feat: show red warning on confirm-tx for addresses with zero transaction history

When sending to an address that has never sent or received funds (zero
nonce and zero balance), display a prominent red warning on the
transaction confirmation screen advising the user to double-check the
address.

Closes #82

src/popup/index.html

@@ -56,104 +56,37 @@
                     < Back
                 </button>
                 <h2 class="font-bold mb-2">Add Wallet</h2>
-
-                <!-- Mode selector tabs -->
+                <p class="mb-2">
+                    Enter your 12 or 24 word recovery phrase below, or click the
+                    button to roll the die for a new one.
+                </p>
+                <div class="mb-1 flex justify-end">
+                    <button
+                        id="btn-generate-phrase"
+                        class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"
+                        title="Generate a random recovery phrase"
+                    >
+                        [&#9856;]
+                    </button>
+                </div>
+                <div class="mb-2">
+                    <textarea
+                        id="wallet-mnemonic"
+                        rows="3"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg resize-y"
+                        placeholder="word word word ..."
+                    ></textarea>
+                </div>
                 <div
-                    class="flex border-b border-border mb-3"
-                    id="add-wallet-tabs"
+                    id="add-wallet-phrase-warning"
+                    class="text-xs mb-2 border border-border border-dashed p-2 hidden"
                 >
-                    <button
-                        id="tab-mnemonic"
-                        class="px-3 py-1.5 cursor-pointer text-xs font-bold border border-border border-b-bg bg-bg -mb-px"
-                    >
-                        From Phrase
-                    </button>
-                    <button
-                        id="tab-privkey"
-                        class="px-3 py-1.5 cursor-pointer text-xs text-muted border border-dashed border-border-light border-b-transparent -mb-px hover:bg-fg hover:text-bg"
-                    >
-                        From Key
-                    </button>
-                    <button
-                        id="tab-xprv"
-                        class="px-3 py-1.5 cursor-pointer text-xs text-muted border border-dashed border-border-light border-b-transparent -mb-px hover:bg-fg hover:text-bg"
-                    >
-                        From xprv
-                    </button>
+                    Write these words down and keep them safe. Anyone with them
+                    can take your funds; if you lose them, your wallet is gone.
                 </div>
-
-                <!-- Mnemonic form section -->
-                <div id="add-wallet-section-mnemonic">
-                    <p class="mb-2">
-                        Enter your 12 or 24 word recovery phrase below, or click
-                        the button to roll the die for a new one.
-                    </p>
-                    <div class="mb-1 flex justify-end">
-                        <button
-                            id="btn-generate-phrase"
-                            class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"
-                            title="Generate a random recovery phrase"
-                        >
-                            [&#9856;]
-                        </button>
-                    </div>
-                    <div class="mb-2">
-                        <textarea
-                            id="wallet-mnemonic"
-                            rows="3"
-                            class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg resize-y"
-                            placeholder="word word word ..."
-                        ></textarea>
-                    </div>
-                    <div
-                        id="add-wallet-phrase-warning"
-                        class="text-xs mb-2 border border-border border-dashed p-2 hidden"
-                    >
-                        Write these words down and keep them safe. Anyone with
-                        them can take your funds; if you lose them, your wallet
-                        is gone.
-                    </div>
-                </div>
-
-                <!-- Private key form section -->
-                <div id="add-wallet-section-privkey" class="hidden">
-                    <p class="mb-2">
-                        Paste your private key below. This wallet will have a
-                        single address.
-                    </p>
-                    <div class="mb-2">
-                        <input
-                            type="password"
-                            id="import-private-key"
-                            class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
-                            placeholder="0x..."
-                        />
-                    </div>
-                </div>
-
-                <!-- Extended key (xprv) form section -->
-                <div id="add-wallet-section-xprv" class="hidden">
-                    <p class="mb-2">
-                        Paste your extended private key (xprv) below. This will
-                        import the HD wallet and scan for used addresses.
-                    </p>
-                    <div class="mb-2">
-                        <input
-                            type="password"
-                            id="import-xprv-key"
-                            class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
-                            placeholder="xprv..."
-                        />
-                    </div>
-                </div>
-
-                <!-- Shared password fields -->
                 <div class="mb-2" id="add-wallet-password-section">
                     <label class="block mb-1">Choose a password</label>
-                    <p
-                        class="text-xs text-muted mb-1"
-                        id="add-wallet-password-hint"
-                    >
+                    <p class="text-xs text-muted mb-1">
                         This password encrypts your recovery phrase on this
                         device. You will need it to send funds.
                     </p>
@@ -174,6 +107,64 @@
                 <button
                     id="btn-add-wallet-confirm"
                     class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                >
+                    Add
+                </button>
+                <div class="mt-3 text-xs text-muted">
+                    Have a private key instead?
+                    <button
+                        id="btn-add-wallet-import-key"
+                        class="underline cursor-pointer bg-transparent border-none text-fg text-xs font-mono p-0"
+                    >
+                        Import private key
+                    </button>
+                </div>
+            </div>
+
+            <!-- ============ IMPORT PRIVATE KEY ============ -->
+            <div id="view-import-key" class="view hidden">
+                <button
+                    id="btn-import-key-back"
+                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
+                >
+                    &lt; Back
+                </button>
+                <h2 class="font-bold mb-2">Import Private Key</h2>
+                <p class="mb-2">
+                    Paste your private key below. This wallet will have a single
+                    address.
+                </p>
+                <div class="mb-2">
+                    <input
+                        type="password"
+                        id="import-private-key"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                        placeholder="0x..."
+                    />
+                </div>
+                <div class="mb-2" id="import-key-password-section">
+                    <label class="block mb-1">Choose a password</label>
+                    <p class="text-xs text-muted mb-1">
+                        This password encrypts your private key on this device.
+                        You will need it to send funds.
+                    </p>
+                    <input
+                        type="password"
+                        id="import-key-password"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                    />
+                </div>
+                <div class="mb-2" id="import-key-password-confirm-section">
+                    <label class="block mb-1">Confirm password</label>
+                    <input
+                        type="password"
+                        id="import-key-password-confirm"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                    />
+                </div>
+                <button
+                    id="btn-import-key-confirm"
+                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
                 >
                     Import
                 </button>
@@ -586,19 +577,6 @@
                     <div id="confirm-fee-amount" class="text-xs"></div>
                 </div>
                 <div id="confirm-warnings" class="mb-2 hidden"></div>
-                <div
-                    id="confirm-recipient-warning"
-                    class="mb-2"
-                    style="visibility: hidden"
-                >
-                    <div
-                        class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
-                    >
-                        WARNING: The recipient address has ZERO transaction
-                        history. This may indicate a fresh or unused address.
-                        Double-check the address before sending.
-                    </div>
-                </div>
                 <div
                     id="confirm-errors"
                     class="mb-2 border border-border border-dashed p-2 hidden"

