Merge branch 'feature/btc-native-send' into fix/multisig-first-signer-deep-link

# Conflicts: # feature-assets/src/main/java/io/novafoundation/nova/feature_assets/presentation/bridge/BridgeFragment.kt # feature-assets/src/main/java/io/novafoundation/nova/feature_assets/presentation/bridge/BridgeViewModel.kt # feature-assets/src/main/java/io/novafoundation/nova/feature_assets/presentation/bridge/di/BridgeModule.kt
2026-07-23 10:45:50 +00:00 · 2026-07-14 07:36:14 -07:00
parent 3def96792a 7401783436
commit be2e1088e5
116 changed files with 5425 additions and 455 deletions
@@ -28,6 +28,9 @@ object MetaAccountSecrets : Schema<MetaAccountSecrets>() {

    val TronKeypair by schema(KeyPairSchema).optional()
    val TronDerivationPath by string().optional()
+
+    val BitcoinKeypair by schema(KeyPairSchema).optional()
+    val BitcoinDerivationPath by string().optional()
 }

 object ChainAccountSecrets : Schema<ChainAccountSecrets>() {
@@ -47,6 +50,8 @@ fun MetaAccountSecrets(
    ethereumDerivationPath: String? = null,
    tronKeypair: Keypair? = null,
    tronDerivationPath: String? = null,
+    bitcoinKeypair: Keypair? = null,
+    bitcoinDerivationPath: String? = null,
 ): EncodableStruct<MetaAccountSecrets> = MetaAccountSecrets { secrets ->
    secrets[Entropy] = entropy
    secrets[SubstrateSeed] = substrateSeed
@@ -75,6 +80,15 @@ fun MetaAccountSecrets(
        }
    }
    secrets[TronDerivationPath] = tronDerivationPath
+
+    secrets[BitcoinKeypair] = bitcoinKeypair?.let {
+        KeyPairSchema { keypair ->
+            keypair[PublicKey] = it.publicKey
+            keypair[PrivateKey] = it.privateKey
+            keypair[Nonce] = null // bitcoin uses secp256k1 (like ethereum/tron), so nonce is always null
+        }
+    }
+    secrets[BitcoinDerivationPath] = bitcoinDerivationPath
 }

 fun ChainAccountSecrets(
@@ -103,6 +117,9 @@ val EncodableStruct<MetaAccountSecrets>.ethereumDerivationPath
 val EncodableStruct<MetaAccountSecrets>.tronDerivationPath
    get() = get(MetaAccountSecrets.TronDerivationPath)

+val EncodableStruct<MetaAccountSecrets>.bitcoinDerivationPath
+    get() = get(MetaAccountSecrets.BitcoinDerivationPath)
+
 val EncodableStruct<MetaAccountSecrets>.entropy
    get() = get(MetaAccountSecrets.Entropy)

@@ -118,6 +135,9 @@ val EncodableStruct<MetaAccountSecrets>.ethereumKeypair
 val EncodableStruct<MetaAccountSecrets>.tronKeypair
    get() = get(MetaAccountSecrets.TronKeypair)

+val EncodableStruct<MetaAccountSecrets>.bitcoinKeypair
+    get() = get(MetaAccountSecrets.BitcoinKeypair)
+
 val EncodableStruct<ChainAccountSecrets>.derivationPath
    get() = get(ChainAccountSecrets.DerivationPath)

@@ -156,20 +156,28 @@ val AccountSecrets.isChainAccountSecrets
 suspend fun SecretStoreV2.getMetaAccountKeypair(
    metaId: Long,
    isEthereum: Boolean,
+    isTron: Boolean = false,
+    isBitcoin: Boolean = false,
 ): Keypair = withContext(Dispatchers.Default) {
    val secrets = getMetaAccountSecrets(metaId) ?: noMetaSecrets(metaId)

