fix(sdk-lib-mpc): authenticate signatureR in DKLS DSG round 4 messages

modules/abstract-lightning/package.json

@@ -39,7 +39,7 @@
     ]
   },
   "dependencies": {
-    "@bitgo/public-types": "5.76.1",
+    "@bitgo/public-types": "5.92.0",
     "@bitgo/sdk-core": "^36.40.0",
     "@bitgo/statics": "^58.35.0",
     "@bitgo/utxo-lib": "^11.22.0",

modules/bitgo/package.json

@@ -138,7 +138,7 @@
     "superagent": "^9.0.1"
   },
   "devDependencies": {
-    "@bitgo/public-types": "5.76.1",
+    "@bitgo/public-types": "5.92.0",
     "@bitgo/sdk-opensslbytes": "^2.1.0",
     "@bitgo/sdk-test": "^9.1.38",
     "@openpgp/web-stream-tools": "0.0.14",

modules/express/package.json

@@ -60,7 +60,7 @@
     "superagent": "^9.0.1"
   },
   "devDependencies": {
-    "@bitgo/public-types": "5.76.1",
+    "@bitgo/public-types": "5.92.0",
     "@bitgo/sdk-lib-mpc": "^10.10.2",
     "@bitgo/sdk-test": "^9.1.38",
     "@types/argparse": "^1.0.36",

modules/express/src/typedRoutes/api/index.ts

@@ -59,7 +59,8 @@ import { GetResourceDelegations } from './v2/resourceDelegations';
 //
 // > error TS7056: The inferred type of this node exceeds the maximum length the compiler will serialize. An explicit type annotation is needed.
 //
-// As a workaround, only construct expressApi with a single key and add it to the type union at the end
+// Workarounds: (1) export heavy httpRoute handlers as `HttpRoute<'post'>` (etc.) in their modules so apiSpec
+// inference stays small; (2) only construct expressApi with a single key and add it to the type union at the end.
 
 export const ExpressPingApiSpec = apiSpec({
   'express.ping': {

modules/express/src/typedRoutes/api/v2/sendCoins.ts

@@ -1,5 +1,5 @@
 import * as t from 'io-ts';
-import { httpRoute, httpRequest, optional } from '@api-ts/io-ts-http';
+import { httpRoute, httpRequest, optional, type HttpRoute } from '@api-ts/io-ts-http';
 import { BitgoExpressError } from '../../schemas/error';
 import { SendManyResponse, EIP1559Params, MemoParams, TokenEnablement } from './sendmany';
 
@@ -412,7 +412,7 @@ export const SendCoinsRequestBody = {
  * @operationId express.wallet.sendcoins
  * @tag express
  */
-export const PostSendCoins = httpRoute({
+export const PostSendCoins: HttpRoute<'post'> = httpRoute({
   path: '/api/v2/{coin}/wallet/{id}/sendcoins',
   method: 'POST',
   request: httpRequest({

modules/express/src/typedRoutes/api/v2/sendmany.ts

@@ -1,6 +1,6 @@
 import * as t from 'io-ts';
 import { DateFromISOString } from 'io-ts-types';
-import { httpRoute, httpRequest, optional } from '@api-ts/io-ts-http';
+import { httpRoute, httpRequest, optional, type HttpRoute } from '@api-ts/io-ts-http';
 import { TransactionRequest as TxRequestResponse } from '@bitgo/public-types';
 import { BitgoExpressError } from '../../schemas/error';
 
@@ -790,7 +790,7 @@ export const SendManyResponse = t.intersection([
  * @operationId express.wallet.sendmany
  * @tag Express
  */
-export const PostSendMany = httpRoute({
+export const PostSendMany: HttpRoute<'post'> = httpRoute({
   path: '/api/v2/{coin}/wallet/{id}/sendmany',
   method: 'POST',
   request: httpRequest({

modules/express/src/typedRoutes/api/v2/walletSignTx.ts

@@ -1,5 +1,5 @@
 import * as t from 'io-ts';
-import { httpRoute, httpRequest, optional } from '@api-ts/io-ts-http';
+import { httpRoute, httpRequest, optional, type HttpRoute } from '@api-ts/io-ts-http';
 import { TransactionRequest as TxRequestResponse, TransactionRequestApiVersion } from '@bitgo/public-types';
 import { BitgoExpressError } from '../../schemas/error';
 import { Recipient } from './coinSignTx';
@@ -147,7 +147,7 @@ export const WalletSignTxResponse = {
  * @operationId express.v2.wallet.signtx
  * @tag Express
  */
-export const PostWalletSignTx = httpRoute({
+export const PostWalletSignTx: HttpRoute<'post'> = httpRoute({
   path: '/api/v2/{coin}/wallet/{id}/signtx',
   method: 'POST',
   request: httpRequest({

modules/express/src/typedRoutes/api/v2/walletTxSignTSS.ts

@@ -1,5 +1,5 @@
 import * as t from 'io-ts';
-import { httpRoute, httpRequest, optional } from '@api-ts/io-ts-http';
+import { httpRoute, httpRequest, optional, type HttpRoute } from '@api-ts/io-ts-http';
 import { TransactionRequest as TxRequestResponse, TransactionRequestApiVersion } from '@bitgo/public-types';
 import { BitgoExpressError } from '../../schemas/error';
 import { Recipient } from './coinSignTx';
@@ -161,7 +161,7 @@ export const WalletTxSignTSSResponse = {
  * @tag express
  * @operationId express.v2.wallet.signtxtss
  */
-export const PostWalletTxSignTSS = httpRoute({
+export const PostWalletTxSignTSS: HttpRoute<'post'> = httpRoute({
   path: '/api/v2/{coin}/wallet/{id}/signtxtss',
   method: 'POST',
   request: httpRequest({

