fix: cross-wallet duplicate address detection on import

Previously each import method (mnemonic, private key, xprv) only checked
for duplicates among wallets of the same type. Now all three check the
derived address against ALL existing wallet addresses regardless of type,
and mnemonic/xprv imports also compare xpubs against existing HD/xprv
wallets.

Closes #111

src/popup/index.html

@@ -586,6 +586,19 @@
                     <div id="confirm-fee-amount" class="text-xs"></div>
                 </div>
                 <div id="confirm-warnings" class="mb-2 hidden"></div>
+                <div
+                    id="confirm-recipient-warning"
+                    class="mb-2"
+                    style="visibility: hidden"
+                >
+                    <div
+                        class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
+                    >
+                        WARNING: The recipient address has ZERO transaction
+                        history. This may indicate a fresh or unused address.
+                        Double-check the address before sending.
+                    </div>
+                </div>
                 <div
                     id="confirm-errors"
                     class="mb-2 border border-border border-dashed p-2 hidden"

src/popup/views/addWallet.js

@@ -97,18 +97,26 @@ async function importMnemonic(ctx) {
     const pw = validatePassword();
     if (!pw) return;
     const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
-    const duplicate = state.wallets.find(
+    const addrDup = state.wallets.find((w) =>
-        (w) =>
+        w.addresses.some(
-            w.type === "hd" &&
+            (a) => a.address.toLowerCase() === firstAddress.toLowerCase(),
-            w.addresses[0] &&
+        ),
-            w.addresses[0].address.toLowerCase() === firstAddress.toLowerCase(),
     );
-    if (duplicate) {
+    if (addrDup) {
         showFlash(
-            "This recovery phrase is already added (" + duplicate.name + ").",
+            "An address from this phrase already exists in " +
+                addrDup.name +
+                ".",
         );
         return;
     }
+    const xpubDup = state.wallets.find(
+        (w) => (w.type === "hd" || w.type === "xprv") && w.xpub === xpub,
+    );
+    if (xpubDup) {
+        showFlash("This recovery phrase matches " + xpubDup.name + ".");
+        return;
+    }
     const encrypted = await encryptWithPassword(mnemonic, pw);
     const walletNum = state.wallets.length + 1;
     const wallet = {
@@ -162,16 +170,11 @@ async function importPrivateKey(ctx) {
     }
     const pw = validatePassword();
     if (!pw) return;
-    const duplicate = state.wallets.find(
+    const duplicate = state.wallets.find((w) =>
-        (w) =>
+        w.addresses.some((a) => a.address.toLowerCase() === addr.toLowerCase()),
-            w.type === "key" &&
-            w.addresses[0] &&
-            w.addresses[0].address.toLowerCase() === addr.toLowerCase(),
     );
     if (duplicate) {
-        showFlash(
+        showFlash("This address already exists in " + duplicate.name + ".");
-            "This private key is already added (" + duplicate.name + ").",
-        );
         return;
     }
     const encrypted = await encryptWithPassword(key, pw);
@@ -208,14 +211,22 @@ async function importXprvKey(ctx) {
         return;
     }
     const { xpub, firstAddress } = result;
-    const duplicate = state.wallets.find(
+    const addrDup = state.wallets.find((w) =>
-        (w) =>
+        w.addresses.some(
-            (w.type === "hd" || w.type === "xprv") &&
+            (a) => a.address.toLowerCase() === firstAddress.toLowerCase(),
-            w.addresses[0] &&
+        ),
-            w.addresses[0].address.toLowerCase() === firstAddress.toLowerCase(),
     );
-    if (duplicate) {
+    if (addrDup) {
-        showFlash("This key is already added (" + duplicate.name + ").");
+        showFlash(
+            "An address from this key already exists in " + addrDup.name + ".",
+        );
+        return;
+    }
+    const xpubDup = state.wallets.find(
+        (w) => (w.type === "hd" || w.type === "xprv") && w.xpub === xpub,
+    );
+    if (xpubDup) {
+        showFlash("This key matches " + xpubDup.name + ".");
         return;
     }
     const pw = validatePassword();

src/popup/views/confirmTx.js

@@ -243,7 +243,11 @@ function show(txInfo) {
     state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
 
+    // Reset recipient warning to hidden (space always reserved, no layout shift)
+    $("confirm-recipient-warning").style.visibility = "hidden";
+
     estimateGas(txInfo);
+    checkRecipientHistory(txInfo);
 }
 
 async function estimateGas(txInfo) {
@@ -286,6 +290,26 @@ async function estimateGas(txInfo) {
     }
 }
 
+async function checkRecipientHistory(txInfo) {
+    const el = $("confirm-recipient-warning");
+    try {
+        const provider = getProvider(state.rpcUrl);
+        // Skip warning for contract addresses — they may legitimately
+        // have zero outgoing transactions (getTransactionCount returns
+        // the nonce, i.e. sent-tx count only).
+        const code = await provider.getCode(txInfo.to);
+        if (code && code !== "0x") {
+            return;
+        }
+        const txCount = await provider.getTransactionCount(txInfo.to);
+        if (txCount === 0) {
+            el.style.visibility = "visible";
+        }
+    } catch (e) {
+        log.errorf("recipient history check failed:", e.message);
+    }
+}
+
 function init(ctx) {
     $("btn-confirm-send").addEventListener("click", async () => {
         const password = $("confirm-tx-password").value;