README.md

Tron External Signature Test

This gist contains code that can be added to your project and run within a Java 8+ environmnet.

The code has 3rd party dependencies named below required to compile the sample code:

• Apache Commons Codec
• Bouncy Castle
• Jackson - Encode / Decode JSON
• Lombok
• Web3J

In TronExternalSignatureTest it defines steps that can also be considered as psuedo code in case you want to build the logic from scratch. These steps are intended to be executed in an automated fashion while securely storing sensitive data:

• Step 1: Provide the referenceToken and signaturePayloads from the API transaction response.
• Step 2: Provide the private key to sign transactions.
• Step 3: Decode the signaturePayloads given by the transaction request.
• Step 4: Verify and sign each transaction.
• Step 5: Encode the objects so that we may send them to the Commit Transaction endpoint.
• Step 6: Submit the values to the Commit Transaction endpoint.

Base58.java

/*
 * Copyright (C) 2019-2023 Six Clovers, Inc. - All rights reserved.
 * 
 * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 * 
 * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 * 
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
package com.sixclovers.external;

import java.math.BigInteger;
import java.util.Arrays;

public final class Base58 {

    private static final char[] ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz".toCharArray();

    private static final char ENCODED_ZERO;

    private static final int[] INDEXES;

    static {
        ENCODED_ZERO = ALPHABET[0];
        INDEXES = new int[128];
        Arrays.fill(INDEXES, -1);

        for (int i = 0; i < ALPHABET.length; INDEXES[ALPHABET[i]] = i++) {
            //
        }

    }

    public static byte[] decode(final String input) {
        if (input.length() == 0) {
            return new byte[0];
        } else {
            final byte[] input58 = new byte[input.length()];

            int zeros;
            int outputStart;
            for (zeros = 0; zeros < input.length(); ++zeros) {
                final char character = input.charAt(zeros);
                outputStart = character < 128 ? INDEXES[character] : -1;
                if (outputStart < 0) {
                    //throw new InvalidCharacter(character, zeros);
                    throw new RuntimeException("InvalidCharacter " + character + " at " + zeros);
                }

                input58[zeros] = (byte)outputStart;
            }

            for (zeros = 0; zeros < input58.length && input58[zeros] == 0; ++zeros) {
                //
            }

            final byte[] decoded = new byte[input.length()];
            outputStart = decoded.length;
            int inputStart = zeros;

            while (inputStart < input58.length) {
                --outputStart;
                decoded[outputStart] = divmod(input58, inputStart, 58, 256);
                if (input58[inputStart] == 0) {
                    ++inputStart;
                }
            }

            while (outputStart < decoded.length && decoded[outputStart] == 0) {
                ++outputStart;
            }

            return Arrays.copyOfRange(decoded, outputStart - zeros, decoded.length);
        }
    }

    public static BigInteger decodeToBigInteger(final String input) {
        return new BigInteger(1, decode(input));
    }

    public static String encode(byte[] input) {
        if (input.length == 0) {
            return "";
        } else {
            int zeros;
            for (zeros = 0; zeros < input.length && input[zeros] == 0; ++zeros) {
                //
            }

            input = Arrays.copyOf(input, input.length);
            final char[] encoded = new char[input.length * 2];
            int outputStart = encoded.length;
            int inputStart = zeros;

            while (inputStart < input.length) {
                --outputStart;
                encoded[outputStart] = ALPHABET[divmod(input, inputStart, 256, 58)];
                if (input[inputStart] == 0) {
                    ++inputStart;
                }
            }

            while (outputStart < encoded.length && encoded[outputStart] == ENCODED_ZERO) {
                ++outputStart;
            }

            while (true) {
                --zeros;
                if (zeros < 0) {
                    return new String(encoded, outputStart, encoded.length - outputStart);
                }

                --outputStart;
                encoded[outputStart] = ENCODED_ZERO;
            }
        }
    }

    private static byte divmod(final byte[] number, final int firstDigit, final int base, final int divisor) {
        int remainder = 0;

        for (int i = firstDigit; i < number.length; ++i) {
            final int digit = number[i] & 255;
            final int temp = remainder * base + digit;
            number[i] = (byte)(temp / divisor);
            remainder = temp % divisor;
        }

        return (byte)remainder;
    }

    private Base58() {
        //
    }

}

EncodeDecodeUtil.java

/*
 * Copyright (C) 2019-2023 Six Clovers, Inc. - All rights reserved.
 * 
 * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 * 
 * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 * 
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
package com.sixclovers.external;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.nio.ByteBuffer;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;

import org.apache.commons.codec.digest.DigestUtils;
import org.bouncycastle.jcajce.provider.digest.SHA256;
import org.bouncycastle.util.encoders.Hex;
import org.web3j.abi.FunctionReturnDecoder;
import org.web3j.crypto.ECKeyPair;
import org.web3j.crypto.Sign;
import org.web3j.utils.Numeric;

import com.sixclovers.utility.Log;
import com.sixclovers.utility.Numbers;

import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;

public final class EncodeDecodeUtil {

    private static final String ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"; // Everything except 0OIl

    private static final BigInteger ALPHABET_SIZE = BigInteger.valueOf(ALPHABET.length());

    private static final String ZEROS = "0000000000000000000000000000000000000000000000000000000000000000";

