ematiu matiu

To prevent unautorized network access, Copay and Bitpay Wallet v5.3.0 and above use the following Content Security Policy (CSP)

  <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-eval' https://bws.bitpay.com
  https://bitpay.com https://auth.shapeshift.io https://shapeshift.io https://api.coinbase.com https://coinbase.com; 
  img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:">

This restrict network connections to the listed hosts only. As a consecuence, accessing self-hosted Bitcore Wallet Service (BWS) hosts will not be allowed.

run bitcoin-abc with: ./bitcoind -regtest -monolithactivationtime=0
create some UTXOs: ./bitcoin-cli generate 100
grab one UTXO: ./bitcoin-cli listunspent (grab the last TXIDs, vout; we will call them here: TXID: 64be40b2688e8767fc62f8556d3b9ee608aae28894b867f8228ac5aa74325aff vout: 0
create a TX with the script you want to test, using P2SH: bitcoin-tx -regtest -json -create in=64be40b2688e8767fc62f8556d3b9ee608aae28894b867f8228ac5aa74325aff:0 outscript=49.999:"XOR 1 DUP":S (last :S is to use P2SH) => hex: 0200000001ff5a3274aac58a22f867b89488e2aa08e69e3b6d55f862fc67878e68b240be640000000000ffffffff01606b042a0100000017a9145944649bbd7f8d554b993e74f7b7884d2c78a2908700000000
sign it:

Download signature file
Check it by running:

$ gpg --verify \
 $FILENAME.sig \
 $FILENAME

# If should say:

 "Good signature from "Copay (visit copay.io) "

createTX
- output: 1bitcoin
- amount: 1BTC
- useCoinJoin: true
  - coinJoinToSignTimeout: 1hr
  - coinJoinToBroadcastTimeout: 24hr
  - coinJoinTimeoutPolicy: broadcastWithoutCoinJoin | rejectByServer

BWS Access Control

There are 3 tiers of access control

Access is controlled at the server

All requests to an existing wallet must be signed by a private key and are verified by the server. All copayers have a always valid private key, m/1/1, and can generate more with restricted access thru the grantAccess removeAccess API.

Extra access keys pairs are always derived from the extended master private key using m/1/x.

Hoy

  var storage = new Client.FileStorage({
    filename: args.file || process.env['BIT_FILE'],
  });
  var c = new Client({
    storage: storage,
    baseUrl: args.host || process.env['BIT_HOST'],
    verbose: args.verbose,
  });



	// cryto exports:

	return Bitcore.crypto.Hash.sha256(pk.toBuffer()).slice(0, 16).toString('base64');

	// priv key validation
	$.checkArgument(Bitcore.PrivateKey.isValid(privKey), 'The private key received is invalid');

	const B = require('bitcore-lib');


	// Example signature, from an actual jsonPaymentProtocol header.
	const h ='6d580c9bc2fbaff7614e3a030d536417d07d6dfb93f7c8887aac4e67e27c3e32';
	const s ='e7a6490572855eb8feedabe32872424a2aef5b0b0f6e8b7d1959f6621de8c15a3871283a8fa78fc292444c50dc578dc58bd924d947f2ecc4bb91c250885a518a';
	const p ='03159069584176096f1c89763488b94dbc8d5e1fa7bf91f50b42f4befe4e45295a';


	hbuf = Buffer.from(h,'hex');

	Using bitcoin-abc 0.17 hash: 855043153da2d7d5d4d577eede5ecf22f2c87080,
	running bitcoind with: `-regtest -monolithactivationtime=0`


	1. Base line
	- send 10 p2pkh TX/s, 10 seconds. Check CPU and IO load.
	- send 10 (small) op_ret TX/s, 100 seconds. Check CPU and IO load and mem usage.


	2. Tests