Open-source verifier testing

A bad wallet on purpose.

BADWALLET emits valid and deliberately broken SD-JWT VC and mdoc presentations. Point it at a verifier to see whether bad signatures, stale nonces, tampered disclosures, and untrusted issuers fail for the right reason.

Install from npm How PROOFGATE uses it

badwallet 0.1.0 · public on npm

verifier test run

$ npm install --save-dev badwallet
$ npx badwallet list
13 fault families · SD-JWT VC · mdoc

$ npx badwallet generate \
    --nonce req_7f92 \
    --audience https://verify.example \
    --origin https://checkout.example

wrote valid and broken presentations

22pairwise cases

13fault families

2credential formats

MITlicensed package

It tests the part demos skip.

A verifier that accepts the happy path can still fail open when one protected value changes. BADWALLET keeps the good presentation and each fault close enough to compare.

binding

Nonce, audience, and origin

Change one request-bound value and check that the verifier rejects the presentation instead of treating it as a fresh proof.

integrity

Signatures and disclosures

Feed it DER-encoded ES256 signatures, altered disclosures, missing holder binding, and a mismatched SD hash.

trust

Issuer and lifetime

Use an untrusted issuer or an expired credential and confirm the failure stays distinct from holder and request errors.

protocol

Algorithms and handover

Try unsupported algorithms and alternate mdoc handover construction without changing the rest of the fixture.

From fixture to finding.

The catalog is useful on its own. The adapter adds a repeatable comparison against an HTTP verifier and records what the target actually returned.

01 / EMIT

Generate the pair

Create a valid presentation and a single controlled fault from the same request inputs.

02 / VERIFY

Run both paths

Check the fixture independently, then submit it to the selected verifier.

03 / CLASSIFY

Compare the reason

Record acceptance, rejection, and whether the returned failure class matches the fault.

Separate tool, first consumer.

BADWALLET is not a PROOFGATE-only test suite. It is a standalone package with one adapter today and room for more verifier adapters.

BADWALLET

Builds synthetic presentations, applies one fault at a time, verifies fixtures independently, and compares a target's response. It does not certify a wallet or verifier.

PROOFGATE

The first target adapter and the first production verifier hardened with the catalog. See the PROOFGATE product for the service that consumes these checks.

Run the package, then point it at your verifier.

Node 20 or newer. The fixture emitter makes no network calls.

npm i -D badwallet