    // Converts the given Base58Check string to a byte array, verifies the checksum, and removes the checksum to return the payload.
    // The caller is responsible for handling the version byte(s).
    @SuppressFBWarnings(value = "UNSAFE_HASH_EQUALS", justification = "False positive")
    public static byte[] base58ToBytes(final String value) {
        final byte[] concat = base58ToRawBytes(value);
        final byte[] data = Arrays.copyOf(concat, concat.length - 4);
        final byte[] hash = Arrays.copyOfRange(concat, concat.length - 4, concat.length);

        final SHA256.Digest digest = new SHA256.Digest();
        digest.update(data);
        final byte[] hash0 = digest.digest();
        digest.reset();
        digest.update(hash0);

        final byte[] rehash = Arrays.copyOf(digest.digest(), 4);
        if (!Arrays.equals(rehash, hash)) {
            // return null;
            throw new IllegalArgumentException("Checksum mismatch");
        }
        return data;
    }

    public static String hexStringToBase58(final String hexString) {
        return encode58(Hex.decode(adjustHex(hexString)));
    }

    public static String hexStringToString(final String hexString) {
        return new String(Hex.decode(adjustHex(hexString)), StandardCharsets.UTF_8).trim();
    }

    public static String parameter(final String base58) {
        String param = toHex(base58);
        if (param.startsWith("41")) {
            param = param.substring(2);
        }
        final String substring = ZEROS.substring(0, 64 - param.length());
        return substring + param;
    }

    public static String sign(final String txId, final String seed) {
        final ECKeyPair keyPair = getECKeyPair(seed);
        final Sign.SignatureData signature = Sign.signMessage(Hex.decode(txId.getBytes(StandardCharsets.UTF_8)), keyPair, false);
        final ByteBuffer sigBuffer = ByteBuffer.allocate(signature.getR().length + signature.getS().length + 1);
        sigBuffer.put(signature.getR());
        sigBuffer.put(signature.getS());
        sigBuffer.put((byte)(signature.getV()[0] - 27));

        return Numeric.toHexString(sigBuffer.array());
    }

    public static BigInteger toBigInteger(final String hexString) {
        return new BigInteger(Hex.decode(adjustHex(hexString)));
    }

    public static String web3ToBase58(final String hexString) {
        return hexStringToBase58(FunctionReturnDecoder.decodeAddress(hexString));
    }

    private static String adjustHex(String hexString) {
        if (hexString.startsWith("0x")) {
            hexString = "41" + hexString.substring(2);
        }
        if (Numbers.isOdd(hexString.length())) {
            hexString = "0" + hexString;
        }
        return hexString;
    }

    // Converts the given Base58Check string to a byte array, without checking or removing the trailing 4-byte checksum.
    private static byte[] base58ToRawBytes(final String value) {
        // Parse base-58 string
        BigInteger num = BigInteger.ZERO;
        for (int i = 0; i < value.length(); i++) {
            num = num.multiply(ALPHABET_SIZE);
            final int digit = ALPHABET.indexOf(value.charAt(i));
            if (digit == -1) {
                throw new IllegalArgumentException("Invalid character for Base58Check");
            }
            num = num.add(BigInteger.valueOf(digit));
        }

        // Strip possible leading zero due to mandatory sign bit
        byte[] bytes = num.toByteArray();
        if (bytes[0] == 0) {
            bytes = Arrays.copyOfRange(bytes, 1, bytes.length);
        }

        try {
            // Convert leading '1' characters to leading 0-value bytes
            final ByteArrayOutputStream buffer = new ByteArrayOutputStream();
            for (int i = 0; i < value.length() && value.charAt(i) == ALPHABET.charAt(0); i++) {
                buffer.write(0);
            }
            buffer.write(bytes);
            return buffer.toByteArray();
        } catch (final IOException e) {
            throw new AssertionError(e);
        }
    }

