release: lace-extension@2.0.6 (#2225)

Snapshot of input-output-hk/lace-platform @ e3777c8419262d464172454200ad24088a1384de
Produced by open-source-release-publish.yml.

See PROVENANCE for the allowlist hash that controlled this snapshot.

Co-authored-by: lace-publish-bot <lace-publish-bot@users.noreply.github.com>

Author: lace-releases[bot]

PROVENANCE

@@ -1,10 +1,10 @@
 Lace public source snapshot
 ===========================
 
-release-tag:         lace-extension@2.0.5
+release-tag:         lace-extension@2.0.6
 source-repo:         input-output-hk/lace-platform (private)
-source-commit:       8abaeff5173f18896aee8c5833693240693b4782
-snapshot-utc:        2026-05-13T12:49:49.584Z
+source-commit:       e3777c8419262d464172454200ad24088a1384de
+snapshot-utc:        2026-05-22T17:03:46.978Z
 
 allowlist-sha256:    a75a43e9e238d609b21b9d7f3409fa46bb8a0a92a4738dbeba71076ec4e74929
 excludelist-sha256:  8e7916a357aae4f8a8a963e32cb48392e039572670b390f043322a9d17e98a50

apps/lace-extension/app.json

@@ -4,7 +4,7 @@
     "slug": "lace-extension",
     "owner": "lace_io",
     "newArchEnabled": true,
-    "version": "2.0.5",
+    "version": "2.0.6",
     "orientation": "portrait",
     "icon": "./assets/icon.png",
     "platforms": ["web"],

apps/lace-extension/assets/manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "$EXTENSION_NAME",
   "description": "One fast, accessible, and secure platform for digital assets, DApps, NFTs, and DeFi.",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "manifest_version": 3,
   "key": "$EXTENSION_KEY",
   "icons": {

apps/lace-extension/metro.config.js

@@ -111,6 +111,16 @@ const patchNxConfig = nxConfig => {
     ) {
       return { type: 'empty' };
     }
+    // Exclude @sentry/browser's lazyLoadIntegration - it contains a hard-coded
+    // "https://browser.sentry-cdn.com" string that Chrome Web Store flags as
+    // remotely hosted code under MV3. Mirror of the webpack stub in
+    // webpack/sentry-lazy-load-stub.js / base/serviceworker.webpack.config.js.
+    if (
+      context.originModulePath.includes('@sentry') &&
+      moduleName.includes('lazyLoadIntegration')
+    ) {
+      return { type: 'empty' };
+    }
     // Exclude @effect/platform's HttpApiScalar module - it contains a CDN reference to
     // @scalar/api-reference (cdn.jsdelivr.net) that violates Chrome Web Store MV3 policy
     // which prohibits remotely hosted code. HttpApiScalar is server-side API docs tooling

packages/module/blockchain-cardano/src/signing/cardano-in-memory-data-signer.ts

@@ -1,8 +1,12 @@
+import * as Crypto from '@cardano-sdk/crypto';
+import { blake2b } from '@cardano-sdk/crypto';
+import { Bip32Account, KeyRole } from '@cardano-sdk/key-management';
 import { AuthenticationCancelledError } from '@lace-contract/signer';
 import { from, switchMap, throwError } from 'rxjs';
 
 import { cip8SignData } from './cip8-sign-data';
 
+import type { Ed25519KeyHashHex } from '@cardano-sdk/crypto';
 import type { AuthSecret } from '@lace-contract/authentication-prompt';
 import type {
   CardanoDataSigner,
@@ -39,6 +43,7 @@ export class CardanoInMemoryDataSigner implements CardanoDataSigner {
     authSecret: AuthSecret,
     request: CardanoSignDataRequest,
   ): Promise<CardanoSignDataResult> {
+    const dRepKeyHash = await this.#deriveDRepKeyHash();
     const keyAgent = await this.#props.createKeyAgent({
       accountIndex: this.#props.accountIndex,
       chainId: this.#props.chainId,
@@ -47,6 +52,28 @@ export class CardanoInMemoryDataSigner implements CardanoDataSigner {
       authSecret,
     });
 
