From 25d17f5e9242e343222667cda83bf4bd6e4e258c Mon Sep 17 00:00:00 2001 From: Local Dev Date: Thu, 17 Sep 2026 01:40:10 +0200 Subject: [PATCH] fix(wallet): message signatures verified only half the time BuiltInWallet.signMessage read `recovery` from libauth's recoverable signature, but libauth v3 names it `recoveryId`. The flag byte came out as 0, so verifiers recovered the right key only when the true recovery id happened to be 1. Signed DNS manifests and Studio uploads failed with "signature does not match current on-chain NFT owner" and a different derived address each attempt. Read the right field, fail loudly if it is missing, rebuild the browser bundle and move every importer to the new bundle URL. Also lands the registrar's signRecordsManifest that the bundle already shipped. --- js/dashboard.js | 2 +- js/register-flow.js | 2 +- js/studio.js | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/js/dashboard.js b/js/dashboard.js index 6fbeca9..b4bcf30 100644 --- a/js/dashboard.js +++ b/js/dashboard.js @@ -10,7 +10,7 @@ // is the persistent device session (js/session.js): sign in once, come back // without a prompt until you sign out. -import * as BNS from "https://silentmode.st/js/bns-register.js?v=20260916dns"; +import * as BNS from "https://silentmode.st/js/bns-register.js?v=20260917sig"; const API = "https://silentmode.st"; const TLD_API = "https://navigate.st/api/tlds?include_hidden=1"; diff --git a/js/register-flow.js b/js/register-flow.js index 4930f35..19882c4 100644 --- a/js/register-flow.js +++ b/js/register-flow.js @@ -7,7 +7,7 @@ // Injects its own modal HTML into and its own CSS into on load // so the host page needs nothing but a single script include. -import * as BNS from "https://silentmode.st/js/bns-register.js?v=20260908split"; +import * as BNS from "https://silentmode.st/js/bns-register.js?v=20260917sig"; const $ = (id) => document.getElementById(id); const esc = (s) => String(s).replace(/[&<>"']/g, (c) => ({ "&":"&","<":"<",">":">",'"':""","'":"'" }[c])); diff --git a/js/studio.js b/js/studio.js index b416514..bf78fef 100644 --- a/js/studio.js +++ b/js/studio.js @@ -11,7 +11,7 @@ // The gateway never holds a key: it verifies each upload's signature // against the current NFT owner and refuses writes outside bns//. -import * as BNS from "https://silentmode.st/js/bns-register.js?v=20260916dns"; +import * as BNS from "https://silentmode.st/js/bns-register.js?v=20260917sig"; const API = "https://silentmode.st"; const $ = (id) => document.getElementById(id);