-    mapMetaAccountSecretsToKeypair(secrets, isEthereum)
+    mapMetaAccountSecretsToKeypair(secrets, isEthereum, isTron, isBitcoin)
 }

 fun mapMetaAccountSecretsToKeypair(
    secrets: EncodableStruct<MetaAccountSecrets>,
    ethereum: Boolean,
+    tron: Boolean = false,
+    bitcoin: Boolean = false,
 ): Keypair {
-    val keypairStruct = if (ethereum) {
-        secrets[MetaAccountSecrets.EthereumKeypair] ?: noEthereumSecret()
-    } else {
-        secrets[MetaAccountSecrets.SubstrateKeypair]
+    // Tron and Bitcoin both reuse Ethereum's secp256k1 curve but derive their own keypair under a different
+    // SLIP-44 path - each must be checked before `ethereum`, not folded into it, or that account would get
+    // signed with the wrong (Ethereum) private key.
+    val keypairStruct = when {
+        tron -> secrets[MetaAccountSecrets.TronKeypair] ?: noTronSecret()
+        bitcoin -> secrets[MetaAccountSecrets.BitcoinKeypair] ?: noBitcoinSecret()
+        ethereum -> secrets[MetaAccountSecrets.EthereumKeypair] ?: noEthereumSecret()
+        else -> secrets[MetaAccountSecrets.SubstrateKeypair]
    }

    return mapKeypairStructToKeypair(keypairStruct)
@@ -178,8 +186,11 @@ fun mapMetaAccountSecretsToKeypair(
 fun mapMetaAccountSecretsToDerivationPath(
    secrets: EncodableStruct<MetaAccountSecrets>,
    ethereum: Boolean,
+    bitcoin: Boolean = false,
 ): String? {
-    return if (ethereum) {
+    return if (bitcoin) {
+        secrets[MetaAccountSecrets.BitcoinDerivationPath]
+    } else if (ethereum) {
        secrets[MetaAccountSecrets.EthereumDerivationPath]
    } else {
        secrets[MetaAccountSecrets.SubstrateDerivationPath]
@@ -198,6 +209,10 @@ private fun noChainSecrets(metaId: Long, accountId: ByteArray): Nothing {

 private fun noEthereumSecret(): Nothing = error("No ethereum keypair found")