    private static byte[] decode58(final String base58) {
        final byte[] decodeCheck = Base58.decode(base58);
        if (decodeCheck.length <= 4) {
            return null;
        }
        final byte[] decodeData = new byte[decodeCheck.length - 4];
        System.arraycopy(decodeCheck, 0, decodeData, 0, decodeData.length);
        final byte[] hash0 = DigestUtils.sha256(decodeData);
        final byte[] hash1 = DigestUtils.sha256(hash0);
        if (hash1[0] == decodeCheck[decodeData.length] &&
            hash1[1] == decodeCheck[decodeData.length + 1] &&
            hash1[2] == decodeCheck[decodeData.length + 2] &&
            hash1[3] == decodeCheck[decodeData.length + 3]) {
            return decodeData;
        }
        return null;
    }

    private static String encode58(final byte[] input) {
        final byte[] hash0 = DigestUtils.sha256(input);
        final byte[] hash1 = DigestUtils.sha256(hash0);
        final byte[] inputCheck = new byte[input.length + 4];
        System.arraycopy(input, 0, inputCheck, 0, input.length);
        System.arraycopy(hash1, 0, inputCheck, input.length, 4);
        return Base58.encode(inputCheck);
    }

    private static ECKeyPair getECKeyPair(final String seed) {
        try {
            return ECKeyPair.create(new BigInteger(org.apache.commons.codec.binary.Hex.decodeHex(seed)));
        } catch (final Exception e) {
            Log.error(e);
            return null;
        }
    }

    private static String toHex(final String base58) {
        return Hex.toHexString(decode58(base58));
    }

    private EncodeDecodeUtil() {
        //
    }

}

TronExternalSignatureTest.java

/*
 * Copyright (C) 2019-2023 Six Clovers, Inc. - All rights reserved.
 * 
 * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 * 
 * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 * 
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
package com.sixclovers.external;

import static org.testng.Assert.assertNotNull;

import java.math.BigInteger;
import java.util.Arrays;
import java.util.Collections;
import java.util.LinkedList;
import java.util.List;

import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Hex;
import org.testng.annotations.BeforeClass;
import org.testng.annotations.Ignore;
import org.testng.annotations.Test;
import org.web3j.crypto.Credentials;
import org.web3j.crypto.ECKeyPair;

import com.algorand.algosdk.util.Encoder;

@SuppressWarnings("PMD")
public class TronExternalSignatureTest {

    /* Step 1: Provide the referenceToken and signaturePayloads from the transaction response. */

    // An opaque token to be maintained with the signature payload.
    private final String referenceToken = "PLACEHOLDER - replace with data from a TransactionPayload";

    // The list of signature payloads that parties must sign.
    private final List<String> signaturePayloads = Arrays.asList("PLACEHOLDER", "replace with data from a TransactionPayload");

    /* Step 2: Provide the private key to sign transactions. */

    // The private key (the seed is held by you in a hot wallet to sign transactions).
    private final String privateKey = "PLACEHOLDER - replace with a hex encoded seed";

    private String publicAddress;

    @BeforeClass
    public void beforeClass() throws DecoderException {
        final ECKeyPair keyPair = ECKeyPair.create(new BigInteger(Hex.decodeHex(privateKey)));
        final Credentials credentials = Credentials.create(keyPair);
        publicAddress = EncodeDecodeUtil.hexStringToBase58(credentials.getAddress());
    }

    @Test
    public void testTronExternalSignatureTransaction() {
        /* Step 3: Decode the signaturePayloads given by the transaction request. */
        final List<TronTransaction> decodedTransactions = decodeSignaturePayloads(signaturePayloads);

        /* Step 4: Verify and sign each transaction. */
        final List<TronTransaction> signedTransactions = signTransactions(decodedTransactions);

        /* Step 5: Encode the objects so that we may send them to the Commit Transaction endpoint. */
        final List<String> encodedTransactions = encodeTransactions(signedTransactions);

        assertNotNull(referenceToken);
        assertNotNull(encodedTransactions);

        /* Step 6: Submit the values to the Commit Transaction endpoint. */
        System.out.println("referenceToken: " + encodeToJson(referenceToken));
        System.out.println("signaturePayloads: " + encodeToJson(encodedTransactions));
    }

    private byte[] decodeFromBase64(final String value) {
        return Encoder.decodeFromBase64(value);
    }

    private <T> T decodeFromJson(final String value, final Class<T> clazz) {
        try {
            return Encoder.decodeFromJson(value, clazz);
        } catch (final Exception e) {
            // We never expect this to happen in live code, but to make test failures obvious, we throw a RuntimeException.
            // Log.error(e);
            // return null;
            throw new RuntimeException(e);
        }
    }

    private List<TronTransaction> decodeSignaturePayloads(final List<String> payloads) {
        final List<TronTransaction> decodedTransactions = new LinkedList<>();
        for (final String payload : payloads) {
            decodedTransactions.add(decodeFromJson(new String(decodeFromBase64(payload)), TronTransaction.class));
        }
        return decodedTransactions;
    }

    private String encodeToBase64(final byte[] bytes) {
        return Encoder.encodeToBase64(bytes);
    }

