From cd412209a7f90c887b06384550a2fd13c493ba28 Mon Sep 17 00:00:00 2001
From: user <user@Mac.lan guest wan>
Date: Sat, 28 Feb 2026 16:01:40 -0800
Subject: [PATCH] fix: cross-wallet duplicate address detection on import

Previously each import method (mnemonic, private key, xprv) only checked
for duplicates among wallets of the same type. Now all three check the
derived address against ALL existing wallet addresses regardless of type,
and mnemonic/xprv imports also compare xpubs against existing HD/xprv
wallets.

Closes #111
---
 src/popup/views/addWallet.js | 55 +++++++++++++++++++++---------------
 1 file changed, 33 insertions(+), 22 deletions(-)

diff --git a/src/popup/views/addWallet.js b/src/popup/views/addWallet.js
index 9fcfed6..bb068df 100644
--- a/src/popup/views/addWallet.js
+++ b/src/popup/views/addWallet.js
@@ -97,18 +97,26 @@ async function importMnemonic(ctx) {
     const pw = validatePassword();
     if (!pw) return;
     const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
-    const duplicate = state.wallets.find(
-        (w) =>
-            w.type === "hd" &&
-            w.addresses[0] &&
-            w.addresses[0].address.toLowerCase() === firstAddress.toLowerCase(),
+    const addrDup = state.wallets.find((w) =>
+        w.addresses.some(
+            (a) => a.address.toLowerCase() === firstAddress.toLowerCase(),
+        ),
     );
-    if (duplicate) {
+    if (addrDup) {
         showFlash(
-            "This recovery phrase is already added (" + duplicate.name + ").",
+            "An address from this phrase already exists in " +
+                addrDup.name +
+                ".",
         );
         return;
     }
+    const xpubDup = state.wallets.find(
+        (w) => (w.type === "hd" || w.type === "xprv") && w.xpub === xpub,
+    );
+    if (xpubDup) {
+        showFlash("This recovery phrase matches " + xpubDup.name + ".");
+        return;
+    }
     const encrypted = await encryptWithPassword(mnemonic, pw);
     const walletNum = state.wallets.length + 1;
     const wallet = {
@@ -162,16 +170,11 @@ async function importPrivateKey(ctx) {
     }
     const pw = validatePassword();
     if (!pw) return;
-    const duplicate = state.wallets.find(
-        (w) =>
-            w.type === "key" &&
-            w.addresses[0] &&
-            w.addresses[0].address.toLowerCase() === addr.toLowerCase(),
+    const duplicate = state.wallets.find((w) =>
+        w.addresses.some((a) => a.address.toLowerCase() === addr.toLowerCase()),
     );
     if (duplicate) {
-        showFlash(
-            "This private key is already added (" + duplicate.name + ").",
-        );
+        showFlash("This address already exists in " + duplicate.name + ".");
         return;
     }
     const encrypted = await encryptWithPassword(key, pw);
@@ -208,14 +211,22 @@ async function importXprvKey(ctx) {
         return;
     }
     const { xpub, firstAddress } = result;
-    const duplicate = state.wallets.find(
-        (w) =>
-            (w.type === "hd" || w.type === "xprv") &&
-            w.addresses[0] &&
-            w.addresses[0].address.toLowerCase() === firstAddress.toLowerCase(),
+    const addrDup = state.wallets.find((w) =>
+        w.addresses.some(
+            (a) => a.address.toLowerCase() === firstAddress.toLowerCase(),
+        ),
     );
-    if (duplicate) {
-        showFlash("This key is already added (" + duplicate.name + ").");
+    if (addrDup) {
+        showFlash(
+            "An address from this key already exists in " + addrDup.name + ".",
+        );
+        return;
+    }
+    const xpubDup = state.wallets.find(
+        (w) => (w.type === "hd" || w.type === "xprv") && w.xpub === xpub,
+    );
+    if (xpubDup) {
+        showFlash("This key matches " + xpubDup.name + ".");
         return;
     }
     const pw = validatePassword();