src/popup/index.js

@@ -10,6 +10,7 @@ const { $, showView } = require("./views/helpers");
 const home = require("./views/home");
 const welcome = require("./views/welcome");
 const addWallet = require("./views/addWallet");
+const importKey = require("./views/importKey");
 const addressDetail = require("./views/addressDetail");
 const addressToken = require("./views/addressToken");
 const send = require("./views/send");
@@ -53,6 +54,7 @@ const ctx = {
     renderWalletList,
     doRefreshAndRender,
     showAddWalletView: () => addWallet.show(),
+    showImportKeyView: () => importKey.show(),
     showAddressDetail: () => addressDetail.show(),
     showAddressToken: () => addressToken.show(),
     showAddTokenView: () => addToken.show(),
@@ -215,6 +217,7 @@ async function init() {
 
     welcome.init(ctx);
     addWallet.init(ctx);
+    importKey.init(ctx);
     home.init(ctx);
     addressDetail.init(ctx);
     addressToken.init(ctx);

src/popup/views/addWallet.js

@@ -3,285 +3,114 @@ const {
     generateMnemonic,
     hdWalletFromMnemonic,
     isValidMnemonic,
-    addressFromPrivateKey,
-    hdWalletFromXprv,
-    isValidXprv,
 } = require("../../shared/wallet");
 const { encryptWithPassword } = require("../../shared/vault");
 const { state, saveState } = require("../../shared/state");
 const { scanForAddresses } = require("../../shared/balances");
 