+private fun noBitcoinSecret(): Nothing = error("No bitcoin keypair found")
+
+private fun noTronSecret(): Nothing = error("No tron keypair found")
+
 fun mapKeypairStructToKeypair(struct: EncodableStruct<KeyPairSchema>): Keypair {
    return Keypair(
        publicKey = struct[KeyPairSchema.PublicKey],
@@ -0,0 +1,164 @@
+package io.novafoundation.nova.common.utils
+
+/**
+ * Bech32 (BIP173) / Bech32m (BIP350) codec, hand-implemented since no such library is currently on this
+ * project's classpath (same rationale as [Base58]/[Base58Check] for Tron - this is a deterministic text
+ * encoding, not a secret-dependent cryptographic primitive).
+ *
+ * Direct port of the reference algorithm in BIP173/BIP350's `segwit_addr.py`. Cross-checked against BIP173's
+ * and BIP350's official test vectors - see [Bech32Test].
+ */
+object Bech32 {
+
+    private const val CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+    private const val BECH32_CONST = 1L
+    private const val BECH32M_CONST = 0x2bc830a3L
+
+    enum class Encoding(val const: Long) {
+        BECH32(BECH32_CONST),
+        BECH32M(BECH32M_CONST)
+    }
+
+    data class Decoded(val hrp: String, val values: IntArray, val encoding: Encoding)
+
+    private fun polymod(values: IntArray): Long {
+        val gen = longArrayOf(0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3)
+        var chk = 1L
+        for (v in values) {
+            val b = (chk ushr 25)
+            chk = (chk and 0x1ffffff) shl 5 xor v.toLong()
+            for (i in 0 until 5) {
+                if ((b ushr i) and 1L == 1L) {
+                    chk = chk xor gen[i]
+                }
+            }
+        }
+        return chk
+    }
+
+    private fun hrpExpand(hrp: String): IntArray {
+        val lower = hrp.map { (it.code ushr 5) }
+        val upper = hrp.map { (it.code and 31) }
+        return (lower + listOf(0) + upper).toIntArray()
+    }
+
+    private fun createChecksum(hrp: String, data: IntArray, encoding: Encoding): IntArray {
+        val values = hrpExpand(hrp) + data + IntArray(6)
+        val mod = polymod(values) xor encoding.const
+        return IntArray(6) { i -> ((mod ushr (5 * (5 - i))) and 31).toInt() }
+    }
+
+    fun encode(hrp: String, data: IntArray, encoding: Encoding): String {
+        val checksum = createChecksum(hrp, data, encoding)
+        val combined = data + checksum
+        return hrp + "1" + combined.map { CHARSET[it] }.joinToString("")
+    }
+
+    fun decode(input: String): Decoded {
+        require(input.length in 8..90) { "Bech32 string has invalid length: ${input.length}" }
+        require(input == input.lowercase() || input == input.uppercase()) { "Bech32 string is mixed case: $input" }
+
+        val lower = input.lowercase()
+        val separatorIndex = lower.lastIndexOf('1')
+        require(separatorIndex >= 1) { "Bech32 string is missing separator '1': $input" }
+        require(separatorIndex + 7 <= lower.length) { "Bech32 data part too short: $input" }
+
+        val hrp = lower.substring(0, separatorIndex)
+        val dataPart = lower.substring(separatorIndex + 1)
+
+        val values = IntArray(dataPart.length)
+        for ((i, c) in dataPart.withIndex()) {
+            val v = CHARSET.indexOf(c)
+            require(v >= 0) { "Invalid Bech32 character: '$c' in $input" }
+            values[i] = v
+        }
+
+        val checksumValue = polymod(hrpExpand(hrp) + values)
+        val encoding = when (checksumValue) {
+            BECH32_CONST -> Encoding.BECH32
+            BECH32M_CONST -> Encoding.BECH32M
+            else -> throw IllegalArgumentException("Invalid Bech32/Bech32m checksum: $input")
+        }
+
+        return Decoded(hrp, values.copyOfRange(0, values.size - 6), encoding)
+    }
+
+    /**
+     * Regroups bits between arbitrary group sizes (e.g. 8-bit bytes <-> 5-bit Bech32 words). Direct port of
+     * BIP173's `convertbits`.
+     */
+    fun convertBits(data: IntArray, fromBits: Int, toBits: Int, pad: Boolean): IntArray? {
+        var acc = 0
+        var bits = 0
+        val ret = mutableListOf<Int>()
+        val maxV = (1 shl toBits) - 1
+        val maxAcc = (1 shl (fromBits + toBits - 1)) - 1
+
+        for (value in data) {
+            if (value < 0 || (value ushr fromBits) != 0) return null
+
+            acc = ((acc shl fromBits) or value) and maxAcc
+            bits += fromBits
+            while (bits >= toBits) {
+                bits -= toBits
+                ret.add((acc ushr bits) and maxV)
+            }
+        }
+
+        if (pad) {
+            if (bits > 0) ret.add((acc shl (toBits - bits)) and maxV)
+        } else if (bits >= fromBits || ((acc shl (toBits - bits)) and maxV) != 0) {
+            return null
+        }
+
+        return ret.toIntArray()
+    }
+}
+
+/**
