vacuumlabs/ledgerjs-cardano-shelley

Enforce canonical ordering of assets in the tokenBundle and withdrawals

Closed this issue · 0 comments

refi93 commented

Currently Ledger serializes the assets/withdrawals in whatever order they are passed from outside - this however is a source of tx hash mismatches which are then hard to debug as the tx serialization logic of the wallets usually does so in canonical order. To at least make the debugging easier, we should throw an exception if the assets are not ordered in a canonical way

In case of multiasset it's also undesired that Ledger can receive the same policyId or assetName within the policyId twice and Ledger would "happily" serialize it into the map - such ill-formed map resuls in undefined behavior (will both entries take effect, or only one?) so it's beneficial to avoid such scenario altogether. Here's the related issue for the ledger app specifying the work needed on that end: vacuumlabs/ledger-app-cardano-shelley#62

As part of the resolution of this issue, we should also submit a CIP establishing the way of serializing maps in (hw) wallets for the sake of clarity and interoperability between different wallets/hw wallet integrations

Solution proposed:

  • verify valid structure of the AssetGroup - i.e. that the policyIds are ordered alphabetically (they have the same length) and that assetNames within the respective policyIds are ordered by length first and then alphabetically (The canonical cbor specs specify that on the serialized representation of the keys, however, given they are of the same type, the prefix appended by CBOR doesn't interfere with the rules specified above - fell free to double-check, however)

Resources: