Security context

Highlights

Cryptographic Issues: 5 prior fixes. Scrutinize any change in this area.

src/ecsignature.js: most-fixed (5 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Signature Validation Bypass: Inconsistent or loose DER signature parsing allows non-canonical signatures (e.g., negative R/S values, invalid padding, or non-standard hash types) to bypass validation, violating BIP66 consensus rules and enabling transaction malleability.

Cryptographic Issues: Allowing critical transaction fields (version, locktime, inputs, or outputs) to be mutated after partial signatures are generated compromises transaction integrity, enabling unauthorized transaction modification.

Auth Bypass: Failing to verify the presence of Taproot signatures or correct public key types on signed inputs allows attackers to bypass validation checks and alter signed input states.