From: Chris Duncan <chris@codecow.com>
Date: Mon, 10 Aug 2026 04:52:41 +0000 (-0700)
Subject: Restrict max account derivations within worker as well as untrusted host, and import... 
X-Git-Url: https://git.codecow.com/?a=commitdiff_plain;h=ca7753104c5e296444b55f476ef774d6e1a1b6d7;p=libnemo.git

Restrict max account derivations within worker as well as untrusted host, and import the max from a constant.
---

diff --git a/src/lib/constants.ts b/src/lib/constants.ts
index 86fc54e..0be0396 100644
--- a/src/lib/constants.ts
+++ b/src/lib/constants.ts
@@ -13,6 +13,7 @@ export const DIFFICULTY_RECEIVE = 0xfffffe0000000000n
 export const DIFFICULTY_SEND = 0xfffffff800000000n
 export const HARDENED_OFFSET = 0x80000000
 export const HEXCHAR = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'] as const
+export const MAX_DERIVATIONS = 1_000
 export const MAX_RAW = 0xFFFF_FFFF_FFFF_FFFF_FFFF_FFFF_FFFF_FFFFn
 export const MAX_SUPPLY = 133_248_297_920_938_463_463_374_607_431_768_211_455n
 export const NONCE_LENGTH = 24
diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index 1bf5b19..5999caa 100644
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -5,7 +5,7 @@ import { derive as nano25519_derive, sign as nano25519_sign } from 'nano25519/sy
 import { UUID } from 'node:crypto'
 import { parentPort, threadId } from 'node:worker_threads'
 import { TaskData } from '.'
-import { BIP44_COIN_NANO } from '../constants'
+import { BIP44_COIN_NANO, MAX_DERIVATIONS } from '../constants'
 import { dec, utf8 } from '../convert'
 import { Bip39, Bip44, Blake2b, WalletAesGcm } from '../crypto'
 import { VaultError } from '../errors'
@@ -183,7 +183,7 @@ function create (type?: WalletType, id?: UUID, key?: CryptoKey, keySalt?: ArrayB
  * wallet seed at a specified index and then returns the public key. The wallet
  * must be unlocked prior to derivation.
  */
-function derive (index?: number | Uint32Array): Promise<Record<string, number | ArrayBuffer>> {
+function derive (index?: Uint32Array): Promise<Record<string, number | ArrayBuffer>> {
 	try {
 		_timer.pause()
 		if (_locked) {
@@ -198,6 +198,9 @@ function derive (index?: number | Uint32Array): Promise<Record<string, number |
 		if (index == null) {
 			throw new VaultError('Invalid wallet account index(es)')
 		}
+		if (index.length > MAX_DERIVATIONS) {
+			throw new VaultError('Maximum 1000 accounts per call')
+		}
 		const promises = []
 		const values = typeof index === 'number' ? [index] : index.values()
 		for (const i of values) {
diff --git a/src/lib/wallet/accounts.ts b/src/lib/wallet/accounts.ts
index b437829..4420675 100644
--- a/src/lib/wallet/accounts.ts
+++ b/src/lib/wallet/accounts.ts
@@ -3,6 +3,7 @@
 
 import { WalletType } from '.'
 import { Account } from '../account'
+import { MAX_DERIVATIONS } from '../constants'
 import { Ledger } from '../ledger'
 import { Vault } from '../vault'
 
@@ -24,7 +25,7 @@ export async function _accounts (type: WalletType, accounts: Map<number, Account
 	if (to - from > 100) {
 		console.warn('libnemo performance may degrade when deriving many accounts at once')
 	}
-	if (to - from > 1_000) {
+	if (to - from > MAX_DERIVATIONS) {
 		throw new RangeError('Maximum 1000 accounts per call')
 	}
 	const output = new Map<number, Account>()