-let currentMode = "mnemonic";
-
-const MODES = ["mnemonic", "privkey", "xprv"];
-
-const PASSWORD_HINTS = {
-    mnemonic:
-        "This password encrypts your recovery phrase on this device. You will need it to send funds.",
-    privkey:
-        "This password encrypts your private key on this device. You will need it to send funds.",
-    xprv: "This password encrypts your key on this device. You will need it to send funds.",
-};
-
-function switchMode(mode) {
-    currentMode = mode;
-    for (const m of MODES) {
-        $("add-wallet-section-" + m).classList.toggle("hidden", m !== mode);
-        const tab = $("tab-" + m);
-        const isActive = m === mode;
-        // Active: bold, solid border on top/sides, no bottom border (connects to content)
-        tab.classList.toggle("font-bold", isActive);
-        tab.classList.toggle("border-solid", isActive);
-        tab.classList.toggle("border-border", isActive);
-        tab.classList.toggle("border-b-bg", isActive);
-        tab.classList.toggle("bg-bg", isActive);
-        // Inactive: muted text, dashed border on top/sides, transparent bottom, hover invert
-        tab.classList.toggle("text-muted", !isActive);
-        tab.classList.toggle("border-dashed", !isActive);
-        tab.classList.toggle("border-border-light", !isActive);
-        tab.classList.toggle("border-b-transparent", !isActive);
-        tab.classList.toggle("hover:bg-fg", !isActive);
-        tab.classList.toggle("hover:text-bg", !isActive);
-    }
-    $("add-wallet-password-hint").textContent = PASSWORD_HINTS[mode];
-}
-
 function show() {
     $("wallet-mnemonic").value = "";
-    $("import-private-key").value = "";
-    $("import-xprv-key").value = "";
     $("add-wallet-password").value = "";
     $("add-wallet-password-confirm").value = "";
     $("add-wallet-phrase-warning").classList.add("hidden");
-    switchMode("mnemonic");
     showView("add-wallet");
 }
 
