refactor(crypto): remove deprecated methods and harden crypto module

[Federico2014]

Summary

• Remove compressPoint/decompressPoint from both ECKey and SM2
  (all 4 were @deprecated, zero callers confirmed by grep)
• Add private static final to SM2 curve domain parameters
  (SM2_N, SM2_P, SM2_A, SM2_B, SM2_GX, SM2_GY)
• Add instanceof type guards in SignUtils.signatureToAddress
  to replace silent ClassCastException with descriptive
  IllegalArgumentException on engine/signature-type mismatch

Compatibility

Removing compressPoint/decompressPoint is a binary-incompatible
change. External code calling these methods via direct reference will
encounter NoSuchMethodError at runtime after upgrading. Migration:
use ECPoint.getEncoded(boolean) directly.

Test plan

• ./gradlew :framework:test --tests "org.tron.common.crypto.*" — all pass
• ./gradlew :framework:test --tests "org.tron.core.net.messagehandler.PbftMsgHandlerTest" — pass
• ./gradlew :framework:test --tests "org.tron.core.pbft.PbftApiTest" — pass
• ./gradlew :chainbase:test — all pass

---

Summary by cubic

Removes deprecated point-compression helpers and hardens signature-type checks to prevent silent casting errors. Also makes SM2 curve constants immutable and makes SignUtils.signatureToAddress error messages null-safe.

• Refactors

  • Removed compressPoint/decompressPoint from ECKey and SM2 (no callers).
  • Added instanceof checks and null-safe errors in SignUtils.signatureToAddress; throw IllegalArgumentException on engine/signature mismatch.
  • Marked SM2 domain parameters (SM2_N, SM2_P, SM2_A, SM2_B, SM2_GX, SM2_GY) as private static final.

• Migration

  • Removal is binary-incompatible; direct callers will hit NoSuchMethodError.
  • Use ECPoint.getEncoded(boolean) for point compression/decompression.

^{Written for commit e8cd104. Summary will update on new commits.}

Summary by CodeRabbit

• Refactor
  • Removed public point compression/decompression utility methods from cryptographic APIs.
  • Added runtime signature-type validation to fail fast on mismatched signature implementations.
  • Made cryptographic domain constants immutable to improve stability.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR removes point compression/decompression utility methods from ECKey and SM2, adds runtime signature-type validation in SignUtils.signatureToAddress, and makes six SM2 elliptic-curve domain constants immutable.

Changes

Cohort / File(s)	Summary
Point Compression/Decompression Removal crypto/src/main/java/org/tron/common/crypto/ECKey.java, crypto/src/main/java/org/tron/common/crypto/sm2/SM2.java	Removed public static methods compressPoint(ECPoint) and decompressPoint(ECPoint) from both classes, eliminating those utility entry points.
SM2 Domain Constants Immutability crypto/src/main/java/org/tron/common/crypto/sm2/SM2.java	Changed six domain parameters (SM2_N, SM2_P, SM2_A, SM2_B, SM2_GX, SM2_GY) from private static to private static final.
Signature Type Validation crypto/src/main/java/org/tron/common/crypto/SignUtils.java	Added explicit runtime checks in signatureToAddress(...): when isECKeyCryptoEngine is true require ECDSASignature, otherwise require SM2Signature; throws IllegalArgumentException on mismatch or null.

Sequence Diagram

sequenceDiagram
    participant Client
    participant SignUtils
    participant ECKey
    participant SM2

    Client->>SignUtils: signatureToAddress(messageHash, signature, isECKeyCryptoEngine)
    alt isECKeyCryptoEngine = true
        SignUtils->>SignUtils: validate signature is ECDSASignature
        SignUtils->>ECKey: signatureToAddress(messageHash, ecdsaSig)
        ECKey-->>SignUtils: address
    else isECKeyCryptoEngine = false
        SignUtils->>SignUtils: validate signature is SM2Signature
        SignUtils->>SM2: signatureToAddress(messageHash, sm2Sig)
        SM2-->>SignUtils: address
    end
    SignUtils-->>Client: address

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• Federico2014/bn128-ipc#1: Type-validation clarifies crypto engine branching and type safety.

Poem

🐰 I nibbled bytes beneath the moonlit tree,

Compression hops away — set free!
Types stand guard at the signature gate,
Constants frozen, tidy and straight.
A rabbit cheers, code trims its sleeve. 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: removal of deprecated methods and hardening of the crypto module, which aligns with the key modifications across ECKey, SM2, and SignUtils.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/crypto/cleanup-dead-code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crypto/src/main/java/org/tron/common/crypto/SignUtils.java">

<violation number="1" location="crypto/src/main/java/org/tron/common/crypto/SignUtils.java:54">
P2: Null `signatureInterface` causes a `NullPointerException` while building the new type-mismatch message, instead of the intended `IllegalArgumentException`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@crypto/src/main/java/org/tron/common/crypto/SignUtils.java`:
- Around line 51-55: Check for null before calling signatureInterface.getClass()
in SignUtils: when validating that signatureInterface is an instance of
ECDSASignature, replace the direct getClass() call in the error message with a
null-safe expression (e.g., use (signatureInterface == null ? "null" :
signatureInterface.getClass().getName())) or explicitly branch to throw an
IllegalArgumentException stating the parameter is null; apply the same
null-guard change to the second occurrence mentioned so neither the instanceof
check nor the error formatting can cause a NullPointerException.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4e22e54c-4b89-4830-ad7b-e88639c15d97

📥 Commits

Reviewing files that changed from the base of the PR and between 3ab5adf and c8adb6c.

📒 Files selected for processing (3)

• crypto/src/main/java/org/tron/common/crypto/ECKey.java
• crypto/src/main/java/org/tron/common/crypto/SignUtils.java
• crypto/src/main/java/org/tron/common/crypto/sm2/SM2.java

💤 Files with no reviewable changes (1)

• crypto/src/main/java/org/tron/common/crypto/ECKey.java