Replace ethereumjs-wallet with an in-package V3 keystore implementation

[palango]

Why

@celo/keystores depended on ethereumjs-wallet, which is deprecated and pulled in the unmaintained browserify crypto stack. That subtree carried four critical advisories, the worst of them badly matched to a keystore package:

• pbkdf2@3.1.2 — silently disregards Uint8Array input and returns static keys, and separately returns predictable zero-filled memory for non-normalized input
• sha.js@2.4.11 and cipher-base@1.0.4 — missing type checks allowing hash rewind
• elliptic@6.5.4 (via secp256k1@4.0.3) — private key extraction in ECDSA

All of it entered through a single direct dependency used in exactly one file.

What changed

V3 encrypt/decrypt now lives in packages/sdk/keystores/src/v3-keystore.ts, built on @noble/hashes and @noble/ciphers. Both are already pinned at these exact versions across ~10 sibling SDK packages, so no new versions enter the lockfile — yarn.lock shrinks by 300 lines.

Confirmed gone from the dependency tree: ethereumjs-wallet, ethereumjs-util, ethereum-cryptography@0.1.3, pbkdf2, sha.js, cipher-base, create-hash, create-hmac, browserify-aes.

The public KeystoreBase API is unchanged.

Compatibility

The keystore format is untouched: encryption still uses geth's defaults (scrypt n=262144, r=8, p=1, AES-128-CTR, keccak256 MAC), and geth-generated keystores still decrypt.

Beyond the unit tests, I ran a bidirectional cross-check against the real ethereumjs-wallet@1.0.2. All 10 checks passed:

Check	Result
new encrypt → old decrypt	PASS
old encrypt → new decrypt	PASS
top-level fields identical	PASS (address,crypto,id,version)
crypto / kdfparams field sets identical	PASS
KDF parameter values identical	PASS
address field format identical	PASS (unprefixed, lowercase)
v3Filename byte-identical	PASS
wrong-passphrase error string identical	PASS

One deliberate behaviour change

Decryption now accepts only aes-128-ctr and throws otherwise. Previously the file's cipher field was passed straight into createDecipheriv, i.e. an untrusted string selected the cipher. Every real V3 keystore uses aes-128-ctr; exotic ones would now be rejected.

Tests

35 pass (was 20). New coverage: geth fixture round-trips, tampered-ciphertext MAC rejection, unsupported cipher/KDF, fresh salt/IV/id per encryption, address normalisation, filename convention.

The pbkdf2 branch previously had only its rejection path covered, so it now has a known-answer test using the Web3 Secret Storage spec vector — validated against ethereumjs-wallet before being added as a fixture, rather than generated by the code under test.

Known gaps, not addressed here

• pbkdf2 iteration count is unbounded. A hostile keystore with c=2e9 costs ~43 min of CPU (measured). Not a regression — the previous code passed attacker-controlled c into a synchronous pbkdf2, blocking the event loop outright. scrypt is bounded: noble rejects absurd n/r in ~0ms.
• Malformed keystore JSON throws TypeError rather than a defined V3ErrorMessages. Robustness only; nothing is silently accepted and no wrong key is ever produced.
• changeKeystorePassphrase drops blspublickey — pre-existing, tracked in changeKeystorePassphrase silently drops blspublickey from validator keystores #793.

Note for the reviewer

packages/sdk/keystores/src/file-keystore.ts has pre-existing biome import-order drift that fails biome check on master today. It is not in this diff — biome's --write kept sweeping it in and I backed it out to keep the diff honest. It needs its own cleanup and will fail CI lint independently of this PR.

---

PR-Codex overview

This PR replaces the deprecated ethereumjs-wallet dependency with a new implementation using @noble/hashes and @noble/ciphers, enhancing security and maintaining compatibility with existing keystore formats.

Detailed summary

• Removed ethereumjs-wallet dependency.
• Added @noble/ciphers and @noble/hashes dependencies.
• Implemented encryptV3 and decryptV3 functions for keystore handling.
• Updated KeystoreBase methods to use the new encryption and decryption functions.
• Added tests for encryptV3 and decryptV3 functionalities.
• Updated documentation regarding the new keystore implementation.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[changeset-bot]

🦋 Changeset detected

Latest commit: 1434bfd

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@celo/keystores	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.

[github-actions]

size-limit report 📦

Path	Size
import * from '@celo/core' (csj)	1.81 KB (0%)
import * from '@celo/core' (esm)	1.56 KB (0%)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.61%. Comparing base (b4f631c) to head (1434bfd).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #792      +/-   ##
==========================================
+ Coverage   64.52%   69.61%   +5.08%     
==========================================
  Files          33      213     +180     
  Lines         919    11312   +10393     
  Branches      114     1973    +1859     
==========================================
+ Hits          593     7875    +7282     
- Misses        313     3349    +3036     
- Partials       13       88      +75     

Components	Coverage Δ
celocli	71.76% <ø> (∅)
sdk	67.70% <100.00%> (∅)
wallets	73.68% <ø> (∅)
viem-sdks	94.15% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.