrong amount', async function () { + const wallet = new Wallet(bitgo, basecoin, {}); + const txParams = { + recipients: [ + { + address: testData.txExplainedTransfer.recipient, + amount: '9999', + }, + ], + memo: { type: '', value: testData.txExplainedTransfer.memo }, + wallet, + }; + await basecoin + .verifyTransaction({ txPrebuild, txParams }) + .should.be.rejectedWith('Tx outputs does not match with expected txParams recipients'); + }); + + it('should fail to verify transaction with wrong memo', async function () { + const wallet = new Wallet(bitgo, basecoin, {}); + const txParams = { + recipients: [ + { + address: testData.txExplainedTransfer.recipient, + amount: testData.txExplainedTransfer.outputAmount, + }, + ], + memo: { type: '', value: 'wrong memo' }, + wallet, + }; + await basecoin + .verifyTransaction({ txPrebuild, txParams }) + .should.be.rejectedWith('Tx memo does not match with expected txParams recipient memo'); + }); }); describe('Recover Transaction STX', function () {