-function validatePassword() {
-    const pw = $("add-wallet-password").value;
-    const pw2 = $("add-wallet-password-confirm").value;
-    if (!pw) {
-        showFlash("Please choose a password.");
-        return null;
-    }
-    if (pw.length < 12) {
-        showFlash("Password must be at least 12 characters.");
-        return null;
-    }
-    if (pw !== pw2) {
-        showFlash("Passwords do not match.");
-        return null;
-    }
-    return pw;
-}
-
-async function importMnemonic(ctx) {
-    const mnemonic = $("wallet-mnemonic").value.trim();
-    if (!mnemonic) {
-        showFlash("Enter a recovery phrase or press the die to generate one.");
-        return;
-    }
-    const words = mnemonic.split(/\s+/);
-    if (words.length !== 12 && words.length !== 24) {
-        showFlash(
-            "Recovery phrase must be 12 or 24 words. You entered " +
-                words.length +
-                ".",
-        );
-        return;
-    }
-    if (!isValidMnemonic(mnemonic)) {
-        showFlash("Invalid recovery phrase. Check for typos.");
-        return;
-    }
-    const pw = validatePassword();
-    if (!pw) return;
-    const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
-    const duplicate = state.wallets.find(
-        (w) =>
-            w.type === "hd" &&
-            w.addresses[0] &&
-            w.addresses[0].address.toLowerCase() === firstAddress.toLowerCase(),
-    );
-    if (duplicate) {
-        showFlash(
-            "This recovery phrase is already added (" + duplicate.name + ").",
-        );
-        return;
-    }
-    const encrypted = await encryptWithPassword(mnemonic, pw);
-    const walletNum = state.wallets.length + 1;
-    const wallet = {
-        type: "hd",
-        name: "Wallet " + walletNum,
-        xpub: xpub,
-        encryptedSecret: encrypted,
-        nextIndex: 1,
-        addresses: [
-            { address: firstAddress, balance: "0.0000", tokenBalances: [] },
-        ],
-    };
-    state.wallets.push(wallet);
-    state.hasWallet = true;
-    await saveState();
-    ctx.renderWalletList();
-    showView("main");
-
-    // Scan for used HD addresses beyond index 0.
-    showFlash("Scanning for addresses...", 30000);
-    const scan = await scanForAddresses(xpub, state.rpcUrl);
-    if (scan.addresses.length > 1) {
-        wallet.addresses = scan.addresses.map((a) => ({
-            address: a.address,
-            balance: "0.0000",
-            tokenBalances: [],
-        }));
-        wallet.nextIndex = scan.nextIndex;
-        await saveState();
-        ctx.renderWalletList();
-        showFlash("Found " + scan.addresses.length + " addresses.");
-    } else {
-        showFlash("Ready.", 1000);
-    }
-
-    ctx.doRefreshAndRender();
-}
-
-async function importPrivateKey(ctx) {
-    const key = $("import-private-key").value.trim();
-    if (!key) {
-        showFlash("Please enter your private key.");
-        return;
-    }
-    let addr;
-    try {
-        addr = addressFromPrivateKey(key);
-    } catch (e) {
-        showFlash("Invalid private key.");
-        return;
-    }
-    const pw = validatePassword();
-    if (!pw) return;
-    const duplicate = state.wallets.find(
-        (w) =>
-            w.type === "key" &&
-            w.addresses[0] &&
-            w.addresses[0].address.toLowerCase() === addr.toLowerCase(),
-    );
-    if (duplicate) {
-        showFlash(
-            "This private key is already added (" + duplicate.name + ").",
-        );
-        return;
-    }
-    const encrypted = await encryptWithPassword(key, pw);
-    const walletNum = state.wallets.length + 1;
-    state.wallets.push({
-        type: "key",
-        name: "Wallet " + walletNum,
-        encryptedSecret: encrypted,
-        addresses: [{ address: addr, balance: "0.0000", tokenBalances: [] }],
-    });
-    state.hasWallet = true;
-    await saveState();
-    ctx.renderWalletList();
-    showView("main");
-
-    ctx.doRefreshAndRender();
-}
-
-async function importXprvKey(ctx) {
-    const xprv = $("import-xprv-key").value.trim();
-    if (!xprv) {
-        showFlash("Please enter your extended private key.");
-        return;
-    }
-    if (!isValidXprv(xprv)) {
-        showFlash("Invalid extended private key.");
-        return;
-    }
-    let result;
-    try {
-        result = hdWalletFromXprv(xprv);
-    } catch (e) {
-        showFlash("Invalid extended private key.");
-        return;
-    }
-    const { xpub, firstAddress } = result;
-    const duplicate = state.wallets.find(
-        (w) =>
-            (w.type === "hd" || w.type === "xprv") &&
-            w.addresses[0] &&
-            w.addresses[0].address.toLowerCase() === firstAddress.toLowerCase(),
-    );
-    if (duplicate) {
-        showFlash("This key is already added (" + duplicate.name + ").");
-        return;
-    }
-    const pw = validatePassword();
-    if (!pw) return;
-    const encrypted = await encryptWithPassword(xprv, pw);
-    const walletNum = state.wallets.length + 1;
-    const wallet = {
-        type: "xprv",
-        name: "Wallet " + walletNum,
-        xpub: xpub,
-        encryptedSecret: encrypted,
-        nextIndex: 1,
-        addresses: [
-            { address: firstAddress, balance: "0.0000", tokenBalances: [] },
-        ],
-    };
-    state.wallets.push(wallet);
-    state.hasWallet = true;
-    await saveState();
-    ctx.renderWalletList();
-    showView("main");
-
-    // Scan for used HD addresses beyond index 0.
-    showFlash("Scanning for addresses...", 30000);
-    const scan = await scanForAddresses(xpub, state.rpcUrl);
-    if (scan.addresses.length > 1) {
-        wallet.addresses = scan.addresses.map((a) => ({
-            address: a.address,
-            balance: "0.0000",
-            tokenBalances: [],
-        }));
-        wallet.nextIndex = scan.nextIndex;
-        await saveState();
-        ctx.renderWalletList();
-        showFlash("Found " + scan.addresses.length + " addresses.");
-    } else {
-        showFlash("Ready.", 1000);
-    }
-
-    ctx.doRefreshAndRender();
-}
-
 function init(ctx) {
-    // Tab click handlers
-    $("tab-mnemonic").addEventListener("click", () => switchMode("mnemonic"));
-    $("tab-privkey").addEventListener("click", () => switchMode("privkey"));
-    $("tab-xprv").addEventListener("click", () => switchMode("xprv"));
-
-    // Generate mnemonic
     $("btn-generate-phrase").addEventListener("click", () => {
         $("wallet-mnemonic").value = generateMnemonic();
         $("add-wallet-phrase-warning").classList.remove("hidden");
     });
 
