Migrate bech32 to @scure/base

Author: webmaster128

.pnp.cjs

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:839fa0b7046eb80672306ed8e74f72ba5c18035789016ff04549eb8598b953a8
+size 102321

.yarn/cache/@scure-base-npm-2.0.0-97a775035d-7d999c7beb.zip

@@ -25,7 +25,11 @@ and this project adheres to
 
   ([#1819])
 
+- Replace bech32 implementation by @scure/base. This changes a bunch of error
+  messages but is otherwise not breaking user code. ([#1825])
+
 [#1819]: https://github.com/cosmos/cosmjs/pull/1819
+[#1825]: https://github.com/cosmos/cosmjs/pull/1825
 
 ## [0.36.1] - 2025-10-02
 

CHANGELOG.md

@@ -38,6 +38,7 @@
     "pack-web": "yarn build-or-skip && webpack --mode development --config webpack.web.config.cjs"
   },
   "dependencies": {
+    "@scure/base": "^2.0.0",
     "base64-js": "^1.3.0",
     "bech32": "^1.1.4",
     "readonly-date": "^1.0.0"

packages/encoding/package.json

@@ -16,7 +16,7 @@ describe("bech32", () => {
     });
 
     it("works for very long prefixes", () => {
-      expect(() => toBech32("p".repeat(70), new Uint8Array(20))).toThrowError(/exceeds length limit/i);
+      expect(() => toBech32("p".repeat(70), new Uint8Array(20))).toThrowError(/length 109 exceeds limit 90/i);
     });
 
     // See https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki#Bech32
@@ -26,7 +26,7 @@ describe("bech32", () => {
     });
 
     it("throws if result exceeds 90 characters", () => {
-      expect(() => toBech32("eth", new Uint8Array(51))).toThrowError(/exceeds length limit/i);
+      expect(() => toBech32("eth", new Uint8Array(51))).toThrowError(/length 92 exceeds limit 90/i);
     });
 
     it("works if a limit parameter is provided", () => {
@@ -40,7 +40,7 @@ describe("bech32", () => {
 
     it("throws if result exceeds the provided limit parameter", () => {
       const limit = 10;
-      expect(() => toBech32("eth", ethAddressRaw, limit)).toThrowError(/exceeds length limit/i);
+      expect(() => toBech32("eth", ethAddressRaw, limit)).toThrowError(/length 42 exceeds limit 10/i);
     });
   });
 
@@ -77,16 +77,33 @@ describe("bech32", () => {
           "cosmospub1ytql0csgqvfzd666axrjzqmn5q2ucztcyxw8hvlzen94ay05tegaerkug5pn3xn8wqdymt598ufzd666axrjzqsxllmwacap3f6xyc4x30jl8ecrcs2tze3zzgxkmthcsqxnqxhwwgfzd666axrjzqs2rlu3wz5gnslgpprszjr8r65n0d6y39q657th77eyvengtk3z0y6h2pnk",
           90,
         ),
-      ).toThrowError(/exceeds length limit/i);
+      ).toThrowError(/invalid string length/i);
+    });
+
+    it("throws for missing separator", () => {
+      expect(() => fromBech32("nooneinhere")).toThrowError(/No bech32 separator found/i);
+    });
+
+    it("throws for invalid checksum", () => {
+      const corrupted = "eth1n48g2mjh9ezz7zjtya37wtgg5r5emr0dxxxxxx";
+      expect(() => fromBech32(corrupted)).toThrowError(/invalid checksum/i);
     });
 
     it("throws for mixed case addresses", () => {
       // "Decoders MUST NOT accept strings where some characters are uppercase and some are lowercase (such strings are referred to as mixed case strings)."
       // https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki
-      expect(() => fromBech32("Eth1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(/Mixed-case/i);
-      expect(() => fromBech32("eTh1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(/Mixed-case/i);
-      expect(() => fromBech32("ETH1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(/Mixed-case/i);
-      expect(() => fromBech32("eth1n48g2mjh9Ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(/Mixed-case/i);
+      expect(() => fromBech32("Eth1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(
+        /must be lowercase or uppercase/i,
+      );
+      expect(() => fromBech32("eTh1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(
+        /must be lowercase or uppercase/i,
+      );
+      expect(() => fromBech32("ETH1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(
+        /must be lowercase or uppercase/i,
+      );
+      expect(() => fromBech32("eth1n48g2mjh9Ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(
+        /must be lowercase or uppercase/i,
+      );
     });
   });
 
@@ -103,10 +120,18 @@ describe("bech32", () => {
     it("throws for mixed case addresses", () => {
       // "Decoders MUST NOT accept strings where some characters are uppercase and some are lowercase (such strings are referred to as mixed case strings)."
       // https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki
-      expect(() => normalizeBech32("Eth1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(/Mixed-case/i);
-      expect(() => normalizeBech32("eTh1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(/Mixed-case/i);
-      expect(() => normalizeBech32("ETH1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(/Mixed-case/i);
-      expect(() => normalizeBech32("eth1n48g2mjh9Ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(/Mixed-case/i);
+      expect(() => normalizeBech32("Eth1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(
+        /must be lowercase or uppercase/i,
+      );
+      expect(() => normalizeBech32("eTh1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(
+        /must be lowercase or uppercase/i,
+      );
+      expect(() => normalizeBech32("ETH1n48g2mjh9ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(
+        /must be lowercase or uppercase/i,
+      );
+      expect(() => normalizeBech32("eth1n48g2mjh9Ezz7zjtya37wtgg5r5emr0drkwlgw")).toThrowError(
+        /must be lowercase or uppercase/i,
+      );
     });
   });
 });

packages/encoding/src/bech32.spec.ts

@@ -1,14 +1,22 @@
-import * as bech32 from "bech32";
+import { bech32 } from "@scure/base";
 
 export function toBech32(prefix: string, data: Uint8Array, limit?: number): string {
   const address = bech32.encode(prefix, bech32.toWords(data), limit);
   return address;
 }
 
+function hasBech32Separator(input: string): input is `${string}1${string}` {
+  return input.indexOf("1") !== -1;
+}
+
 export function fromBech32(
   address: string,
   limit = Infinity,
 ): { readonly prefix: string; readonly data: Uint8Array } {
+  // This extra check can be removed once
+  // https://github.com/paulmillr/scure-base/pull/45 is merged and published.
+  if (!hasBech32Separator(address)) throw new Error(`No bech32 separator found`);
+
   const decodedAddress = bech32.decode(address, limit);
   return {
     prefix: decodedAddress.prefix,

packages/encoding/src/bech32.ts

@@ -357,6 +357,7 @@ __metadata:
   resolution: "@cosmjs/encoding@workspace:packages/encoding"
   dependencies:
     "@istanbuljs/nyc-config-typescript": "npm:^1.0.1"
+    "@scure/base": "npm:^2.0.0"
     "@types/base64-js": "npm:^1.2.5"
     "@types/jasmine": "npm:^4"
     "@types/karma-firefox-launcher": "npm:^2"
@@ -1329,6 +1330,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@scure/base@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "@scure/base@npm:2.0.0"
+  checksum: 10c0/7d999c7bebf053bb49cb706fdc6c5366737cff0f7f7518f52d32d7f7ad7b898904f03673648a2af5c4f22396f5c05f1d8bddbf010d6595052d07ba8163d506ad
+  languageName: node
+  linkType: hard
+
 "@shikijs/engine-oniguruma@npm:^3.6.0":
   version: 3.6.0
   resolution: "@shikijs/engine-oniguruma@npm:3.6.0"