chore: Use @noble/hashes/sha256 rather than obscure package (#2580)

ts/packages/anchor/package.json

@@ -34,6 +34,7 @@
   },
   "dependencies": {
     "@coral-xyz/borsh": "^0.28.0",
+    "@noble/hashes": "^1.3.1",
     "@solana/web3.js": "^1.68.0",
     "base64-js": "^1.5.1",
     "bn.js": "^5.1.2",
@@ -43,7 +44,6 @@
     "cross-fetch": "^3.1.5",
     "crypto-hash": "^1.3.0",
     "eventemitter3": "^4.0.7",
-    "js-sha256": "^0.9.0",
     "pako": "^2.0.3",
     "snake-case": "^3.0.4",
     "superstruct": "^0.15.4",

ts/packages/anchor/rollup.config.ts

@@ -39,7 +39,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/anchor/src/coder/borsh/accounts.ts

@@ -2,16 +2,11 @@ import bs58 from "bs58";
 import { Buffer } from "buffer";
 import { Layout } from "buffer-layout";
 import camelcase from "camelcase";
-import { sha256 } from "js-sha256";
 import { Idl, IdlTypeDef } from "../../idl.js";
 import { IdlCoder } from "./idl.js";
 import { AccountsCoder } from "../index.js";
 import { accountSize } from "../common.js";
-
-/**
- * Number of bytes of the account discriminator.
- */
-export const ACCOUNT_DISCRIMINATOR_SIZE = 8;
+import { DISCRIMINATOR_SIZE, discriminator } from "./discriminator.js";
 
 /**
  * Encodes and decodes account objects.
@@ -77,7 +72,7 @@ export class BorshAccountsCoder<A extends string = string>
 
   public decodeUnchecked<T = any>(accountName: A, ix: Buffer): T {
     // Chop off the discriminator before decoding.
-    const data = ix.slice(ACCOUNT_DISCRIMINATOR_SIZE);
+    const data = ix.subarray(DISCRIMINATOR_SIZE);
     const layout = this.accountLayouts.get(accountName);
     if (!layout) {
       throw new Error(`Unknown account: ${accountName}`);
@@ -96,9 +91,7 @@ export class BorshAccountsCoder<A extends string = string>
   }
 
   public size(idlAccount: IdlTypeDef): number {
-    return (
-      ACCOUNT_DISCRIMINATOR_SIZE + (accountSize(this.idl, idlAccount) ?? 0)
-    );
+    return DISCRIMINATOR_SIZE + (accountSize(this.idl, idlAccount) ?? 0);
   }
 
   /**
@@ -107,13 +100,10 @@ export class BorshAccountsCoder<A extends string = string>
    * @param name The name of the account to calculate the discriminator.
    */
   public static accountDiscriminator(name: string): Buffer {
-    return Buffer.from(
-      sha256.digest(
-        `account:${camelcase(name, {
-          pascalCase: true,
-          preserveConsecutiveUppercase: true,
-        })}`
-      )
-    ).slice(0, ACCOUNT_DISCRIMINATOR_SIZE);
+    const discriminatorPreimage = `account:${camelcase(name, {
+      pascalCase: true,
+      preserveConsecutiveUppercase: true,
+    })}`;
+    return discriminator(discriminatorPreimage);
   }
 }

ts/packages/anchor/src/coder/borsh/discriminator.ts

@@ -0,0 +1,10 @@
+import { sha256 } from "@noble/hashes/sha256";
+
+/**
+ * Number of bytes in anchor discriminators
+ */
+export const DISCRIMINATOR_SIZE = 8;
+
+export function discriminator(preimage: string): Buffer {
+  return Buffer.from(sha256(preimage).slice(0, DISCRIMINATOR_SIZE));
+}

ts/packages/anchor/src/coder/borsh/event.ts

@@ -1,11 +1,11 @@
 import { Buffer } from "buffer";
 import * as base64 from "base64-js";
 import { Layout } from "buffer-layout";
-import { sha256 } from "js-sha256";
 import { Idl, IdlEvent, IdlTypeDef } from "../../idl.js";
 import { Event, EventData } from "../../program/event.js";
 import { IdlCoder } from "./idl.js";
 import { EventCoder } from "../index.js";
+import { discriminator } from "./discriminator.js";
 
 export class BorshEventCoder implements EventCoder {
   /**
@@ -78,5 +78,5 @@ export class BorshEventCoder implements EventCoder {
 }
 
 export function eventDiscriminator(name: string): Buffer {
-  return Buffer.from(sha256.digest(`event:${name}`)).slice(0, 8);
+  return discriminator(`event:${name}`);
 }

ts/packages/anchor/src/coder/borsh/index.ts

@@ -6,7 +6,8 @@ import { BorshTypesCoder } from "./types.js";
 import { Coder } from "../index.js";
 
 export { BorshInstructionCoder } from "./instruction.js";
-export { BorshAccountsCoder, ACCOUNT_DISCRIMINATOR_SIZE } from "./accounts.js";
+export { BorshAccountsCoder } from "./accounts.js";
+export { DISCRIMINATOR_SIZE } from "./discriminator.js";
 export { BorshEventCoder, eventDiscriminator } from "./event.js";
 
 /**

ts/packages/anchor/src/coder/borsh/instruction.ts

@@ -3,7 +3,6 @@ import { Buffer } from "buffer";
 import { Layout } from "buffer-layout";
 import camelCase from "camelcase";
 import { snakeCase } from "snake-case";
-import { sha256 } from "js-sha256";
 import * as borsh from "@coral-xyz/borsh";
 import { AccountMeta, PublicKey } from "@solana/web3.js";
 import {
@@ -21,6 +20,7 @@ import {
 } from "../../idl.js";
 import { IdlCoder } from "./idl.js";
 import { InstructionCoder } from "../index.js";
+import { sha256 } from "@noble/hashes/sha256";
 