-    // Import / confirm
     $("btn-add-wallet-confirm").addEventListener("click", async () => {
-        if (currentMode === "mnemonic") {
-            await importMnemonic(ctx);
-        } else if (currentMode === "privkey") {
-            await importPrivateKey(ctx);
-        } else if (currentMode === "xprv") {
-            await importXprvKey(ctx);
+        const mnemonic = $("wallet-mnemonic").value.trim();
+        if (!mnemonic) {
+            showFlash(
+                "Enter a recovery phrase or press the die to generate one.",
+            );
+            return;
         }
+        const words = mnemonic.split(/\s+/);
+        if (words.length !== 12 && words.length !== 24) {
+            showFlash(
+                "Recovery phrase must be 12 or 24 words. You entered " +
+                    words.length +
+                    ".",
+            );
+            return;
+        }
+        if (!isValidMnemonic(mnemonic)) {
+            showFlash("Invalid recovery phrase. Check for typos.");
+            return;
+        }
+        const pw = $("add-wallet-password").value;
+        const pw2 = $("add-wallet-password-confirm").value;
+        if (!pw) {
+            showFlash("Please choose a password.");
+            return;
+        }
+        if (pw.length < 12) {
+            showFlash("Password must be at least 12 characters.");
+            return;
+        }
+        if (pw !== pw2) {
+            showFlash("Passwords do not match.");
+            return;
+        }
+        const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
+        const duplicate = state.wallets.find(
+            (w) =>
+                w.type === "hd" &&
+                w.addresses[0] &&
+                w.addresses[0].address.toLowerCase() ===
+                    firstAddress.toLowerCase(),
+        );
+        if (duplicate) {
+            showFlash(
+                "This recovery phrase is already added (" +
+                    duplicate.name +
+                    ").",
+            );
+            return;
+        }
+        const encrypted = await encryptWithPassword(mnemonic, pw);
+        const walletNum = state.wallets.length + 1;
+        const wallet = {
+            type: "hd",
+            name: "Wallet " + walletNum,
+            xpub: xpub,
+            encryptedSecret: encrypted,
+            nextIndex: 1,
+            addresses: [
+                { address: firstAddress, balance: "0.0000", tokenBalances: [] },
+            ],
+        };
+        state.wallets.push(wallet);
+        state.hasWallet = true;
+        await saveState();
+        ctx.renderWalletList();
+        showView("main");
+
+        // Scan for used HD addresses beyond index 0.
+        showFlash("Scanning for addresses...", 30000);
+        const scan = await scanForAddresses(xpub, state.rpcUrl);
+        if (scan.addresses.length > 1) {
+            wallet.addresses = scan.addresses.map((a) => ({
+                address: a.address,
+                balance: "0.0000",
+                tokenBalances: [],
+            }));
+            wallet.nextIndex = scan.nextIndex;
+            await saveState();
+            ctx.renderWalletList();
+            showFlash("Found " + scan.addresses.length + " addresses.");
+        } else {
+            showFlash("Ready.", 1000);
+        }
+
+        ctx.doRefreshAndRender();
     });
 