+ * Segwit address encoding/decoding (BIP173 witness v0, BIP350 witness v1+/Bech32m) on top of the raw [Bech32]
+ * codec above. Only witness version 0 (P2WPKH/P2WSH) is actually used by this app today (native SegWit only -
+ * Taproot/witness v1 is explicitly out of scope for now), but decode handles both since a user could paste any
+ * valid segwit address.
+ */
+object SegwitAddress {
+
+    fun encode(hrp: String, witnessVersion: Int, witnessProgram: ByteArray): String {
+        require(witnessVersion in 0..16) { "Invalid witness version: $witnessVersion" }
+        require(witnessProgram.size in 2..40) { "Invalid witness program length: ${witnessProgram.size}" }
+
+        val programWords = Bech32.convertBits(witnessProgram.map { it.toInt() and 0xff }.toIntArray(), 8, 5, true)
+            ?: throw IllegalArgumentException("Failed to convert witness program to 5-bit words")
+
+        val encoding = if (witnessVersion == 0) Bech32.Encoding.BECH32 else Bech32.Encoding.BECH32M
+
+        return Bech32.encode(hrp, intArrayOf(witnessVersion) + programWords, encoding)
+    }
+
+    data class Decoded(val witnessVersion: Int, val witnessProgram: ByteArray)
+
+    fun decode(expectedHrp: String, address: String): Decoded {
+        val (hrp, values, encoding) = Bech32.decode(address)
+        require(hrp == expectedHrp) { "Unexpected HRP: expected $expectedHrp, got $hrp" }
+        require(values.isNotEmpty()) { "Empty Bech32 data part: $address" }
+
+        val witnessVersion = values[0]
+        val expectedEncoding = if (witnessVersion == 0) Bech32.Encoding.BECH32 else Bech32.Encoding.BECH32M
+        require(encoding == expectedEncoding) {
+            "Witness version $witnessVersion requires ${expectedEncoding.name} but address used ${encoding.name}: $address"
+        }
+
+        val programWords = values.copyOfRange(1, values.size)
+        val programBytes = Bech32.convertBits(programWords, 5, 8, false)
+            ?: throw IllegalArgumentException("Invalid witness program padding: $address")
+
+        require(programBytes.size in 2..40) { "Invalid witness program length: $address" }
+        if (witnessVersion == 0) {
+            require(programBytes.size == 20 || programBytes.size == 32) {
+                "Witness v0 program must be 20 (P2WPKH) or 32 (P2WSH) bytes: $address"
+            }
+        }
+
+        return Decoded(witnessVersion, ByteArray(programBytes.size) { programBytes[it].toByte() })
+    }
+}
@@ -0,0 +1,56 @@
+package io.novafoundation.nova.common.utils
+
+import io.novasama.substrate_sdk_android.runtime.AccountId
+import org.bouncycastle.jcajce.provider.digest.RIPEMD160
+
+/**
+ * Native SegWit (P2WPKH) Bitcoin address support. Only witness v0 P2WPKH (`bc1q...`) is implemented - Taproot
+ * and legacy/P2SH-SegWit are explicitly out of scope for this phase (see the BTC integration plan).
+ *
+ * Bitcoin's "account id" here is the 20-byte HASH160 of the compressed secp256k1 public key - unlike
+ * Tron/Ethereum (which both derive their account id via keccak256 of the *uncompressed* pubkey), so this is
+ * NOT interchangeable with [tronPublicKeyToAccountId]/`asEthereumPublicKey().toAccountId()` despite all three
+ * using the same underlying secp256k1 keypair machinery.
+ */
+private const val BITCOIN_MAINNET_HRP = "bc"
+
+/** RIPEMD160(SHA256(x)) - the "HASH160" function used throughout Bitcoin for pubkey hashes and script hashes. */
+fun ByteArray.hash160(): ByteArray {
+    val ripemd160 = RIPEMD160.Digest()
+    return ripemd160.digest(this.sha256())
+}
+
+/**
+ * @param compressedPublicKey a 33-byte compressed secp256k1 public key (0x02/0x03 prefix + 32-byte x-coordinate).
+ */
+fun ByteArray.bitcoinPublicKeyToAccountId(): AccountId {
+    require(size == 33) { "Bitcoin native SegWit requires a compressed (33-byte) public key, got $size bytes" }
+
+    return hash160()
+}
+
+/** P2WPKH scriptPubKey: `OP_0 <20-byte-push> <hash160>`, i.e. `0x00 0x14 <20 bytes>`. */
+fun AccountId.toP2wpkhScriptPubKey(): ByteArray {
+    require(size == 20) { "Bitcoin account id (HASH160) must be 20 bytes, got $size" }
+
+    return byteArrayOf(0x00, 0x14) + this
+}
+
+fun AccountId.toBitcoinAddress(): String {
+    require(size == 20) { "Bitcoin account id (HASH160) must be 20 bytes, got $size" }
+
+    return SegwitAddress.encode(BITCOIN_MAINNET_HRP, witnessVersion = 0, witnessProgram = this)
+}
+
+fun String.bitcoinAddressToAccountId(): AccountId {
+    val decoded = SegwitAddress.decode(BITCOIN_MAINNET_HRP, this)
+    require(decoded.witnessVersion == 0 && decoded.witnessProgram.size == 20) {
+        "Not a native SegWit P2WPKH address: $this"
+    }
+
+    return decoded.witnessProgram
+}
+
+fun String.isValidBitcoinAddress(): Boolean = runCatching { bitcoinAddressToAccountId() }.isSuccess
+
+fun emptyBitcoinAccountId() = ByteArray(20) { 1 }
@@ -0,0 +1,79 @@
+package io.novafoundation.nova.common.utils
+