    private String encodeToJson(final Object object) {
        try {
            return Encoder.encodeToJson(object);
        } catch (final Exception e) {
            // We never expect this to happen in live code, but to make test failures obvious, we throw a RuntimeException.
            // Log.error(e);
            // return null;
            throw new RuntimeException(e);
        }
    }

    private List<String> encodeTransactions(final List<TronTransaction> transactions) {
        final List<String> encodedTransactions = new LinkedList<>();
        for (final TronTransaction transaction : transactions) {
            encodedTransactions.add(encodeToBase64(encodeToJson(transaction).getBytes()));
        }
        return encodedTransactions;
    }

    private List<TronTransaction> signTransactions(final List<TronTransaction> transactions) {
        final List<TronTransaction> signedTransactions = new LinkedList<>();
        for (final TronTransaction transaction : transactions) {
            if (publicAddress.equals(transaction.getFrom())) {
                // Sign the transaction with the privateKey.
                final String signature = EncodeDecodeUtil.sign(transaction.getTxId(), privateKey);
                transaction.setSignatures(Collections.singletonList(signature));

                // Store the signed transaction.
                signedTransactions.add(transaction);
            } else {
                // Store the same transaction unsigned. It belongs to the same transaction group and will be signed by someone else.
                signedTransactions.add(transaction);
            }
        }
        return signedTransactions;
    }

}

TronTransaction.java

/*
 * Copyright (C) 2019-2023 Six Clovers, Inc. - All rights reserved.
 * 
 * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 * 
 * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 * 
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
package com.sixclovers.external;

import java.nio.charset.StandardCharsets;
import java.util.List;

import org.bouncycastle.util.encoders.Hex;

import com.fasterxml.jackson.annotation.JsonIgnore;
import com.fasterxml.jackson.annotation.JsonProperty;

import lombok.Data;

@Data
public final class TronTransaction {

    @Data
    public static class RawData {

        @Data
        public static class Abi {

            @JsonProperty("entrys")
            private List<Entry> entries;

        }

        @Data
        public static class Contract {

            @JsonProperty("ContractName")
            private String contractName;

            private Parameter parameter;

            @JsonProperty("Permission_id")
            private String permissionId;

            private String provider;

            private String type;

        }

        @Data
        public static class Entry {

            private Boolean constant;

            private List<Input> inputs;

            private String name;

            private List<Output> outputs;

            private String stateMutability;

            private String type;

        }

        @Data
        public static class Input {

            private Boolean indexed;

            private String name;

            private String type;

        }

        @Data
        public static class NewContract {

            private Abi abi;

            private String bytecode;

            @JsonProperty("consume_user_resource_percent")
            private Integer consumeUserResourcePercent;

            private String name;

            @JsonProperty("origin_address")
            private String originAddress;

            @JsonProperty("origin_energy_limit")
            private Integer originEnergyLimit;

        }

        @Data
        public static class Output {

            private String name;

            private String type;

        }

        @Data
        public static class Parameter {

            @JsonProperty("type_url")
            private String typeUrl;

            private Value value;

        }

        @Data
        public static class Value {

            @JsonProperty
            private BigInteger amount;

            @JsonProperty("call_token_value")
            private BigInteger callTokenValue;

            @JsonProperty("call_value")
            private BigInteger callValue;

            @JsonProperty("contract_address")
            private String contractAddress;

            @JsonProperty
            private String data;

            @JsonProperty("new_contract")
            private NewContract newContract;

            @JsonProperty("owner_address")
            private String ownerAddress;

            @JsonProperty("to_address")
            private String toAddress;

            @JsonIgnore
            public String getAssetId() {
                return contractAddress.startsWith("T") ? contractAddress : EncodeDecodeUtil.hexStringToBase58(contractAddress);
            }

        }

        private String auths;

        private List<Contract> contract;

        private String data;

        private Long expiration;

        @JsonProperty("fee_limit")
        private Long feeLimit;

        @JsonProperty("ref_block_bytes")
        private String refBlockBytes;

        @JsonProperty("ref_block_hash")
        private String refBlockHash;

        @JsonProperty("ref_block_num")
        private Long refBlockNum;

        private String scripts;

        private Long timestamp;

        public String decodeData() {
            return data == null ? null : new String(Hex.decode(data), StandardCharsets.UTF_8);
        }

    }

    @JsonProperty("raw_data")
    private RawData rawData;

    @JsonProperty("raw_data_hex")
    private String rawDataHex;

    @JsonProperty("signature")
    private List<String> signatures;

    @JsonProperty("txID")
    private String txId;

    private boolean visible;

    @JsonIgnore
    public String getFrom() {
        return rawData.getContract().get(0).getParameter().getValue().getOwnerAddress();
    }

}