Verify signature

[ctb0k33]

Describe your question in detail.

I want to create a function to verify signature using aptos typescript SDK. Currently, I'm using signMessage() function from useWallet() to generate a signature. Then, i try to use verifySignature() function to check if the signature is valid. But when i do that, i face with this error:

What error, if any, are you getting?

Uncaught ReferenceError: Buffer is not defined
at o6 (utils.ts:17:14)
at n10.verifySignature (ed25519.ts:72:29)
at verifySignature (Interact.tsx:145:39)
at onClick (Interact.tsx:232:13)
at HTMLUnknownElement.callCallback2 (react-dom.development.js:4164:14)
at Object.invokeGuardedCallbackDev (react-dom.development.js:4213:16)
at invokeGuardedCallback (react-dom.development.js:4277:31)
at invokeGuardedCallbackAndCatchFirstError (react-dom.development.js:4291:25)
at executeDispatch (react-dom.development.js:9041:3)

"

What have you tried or looked at? Or how can we reproduce the error?

here is my code that you can do to repoduce the error:

Which operating system are you using?

Windows

Which SDK or tool are you using? (if any)

TypeScript SDK

Describe your environment or tooling in detail

No response

[0xmaayan]

The wallet adapter provides signMessageAndVerify() function where an account can sign a message and the adapter would verify the signature.

How to use it https://github.com/aptos-labs/aptos-wallet-adapter/blob/main/apps/nextjs-example/components/transactionFlow/SingleSigner.tsx#L33
Source code https://github.com/aptos-labs/aptos-wallet-adapter/blob/main/packages/wallet-adapter-core/src/WalletCore.ts#L979 Real example here https://aptos-labs.github.io/aptos-wallet-adapter/

[ctb0k33]

thanks for your answer. But in my use case, I want to create signMessage at FE and verify it at backend. For example, after sign the message, the function return an response like this:

And now, I want to send these type of response to BE to verify it

[0xmaayan]

Ok. Then you can follow the adapter implementation of signAndVerify https://github.com/aptos-labs/aptos-wallet-adapter/blob/main/packages/wallet-adapter-core/src/AIP62StandardWallets/WalletStandard.ts#L138

It might be that you specific error is because you need to pass in an encoded message

new Ed25519PublicKey(publicKey).verifySignature({
   message: new TextEncoder().encode(message),
  signature: signature,
});

[ctb0k33]

Thanks for replying. I try to do as your suggest and the error about Buffer is dissapper. But when i try to verify a true signature, the function return false.
Here is the signature:

The verifySignature function implementation:

And the verify signature function call:

[songcyGleam]

thanks for your answer. But in my use case, I want to create signMessage at FE and verify it at backend. For example, after sign the message, the function return an response like this:感谢您的回答。但在我的用例中，我想在 FE 创建signMessage 并在后端验证它。例如，在签署消息后，该函数会返回如下响应：

And now, I want to send these type of response to BE to verify it现在，我想将这些类型的响应发送给 BE 进行验证

I also want to use this signature just like this, but I'm not sure if it is safe to prevent forged signatures

[0xmaayan]

@ctb0k33 you should pass in the fullMessage you are getting back from the sign function into the verify function https://github.com/aptos-labs/aptos-wallet-adapter/blob/main/packages/wallet-adapter-core/src/AIP62StandardWallets/WalletStandard.ts#L210

[Harshy01]

Hey @ctb0k33,
Did you find a solution for this, i've been facing this issue from quite some time now, can't find a good documentation on the implementation, the verifySignature result is always false.
Thank you.

[ajaythxkur]

@Harshy01 @ctb0k33 did you find the solution?? I am facing the same issue..

const signMessageResponse = await signMessage({
               message: "This is a message",
               application: false,
               chainId: false,
               address: true,
               nonce: "nonceCAFE0x123"
           })
           console.log(signMessageResponse);

function verifySignature(
    publicKey: string,
    message: string,
    signature: string,
) {
    try{
        console.log({publicKey, message, signature})
        const verfiyRes = new Ed25519PublicKey(publicKey).verifySignature({
            message: new TextEncoder().encode(message),
            signature: new Ed25519Signature(signature),
        });
        console.log({verfiyRes});
        return verfiyRes;
    } catch(error: any) {
        console.log(error)
        return false
    }
}

[Harshy01]

Yeah, I did, we have to include the whole message instead of message and include nonce as well, here's a snippet which might help you:

The server side code:

import { Ed25519PublicKey, Ed25519Signature } from "@aptos-labs/ts-sdk";

const verifyEd25519Signature = (req, res, next) => {
  let { walletAddress, publicKey, signature, message } = req.body;

  if (!walletAddress || !publicKey || !signature || !message) {
    return res
      .status(400)
      .json({ error: "Missing required fields for signature verification" });
  }

  // TODO: add proper logging in production

  try {
    const pubKey = new Ed25519PublicKey(publicKey);
    const signatureObj = new Ed25519Signature(signature);
    const encodedMessage = new TextEncoder().encode(message);

    const result = pubKey.verifySignature({
      message: encodedMessage,
      signature: signatureObj,
    });

    console.log("Verification result:", result);

    if (result) {
      req.verifiedData = { walletAddress, publicKey, message };
      next();
    } else {
      return res.status(401).json({ error: "Invalid signature" });
    }
  } catch (error) {
    console.error("Error verifying signature:", error);
    return res
      .status(500)
      .json({ error: "Error during signature verification" });
  }
};

export default verifyEd25519Signature;

Client side code:

const signUp = async () => {
    if (!connected || !account) {
      console.error("Wallet not connected");
      return false;
    }
    try {
      const nonce = Math.random().toString(36).substring(2, 15);
      const message = `Sign up for our app: ${nonce}`;
      const signedMessage = await signMessage({
        message: message,
        nonce: nonce
      });
      const response = await axios.post(`/api/v1/auth/signup`, {
        walletAddress: account.address,
        publicKey: account.publicKey,
        signature: signedMessage.signature,
        message: signedMessage.fullMessage
      });  
// make sure you've added full message here instead of just message 

      if (response.data.token) {
        localStorage.setItem('jwt_token', response.data.token);
        setUser(response.data.user);
        console.log("response from Signup function in AuthContext", response.data.user);
        setIsAuthenticated(true);
        // Fetch other data as well
        await fetchSubscriptions(response.data.token);
        return response.data.isNewUser;
      }
    } catch (error) {
      console.error("Error during sign up:", error);
      return false;
    }
  };

[ajaythxkur]

Thanks @Harshy01

[rkoranne0755]

https://github.com/rkoranne0755/Aptos-Multisig-and-Signature-Verification.git

Check out this example.
This might help.

[Pcharlesme]

Check this out
https://github.com/rkoranne0755/Aptos-Multisig-and-Signature-Verification/tree/main/build/verify-multi-sign-01