modules/express/test/unit/clientRoutes/externalSign.ts

@@ -1046,16 +1046,22 @@ async function signBitgoMPCv2Round3(
   userGPGPubKey: string
 ): Promise<{ userMsg4: MPCv2SignatureShareRound3Input }> {
   const parsedSignatureShare = JSON.parse(userShare.share) as MPCv2SignatureShareRound3Input;
+  const msg4 = parsedSignatureShare.data.msg4;
+  const signatureRAuthMessage =
+    msg4.signatureR && msg4.signatureRSignature
+      ? { message: msg4.signatureR, signature: msg4.signatureRSignature }
+      : undefined;
   const serializedMessages = await DklsComms.decryptAndVerifyIncomingMessages(
     {
       p2pMessages: [],
       broadcastMessages: [
         {
-          from: parsedSignatureShare.data.msg4.from,
+          from: msg4.from,
           payload: {
-            message: parsedSignatureShare.data.msg4.message,
-            signature: parsedSignatureShare.data.msg4.signature,
+            message: msg4.message,
+            signature: msg4.signature,
           },
+          signatureR: signatureRAuthMessage,
         },
       ],
     },

modules/sdk-coin-flrp/package.json

@@ -47,7 +47,7 @@
     "@bitgo/sdk-test": "^9.1.38"
   },
   "dependencies": {
-    "@bitgo/public-types": "5.76.1",
+    "@bitgo/public-types": "5.92.0",
     "@bitgo/sdk-core": "^36.40.0",
     "@bitgo/secp256k1": "^1.11.0",
     "@bitgo/statics": "^58.35.0",

modules/sdk-coin-sol/package.json

@@ -57,7 +57,7 @@
   },
   "dependencies": {
     "@bitgo/logger": "^1.4.0",
-    "@bitgo/public-types": "5.76.1",
+    "@bitgo/public-types": "5.92.0",
     "@bitgo/sdk-core": "^36.40.0",
     "@bitgo/sdk-lib-mpc": "^10.10.2",
     "@bitgo/statics": "^58.35.0",

modules/sdk-core/package.json

@@ -40,7 +40,7 @@
     ]
   },
   "dependencies": {
-    "@bitgo/public-types": "5.76.1",
+    "@bitgo/public-types": "5.92.0",
     "@bitgo/sdk-lib-mpc": "^10.10.2",
     "@bitgo/secp256k1": "^1.11.0",
     "@bitgo/sjcl": "^1.1.0",

modules/sdk-core/src/bitgo/tss/ecdsa/ecdsaMPCv2.ts

@@ -126,17 +126,22 @@ export async function getSignatureShareRoundThree(
     [getUserPartyGpgKey(userGpgKey, partyId)]
   );
   assert(MPCv2PartyFromStringOrNumber.is(userToBitGoEncryptedMsg4.broadcastMessages[0].from));
-  if (!userToBitGoEncryptedMsg4.broadcastMessages[0].signatureR?.message) {
+  const signatureR = userToBitGoEncryptedMsg4.broadcastMessages[0].signatureR;
+  if (!signatureR?.message) {
     throw Error('signatureR should be defined');
   }
+  if (!signatureR.signature) {
+    throw Error('signatureR signature should be defined');
+  }
   const share: MPCv2SignatureShareRound3Input = {
     type: 'round3Input',
     data: {
       msg4: {
         from: userToBitGoEncryptedMsg4.broadcastMessages[0].from,
         message: userToBitGoEncryptedMsg4.broadcastMessages[0].payload.message,
         signature: userToBitGoEncryptedMsg4.broadcastMessages[0].payload.signature,
-        signatureR: userToBitGoEncryptedMsg4.broadcastMessages[0].signatureR.message,
+        signatureR: signatureR.message,
+        signatureRSignature: signatureR.signature,
       },
     },
   };

modules/sdk-lib-mpc/src/tss/ecdsa-dkls/commsLayer.ts

@@ -188,9 +188,15 @@ export async function decryptAndVerifyIncomingMessages(
         if (!(await verifySignedData(m.payload, pubGpgKey.gpgKey))) {
           throw Error(`Failed to authenticate broadcast message from party: ${m.from}`);
         }
+        if (m.signatureR !== undefined) {
+          if (!(await verifySignedData(m.signatureR, pubGpgKey.gpgKey))) {
+            throw Error(`Failed to authenticate signatureR in broadcast message from party: ${m.from}`);
+          }
+        }
         return {
           from: m.from,
           payload: m.payload.message,
+          signatureR: m.signatureR?.message,
         };
       })
     ),
@@ -233,15 +239,16 @@ export async function encryptAndAuthOutgoingMessages(
         if (!prvGpgKey) {
           throw Error(`No private key provided for sender with ID: ${m.from}`);
         }
+        const [signedPayload, signedSignatureR] = await Promise.all([
+          detachSignData(Buffer.from(m.payload, 'base64'), prvGpgKey.gpgKey),
+          m.signatureR
+            ? detachSignData(Buffer.from(m.signatureR, 'base64'), prvGpgKey.gpgKey)
+            : Promise.resolve(undefined),
+        ]);
         return {
           from: m.from,
-          payload: await detachSignData(Buffer.from(m.payload, 'base64'), prvGpgKey.gpgKey),
-          signatureR: m.signatureR
-            ? {
-                message: m.signatureR,
-                signature: '',
-              }
-            : undefined,
+          payload: signedPayload,
+          signatureR: signedSignatureR,
         };
       })
     ),