Skip to content

v1.8.0: verify, decode, validate, inscription, tx details, and fixes - #54

Merged
devdavidejesus merged 3 commits into
mainfrom
feat/v1.8.0
Oct 15, 2026
Merged

devdavidejesus merged 3 commits into
mainfrom
feat/v1.8.0

Conversation

@devdavidejesus

Copy link
Copy Markdown
Owner

Fixes from an audit of 1.7.2 and four new commands. See CHANGELOG.md [Unreleased] for the full list.

  • verify: checks a transaction is in a block by recomputing its txid, Merkle proof and the header's proof of work. The verdict depends only on the work proven.
  • decode, validate: offline (raw transactions; addresses with full checksum validation, BIP 173/350 vectors).
  • inscription: Ordinals envelope detection following ord's rules.
  • tx --inputs/--outputs; opreturn protocol tags.
  • Terminal escaping of every untrusted string, bounded HTTP reads, clearer errors.

Tested: 294 unit tests on Python 3.11-3.14, mypy --strict, ruff, 96% branch coverage, fuzzing (new parsers included), and the live smoke test against mainnet: 14/14.

- Text mode escapes control characters in every string that comes from the
  API or from input, not only OP_RETURN text; hashes from the API must be hex.
- A malformed --api-url is invalid input (exit code 2); JSON nested too deeply
  is an API error; a coinbase is never flagged RBF; non-ASCII addresses are
  rejected locally; opreturn --json reports the txid normalized.
- Docs: JSON error keys, how amounts are typed, utxo --limit, --file comments,
  a quick start, option order, and uv.
- verify: recompute the txid, the Merkle root (refusing a 64-byte pair of
  nodes that is also a transaction, CVE-2017-12842), the header hash and its
  proof of work. The verdict depends only on the work proven: strong for a
  mainnet header at difficulty 50 T or more, weak otherwise.
- decode: offline raw transaction decoder; --txid fetches it and checks it
  hashes to the txid.
- validate: offline address validation (Base58Check, BIP 173, BIP 350), also
  run before balance, address and utxo, so a typo never reaches the API.
- inscription: Ordinals envelope detection, following ord's parsing rules.
- tx --inputs/--outputs, with outspends; addresses computed from the scripts.
- opreturn tags Runes, Omni and the BIP 141 witness commitment.
- HTTP reads are bounded in size and time; -n works with --api-url.
- The fuzzer and the weekly live test cover the new parsers and commands.
@devdavidejesus
devdavidejesus merged commit 2b5ef33 into main Oct 15, 2026
15 checks passed
@devdavidejesus
devdavidejesus deleted the feat/v1.8.0 branch October 15, 2026 14:20
@devdavidejesus devdavidejesus mentioned this pull request Oct 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant