BIP328: Use Base58Check in ExtendedKey.deserialize and validate length #1955

1. 
   sashass1315 commented at 9:09 am on September 5, 2025: contributor

   • Replace raw Base58 decode and manual slice with base58.decode_check(xpub) to enforce checksum validation as required by BIP-32 and as implied by the method docstring.
   • Add strict len(data) == 78 check before parsing to ensure the serialized extended key length matches the BIP-32 78-byte structure.
   • This prevents accepting corrupted or truncated extended keys and aligns deserialization behavior with Base58Check semantics.
2. Use Base58Check in ExtendedKey.deserialize and validate length fd9f5694a8
3. in bip-0328/_xpub.py:137 in fd9f5694a8 outdated

   132@@ -133,7 +133,9 @@ def deserialize(cls, xpub: str) -> 'ExtendedKey':
   133 
   134         :param xpub: The Base58 check encoded xpub
   135         """
   136-        data = base58.decode(xpub)[:-4] # Decoded xpub without checksum
   137+        data = base58.decode_check(xpub)
   138+        if len(data) != 78:
   

   ---

   ---

   

   jonatack commented at 4:24 pm on September 5, 2025:

   Maybe describe the origin of the 78 value.

   0        if len(data) != 78:  # BIP32 Serialization Format defines a 78-byte structure.
   

4. 
   jonatack commented at 4:26 pm on September 5, 2025: member

   Pinging BIP author @achow101 for feedback.
5. jonatack added the label Pending acceptance on Sep 5, 2025
6. Update bip-0328/_xpub.py

   Co-authored-by: Jon Atack <jon@atack.com>

   fc10bd4995

Contributors
sashass1315 jonatack

Labels
Pending acceptance