fix: reject compressed public keys in Address.fromPublicKey

.changeset/address-from-compressed-public-key.md

@@ -0,0 +1,5 @@
+---
+"ox": patch
+---
+
+Fixed `Address.fromPublicKey` to throw `PublicKey.InvalidError` for a compressed public key instead of deriving an address from the `x` coordinate alone.

src/core/Address.ts

@@ -204,14 +204,30 @@ export declare namespace from {
  * // @log: '0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266'
  * ```
  *
- * @param publicKey - The ECDSA public key to convert to an {@link ox#Address.Address}.
+ * @example
+ * ### Compressed Public Keys
+ *
+ * The address is derived from both coordinates, so a compressed public key throws.
+ *
+ * ```ts twoslash
+ * import { Address, PublicKey } from 'ox'
+ *
+ * const publicKey = PublicKey.from(
+ *   '0x038318535b54105d4a7aae60c08fc45f9687181b4fdfc625bd1a753fa7397fed75'
+ * )
+ * const address = Address.fromPublicKey(publicKey)
+ * // @error: PublicKey.InvalidError: Value `{"prefix":3,"x":"0x8318535b54105d4a7aae60c08fc45f9687181b4fdfc625bd1a753fa7397fed75"}` is not a valid public key.
+ * ```
+ *
+ * @param publicKey - The uncompressed ECDSA public key to convert to an {@link ox#Address.Address}.
  * @param options - Conversion options.
  * @returns The {@link ox#Address.Address} corresponding to the public key.
  */
 export function fromPublicKey(
   publicKey: PublicKey.PublicKey,
   options: fromPublicKey.Options = {},
 ): Address {
+  PublicKey.assert(publicKey, { compressed: false })
   const address = Hash.keccak256(
     `0x${PublicKey.toHex(publicKey).slice(4)}`,
   ).substring(26)
@@ -230,6 +246,7 @@ export declare namespace fromPublicKey {
 
   type ErrorType =
     | Hash.keccak256.ErrorType
+    | PublicKey.assert.ErrorType
     | PublicKey.toHex.ErrorType
     | Errors.GlobalErrorType
 }

src/core/_test/Address.test.ts

@@ -145,6 +145,47 @@ describe('Address.fromPublicKey', () => {
       ),
     ).toEqual('0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266')
   })
+
+  test('error: compressed public key', () => {
+    const publicKey = PublicKey.from(
+      '0x048318535b54105d4a7aae60c08fc45f9687181b4fdfc625bd1a753fa7397fed753547f11ca8696646f2f3acb08e31016afac23e630c5d11f59f61fef57b0d2aa5',
+    )
+
+    expect(() => Address.fromPublicKey(PublicKey.compress(publicKey) as never))
+      .toThrowErrorMatchingInlineSnapshot(`
+      [PublicKey.InvalidError: Value \`{"prefix":3,"x":"0x8318535b54105d4a7aae60c08fc45f9687181b4fdfc625bd1a753fa7397fed75"}\` is not a valid public key.
+
+      Public key must contain:
+      - an \`x\` and \`prefix\` value (compressed)
+      - an \`x\`, \`y\`, and \`prefix\` value (uncompressed)]
+    `)
+    expect(() =>
+      Address.fromPublicKey(
+        PublicKey.from(
+          '0x038318535b54105d4a7aae60c08fc45f9687181b4fdfc625bd1a753fa7397fed75',
+        ),
+      ),
+    ).toThrowErrorMatchingInlineSnapshot(`
+      [PublicKey.InvalidError: Value \`{"prefix":3,"x":"0x8318535b54105d4a7aae60c08fc45f9687181b4fdfc625bd1a753fa7397fed75"}\` is not a valid public key.
+
+      Public key must contain:
+      - an \`x\` and \`prefix\` value (compressed)
+      - an \`x\`, \`y\`, and \`prefix\` value (uncompressed)]
+    `)
+    expect(() =>
+      Address.fromPublicKey(
+        PublicKey.from(
+          '0x028318535b54105d4a7aae60c08fc45f9687181b4fdfc625bd1a753fa7397fed75',
+        ),
+      ),
+    ).toThrowErrorMatchingInlineSnapshot(`
+      [PublicKey.InvalidError: Value \`{"prefix":2,"x":"0x8318535b54105d4a7aae60c08fc45f9687181b4fdfc625bd1a753fa7397fed75"}\` is not a valid public key.
+
+      Public key must contain:
+      - an \`x\` and \`prefix\` value (compressed)
+      - an \`x\`, \`y\`, and \`prefix\` value (uncompressed)]
+    `)
+  })
 })
 
 describe('Address.isEqual', () => {