minor [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/hash.ts:75apps/alp-fusion/src/protocol/hash.ts:75-80]8;;

Reject malformed pool keys instead of truncating them.

key.split(':') ignores fields after the second, so
tokenHex:10000:extra is parsed as tokenHex:10000. Require exactly two
fields before decoding to prevent malformed persisted or input keys from
resolving to an unintended pool.

major [Functional Correctness]
→ ]8;;vscode://file//work/apps/alp-fusion/test/hash.test.ts:29apps/alp-fusion/test/hash.test.ts:29-49]8;;

Add golden vectors for protocol hashes.

The test claims hash stability but checks only length and that
round/session hashes differ. Changes to domain tags, field ordering, byte
order, or length framing would still pass. Assert exact reference hex
digests for the session and round hashes, plus a fixed listHash vector.

major [Functional Correctness]
→ ]8;;vscode://file//work/apps/alp-fusion/test/hash.test.ts:51apps/alp-fusion/test/hash.test.ts:51-63]8;;

Use asymmetric token IDs and assert the serialized key.

'cc'.repeat(32) and 'ab'.repeat(32) are invariant under byte reversal,
so these tests cannot detect an endian regression. Use a non-repeating
32-byte ID and assert the exact pool-key text and encoded bytes.

major [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/hash.ts:71apps/alp-fusion/src/protocol/hash.ts:71-95]8;;

Validate pool-key components at the boundary.

poolKey, parsePoolKey, and the token-ID helpers accept
arbitrary-length IDs and negative or oversized tiers. This conflicts with
the 32-byte txid-shaped IDs used by the tests and the u64 atomTier
encoding used by calcSessionHash, allowing invalid pool state to enter
downstream logic. Enforce a 32-byte token ID, 0 <= atomTier <= 2^64 - 1,
and canonical decimal key text in both directions; add regression tests
for these cases.

major [Functional Correctness]
→ ]8;;vscode://file//work/modules/ecash-lib/src/pedersen.ts:88modules/ecash-lib/src/pedersen.ts:88-102]8;;

Support zero aggregate nonces.

addScalars(k, n-k) throws because seckeyAdd rejects a zero result, and
verifyCommitmentSum would subsequently reject that zero nonce in
commit. A zero aggregate nonce with a nonzero total amount is a valid
Pedersen opening (C = amount·H).

Return canonical zero from scalar aggregation and handle the zero-nonce
verification path; add a regression test for complementary nonces.






Also applies to: 160-176

major [Stability & Availability]
→ ]8;;vscode://file//work/modules/ecash-lib/src/blindSchnorr.ts:111modules/ecash-lib/src/blindSchnorr.ts:111-152]8;;

Retry loop's catch-all masks deterministic input errors as probabilistic
failures.

The try/catch at lines 114-147 treats every exception from
pubkeyMul/pubkeyCombine/pubkeyAdd/uncompressPk the same as a
jacobi-symbol retry case. If pubkey or R is malformed (e.g. wrong
length, invalid point), every one of the 32 attempts will fail identically
for the same deterministic reason — the retry loop wastes compute and then
surfaces a misleading "failed to find valid R' after retries" error
instead of the actual root cause (invalid input).

Consider validating pubkey/R up front (fail fast with a clear message)
and only catching the specific rare point-at-infinity/degenerate cases
inside the loop, or at minimum propagate/wrap the last caught error when
retries are exhausted.





💡 Suggested direction

     constructor(pubkey: Uint8Array, R: Uint8Array, messageHash: Uint8Array) {
         if (messageHash.length !== 32) {
             throw new Error('message_hash must be 32 bytes');
         }
+        if (pubkey.length !== 33 || R.length !== 33) {
+            throw new Error('pubkey and R must be 33-byte compressed points');
+        }
         this.messageHash = new Uint8Array(messageHash);
         this.pubkeyCompressed = new Uint8Array(pubkey);

         // R' = R + a*G + b*P; c = jacobi(R'.y) ∈ {±1}.
+        let lastError: unknown;
         for (let attempt = 0; attempt < 32; attempt++) {
             ...
             } catch {
+                lastError = err;
                 zeroBytes(a);
                 zeroBytes(b);
             }
         }
         throw new Error(
-            "BlindSignatureRequest: failed to find valid R' after retries",
+            `BlindSignatureRequest: failed to find valid R' after retries: ${lastError}`,
         );
     }

minor [Functional Correctness]
→ ]8;;vscode://file//work/apps/alp-fusion/test/pedersenDomains.test.ts:13apps/alp-fusion/test/pedersenDomains.test.ts:13-25]8;;

Add a same-domain positive control.

This negative-only test also passes if commit and verifyCommitmentSum
disagree for unrelated reasons. Verify the same witness succeeds with
satsSetup before asserting that it fails with tokenSetup.






