Updated Handler for appencryptionrequest, added z_functions ported from React Native Verus by iamahmedshahh · Pull Request #228 · VerusCoin/Verus-Mobile

iamahmedshahh · 2026-02-07T07:33:36Z

No description provided.

… decrypt from react-native-zcash

Add validation logic to prevent spoofing attacks in AppEncryptionRequest flow: - If requestSignerID is in wallet: appOrDelegatedID can be any identity (user is delegating) - If requestSignerID is NOT in wallet: appOrDelegatedID must equal requestSignerID or be absent (app can only claim to be itself) New helper functions: - isIdentityInWallet: checks if identity's primaryaddresses include wallet address - validateRequestIdentities: enforces the above rules, returns validated appID - validateResponseSignerID: validates user's responding identity is in wallet Handler does the following: - Validates identities before key derivation - Builds full AppEncryptionResponseDetails (ivk, evk, address, optionally spending_key) - Encrypts response to app's z-address - Pushes result to response array for envelope construction

-- fixed typo in zGet validate response signer in now the main handler of appEncryptionHandler -- changed the top level import on zfunctions from react native zcash (old) to react native verus (new)

… on miketout changes -- added checks in appEncryptionRequestValidator -- requests are handled in appEncryptionRequestHandler -- returns encrypted response and handledIndices

-- returned encrypted results directly -- code clean up

…stVDXFObject function - using the ESK for deriving channel keys instead of seed - removed the app or delegated id check that was in appEncryptionRequestValidator because that would go on envelope level.

michaeltout

Initial comments

michaeltout · 2026-02-07T08:52:59Z

.yarn/releases/yarn-classic.cjs

Please remove this file, we do not use yarn classic

removed, will push when make all changes

michaeltout · 2026-02-07T08:53:43Z

android/gradle.properties

Please undo this change, we should point to the VerusCoin repo and pointing to biz's repo was temporary

I dont see it pointing to any repo except for the ./m2/repository

michaeltout · 2026-02-07T08:59:20Z

src/utils/deeplink/handlers/appEncryptionRequestHandler.js

+  const keys = derivationResult.result;
+
+  // build response details
+  const responseDetails = AppEncryptionResponseDetails.fromJson({


Please avoid using the fromJson function, and use the constructor while passing in and formatting the data as needed by the constructor

michaeltout · 2026-02-07T09:00:15Z

src/utils/deeplink/handlers/appEncryptionRequestHandler.js

+  // encrypt response to app's z-address
+  const encryptTo = request.encryptToZAddress;
+
+  if (!encryptTo) {


You don't need to handle encryptToZAddress here, that'll be handled when processing the entire response at the very end

Hm I got this confused with encryptResponseToAddress on the generic request, I'm actually not sure what to do to handle the encryptToZAddress on the appEncryptionRequestHandler, it still might need to be handled in a different way than what you're doing though, because to return an encrypted AppEncryptionResponse, you probably need to return a DataDescriptorOrdinalVDXFObject instead of an AppEncryptionResponseOrdinalVDXFObject. AppEncryptionResponseOrdinalVDXFObject would only be if the response was unencrypted.

Looking into the code it seems this encryptToZAddress is not actually optional, I will make it optional with a flag and then you can check something like hasEncryptToZAddress to see if it is present or not

waiting on this

It was pushed and the libraries were updated a few days ago

michaeltout · 2026-02-07T09:05:35Z

src/utils/deeplink/handlers/appEncryptionRequestHandler.js

+  // extract envelope-level info
+  const systemID = request.signature.systemID.toIAddress();
+  const requestSignerID = request.signature.identityID.toIAddress();
+  const appOrDelegatedID = getAppOrDelegatedID(request);


Please do not do any verification of the appOrDelegatedID in this request, that will be verified when the request comes in, before processing occurs. You can remove things like validateRequestIdentities

michaeltout · 2026-02-07T09:08:38Z

.yarnrc.yml

Remove this file please

michaeltout · 2026-02-07T09:09:03Z

package.json

Changes to this file should be removed

michaeltout · 2026-02-07T09:09:16Z

shim.js

Please do not add shim.js

michaeltout · 2026-02-07T09:09:34Z

yarn.lock

Changes to this file should be removed, there is no reason to change the packages or yarn lock files

michaeltout · 2026-02-07T09:10:57Z

src/utils/deeplink/handlers/appEncryptionRequestHandler.js

+  VrpcProvider.initEndpoint(coinObj.system_id, coinObj.vrpc_endpoints[0]);
+
+  // process the request
+  const encryptedResponse = await processAppEncryptionRequest({


From what I can tell, processAppEncryptionRequest returns hex, this will cause a runtime error when hex is passed into the data field of AppEncryptionResponseOrdinalVDXFObject, as it is expecting AppEncryptionResponseDetails

- Use AppEncryptionResponseDetails constructor instead of fromJson() - Convert string keys to proper types (Buffer, SaplingExtendedViewingKey, SaplingPaymentAddress, SaplingExtendedSpendingKey) - Remove validateRequestIdentities and isIdentityInWallet functions - Validation now handled at envelope level before handler is called - Fix response wrapping to prevent runtime error - Unencrypted: return AppEncryptionResponseOrdinalVDXFObject with AppEncryptionResponseDetails object (not hex string) - Encrypted: return DataDescriptorOrdinalVDXFObject with DataDescriptor containing encrypted data - Rename encryptToZAddress to encryptResponseToAddress - Add hasEncryptResponseToAddress() helper with method/property fallback - Add getEncryptResponseToAddress() helper for address extraction

who-biz and others added 11 commits May 29, 2025 09:36

Use ka_agree branch of 'react-native-verus'

aed6b0e

Add lines to keys.js for testing of ka_agree

fb6bbe7

importing and making a wrapper for zgetencrpytionaddress, encrypt and…

c638fb5

… decrypt from react-native-zcash

-- importing functions called from react native verus in callcreators

7685be2

-- fixed typo in zGet validate response signer in now the main handler of appEncryptionHandler -- changed the top level import on zfunctions from react native zcash (old) to react native verus (new)

- updated appEncryptionRequest handlers, following the existing style…

005428a

… on miketout changes -- added checks in appEncryptionRequestValidator -- requests are handled in appEncryptionRequestHandler -- returns encrypted response and handledIndices

-- removed console logs

50e5218

-- returned encrypted results directly -- code clean up

minor updates and corrections

77563fd

- removed context from the parameters of the handleAppEncryptionReque…

691319f

…stVDXFObject function - using the ESK for deriving channel keys instead of seed - removed the app or delegated id check that was in appEncryptionRequestValidator because that would go on envelope level.

get esk from activeAccount

076db10

change derivationParams from seed to spendingKey

95f5fb6

michaeltout reviewed Feb 7, 2026

View reviewed changes

iamahmedshahh marked this pull request as draft February 18, 2026 15:24

Conversation

iamahmedshahh commented Feb 7, 2026

Uh oh!

michaeltout left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iamahmedshahh Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaeltout Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

iamahmedshahh Feb 9, 2026 •

edited

Loading

michaeltout Feb 7, 2026 •

edited

Loading