feat(sdk-lib-mpc): bump @bitgo/wasm-mps to 1.10.0 and use Eddsa.deriveUnhardened

[bitgo-ai-agent-dev]

What

• Bump @bitgo/wasm-mps from 1.8.1 to 1.10.0 in @bitgo/sdk-lib-mpc
• Update @bitgo/express externalSign test: replace deriveUnhardenedMps with MPC.deriveUnhardened for DSG signature verification
• deriveUnhardenedMps is already marked @deprecated in sdk-lib-mpc (full removal tracked under WCI-644)

Why

wasm-mps 1.10.0 switches DSG path derivation from the Silence Labs single-HMAC formula (deriveUnhardenedMps) to standard BIP32-Ed25519 dual-HMAC (Eddsa.deriveUnhardened). Any test that verifies a DSG-produced signature against a public key computed with deriveUnhardenedMps now fails because the two formulas produce completely different child keys.

Test plan

• @bitgo/express externalSign EddsaMPCv2Round1/2/3 test passes locally
• @bitgo/sdk-core unit tests pass (447 passing)
• CI unit tests for @bitgo/sdk-lib-mpc pass
• CI unit tests for @bitgo/sdk-core pass
• CI unit tests for @bitgo/express pass

Ticket: WCI-793

[linear-code]

WCI-793

[zahin-mohammad]

@claude

[github-actions]

Claude finished @zahin-mohammad's task —— View job

---

Code Review for wasm-mps 1.10.0 Bump

Todo List:

• Review package.json changes and dependency update
• Analyze changes to DSG derivation implementation
• Review test updates and coverage
• Check for potential breaking changes or security concerns
• Provide final review feedback

Review Summary

This is a well-executed dependency update that properly handles a breaking change in the cryptographic derivation formula used by @bitgo/wasm-mps. The PR correctly addresses the transition from Silence Labs' single-HMAC formula to standard BIP32-Ed25519 dual-HMAC derivation.

Positive Aspects

✅ Proper deprecation handling: The deriveUnhardenedMps function is correctly marked as @deprecated with clear guidance to use Eddsa.deriveUnhardened instead

✅ Comprehensive test updates: All affected tests have been updated to use the new derivation method with proper verification against the BIP32-Ed25519 standard

✅ Correct API usage: The switch from deriveUnhardenedMps to MPC.deriveUnhardened in the express test (modules/express/test/unit/clientRoutes/externalSign.ts:1226) ensures signature verification works with the new derivation formula

✅ Backward compatibility: The deprecated function remains available for existing code while new implementations use the standard approach

✅ Security improvement: Moving to standard BIP32-Ed25519 improves cryptographic interoperability and follows established standards

Technical Details Reviewed

Dependency Update (modules/sdk-lib-mpc/package.json):

• Clean bump from 1.8.1 to 1.10.0 with no other dependency conflicts

Core Implementation Changes (modules/sdk-core/src/bitgo/utils/tss/eddsa/eddsaMPCv2.ts):

• signRecoveryEddsaMPCv2 function correctly updated to use mpc.deriveUnhardened() instead of deriveUnhardenedMps()
• Proper import of getInitializedMpcInstance added
• Comment updated to clarify BIP32-Ed25519 usage since wasm-mps 1.9.0

Test Coverage (modules/sdk-lib-mpc/test/unit/tss/eddsa/derive.ts):

• Tests updated to verify signatures against Eddsa.deriveUnhardened results instead of the deprecated function
• Addition of Ed25519Bip32HdTree for local BIP32-Ed25519 derivation verification
• Test descriptions updated to reflect the new verification method

No Issues Found

• No security concerns identified
• No performance regressions expected
• Breaking change is properly handled with deprecation
• Test coverage remains comprehensive
• Code follows existing patterns and conventions

Recommendation: APPROVE ✅

This PR correctly implements the necessary changes for the wasm-mps upgrade and maintains backward compatibility while moving to cryptographic standards. The implementation is thorough and well-tested.

---

Job Run | Branch: wci-793-bump-wasm-mps-1.10.0