Wrong address from equivalents derivation path about money-tree HOT 2 CLOSED

Yes, the parsing of the node path is very broken when the path uses the negative notation or when the index value is >= 2147483648. The readme states that these notations are supported but there is very sparse testing of this. In fact the one test for negative indexes goes out of its way to avoid testing and tests using m/0'/-1 instead. (m/-0/-1 will not pass).

From what I can tell, no index of 2147483648 (0x80000000) or larger will work and negative indexes of -0 will also fail; unfortunately hardened-0 is very commonly required.

This library's use of signed arithmetic for index values is troubling to me in general since the spec says that index values are unsigned 32 bit integers. Supporting the negative notation when parsing the path is fine, but actually handling internal index values less then zero is problematic since -0 is not < 0 which this code expects to be true.

To me these are very serious bugs that should prevent anyone from using this gem as it will lead to loss of funds.

from money-tree.

Yep, bugs; patches welcome.

from money-tree.