Submitting an empty "assetMetadataHash" causes the signature validation to fail

[DJRHails]

For instance the following code snippet:

const txnParams = {
      'from': addr,
      'note': note,
      'suggestedParams': suggestedParams,
      'assetTotal': supply,
      'assetDecimals': decimals,
      'assetDefaultFrozen': false,
      'assetUnitName': unitName,
      'assetName': assetName,
      'assetURL': assetURL,
      'assetMetadataHash': '',
      'assetManager': managerAddress,
      'assetReserve': reserveAddress,
      'assetFreeze': freezeAddress,
      'assetClawback': clawbackAddress,
      'type': 'acfg' as const,
    }
    const signedTxn = sdk.signTransaction(txnParams, sk)
    const transaction = await algodv2.sendRawTransaction(signedTxn.blob).do()

Will fail with:

{"message":"signature validation failed"}

If you remove the assetMetadataHash then this will then succeed happily.

[jasonpaulos]

Thanks for reporting this @DJRHails, I'm looking into it.

[jasonpaulos]

This was a strange one to debug, but it looks like the issue is because the Javascript SDK does not validate assetMetadataHash properly. This value is supposed to be exactly 32 bytes long, but if you pass in a smaller value the Javascript SDK will construct and sign a transaction with that smaller value.

Then when the transaction reaches the server, the assetMetadataHash gets unpacked into the field here, which is 32 bytes long. In the case of a smaller value, it appears extra 0s are added. This means that when the server tries to verify the transaction signature it fails because a different transaction with a shorter assetMetadataHash was actually signed in Javascript.

I've created #253 to fix this by throwing an error if assetMetadataHash isn't 32 bytes long, and I've made it so that an empty string or a zero-length Uint8Array also get treated the same as undefined for this field.

In the meantime, you'll have to manually make sure you either pass in undefined or a string/Uint8Array that's exactly 32 bytes long.

Thanks for reporting this!