feat: support starknet multiple signers signature (#1182)

* feat: support starknet multiple signers signature

tests: fix test

tests: fix tests

refactor: code improvement

* feat: add hash for new starknet SNIP-12 domain format

* doc: add doc

* fix: update alias type to use felt

* Bump version from 0.14.11 to 0.14.12

---------

Co-authored-by: Chaitanya <[email protected]>

Author: wa0x6e

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snapshot-labs/snapshot.js",
-  "version": "0.14.11",
+  "version": "0.14.12",
   "repository": "snapshot-labs/snapshot.js",
   "license": "MIT",
   "main": "dist/snapshot.cjs.js",

src/sign/hashedTypes.json

@@ -57,6 +57,7 @@
   "6f6cdd15a1e9e6c4ee544231c4fa7b6c7e5183bc2b37fa4bd1a695f458348ab7": "delete-space",
   "1aad7825b991457fca04aae48a2a49d815ada524e10316af0da5522ea48b3df6": "alias",
   "8ea9074bff3a30cb61f4f0f0f142c9335c6be828feba0571a45de3f1fd0319c0": "alias",
+  "23310e197cbdcd80e506c0dbdd41831c9cf91d103a3ab663b278a1944a210920": "alias",
   "42f8858a21d4aa232721cb97074851e729829ea362b88bb21f3879899663b586": "follow",
   "2bb75450e28b06f259ea764cd669de6bde0ba70ce729b0ff05ab9df56e0ff21d": "unfollow",
   "2ffbebcbd22ef48fd2f4a1182ff1feda7795b57689bd6f0dd73c89e925e7fefb": "profile",

src/verify/starknet.spec.ts

@@ -1,6 +1,7 @@
 import { test, expect, describe } from 'vitest';
 import starknetMessage from '../../test/fixtures/starknet/message-alias.json';
 import starknetMessageRsv from '../../test/fixtures/starknet/message-alias-rsv.json';
+import starknetMessageMultisigner from '../../test/fixtures/starknet/message-alias-multisigner.json';
 import verify, { getHash } from './starknet';
 import { validateAndParseAddress } from 'starknet';
 import { clone } from '../utils';
@@ -24,9 +25,10 @@ describe('verify/starknet', () => {
 
   describe('verify()', () => {
     describe.each([
-      ['2', starknetMessage],
-      ['3', starknetMessageRsv]
-    ])('with a %s items signature', (title, message) => {
+      ['2 items', starknetMessage, false],
+      ['3 items', starknetMessageRsv, false],
+      ['multiple signers', starknetMessageMultisigner, true]
+    ])('with a %s signature', (title, message, multisign) => {
       test('should return true if the signature is valid', () => {
         expect(
           verify(message.address, message.sig, message.data, 'SN_MAIN')
@@ -44,11 +46,19 @@ describe('verify/starknet', () => {
         ).resolves.toBe(true);
       });
 
-      test('should return true when verifying on a different network', () => {
-        expect(
-          verify(message.address, message.sig, message.data, 'SN_SEPOLIA')
-        ).resolves.toBe(true);
-      });
+      if (multisign) {
+        test('should throw an error when verifying on a different network', () => {
+          expect(
+            verify(message.address, message.sig, message.data, 'SN_SEPOLIA')
+          ).rejects.toThrowError();
+        });
+      } else {
+        test('should return true when verifying on a different network', () => {
+          expect(
+            verify(message.address, message.sig, message.data, 'SN_SEPOLIA')
+          ).resolves.toBe(true);
+        });
+      }
 
       test('should throw an error if the signature is invalid', () => {
         expect(

src/verify/starknet.ts

@@ -62,6 +62,38 @@ export function getHash(data: SignaturePayload, address: string): string {
   );
 }
 
+/**
+ * Processes a StarkNet signature array and returns the appropriate signature format
+ * for contract verification.
+ * Returns the r ands values for each signature in the array.
+ *
+ * Handles the following cases:
+ * - 2-item array: Standard signature, returns as-is.
+ * - 3-item array: Some wallets (e.g., Braavos) may return a 3-item array; returns the last two items.
+ * - Multi-signer array: For multisig accounts, the array may contain multiple signatures;
+ *   this function extracts the relevant signature pairs.
+ *
+ * @param {string[]} sig - The signature array to process. Must have at least 2 items.
+ * @returns {string[]} The processed signature array suitable for contract verification.
+ * @throws {Error} If the signature array has fewer than 2 items.
+ */
+function getSignatureArray(sig: string[]): string[] {
+  if (sig.length < 2) {
+    throw new Error('Invalid signature format');
+  }
+
+  if (sig.length <= 3) {
+    return sig.slice(-2);
+  }
+
+  const results: string[] = [];
+  for (let i = 1; i < sig.length; i += 4) {
+    results.push(sig[i + 2], sig[i + 3]);
+  }
+
+  return results;
+}
+
 export default async function verify(
   address: string,
   sig: string[],
@@ -76,13 +108,9 @@ export default async function verify(
       getProvider(network, options)
     );
 
-    if (sig.length < 2) {
-      throw new Error('Invalid signature format');
-    }
-
     const result = await contractAccount.is_valid_signature(
       getHash(data, address),
-      sig.slice(-2)
+      getSignatureArray(sig)
     );
 
     return BigNumber.from(result).eq(BigNumber.from('370462705988'));

test/fixtures/starknet/message-alias-multisigner.json

@@ -0,0 +1,39 @@
+{
+  "address": "0x03c56e9437c23bbfce260b1e6ae45eee4cf808cfef4b5e767d1a2a5e152a71df",
+  "sig": [
+    "0x2",
+    "0x0",
+    "0xec31c589d1f36a04d2855cc464ce048bb925430653f146c3d5edc31282405d",
+    "0x696d12a9efa31910453a7cc3d051318636b1a8f20c9f6c499f53203cc9d5a76",
+    "0x7824808635967515f03ed2d204fe0fe9095d4029679e863cf48febee7a2f23",
+    "0x0",
+    "0x424fd8e0158c9d744ca6c22e7c48a1b46914a98e0e2fc6e78e69a7d5a7b84b4",
+    "0x3bb91f654cf18927e17c040642dd8503b0e5783a2633bb1e6badbae20226f2f",
+    "0x625d001a648a0891a93fbc5f4447f08b14cfb011e373801598d8f9d45175b31"
+  ],
+  "data": {
+    "domain": {
+      "name": "sx-starknet",
+      "version": "0.1.0",
+      "chainId": "0x534e5f4d41494e"
+    },
+    "types": {
+      "StarkNetDomain": [
+        { "name": "name", "type": "felt" },
+        { "name": "version", "type": "felt" },
+        { "name": "chainId", "type": "felt" }
+      ],
+      "SetAlias": [
+        { "name": "from", "type": "felt" },
+        { "name": "alias", "type": "felt" },
+        { "name": "timestamp", "type": "felt" }
+      ]
+    },
+    "message": {
+      "alias": "0xFeDaBaEDB4DCa1536AD3A791C3666FAc0BE2B9DB",
+      "from": "0x03c56e9437c23bbfce260b1e6ae45eee4cf808cfef4b5e767d1a2a5e152a71df",
+      "timestamp": 1757857885
+    },
+    "primaryType": "SetAlias"
+  }
+}