-    // Back button
     $("btn-add-wallet-back").addEventListener("click", () => {
         if (!state.hasWallet) {
             showView("welcome");
@@ -290,6 +119,11 @@ function init(ctx) {
             showView("main");
         }
     });
+
+    $("btn-add-wallet-import-key").addEventListener(
+        "click",
+        ctx.showImportKeyView,
+    );
 }
 
 module.exports = { init, show };

src/popup/views/confirmTx.js

@@ -24,7 +24,7 @@ const { getSignerForAddress } = require("../../shared/wallet");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { getProvider } = require("../../shared/balances");
-const { isScamAddress, isNullOrBurnAddress } = require("../../shared/scamlist");
+const { isScamAddress } = require("../../shared/scamlist");
 const { ERC20_ABI } = require("../../shared/constants");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
@@ -38,28 +38,6 @@ const EXT_ICON =
     `</svg></span>`;
 
 let pendingTx = null;
-// Track active warnings so async checks can append without overwriting.
-let activeWarnings = [];
-
-function renderWarnings(el, warnings) {
-    activeWarnings = warnings.slice();
-    if (warnings.length > 0) {
-        el.innerHTML = warnings
-            .map(
-                (w) =>
-                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w}</div>`,
-            )
-            .join("");
-        el.classList.remove("hidden");
-    } else {
-        el.classList.add("hidden");
-    }
-}
-
-function appendWarning(el, message) {
-    activeWarnings.push(message);
-    renderWarnings(el, activeWarnings);
-}
 
 function restore() {
     const d = state.viewData;
@@ -108,6 +86,42 @@ function valueWithUsd(text, usdAmount) {
     return text;
 }
 
+function renderWarnings(warnings) {
+    const warningsEl = $("confirm-warnings");
+    if (warnings.length > 0) {
+        warningsEl.innerHTML = warnings
+            .map(
+                (w) =>
+                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold" style="color:#c00">WARNING: ${w}</div>`,
+            )
+            .join("");
+        warningsEl.classList.remove("hidden");
+    } else {
+        warningsEl.classList.add("hidden");
+    }
+}
+
+async function checkAddressHistory(address, existingWarnings) {
+    try {
+        const provider = getProvider(state.rpcUrl);
+        const [balance, txCount] = await Promise.all([
+            provider.getBalance(address),
+            provider.getTransactionCount(address),
+        ]);
+        if (balance === 0n && txCount === 0) {
+            const warnings = existingWarnings.slice();
+            warnings.push(
+                "This address has ZERO transaction history. " +
+                    "It has never sent or received funds. " +
+                    "Double-check that the address is correct before sending.",
+            );
+            renderWarnings(warnings);
+        }
+    } catch (e) {
+        log.errorf("address history check failed:", e.message);
+    }
+}
+
 function show(txInfo) {
     pendingTx = txInfo;
 
@@ -187,24 +201,21 @@ function show(txInfo) {
         $("confirm-balance").textContent = valueWithUsd(bal + " ETH", balUsd);
     }
 