-    return cip8SignData(keyAgent, request, this.#props.knownAddresses);
+    return cip8SignData({
+      keyAgent,
+      request,
+      knownAddresses: this.#props.knownAddresses,
+      dRepKeyHash,
+    });
+  }
+
+  async #deriveDRepKeyHash(): Promise<Ed25519KeyHashHex> {
+    const bip32Ed25519 = await Crypto.SodiumBip32Ed25519.create();
+    const bip32Account = new Bip32Account(
+      {
+        accountIndex: this.#props.accountIndex,
+        chainId: this.#props.chainId,
+        extendedAccountPublicKey: this.#props.extendedAccountPublicKey,
+      },
+      { blake2b, bip32Ed25519 },
+    );
+    const dRepPubKey = await bip32Account.derivePublicKey({
+      index: 0,
+      role: KeyRole.DRep,
+    });
+    return Crypto.Ed25519PublicKey.fromHex(dRepPubKey).hash().hex();
   }
 }

packages/module/blockchain-cardano/src/signing/cip8-sign-data.ts

@@ -2,6 +2,7 @@ import { Cardano, Serialization } from '@cardano-sdk/core';
 import { HexBlob } from '@cardano-sdk/util';
 import { HexBytes } from '@lace-sdk/util';
 
+import type { Ed25519KeyHashHex } from '@cardano-sdk/crypto';
 import type { GroupedAddress } from '@cardano-sdk/key-management';
 import type { CardanoKeyAgent } from '@lace-contract/cardano-context';
 import type {
@@ -18,11 +19,21 @@ const COSE_KEY_ALG = 3;
 const COSE_KEY_CRV = -1;
 const COSE_KEY_X = -2;
 const STAKE_KEY_DERIVATION_PATH = { role: 2, index: 0 };
+const DREP_KEY_DERIVATION_PATH = { role: 3, index: 0 };
 
-const getDerivationPath = (
-  signWith: Cardano.PaymentAddress | Cardano.RewardAccount,
-  knownAddresses: GroupedAddress[],
-): { role: number; index: number } => {
+interface GetDerivationPathParams {
+  address: Cardano.Address;
+  signWith: Cardano.PaymentAddress | Cardano.RewardAccount;
+  knownAddresses: GroupedAddress[];
+  dRepKeyHash: Ed25519KeyHashHex | undefined;
+}
+
+const getDerivationPath = ({
+  address,
+  signWith,
+  knownAddresses,
+  dRepKeyHash,
+}: GetDerivationPathParams): { role: number; index: number } => {
   if (Cardano.isRewardAccount(signWith)) {
     const matchingAddress = knownAddresses.find(
       addr => addr.rewardAccount === signWith,
@@ -36,6 +47,14 @@ const getDerivationPath = (
     return STAKE_KEY_DERIVATION_PATH;
   }
 
+  if (
+    dRepKeyHash &&
+    address.getType() === Cardano.AddressType.EnterpriseKey &&
+    address.getProps().paymentPart?.hash === dRepKeyHash
+  ) {
+    return DREP_KEY_DERIVATION_PATH;
+  }
+
   const matchingAddress = knownAddresses.find(
     addr => addr.address === signWith,
   );
@@ -46,7 +65,7 @@ const getDerivationPath = (
     };
   }
 
-  return { role: 0, index: 0 };
+  throw new Error(`Unknown signWith address: ${signWith}`);
 };
 
 const createProtectedHeaders = (addressBytes: Uint8Array): Uint8Array => {
@@ -109,19 +128,32 @@ const createCoseKey = (
   return writer.encode();
 };
 
