Verify seed in constant time.

diff --git a/src/lib/safe.ts b/src/lib/safe.ts
index a0f55ccd8d80477edb38d960b742c35a3fff9425..8a9712431537db05a6e3ba6cbdbb48d6f1912c36 100644 (file)
--- a/src/lib/safe.ts
+++ b/src/lib/safe.ts
@@ -279,23 +279,16 @@ export class Safe {
                        }
                        let isVerified = false
                        if (seed != null) {
-                               if (seed.byteLength === this.#seed.byteLength) {
-                                       const userSeed = new Uint8Array(seed)
-                                       const thisSeed = new Uint8Array(this.#seed)
-                                       for (let i = 0; i < seed.byteLength; i++) {
-                                               if (userSeed[i] === thisSeed[i]) {
-                                                       isVerified = true
-                                               } else {
-                                                       isVerified = false
-                                                       break
-                                               }
-                                       }
+                               let diff = 0
+                               const userSeed = new Uint8Array(seed)
+                               const thisSeed = new Uint8Array(this.#seed)
+                               for (let i = 0; i < seed.byteLength; i++) {
+                                       diff |= userSeed[i] ^ thisSeed[i]
                                }
+                               isVerified = diff === 0
                        }
-                       if (mnemonicPhrase != null) {
-                               if (mnemonicPhrase === this.#mnemonic) {
-                                       isVerified = true
-                               }
+                       if (mnemonicPhrase != null && mnemonicPhrase === this.#mnemonic) {
+                               isVerified = true
                        }
                        return { isVerified }
                } catch (err) {