fix: follow-up SDK fixes from the 0.14 audit

[mr-zwets]

Opened on behalf of Mathieu G. (mr-zwets), written by Claude Opus 5.5.

Replaces #460, which was opened from the wrong branch by mistake.

Follow-up to the 0.14 audit, meant to land after the 0.14.0 release, with the SDK findings that were left out to keep the release's scope small. Rebased on next (including #457 and #463); every fix below still has a test that fails on the current next.

Changes

• Debugging:
  • Each input is debugged with its own contract's artifact, looked up by exact unlocking script id. Before, the lookup was by contract-name prefix, so with Vault and VaultSidecar in one transaction the sidecar input could use Vault's artifact: logs printed for code that didn't run, and a failing require crashed the debugger.
  • A failing final require(f(x)) with a non-inlined f is reported at its own line and message.
  • console.log statements after a failing instruction are no longer printed (twice), and a log after a division by zero no longer makes debug() throw a plain Error.
  • A function whose body is only a parameter type check (require(b) for bool b) no longer crashes debug(), send() and getBitauthUri().
• send(): a NetworkProviderError is thrown as it is instead of being wrapped in a FailedTransactionError, so the documented error classes can be caught. Unrecognised Electrum rejections are a NetworkProviderError, and MockNetworkProvider throws NetworkProviderMissingInputsError for missing or spent UTXOs. This is breaking for code that catches FailedTransactionError for network rejections, so it fits 0.15 rather than a 0.14.x patch (or can be split out).
• addBchChangeOutputIfNeeded(): ECDSA signatures are sized at their maximum length, since re-signing after adding the change output could push the fee below 1 sat/byte (about 1 in 4 builds with one ECDSA input). The docs note that placeholder inputs assume Schnorr.
• addOpReturnOutput(): invalid hex ('0xabc', '0xzz') now throws instead of being mis-encoded.
• Hex case: token categories and locking bytecode are compared case-insensitively. An upper case category passed to addTokenChangeOutputIfNeeded() used to add no change output, so with allowImplicitFungibleTokenBurn the tokens were burned.
• asmToBytecode: unknown opcode names (previously encoded as OP_0) and invalid data tokens now throw, so an artifact with an opcode the installed libauth doesn't know no longer silently gets a different address.

No release or migration notes yet, since the 0.14 sections will be closed by then. For the send() change, a BREAKING release note and a migration note along these lines: "send() now throws the provider's NetworkProviderError (or a subclass such as NetworkProviderMissingInputsError) when the network rejects a transaction; catch it in addition to FailedTransactionError."

Tests

• Prefix-named contracts in both input orders (logs and the failing require).
• A final require(f(x)) with disableInlining, logs after a failed require and after a division by zero, and a parameter-check-only function through the SDK.
• A double spend on MockNetworkProvider and a fake Electrum client, both through send().
• 100 ECDSA change builds at 1 sat/byte.
• Invalid OP_RETURN hex, upper case token category and locking bytecode.
• Unknown opcodes and invalid data in asmToBytecode.

yarn build, yarn test, yarn lint and yarn spellcheck pass.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cashscript	Ready	Preview	Sep 29, 2026 9:58am UTC

[codecov]

Codecov Report

❌ Patch coverage is 98.38710% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 89.68%. Comparing base (625d844) to head (230d098).

Files with missing lines	Patch %	Lines
packages/cashscript/src/transaction-utils.ts	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             next     #462      +/-   ##
==========================================
+ Coverage   89.23%   89.68%   +0.44%     
==========================================
  Files          61       61              
  Lines        5074     5111      +37     
  Branches      949      963      +14     
==========================================
+ Hits         4528     4584      +56     
+ Misses        421      409      -12     
+ Partials      125      118       -7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Pull request stats

	Source	Tests	Docs	Total	Net	Share
SDK (cashscript)	+111 −28	+261 −4		+372 −32	+340	90%
Utils (@cashscript/utils)	+13 −4	+21 −0		+34 −4	+30	8%
Website			+5 −1	+5 −1	+4	1%
Total	+124 −32	+282 −4	+5 −1	+411 −37	+374	100%

Reviewable churn: 448 lines (net +374), version bumps and generated files excluded.
Test lines per line of source: 1.83.
Comments: 25 of 109 added source lines, 23%.

Package source changed without an update to website/docs/releases/release-notes.md.