+private const val P2PKH_VERSION = 0x00
+private const val P2SH_VERSION = 0x05
+
+/**
+ * Any Bitcoin address this wallet can SEND to - a strict superset of what it can derive/receive as its own
+ * address (native SegWit only, see `BitcoinAddress.kt`). Needed because a real exchange withdrawal address was
+ * confirmed live to be P2SH (`3...`), which this app's original native-SegWit-only `isValidBitcoinAddress()`
+ * rejected outright, blocking the send with a misleading "QR can't be decoded" error (the QR was fine - a bare
+ * P2SH address - the address TYPE just wasn't recognized as a valid destination at all).
+ *
+ * Deliberately kept separate from [bitcoinAddressToAccountId]/[AccountId] - that function's 20-byte output feeds
+ * generic multi-chain code (`Chain.accountIdOf`) that assumes every account id is THIS wallet's own P2WPKH
+ * shape. Silently reusing it for a P2SH/P2PKH recipient would produce a 20-byte hash with no type tag, and
+ * downstream code would wrap it in the wrong (P2WPKH) scriptPubKey - sending funds to an address that doesn't
+ * match what was actually asked for. [BitcoinDestination] carries its type through to [toScriptPubKey] instead.
+ */
+sealed class BitcoinDestination {
+
+    data class NativeSegwit(val witnessProgram: ByteArray) : BitcoinDestination()
+
+    data class P2sh(val scriptHash: ByteArray) : BitcoinDestination()
+
+    data class P2pkh(val pubKeyHash: ByteArray) : BitcoinDestination()
+}
+
+fun String.decodeBitcoinDestination(): BitcoinDestination {
+    runCatching {
+        val decoded = SegwitAddress.decode("bc", this)
+        if (decoded.witnessVersion == 0 && decoded.witnessProgram.size == 20) {
+            return BitcoinDestination.NativeSegwit(decoded.witnessProgram)
+        }
+    }
+
+    // Base58Check itself is chain-agnostic (see TronAddress.kt) - a Bitcoin legacy address is 1 version byte +
+    // 20-byte hash, same shape as Tron's own address, just a different version byte and no fixed prefix meaning.
+    val decoded = Base58Check.decode(this)
+    require(decoded.size == 21) { "Not a valid Bitcoin legacy address: $this" }
+
+    val version = decoded[0].toInt() and 0xff
+    val hash = decoded.copyOfRange(1, decoded.size)
+
+    return when (version) {
+        P2PKH_VERSION -> BitcoinDestination.P2pkh(hash)
+        P2SH_VERSION -> BitcoinDestination.P2sh(hash)
+        else -> error("Unsupported Bitcoin address version byte: $version")
+    }
+}
+
+fun String.isValidBitcoinDestinationAddress(): Boolean = runCatching { decodeBitcoinDestination() }.isSuccess
+
+/**
+ * The raw 20-byte hash underlying any destination type, with its type tag dropped - safe ONLY for consumers
+ * that treat it as an opaque identicon/display seed (e.g. `Chain.accountIdOf` and, downstream, address icon
+ * generation) and never feed it back into [toScriptPubKey] or re-encode it as an address. Real transaction
+ * construction must keep using [decodeBitcoinDestination]/[toScriptPubKey] directly, which keep the type.
+ */
+val BitcoinDestination.hash: ByteArray
+    get() = when (this) {
+        is BitcoinDestination.NativeSegwit -> witnessProgram
+        is BitcoinDestination.P2sh -> scriptHash
+        is BitcoinDestination.P2pkh -> pubKeyHash
+    }
+
+/**
+ * @return the scriptPubKey a transaction output must use to actually pay this destination - P2SH/P2PKH have
+ * different script shapes from this wallet's own P2WPKH (see [toP2wpkhScriptPubKey]), despite all three being a
+ * "20-byte hash wrapped in a short script."
+ */
+fun BitcoinDestination.toScriptPubKey(): ByteArray = when (this) {
+    is BitcoinDestination.NativeSegwit -> byteArrayOf(0x00, 0x14) + witnessProgram
+
+    // OP_HASH160 <20-byte-push> OP_EQUAL
+    is BitcoinDestination.P2sh -> byteArrayOf(0xa9.toByte(), 0x14) + scriptHash + byteArrayOf(0x87.toByte())
+
+    // OP_DUP OP_HASH160 <20-byte-push> OP_EQUALVERIFY OP_CHECKSIG
+    is BitcoinDestination.P2pkh -> byteArrayOf(0x76, 0xa9.toByte(), 0x14) + pubKeyHash + byteArrayOf(0x88.toByte(), 0xac.toByte())
+}
@@ -0,0 +1,170 @@
+package io.novafoundation.nova.common.utils
+
+import java.io.ByteArrayOutputStream
+
+/** SHA256(SHA256(x)) - Bitcoin's standard "double SHA256", used for both txids and the BIP143 sighash. */
+fun ByteArray.sha256d(): ByteArray = sha256().sha256()
+
+/** Bitcoin's variable-length integer ("CompactSize") encoding, used throughout raw transaction serialization. */
+fun Long.toBitcoinVarInt(): ByteArray {
+    require(this >= 0) { "VarInt cannot encode a negative value: $this" }
+    val out = ByteArrayOutputStream()
+    when {
+        this < 0xfd -> out.write(toInt())
+        this <= 0xffff -> {
+            out.write(0xfd)
+            out.write(toInt() and 0xff)
+            out.write((toInt() ushr 8) and 0xff)
+        }
+        this <= 0xffffffffL -> {
+            out.write(0xfe)
