addOutputAddress doesn't validate address checksum

[mahnunchik]

addOutputAddress method uses Address.decode which uses base58 instead base58check.

Checksum bytes stripped away.

In addition the same address is decoded multiple times.

scure-btc-signer/index.ts

Lines 1486 to 1499 in 98fd1c6

	const data = base58.decode(address);
	if (data.length !== 25) throw new Error('Invalid base58 address');
	// Pay To Public Key Hash
	if (data[0] === network.pubKeyHash) {
	const bytes = base58.decode(address);
	return { type: 'pkh', hash: bytes.slice(1, bytes.length - 4) };
	} else if (data[0] === network.scriptHash) {
	const bytes = base58.decode(address);
	return {
	type: 'sh',
	hash: base58.decode(address).slice(1, bytes.length - 4),
	};
	}
	throw new Error(`Invalid address prefix=${data[0]}`);

It seems address should be decoded the following way:

const data = base58check.decode(address);
if (data.length !== 21) throw new Error('Invalid base58 address');
// Pay To Public Key Hash
if (data[0] === network.pubKeyHash) {
  return { type: 'pkh', hash: data.slice(1) };
} else if (data[0] === network.scriptHash) {
  return {
    type: 'sh',
    hash: data.slice(1),
  };
}