-    // Check for warnings (synchronous checks first, async checks added later)
+    // Check for warnings
     const warnings = [];
     if (isScamAddress(txInfo.to)) {
         warnings.push(
             "This address is on a known scam/fraud list. Do not send funds to this address.",
         );
     }
-    if (isNullOrBurnAddress(txInfo.to)) {
-        warnings.push(
-            "This is a null or burn address. Funds sent here will be permanently lost.",
-        );
-    }
     if (txInfo.to.toLowerCase() === txInfo.from.toLowerCase()) {
         warnings.push("You are sending to your own address.");
     }
 
-    const warningsEl = $("confirm-warnings");
-    renderWarnings(warningsEl, warnings);
+    renderWarnings(warnings);
+
+    // Async check: warn if destination address has zero transaction history
+    checkAddressHistory(txInfo.to, warnings);
 
     // Check for errors
     const errors = [];
@@ -260,14 +271,7 @@ function show(txInfo) {
     state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
 
-    // Hide the legacy recipient warning element (warnings now unified)
-    const legacyWarningEl = $("confirm-recipient-warning");
-    if (legacyWarningEl) {
-        legacyWarningEl.style.display = "none";
-    }
-
     estimateGas(txInfo);
-    checkRecipientHistory(txInfo);
 }
 
 async function estimateGas(txInfo) {
@@ -310,31 +314,6 @@ async function estimateGas(txInfo) {
     }
 }
 
-async function checkRecipientHistory(txInfo) {
-    const warningsEl = $("confirm-warnings");
-    try {
-        const provider = getProvider(state.rpcUrl);
-        const code = await provider.getCode(txInfo.to);
-        if (code && code !== "0x") {
-            // Recipient is a contract address — warn the user
-            appendWarning(
-                warningsEl,
-                "The recipient is a contract address. Sending tokens directly to a contract may result in permanent loss of funds.",
-            );
-            return;
-        }
-        const txCount = await provider.getTransactionCount(txInfo.to);
-        if (txCount === 0) {
-            appendWarning(
-                warningsEl,
-                "The recipient address has ZERO transaction history. This may indicate a fresh or unused address. Double-check the address before sending.",
-            );
-        }
-    } catch (e) {
-        log.errorf("recipient history check failed:", e.message);
-    }
-}
-
 function init(ctx) {
     $("btn-confirm-send").addEventListener("click", async () => {
         const password = $("confirm-tx-password").value;

src/popup/views/helpers.js

@@ -13,6 +13,7 @@ const { state, saveState } = require("../../shared/state");
 const VIEWS = [
     "welcome",
     "add-wallet",
+    "import-key",
     "main",
     "address",
     "address-token",

src/popup/views/home.js

@@ -239,7 +239,7 @@ function render(ctx) {
         html += `<div>`;
         html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
         html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
-        if (wallet.type === "hd" || wallet.type === "xprv") {
+        if (wallet.type === "hd") {
             html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
         }
         html += `</div>`;

src/popup/views/importKey.js

@@ -0,0 +1,69 @@
+const { $, showView, showFlash } = require("./helpers");
+const { addressFromPrivateKey } = require("../../shared/wallet");
+const { encryptWithPassword } = require("../../shared/vault");
+const { state, saveState } = require("../../shared/state");
+
+function show() {
+    $("import-private-key").value = "";
+    $("import-key-password").value = "";
+    $("import-key-password-confirm").value = "";
+    showView("import-key");
+}
+
+function init(ctx) {
+    $("btn-import-key-confirm").addEventListener("click", async () => {
+        const key = $("import-private-key").value.trim();
+        if (!key) {
+            showFlash("Please enter your private key.");
+            return;
+        }
+        let addr;
+        try {
+            addr = addressFromPrivateKey(key);
+        } catch (e) {
+            showFlash("Invalid private key.");
+            return;
+        }
+        const pw = $("import-key-password").value;
+        const pw2 = $("import-key-password-confirm").value;
+        if (!pw) {
+            showFlash("Please choose a password.");
+            return;
+        }
+        if (pw.length < 12) {
+            showFlash("Password must be at least 12 characters.");
+            return;
+        }
+        if (pw !== pw2) {
+            showFlash("Passwords do not match.");
+            return;
+        }
+        const encrypted = await encryptWithPassword(key, pw);
+        const walletNum = state.wallets.length + 1;
+        state.wallets.push({
+            type: "key",
+            name: "Wallet " + walletNum,
+            encryptedSecret: encrypted,
+            addresses: [
+                { address: addr, balance: "0.0000", tokenBalances: [] },
+            ],
+        });
+        state.hasWallet = true;
+        await saveState();
+        ctx.renderWalletList();
+        showView("main");
+
+        ctx.doRefreshAndRender();
+    });
+
+    $("btn-import-key-back").addEventListener("click", () => {
+        if (!state.hasWallet) {
+            showView("welcome");
+        } else {
+            ctx.renderWalletList();
+            showView("main");
+        }
+    });
+}
+
+module.exports = { init, show };

