feat: mint ed25519 safe wallets from StrKey seed user roots - #9686
Draft
davidkaplanbitgo wants to merge 2 commits into
Draft
davidkaplanbitgo wants to merge 2 commits into
davidkaplanbitgo wants to merge 2 commits into
Conversation
Contributor
Contributor
|
|
davidkaplanbitgo
force-pushed
the
WCN-2411
branch
4 times, most recently
from
September 15, 2026 20:34
27de50c to
b933ec9
Compare
Change the ed25519Multisig Safe root public-key contract so backup and BitGo roots are represented by raw Ed25519 public derivation material: raw public key (32 bytes) || raw chain code (32 bytes) Encode the 64-byte payload as canonical, unpadded RFC 4648 base32 using the uppercase A-Z2-7 alphabet. The resulting root value is exactly 103 characters and is independent of Stellar, Algorand, HBAR, or any other coin-specific public-key format. Update Safe backup-key creation to decode the representative XLM public key into raw bytes before composing the neutral root value. Update Safe root validation to validate the canonical base32 payload and to apply the same contract to both backup and BitGo ed25519Multisig roots. Keep Stellar StrKey handling isolated to the user-root and coin-specific child-key boundaries. The neutral Safe root codec now uses Buffer inputs and outputs for raw public-key and chain-code material, minimizing string parsing and hexadecimal re-encoding. Public derivation continues to consume the SDK's internal raw public-key-plus-chain-code representation and discards child chain codes at the wallet-child boundary. Update SDK Safe root fixtures and tests for: - canonical base32 encoding and decoding; - exact 32-byte public-key and chain-code boundaries; - rejection of lowercase, malformed, padded, truncated, and non-canonical values; - raw Buffer-based codec APIs; - deterministic Ed25519 public derivation vectors; - unchanged Stellar StrKey user-root encoding; - backup and BitGo Safe root validation. Ticket: WCN-2411
Update the Ed25519 Safe root validation error to describe the canonical base32 representation used by backup and BitGo roots.\n\nThe root payload is raw publicKey32 || chainCode32 encoded as unpadded RFC 4648 base32; it is not lowercase hexadecimal or a coin-specific public-key format.\n\nTicket: WCN-2411
davidkaplanbitgo
force-pushed
the
WCN-2411
branch
from
September 15, 2026 20:43
b933ec9 to
32fc80b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change the ed25519Multisig Safe root public-key contract so backup and
BitGo roots are represented by raw Ed25519 public derivation material:
raw public key (32 bytes) || raw chain code (32 bytes)
Encode the 64-byte payload as canonical, unpadded RFC 4648 base32 using
the uppercase A-Z2-7 alphabet. The resulting root value is exactly 103
characters and is independent of Stellar, Algorand, HBAR, or any other
coin-specific public-key format.
Update Safe backup-key creation to decode the representative XLM
public key into raw bytes before composing the neutral root value.
Update Safe root validation to validate the canonical base32 payload and
to apply the same contract to both backup and BitGo ed25519Multisig
roots.
Keep Stellar StrKey handling isolated to the user-root and
coin-specific child-key boundaries. The neutral Safe root codec now
uses Buffer inputs and outputs for raw public-key and chain-code
material, minimizing string parsing and hexadecimal re-encoding.
Public derivation continues to consume the SDK's internal raw
public-key-plus-chain-code representation and discards child chain
codes at the wallet-child boundary.
Update SDK Safe root fixtures and tests for:
non-canonical values;
Ticket: WCN-2411