mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-10-20 18:56:16 +00:00
Satoshi Qazi Muhammed
3c5970b711
verifyWalletSignature checked a signature only through @pezkuwi/util-crypto, whose sr25519 uses Pezkuwi's `bizinikiwi` signing context. The browser extension signs in that context. The Pezkuwi Wallet mobile app does not, for a message: it picks the signing chain from the address prefix, prefix 42 falls back to Polkadot, and Polkadot gets the standard `substrate` context. Transactions are unaffected, since their payload carries the genesis hash. Measured on 2026-10-01 on dks.news, which verifies the same way: every sign-in from the app was refused with 401, and the captured signature verifies in the substrate context and in no other. This verifier has the same shape and its tests sign only with @pezkuwi/keyring, so the mobile path was never exercised here -- withdrawal and payment confirmations, identity and citizenship signed from the app would be refused the same way. The wallet is the released, store-tested build and is not changed for this. The verifier now also accepts an sr25519 signature in the substrate context, via @scure/sr25519, the upstream that @pezkuwi/scure-sr25519 is forked from with only the context string changed. The proof is unchanged: the account's own key over a canonical, single-use challenge. Tests: a substrate-context signature passes; the same signature claimed for another address, or over a different message, is refused. With the fallback disabled the first fails (26/27); restored, 27/27.