src/popup/views/transactionDetail.js

@@ -158,9 +158,8 @@ function render() {
         loadCalldata(tx.hash, tx.to);
     }
 
-    const isoStr = isoDate(tx.timestamp);
-    $("tx-detail-time").innerHTML =
-        copyableHtml(isoStr) + " (" + escapeHtml(timeAgo(tx.timestamp)) + ")";
+    $("tx-detail-time").textContent =
+        isoDate(tx.timestamp) + " (" + timeAgo(tx.timestamp) + ")";
     $("tx-detail-status").textContent = tx.isError ? "Failed" : "Success";
     showView("transaction");
 

src/popup/views/txStatus.js

@@ -59,16 +59,6 @@ function txHashHtml(hash) {
     );
 }
 
-function blockNumberHtml(blockNumber) {
-    const num = String(blockNumber);
-    const link = `https://etherscan.io/block/${num}`;
-    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    return (
-        `<span class="underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(num)}">${escapeHtml(num)}</span>` +
-        extLink
-    );
-}
-
 function attachCopyHandlers(viewId) {
     document
         .getElementById(viewId)
@@ -199,7 +189,7 @@ function renderSuccess() {
         $("success-tx-to").innerHTML = toAddressHtml(d.to);
     }
 
-    $("success-tx-block").innerHTML = blockNumberHtml(d.blockNumber);
+    $("success-tx-block").textContent = String(d.blockNumber);
     $("success-tx-hash").innerHTML = txHashHtml(d.hash);
 
     // Show decoded calldata details if present

src/shared/wallet.js

@@ -24,26 +24,6 @@ function hdWalletFromMnemonic(mnemonic) {
     return { xpub, firstAddress };
 }
 
-function hdWalletFromXprv(xprv) {
-    const root = HDNodeWallet.fromExtendedKey(xprv);
-    if (!root.privateKey) {
-        throw new Error("Not an extended private key (xprv).");
-    }
-    const node = root.derivePath("44'/60'/0'/0");
-    const xpub = node.neuter().extendedKey;
-    const firstAddress = node.deriveChild(0).address;
-    return { xpub, firstAddress };
-}
-
-function isValidXprv(key) {
-    try {
-        const node = HDNodeWallet.fromExtendedKey(key);
-        return !!node.privateKey;
-    } catch {
-        return false;
-    }
-}
-
 function addressFromPrivateKey(key) {
     const w = new Wallet(key);
     return w.address;
@@ -58,11 +38,6 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
         );
         return node.deriveChild(addrIndex);
     }
-    if (walletData.type === "xprv") {
-        const root = HDNodeWallet.fromExtendedKey(decryptedSecret);
-        const node = root.derivePath("44'/60'/0'/0");
-        return node.deriveChild(addrIndex);
-    }
     return new Wallet(decryptedSecret);
 }
 
@@ -74,8 +49,6 @@ module.exports = {
     generateMnemonic,
     deriveAddressFromXpub,
     hdWalletFromMnemonic,
-    hdWalletFromXprv,
-    isValidXprv,
     addressFromPrivateKey,
     getSignerForAddress,
     isValidMnemonic,