+export interface Cip8SignDataParams {
+  keyAgent: CardanoKeyAgent;
+  request: CardanoSignDataRequest;
+  knownAddresses: GroupedAddress[];
+  dRepKeyHash?: Ed25519KeyHashHex;
+}
+
 /** Signs data per CIP-8 by constructing COSE structures without WASM. */
-export const cip8SignData = async (
-  keyAgent: CardanoKeyAgent,
-  request: CardanoSignDataRequest,
-  knownAddresses: GroupedAddress[],
-): Promise<CardanoSignDataResult> => {
+export const cip8SignData = async ({
+  keyAgent,
+  request,
+  knownAddresses,
+  dRepKeyHash,
+}: Cip8SignDataParams): Promise<CardanoSignDataResult> => {
   const address = Cardano.Address.fromString(request.signWith);
   if (!address) {
     throw new Error(`Invalid address: ${request.signWith}`);
   }
 
   const addressBytes = Buffer.from(address.toBytes(), 'hex');
-  const derivationPath = getDerivationPath(request.signWith, knownAddresses);
+  const derivationPath = getDerivationPath({
+    address,
+    signWith: request.signWith,
+    knownAddresses,
+    dRepKeyHash,
+  });
 
   const protectedHeadersBytes = createProtectedHeaders(addressBytes);
   const payloadBytes = Buffer.from(request.payload, 'hex');

packages/module/blockchain-cardano/test/signing/cardano-in-memory-data-signer.test.ts

@@ -14,12 +14,38 @@ import type {
 import type { SignerAuth } from '@lace-contract/signer';
 import type { HexBytes } from '@lace-sdk/util';
 
+const STUB_DREP_PUB_KEY = 'ab'.repeat(32);
+const STUB_DREP_KEY_HASH = 'cd'.repeat(28);
+
 vi.mock('../../src/signing/cip8-sign-data', () => ({
   cip8SignData: vi
     .fn()
     .mockResolvedValue({ signature: 'sig-hex', key: 'key-hex' }),
 }));
 
+vi.mock('@cardano-sdk/key-management', async () => {
+  const actual = await vi.importActual('@cardano-sdk/key-management');
+  return {
+    ...actual,
+    Bip32Account: vi.fn().mockImplementation(() => ({
+      derivePublicKey: vi.fn().mockResolvedValue(STUB_DREP_PUB_KEY),
+    })),
+  };
+});
+
+vi.mock('@cardano-sdk/crypto', async () => {
+  const actual = await vi.importActual('@cardano-sdk/crypto');
+  return {
+    ...actual,
+    SodiumBip32Ed25519: { create: vi.fn().mockResolvedValue({}) },
+    Ed25519PublicKey: {
+      fromHex: vi.fn().mockReturnValue({
+        hash: () => ({ hex: () => STUB_DREP_KEY_HASH }),
+      }),
+    },
+  };
+});
+
 const mockAuthSecret = new Uint8Array([1, 2, 3]);
 
 const createMockAuth = (authSecret: Uint8Array): SignerAuth => ({
@@ -73,6 +99,43 @@ describe('CardanoInMemoryDataSigner', () => {
     expect(result).toEqual({ signature: 'sig-hex', key: 'key-hex' });
   });
 
+  it('pre-derives the DRep key hash and forwards it to cip8SignData (LW-14940)', async () => {
+    const { cip8SignData } = await import('../../src/signing/cip8-sign-data');
+    vi.mocked(cip8SignData).mockClear();
+
+    const mockKeyAgent: CardanoKeyAgent = {
+      signTransaction: vi.fn(),
+      signBlob: vi.fn(),
+    };
+    const createKeyAgent: CreateCardanoKeyAgent = vi
+      .fn()
+      .mockResolvedValue(mockKeyAgent);
+
+    const knownAddresses = [{ address: 'addr_test1...' }] as never;
+    const signer = new CardanoInMemoryDataSigner({
+      ...mockProps,
+      createKeyAgent,
+      knownAddresses,
+    });
+
+    await firstValueFrom(
+      signer.signData({
+        signWith: 'addr_test1qz...' as Cardano.PaymentAddress,
+        payload: 'deadbeef',
+      }),
+    );
+
+    expect(cip8SignData).toHaveBeenCalledWith({
+      keyAgent: mockKeyAgent,
+      request: {
+        signWith: 'addr_test1qz...' as Cardano.PaymentAddress,
+        payload: 'deadbeef',
+      },
+      knownAddresses,
+      dRepKeyHash: STUB_DREP_KEY_HASH,
+    });
+  });
+
   it('propagates signing errors', async () => {
     const { cip8SignData } = await import('../../src/signing/cip8-sign-data');
     vi.mocked(cip8SignData).mockRejectedValueOnce(