+            for (i in 0..3) out.write(((this ushr (8 * i)) and 0xff).toInt())
+        }
+        else -> {
+            out.write(0xff)
+            for (i in 0..7) out.write(((this ushr (8 * i)) and 0xff).toInt())
+        }
+    }
+    return out.toByteArray()
+}
+
+private fun Int.toLeBytes(byteCount: Int): ByteArray = ByteArray(byteCount) { i -> ((this ushr (8 * i)) and 0xff).toByte() }
+
+private fun Long.toLeBytes(byteCount: Int): ByteArray = ByteArray(byteCount) { i -> ((this ushr (8 * i)) and 0xff).toByte() }
+
+/**
+ * A single UTXO being spent, in the form needed to build and sign a transaction.
+ *
+ * @param txid the previous transaction's id in standard (RPC/explorer-display) byte order - this class reverses
+ * it internally to the on-wire/internal order raw transactions actually use (see [reversedTxid]).
+ */
+data class BitcoinInput(
+    val txid: ByteArray,
+    val vout: Int,
+    val valueSat: Long,
+    val sequence: Long = 0xfffffffdL, // RBF-signaling (BIP125), matching the exchange's proven, already-live choice
+) {
+    init {
+        require(txid.size == 32) { "txid must be 32 bytes, got ${txid.size}" }
+    }
+
+    fun reversedTxid(): ByteArray = txid.reversedArray()
+}
+
+data class BitcoinOutput(
+    val valueSat: Long,
+    val scriptPubKey: ByteArray,
+)
+
+/**
+ * Builds and signs native SegWit (P2WPKH-only) Bitcoin transactions using BIP143 sighashes - hand-implemented
+ * since no Bitcoin transaction library (bitcoinj/PSBT/etc.) is on this project's classpath (same rationale as
+ * [Bech32]/[DerSignature]). Verified byte-for-byte against BIP143's official "Native P2WPKH" worked example,
+ * including the fully serialized signed transaction - see [BitcoinTransactionTest].
+ */
+object BitcoinTransaction {
+
+    private const val SIGHASH_ALL = 1
+
+    /** P2PKH-shaped "scriptCode" BIP143 requires for a P2WPKH input - see BIP143's "Specification" section. */
+    private fun p2wpkhScriptCode(accountId: ByteArray): ByteArray {
+        require(accountId.size == 20)
+        val script = byteArrayOf(0x76.toByte(), 0xa9.toByte(), 0x14) + accountId + byteArrayOf(0x88.toByte(), 0xac.toByte())
+        return 25L.toBitcoinVarInt() + script
+    }
+
+    private fun serializeOutpoint(input: BitcoinInput): ByteArray = input.reversedTxid() + input.vout.toLeBytes(4)
+
+    private fun hashPrevouts(inputs: List<BitcoinInput>): ByteArray =
+        inputs.fold(ByteArray(0)) { acc, input -> acc + serializeOutpoint(input) }.sha256d()
+
+    private fun hashSequence(inputs: List<BitcoinInput>): ByteArray =
+        inputs.fold(ByteArray(0)) { acc, input -> acc + input.sequence.toLeBytes(4) }.sha256d()
+
+    private fun serializeOutput(output: BitcoinOutput): ByteArray =
+        output.valueSat.toLeBytes(8) + output.scriptPubKey.size.toLong().toBitcoinVarInt() + output.scriptPubKey
+
+    private fun hashOutputs(outputs: List<BitcoinOutput>): ByteArray =
+        outputs.fold(ByteArray(0)) { acc, output -> acc + serializeOutput(output) }.sha256d()
+
+    /**
+     * BIP143 sighash preimage + double-SHA256 for signing [inputIndex], which must be a P2WPKH input whose
+     * pubkey hashes to [signingAccountId]. Always uses SIGHASH_ALL, no ANYONECANPAY/NONE/SINGLE - this app never
+     * constructs those.
+     */
+    fun bip143Sighash(
+        version: Int,
+        inputs: List<BitcoinInput>,
+        outputs: List<BitcoinOutput>,
+        inputIndex: Int,
+        signingAccountId: ByteArray,
+        locktime: Int,
+    ): ByteArray {
+        val input = inputs[inputIndex]
+
+        val preimage = version.toLeBytes(4) +
+            hashPrevouts(inputs) +
+            hashSequence(inputs) +
+            serializeOutpoint(input) +
+            p2wpkhScriptCode(signingAccountId) +
+            input.valueSat.toLeBytes(8) +
+            input.sequence.toLeBytes(4) +
+            hashOutputs(outputs) +
+            locktime.toLeBytes(4) +
+            SIGHASH_ALL.toLeBytes(4)
+
+        return preimage.sha256d()
+    }
+
+    /**
+     * @param witnesses one (derSignatureWithoutSighashByte, compressedPublicKey) pair per input, in input order -
+     * every input in this app's transactions is a P2WPKH input from this wallet's own single address, so every
+     * witness has exactly 2 items (signature, pubkey), never a bare key-path/script-path Taproot witness or a
+     * multisig-style stack.
+     */
+    fun serializeSigned(
+        version: Int,
+        inputs: List<BitcoinInput>,
+        outputs: List<BitcoinOutput>,
+        witnesses: List<Pair<ByteArray, ByteArray>>,
+        locktime: Int,
+    ): ByteArray {
+        require(witnesses.size == inputs.size) { "Need exactly one witness per input" }
+
+        val out = ByteArrayOutputStream()
+        out.write(version.toLeBytes(4))
+        out.write(0x00) // segwit marker
+        out.write(0x01) // segwit flag
