KarpelesLab / libwallet / 24818875959

25%

push

github

EVM off-chain signing: emit Ethereum wire format, not DER

personal_sign and eth_signTypedData (v3/v4) were returning the raw
DER-encoded ECDSA signature from a.Sign(), hex-prefixed. Off-chain
verifiers all expect the 65-byte Ethereum form:

  R(32) || S(32) || V(1)   where V ∈ {27, 28}

ecrecover, viem.verifyTypedData, ethers.verifyMessage, MetaMask
test-dapp's Recover button, OpenSea, Snapshot, Permit2 etc. all
reject DER with either "Invalid signature v value" or a silent
address mismatch.

Add `wltacct.SignEthereumDigest` that wraps the TSS signer's DER
output: ParseDERSignature → BruteforceRecoveryCode (the TSS path
drops the recovery byte, same as Bitcoin) → ExportCompact(false, 27)
to produce R || S || (recovery + 27). Mirror of SignCompact for
Bitcoin, just with V last instead of header-first.

Wire approveEthPersonalSign + approveEthTypedDataSign and the
host-direct Account:signMessage Mode="evm"/"personal_sign" path
through the new helper. EIP-155 chain-id adjustment is NOT applied
here — off-chain v stays at 27/28, the chainId*2+35+rec form is
specific to on-chain tx signing (which already does the right thing).

Test: TestEthereumWireFormat verifies the wire layout end-to-end
against an independent ecrecover with a throwaway secp256k1 key.

Reported on 0.3.29 against https://metamask.github.io/test-dapp/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

0 of 31 new or added lines in 3 files covered. (0.0%)

2529 of 12752 relevant lines covered (19.83%)

61.97 hits per line