Proposed test addition

         const c = satsSetup.commit(42n);
+        expect(
+            verifyCommitmentSum(
+                satsSetup,
+                [c.pointUncompressed],
+                42n,
+                c.nonce,
+            ),
+        ).to.equal(true);
         expect(
             verifyCommitmentSum(
                 tokenSetup,

major [Security & Privacy]
→ ]8;;vscode://file//work/modules/ecash-lib/src/pedersen.ts:64modules/ecash-lib/src/pedersen.ts:64-89]8;;

Do not allow caller-selected known generator relations.

Line 85 rejects only H = -G. H = G passes, making `C = (nonce +
amount)G`, so equivalent openings can be constructed and binding is lost.
A public constructor cannot prove an unknown discrete-log relation;
require an audited, domain-separated hash-to-curve derivation for H
rather than arbitrary caller input, and add an H = G regression case.

major [Functional Correctness]
→ ]8;;vscode://file//work/modules/ecash-lib/src/pedersen.ts:169modules/ecash-lib/src/pedersen.ts:169-190]8;;

Handle valid identity aggregates explicitly.

A commitment sum with total amount and nonce both zero is the group
identity. addCommitmentPoints cannot serialize that result, while Lines
114-119 make setup.commit(0n, zeroNonce) throw. Consequently,
verifyCommitmentSum throws instead of returning a boolean for a valid
balanced aggregate. Represent identity separately from malformed points,
or explicitly exclude this case from the API and its callers.

minor [Data Integrity & Integration]
→ ]8;;vscode://file//work/modules/ecash-lib/src/blindSchnorr.ts:71modules/ecash-lib/src/blindSchnorr.ts:71-80]8;;

getR()/R expose the live internal buffer — no defensive copy.

Unlike getRequest() (line 171), which returns new Uint8Array(this.e),
getR() returns this.R directly, and the readonly modifier on line 71
only prevents reassigning the reference, not mutating its bytes at
runtime. A caller that mutates the returned array corrupts the signer's
own nonce point permanently.





🛡️ Proposed fix

     getR(): Uint8Array {
-        return this.R;
+        return new Uint8Array(this.R);
     }

minor [Performance & Scalability]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/hash.ts:112apps/alp-fusion/src/protocol/hash.ts:112-118]8;;

Bound the tier text before parsing it as BigInt.

Line 117 parses arbitrarily long digit strings that pass the regex,
allowing needless CPU and memory work before the uint64-range check.
Reject values longer than 20 digits (and lexically above 2^64 - 1)
first.






Proposed fix

     if (!ATOM_TIER_DEC_RE.test(tierStr)) {
         throw new Error(
             'parsePoolKey: atomTier must be canonical decimal (no leading zeros)',
         );
     }
+    if (
+        tierStr.length > 20 ||
+        (tierStr.length === 20 && tierStr > U64_MAX.toString())
+    ) {
+        throw new Error('parsePoolKey: atomTier exceeds uint64 range');
+    }
     const atomTier = BigInt(tierStr);
-    assertAtomTier(atomTier);
     return { tokenId: fromHex(hex), atomTier };

major [Functional Correctness]
→ ]8;;vscode://file//work/contrib/teamcity/build-configurations.yml:935contrib/teamcity/build-configurations.yml:935-954]8;;

Trigger ALP Fusion tests when chronik-client changes.

The ecash-lib build configuration depends on chronik-client, but this
job neither watches modules/chronik-client/ nor declares the
corresponding build dependency. A change there can leave this test job
green without exercising the updated dependency.


Suggested fix

         - modules/ecash-lib/
+        - modules/chronik-client/
         - modules/ecash-lib-wasm/
...
         depends:
             - ecashaddrjs
             - b58-ts
             - ecash-lib-wasm
+            - chronik-client
             - ecash-lib

minor [Security & Privacy]
→ ]8;;vscode://file//work/apps/alp-fusion/README.md:56apps/alp-fusion/README.md:56]8;;

Clarify that linkage—not amounts or addresses—is obscured.

The protocol requirements establish input↔output unlinkability, but do not
hide the public transaction’s amounts or addresses. Please make the
wording explicit to avoid overstating the privacy guarantee.


Suggested wording

-| What stays visible | That XEC moved in a large fusion                                             | That a given `tokenId` moved in a fusion; amounts↔addresses obscured inside the round |
+| What stays visible | That XEC moved in a large fusion                                             | That a given `tokenId` moved in a fusion; input↔output linkage is obscured inside the round |

minor [Security & Privacy]
→ ]8;;vscode://file//work/modules/ecash-lib/src/blindSchnorr.ts:171modules/ecash-lib/src/blindSchnorr.ts:171-204]8;;

Zero the intermediate s+a secret material on the schnorrVerify failure
path.

sPlusA/sFinal (built from secret a combined with the
attacker/server-supplied public sbytes) is zeroized only in the `c ===
-1 branch, and only ever intentionally exposed via the returned sig` on
success. If check is true and ecc.schnorrVerify throws (exactly the
"bastardized s response" case exercised in tests), the function throws
without zeroing sFinal/sig, leaving array data that — combined with
the caller-supplied sbytes — trivially reveals the blinding secret a
(a = sFinal - sbytes mod n) lingering in memory. This undermines the
defense-in-depth zeroing pattern established everywhere else in this file.