+        out.write(inputs.size.toLong().toBitcoinVarInt())
+        for (input in inputs) {
+            out.write(input.reversedTxid())
+            out.write(input.vout.toLeBytes(4))
+            out.write(0L.toBitcoinVarInt()) // scriptSig: empty for a native SegWit input
+            out.write(input.sequence.toLeBytes(4))
+        }
+        out.write(outputs.size.toLong().toBitcoinVarInt())
+        for (output in outputs) {
+            out.write(serializeOutput(output))
+        }
+        for ((derSignature, publicKey) in witnesses) {
+            out.write(2L.toBitcoinVarInt()) // 2 witness items: signature, pubkey
+            val sigWithHashType = derSignature + byteArrayOf(SIGHASH_ALL.toByte())
+            out.write(sigWithHashType.size.toLong().toBitcoinVarInt())
+            out.write(sigWithHashType)
+            out.write(publicKey.size.toLong().toBitcoinVarInt())
+            out.write(publicKey)
+        }
+        out.write(locktime.toLeBytes(4))
+
+        return out.toByteArray()
+    }
+
+    /**
+     * Estimated virtual size in vbytes for fee purposes - the same hardcoded heuristic already proven in
+     * production by `pezkuwi-exchange/wallet-service` (`inputs*68 + outputs*31 + 11`), reused here rather than
+     * computing an exact post-signing weight (which would require knowing final DER signature lengths ahead of
+     * time - low-S-normalized DER signatures are 70-72 bytes almost always, making this heuristic accurate to
+     * within a few vbytes in practice).
+     */
+    fun estimateVsize(inputCount: Int, outputCount: Int): Long = inputCount * 68L + outputCount * 31L + 11L
+}
@@ -0,0 +1,62 @@
+package io.novafoundation.nova.common.utils
+
+import java.math.BigInteger
+
+/**
+ * DER-encodes a raw secp256k1 ECDSA (r, s) signature the way Bitcoin's script/witness format requires it -
+ * unlike Tron/Ethereum, which both use a fixed-size compact r(32)+s(32)+v(1) format (see
+ * [io.novafoundation.nova.feature_wallet_impl.data.network.tron.transaction.RealTronTransactionService]'s
+ * doc-comment for that format), Bitcoin signatures are a variable-length ASN.1 DER `SEQUENCE(INTEGER r, INTEGER
+ * s)`.
+ *
+ * `r`/`s` are taken as raw big-endian unsigned 32-byte values - exactly what
+ * [io.novasama.substrate_sdk_android]'s `SignatureWrapper.Ecdsa` (reached via `SignedRaw.toEcdsaSignatureData()`)
+ * already exposes for Ethereum-style signing, which this app already uses. No new signing call path is needed
+ * for Bitcoin: only this pure, standalone encoding step is new.
+ */
+object DerSignature {
+
+    // secp256k1 curve order n, and n/2 - Bitcoin Core's standardness rules (BIP62) reject a signature whose `s`
+    // is greater than n/2 ("high-S"); wallets are expected to always produce the "low-S" of the two equally
+    // valid (r, s) and (r, n-s) signatures for a given message, or relay nodes/miners may refuse the transaction.
+    private val CURVE_ORDER = BigInteger("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", 16)
+    private val HALF_CURVE_ORDER = CURVE_ORDER.shiftRight(1)
+
+    /**
+     * @param r raw big-endian unsigned 32-byte value
+     * @param s raw big-endian unsigned 32-byte value (will be normalized to low-S if not already)
+     * @return DER-encoded `SEQUENCE(INTEGER r, INTEGER s)`, WITHOUT the trailing sighash-type byte (the caller
+     * appends that when assembling the witness/scriptSig, since it is not part of the DER signature itself).
+     */
+    fun encode(r: ByteArray, s: ByteArray): ByteArray {
+        val rInt = BigInteger(1, r)
+        var sInt = BigInteger(1, s)
+
+        if (sInt > HALF_CURVE_ORDER) {
+            sInt = CURVE_ORDER.subtract(sInt)
+        }
+
+        val rEncoded = encodeInteger(rInt)
+        val sEncoded = encodeInteger(sInt)
+
+        val sequenceBody = rEncoded + sEncoded
+
+        return byteArrayOf(0x30, sequenceBody.size.toDerLength()) + sequenceBody
+    }
+
+    /**
+     * ASN.1 DER INTEGER: tag(0x02) + length + minimal big-endian two's-complement bytes. [BigInteger.toByteArray]
+     * already produces minimal big-endian two's-complement (including the leading 0x00 disambiguation byte when
+     * the high bit of the first byte would otherwise be set, which would make it read as negative) - since
+     * `rInt`/`sInt` are always non-negative here, its output is exactly the DER INTEGER content we need.
+     */
+    private fun encodeInteger(value: BigInteger): ByteArray {
+        val bytes = value.toByteArray()
+        return byteArrayOf(0x02, bytes.size.toDerLength()) + bytes
+    }
+
+    private fun Int.toDerLength(): Byte {
+        require(this in 0..127) { "DER length $this requires long-form encoding, not expected for a 32-byte ECDSA signature" }
+        return toByte()
+    }
+}
@@ -2,6 +2,7 @@ package io.novafoundation.nova.common.utils