 /**
  * Namespace for global instruction function signatures (i.e. functions
@@ -352,5 +352,5 @@ function sentenceCase(field: string): string {
 function sighash(nameSpace: string, ixName: string): Buffer {
   let name = snakeCase(ixName);
   let preimage = `${nameSpace}:${name}`;
-  return Buffer.from(sha256.digest(preimage)).slice(0, 8);
+  return Buffer.from(sha256(preimage).slice(0, 8));
 }

ts/packages/anchor/src/utils/pubkey.ts

@@ -1,7 +1,7 @@
 import { Buffer } from "buffer";
 import { PublicKey } from "@solana/web3.js";
 import { Address, translateAddress } from "../program/common.js";
-import { sha256 as sha256Sync } from "js-sha256";
+import { sha256 } from "@noble/hashes/sha256";
 
 // Sync version of web3.PublicKey.createWithSeed.
 export function createWithSeedSync(
@@ -14,8 +14,7 @@ export function createWithSeedSync(
     Buffer.from(seed),
     programId.toBuffer(),
   ]);
-  const hash = sha256Sync.digest(buffer);
-  return new PublicKey(Buffer.from(hash));
+  return new PublicKey(sha256(buffer));
 }
 
 export function associated(

ts/packages/anchor/src/utils/sha256.ts

@@ -1,5 +1,5 @@
-import { sha256 } from "js-sha256";
+import { sha256 } from "@noble/hashes/sha256";
 
 export function hash(data: string): string {
-  return sha256(data);
+  return new TextDecoder().decode(sha256(data));
 }

ts/packages/anchor/tests/coder-accounts.spec.ts

@@ -1,8 +1,7 @@
 import * as assert from "assert";
-import { createNodeArray } from "typescript";
 import { BorshCoder } from "../src";
-import { sha256 } from "js-sha256";
-import { ACCOUNT_DISCRIMINATOR_SIZE } from "../src/coder/borsh/accounts";
+import { DISCRIMINATOR_SIZE } from "../src/coder/borsh/discriminator";
+import { sha256 } from "@noble/hashes/sha256";
 
 describe("coder.accounts", () => {
   test("Can encode and decode user-defined accounts, including those with consecutive capital letters", () => {
@@ -40,11 +39,8 @@ describe("coder.accounts", () => {
     coder.accounts.encode("MemberDAO", memberDAO).then((encoded) => {
       // start of encoded account = account discriminator
       assert.deepEqual(
-        encoded.subarray(0, ACCOUNT_DISCRIMINATOR_SIZE),
-        Buffer.from(sha256.digest("account:MemberDAO")).subarray(
-          0,
-          ACCOUNT_DISCRIMINATOR_SIZE
-        )
+        encoded.subarray(0, DISCRIMINATOR_SIZE),
+        Buffer.from(sha256("account:MemberDAO").slice(0, DISCRIMINATOR_SIZE))
       );
       assert.deepEqual(coder.accounts.decode("MemberDAO", encoded), memberDAO);
     });

ts/packages/spl-associated-token-account/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-binary-option/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-binary-oracle-pair/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-feature-proposal/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-governance/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-memo/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-name-service/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-record/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-stake-pool/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-stateless-asks/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-token-lending/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-token-swap/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/packages/spl-token/rollup.config.ts

@@ -41,7 +41,7 @@ export default {
     "buffer",
     "camelcase",
     "eventemitter3",
-    "js-sha256",
+    "@noble/hashes/sha256",
     "pako",
     "toml",
   ],

ts/yarn.lock

@@ -735,6 +735,11 @@
   resolved "https://registry.yarnpkg.com/@noble/hashes/-/hashes-1.1.3.tgz#360afc77610e0a61f3417e497dcf36862e4f8111"
   integrity sha512-CE0FCR57H2acVI5UOzIGSSIYxZ6v/HOhDR0Ro9VLyhnzLwx0o8W1mmgaqlEUx4049qJDlIBRztv5k+MM8vbO3A==
 
+"@noble/hashes@^1.3.1":
+  version "1.3.1"
+  resolved "https://registry.yarnpkg.com/@noble/hashes/-/hashes-1.3.1.tgz#8831ef002114670c603c458ab8b11328406953a9"
+  integrity sha512-EbqwksQwz9xDRGfDST86whPBgM65E0OH/pCgqW0GBVzO22bNE+NuIbeTb714+IfSjU3aRk47EUvXIb5bTsenKA==
+
 "@noble/secp256k1@^1.6.3":
   version "1.7.0"
   resolved "https://registry.yarnpkg.com/@noble/secp256k1/-/secp256k1-1.7.0.tgz#d15357f7c227e751d90aa06b05a0e5cf993ba8c1"
@@ -3253,11 +3258,6 @@ jest@27.3.1:
     import-local "^3.0.2"
     jest-cli "^27.3.1"
 
-js-sha256@^0.9.0:
-  version "0.9.0"
-  resolved "https://registry.yarnpkg.com/js-sha256/-/js-sha256-0.9.0.tgz#0b89ac166583e91ef9123644bd3c5334ce9d0966"
-  integrity sha512-sga3MHh9sgQN2+pJ9VYZ+1LPwXOxuBJBA5nrR5/ofPfuiJBE2hnjsaN8se8JznOmGLN2p49Pe5U/ttafcs/apA==
-
 js-tokens@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"