fix: enforce the base58 checksum and reject non-master extended keys (closes #210)

src/popup/views/addWallet.js

@@ -6,6 +6,7 @@ const {
     addressFromPrivateKey,
     hdWalletFromXprv,
     isValidXprv,
+    isMasterExtendedKey,
 } = require("../../shared/wallet");
 const { encryptWithPassword } = require("../../shared/vault");
 const { state, saveState } = require("../../shared/state");
@@ -213,14 +214,25 @@ async function importXprvKey(ctx) {
         return;
     }
     if (!isValidXprv(xprv)) {
-        showFlash("Invalid extended private key.");
+        showFlash(
+            "That extended private key is not valid. Please check it and try again.",
+        );
+        return;
+    }
+    if (!isMasterExtendedKey(xprv)) {
+        showFlash(
+            "That is an account-level or child key, which cannot be imported. " +
+                "Please paste the master extended private key for the wallet.",
+        );
         return;
     }
     let result;
     try {
         result = hdWalletFromXprv(xprv);
     } catch (e) {
-        showFlash("Invalid extended private key.");
+        showFlash(
+            "That extended private key is not valid. Please check it and try again.",
+        );
         return;
     }
     const { xpub, firstAddress } = result;