 import io.novasama.substrate_sdk_android.extensions.asEthereumPublicKey
 import io.novasama.substrate_sdk_android.extensions.toAccountId
+import io.novasama.substrate_sdk_android.extensions.toHexString
 import io.novasama.substrate_sdk_android.runtime.AccountId
 import java.math.BigInteger

@@ -113,3 +114,21 @@ fun String.tronAddressToAccountId(): AccountId {
 fun String.isValidTronAddress(): Boolean = runCatching { tronAddressToAccountId() }.isSuccess

 fun emptyTronAccountId() = ByteArray(20) { 1 }
+
+/**
+ * Hex form of a Tron address (`0x41` prefix byte ++ accountId, hex-encoded, no `0x` prefix), e.g.
+ * `41a614f803b6fd780986a42c78ec9c7f77e6ded13c`. This is the format TronGrid's `/wallet/` transaction
+ * construction/broadcast endpoints expect when called with `"visible": false` (as opposed to the human-facing
+ * Base58Check form used by the `/v1/accounts/{address}` balance endpoint and by [toTronAddress]).
+ */
+fun AccountId.toTronHexAddress(): String {
+    require(size == 20) { "Tron account id must be 20 bytes, got $size" }
+
+    return byteArrayOf(TRON_ADDRESS_PREFIX_BYTE).toHexString(withPrefix = false) + toHexString(withPrefix = false)
+}
+
+/**
+ * Converts a human-facing Base58Check Tron address (e.g. a TRC20 `contractAddress` from chain config) directly
+ * into the hex form described in [toTronHexAddress].
+ */
+fun String.tronAddressToHexAddress(): String = tronAddressToAccountId().toTronHexAddress()
@@ -355,6 +355,8 @@

    <!-- Bridge Screen -->
    <string name="bridge_title">DOT ↔ HEZ Bridge</string>
+    <string name="bridge_pair_dot_hez">HEZ ⇄ DOT</string>
+    <string name="bridge_pair_usdt">USDT ⇄ USDT.p</string>
    <string name="bridge_you_send">You send</string>
    <string name="bridge_you_receive">You receive (estimated)</string>
    <string name="bridge_exchange_rate">Exchange rate</string>