🔒 Proposed fix

             const sig = concatBytes(this.Rxnew, sFinal);
             if (check) {
-                ecc.schnorrVerify(sig, this.messageHash, this.pubkeyCompressed);
+                try {
+                    ecc.schnorrVerify(sig, this.messageHash, this.pubkeyCompressed);
+                } catch (err) {
+                    zeroBytes(sFinal);
+                    zeroBytes(sig);
+                    throw err;
+                }
             }
             return sig;

major [Data Integrity & Integration]
→ ]8;;vscode://file//work/modules/ecash-lib/src/pedersen.ts:247modules/ecash-lib/src/pedersen.ts:247-254]8;;

Catch-all masks malformed-scalar errors as "sum ≡ 0".

ecc.seckeyAdd can throw for reasons other than a genuine zero result
(e.g. wrong-length or out-of-range input), but the bare catch here
always returns a canonical all-zero 32-byte array. Since this is an
exported function usable outside this file's tests, a malformed a/b
would silently become "zero" instead of raising an error, corrupting any
downstream nonce/scalar aggregation.


🛡️ Proposed fix

 export function addScalars(a: Uint8Array, b: Uint8Array): Uint8Array {
+    if (a.length !== 32 || b.length !== 32) {
+        throw new Error('Scalars must be 32 bytes');
+    }
     try {
         return ecc.seckeyAdd(a, b);
     } catch {
         // (a + b) ≡ 0 (mod n)
         return new Uint8Array(32);
     }
 }

major [Security & Privacy]
→ ]8;;vscode://file//work/modules/ecash-lib/src/pedersen.ts:188modules/ecash-lib/src/pedersen.ts:188-204]8;;

Catch-all swallows malformed-input errors as "point at infinity".

Any exception from pubkeyCombine (invalid point length/format, not just
a genuine sum-to-infinity) is converted into ResultAtInfinity. Since
verifyCommitmentSum treats ResultAtInfinity as "the aggregate is the
identity" and returns true when the caller also claims `(amount, nonce)
= (0, 0)` (Lines 223-228), malformed/garbage commitment points combined
with a (0,0) claim could incorrectly verify as valid. There's also no
upfront validation that each point is 33 or 65 bytes before the
length-based compress branch.


🛡️ Proposed fix

 export function addCommitmentPoints(points: Uint8Array[]): Uint8Array {
     if (points.length === 0) {
         throw new Error('No points to add');
     }
+    for (const p of points) {
+        if (p.length !== 33 && p.length !== 65) {
+            throw new Error('Invalid commitment point length');
+        }
+    }
     const compressed = points.map(p =>
         p.length === 65 ? ecc.compressPk(p) : p,
     );

minor [Functional Correctness]
→ ]8;;vscode://file//work/modules/ecash-lib/src/pedersen.ts:211modules/ecash-lib/src/pedersen.ts:211-241]8;;

Validate totalNonce length before use.

commit() strictly validates nonce.length === 32 (Lines 119-121), but
verifyCommitmentSum passes totalNonce straight into bytesToScalar
without any length check. For consistency and to avoid surprising behavior
with malformed input, add the same guard here.


🛡️ Proposed fix

 export function verifyCommitmentSum(
     setup: PedersenSetup,
     commitments: Uint8Array[],
     totalAmount: bigint,
     totalNonce: Uint8Array,
 ): boolean {
+    if (totalNonce.length !== 32) {
+        return false;
+    }
     const amountMod = modCurveOrder(totalAmount);

major [Functional Correctness]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/hash.ts:19apps/alp-fusion/src/protocol/hash.ts:19-33]8;;

Reject non-canonical numeric hash inputs.
Math.floor can alias distinct timestamps before hashing, and
covertPort lacks a local range check. Require non-negative safe integers
(and a uint32 bound for the port), or switch timestamp inputs to
bigint for full uint64 support.

major [Functional Correctness]
→ ]8;;vscode://file//work/modules/ecash-lib/src/pedersen.ts:273modules/ecash-lib/src/pedersen.ts:273-280]8;;

Overly broad catch can silently mask malformed input.

Unlike the internal uses of this same "catch = zero-result" pattern (e.g.
line 158, where operands are already validated in-range), addScalars is
a public API that accepts arbitrary caller-supplied Uint8Arrays with no
length/range validation before calling ecc.seckeyAdd. Any failure —
wrong length, out-of-range scalar, or the genuine (a+b)≡0 case — is
indistinguishable here and all silently become new Uint8Array(32). A
caller passing a malformed nonce would get a plausible-looking but wrong
zero result instead of an error.





🐛 Proposed fix

 export function addScalars(a: Uint8Array, b: Uint8Array): Uint8Array {
+    if (a.length !== 32 || b.length !== 32) {
+        throw new Error('addScalars: inputs must be 32 bytes');
+    }
     try {
         return ecc.seckeyAdd(a, b);
     } catch {
         // (a + b) ≡ 0 (mod n)
         return new Uint8Array(32);
     }
 }