VeChain security record

The report gives no description here.

In the constructor of the `Certificate` object, the `signature` is not checked to be corresponding to the input `signer` when creating the certificate with the optional signature parameter.

The `eth_chainid` method is used to get the chainId, based on the `genesisBlock.id`. The function returns either the mainnet chain ID or the testnet chain ID. However, the pointed comment indicates `// Testnet OR Solo OR some other network`. The cases for `Solo` or for `some other network` are not covered.

The `HDKey.ts#fromMnemonic()` function is responsible for generating an HD key from a given mnemonic. This function internally utilizes [scure-bip39#mnemonicToSeedSync()](https://github.com/paulmillr/scure-bip39/blob/main/src/index.ts#L137) to derive a 64-byte key from the mnemonic, along with an optional password. The `mnemonicToSeedSync()` function provides flexibility by allowing a `passphrase` parameter, which can be used to offer additional protection for the key generation process. However, the current implementation of the `HDKey.ts#fromMnemonic()` function does not provide an option to input this password parameter, thereby removing the additional layer of security that the `scure-bip39#mnemonicToSeedSync()` function is capable of offering.

The pointed functions have some input parameters that lack documentation in the JSDoc comment, despite being used in the method implementation. The lack of documentation can cause confusion for developers, making it harder to understand the parameter's purpose, expected format, and behavior.

The `getCorrectBlockNumberRPCToVeChain` function groups all possible blocks states to the `best` one, that, as reported in code comments, represents the sole state to represent them all. However, comments do not mention the `pending` state, which differently from all the other reported cases, may report a block that did not undergo the chain consensus process, thus providing transient or false information. Since all states are treated in the same way, function caller may obtain incorrect data.

In `Certificate.ts`, the `encode()` function is designed to nullify the `signature` of the certificate by setting it to `undefined` before returning the encoded object: ```typescript=183 public encode(): Uint8Array { return Certificate.encode({ ...this, signature: undefined }); } ``` Within the `sign()` and `verify()` functions, the `this.signature` property is explicitly set to `undefined` before calling the `encode(object: unknown)` function. This approach can be simplified, as the `encode()` function already handles the nullification of the `signature`.

There are typos in the code: - In `hardhat-provider.ts`: - The comment `Overload off ...` should be `Overload of`. - In `vechain-abstract-signer.ts`: - The comment `Estimates the required gas required to execute //tx// on the Blockchain` has one too many `required` in it. Consider removing one of them.

The `KMSVechainSigner` constructor allows the creation of an instance of the signer with the following combinations: - The `provider` is not undefined. - The `delegator` is not undefined - The `delegator_url` is not undefined. In the third case the `KMSVeChainSigner` will be instantiated with an empty `provider`, empty `delegator provider`, and non-empty `delegator_url`. The function `concatSignatureIfDelegation()` used when signing a transaction concatenates the delegator's signature from the `kmsVeChainDelegatorProvider` if it is set. If the `kmsVeChainDelegatorProvider` is undefined the function retrieves the delegator's signature using the `kmsVeChainDelegatorUrl` and the `provider`: ```typescript=261 ... else if ( // If not, we try with the delegator URL this.kmsVeChainDelegatorUrl !== undefined && this.provider !== undefined ) ... ``` However, the function calls `this.buildVeChainSignatureFromPayload()` before reaching the abovementioned check which throws an error if `this.kmsVeChainProvider` is undefined. Since `this.kmsVeChainProvider` is assigned to `this.provider` in the `KMSVeChainSigner` constructor, the check `this.provider !== undefined` in the `else if` of `concatSignatureIfDelegation()` is redundant.

The report gives no description here.