Signature verification failed for newly created accounts

[mx5kevin]

Signature verification failed for newly created accounts

Description

There appears to be an account number precision issue in the web wallet integration.

The EPIX REST API returns the correct account number for the affected account, but the web interface passes a different value to Keplr when creating the transaction.

This results in:

Error: signature verification failed; please verify account number

(unable to verify single signer signature): unauthorized

Important observations

• Chain ID: epix_1916-1
• The public address is correct.
• The affected account works correctly when sending and staking directly through Keplr.
• The same web interface works correctly with an older account.
• The problem occurs with both Send and Staking through the web interface.
• Clearing browser cache and using an incognito window does not resolve the issue.
• The REST API returns the correct account number.
• Keplr also uses the correct account number.
• The web interface appears to pass a different account number to Keplr.

Suspected cause

The account number is a uint64 value and can exceed JavaScript's Number.MAX_SAFE_INTEGER.

If the Explorer converts the account number to a JavaScript Number, precision can be lost.

This can cause the account number included in the SignDoc to differ from the actual on-chain account number.

Expected behavior

The complete uint64 account number should be preserved when constructing the SignDoc passed to Keplr.

The value should be handled using an appropriate 64-bit integer representation such as Long, BigInt, or another representation supported by the signing library, rather than JavaScript Number.

Actual behavior

The web interface appears to modify the account number before passing the transaction to Keplr.

The resulting signature is rejected by the chain because the account_number in the signed document does not match the account number stored on-chain.

Reproduction

1. Connect a newly created EPIX account to the web interface. EPIX Explorer
2. Start a Send or Staking transaction.
3. Approve the transaction with Keplr.
4. The transaction fails with signature verification failed.
5. Query the account through the REST API and compare the account number used by the web interface.
6. The REST API and Keplr report the correct account number, while the web interface passes a different value to Keplr.

Suggested investigation

Please check the code path that:

1. Fetches account information from the EPIX REST/LCD API.
2. Reads accountNumber / account_number.
3. Constructs the Cosmos SignDoc.
4. Passes the SignDoc to Keplr via signDirect.

In particular, search for conversions such as:

Number(accountNumber)

or:

Number(account.account_number)

and ensure that the value remains precise throughout the signing process.

This appears to affect newly created accounts with large account numbers, while older accounts with smaller account numbers continue to work correctly.

No wallet address or other account-identifying information is included in this report for privacy reasons.

[MudDev]

Try v0.5.3 (https://github.com/EpixZone/EpixNet/releases/tag/v0.5.3) i added redundant RPC's and have more work to do on polishing it, but this should resolve the immediate issue.

[mx5kevin]

Try v0.5.3 (https://github.com/EpixZone/EpixNet/releases/tag/v0.5.3) i added redundant RPC's and have more work to do on polishing it, but this should resolve the immediate issue.

The issue occurs with Keplr 0.13.37 in Firefox on this page: https://explorer.epix.zone/#/ when EpixNet is not installed.

However, these functions are also not working on https://restake.app/epix

I tried it with v0.5.3 and the Epix Wallet as well, but it still doesn't work.