Remove dangerous dependencies

Current dep list is:

    "@ethersproject/bytes": "^5.6.1",
    "bn.js": "^5.2.1",
    "cross-fetch": "^3.1.5",
    "elliptic": "^6.5.4",
    "ethereum-cryptography": "^1.0.3",
    "hash.js": "^1.1.7",
    "json-bigint": "^1.0.0",
    "minimalistic-assert": "^1.0.1",
    "pako": "^2.0.4",
    "ts-custom-error": "^3.2.0",
    "url-join": "^4.0.1"

You’re depending on ethereum-cryptography, which contains audited versions of secp256k1, all sorts of hashes (sha2, sha3…); e-c also doesn’t use bn.js, instead, it uses native bigints.

So, I strongly suggest to remove bn.js, elliptic, hash.js — it would reduce your bundle size by a huge amount; and improve security drastically. Elliptic had 2 CVEs in 2020. Instead of them, you can simply use ethereum-cryptography stuff.

[tabaktoni]

This Issue is Assigned to @katsumotoeth but there seems like no activity around it. Can we reassign it to @paulmillr true only dust?

[paulmillr]

Yes.