fix: derive xprv addresses from correct BIP44 path (m/44'/60'/0'/0)

hdWalletFromXprv() and getSignerForAddress() for xprv type were deriving
addresses directly from the root key (m/N) instead of the standard BIP44
Ethereum path (m/44'/60'/0'/0/N). This caused imported xprv wallets to
generate completely wrong addresses.

Navigate to the BIP44 Ethereum derivation path before deriving child
addresses, matching the behavior of mnemonic-based wallet imports.

src/popup/index.html

@@ -119,6 +119,15 @@
                         Import private key
                     </button>
                 </div>
+                <div class="mt-1 text-xs text-muted">
+                    Have an extended private key (xprv)?
+                    <button
+                        id="btn-add-wallet-import-xprv"
+                        class="underline cursor-pointer bg-transparent border-none text-fg text-xs font-mono p-0"
+                    >
+                        Import xprv
+                    </button>
+                </div>
             </div>
 
             <!-- ============ IMPORT PRIVATE KEY ============ -->
@@ -170,6 +179,55 @@
                 </button>
             </div>
 
+            <!-- ============ IMPORT XPRV ============ -->
+            <div id="view-import-xprv" class="view hidden">
+                <button
+                    id="btn-import-xprv-back"
+                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
+                >
+                    &lt; Back
+                </button>
+                <h2 class="font-bold mb-2">Import Extended Private Key</h2>
+                <p class="mb-2">
+                    Paste your extended private key (xprv) below. This will
+                    import the HD wallet and scan for used addresses.
+                </p>
+                <div class="mb-2">
+                    <input
+                        type="password"
+                        id="import-xprv-key"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                        placeholder="xprv..."
+                    />
+                </div>
+                <div class="mb-2" id="import-xprv-password-section">
+                    <label class="block mb-1">Choose a password</label>
+                    <p class="text-xs text-muted mb-1">
+                        This password encrypts your key on this device. You will
+                        need it to send funds.
+                    </p>
+                    <input
+                        type="password"
+                        id="import-xprv-password"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                    />
+                </div>
+                <div class="mb-2" id="import-xprv-password-confirm-section">
+                    <label class="block mb-1">Confirm password</label>
+                    <input
+                        type="password"
+                        id="import-xprv-password-confirm"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                    />
+                </div>
+                <button
+                    id="btn-import-xprv-confirm"
+                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                >
+                    Import
+                </button>
+            </div>
+
             <!-- ============ MAIN VIEW: ALL WALLETS & ADDRESSES ============ -->
             <div id="view-main" class="view hidden">
                 <!-- active address headline -->
@@ -463,12 +521,12 @@
                 </div>
 
                 <!-- ERC-20 token contract (hidden for ETH) -->
-                <div
+                <div id="confirm-token-section" class="mb-3 hidden">
-                    id="confirm-token-section"
+                    <div class="text-xs text-muted mb-1">Token contract</div>
-                    class="bg-hover rounded-md mx-1 p-3 mb-3 text-xs hidden"
+                    <div
-                >
+                        id="confirm-token-contract"
-                    <div class="font-bold mb-2">Token Contract</div>
+                        class="text-xs break-all"
-                    <div id="confirm-token-contract" class="break-all"></div>
+                    ></div>
                 </div>
 
                 <div class="mb-3">
@@ -531,7 +589,6 @@
             <!-- ============ TX SUCCESS ============ -->
             <div id="view-success-tx" class="view hidden">
                 <h2 class="font-bold mb-2">Transaction Confirmed</h2>
-                <div id="success-tx-decoded" class="mb-3 hidden text-xs"></div>
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">Amount</div>
                     <div id="success-tx-summary" class="font-bold"></div>
@@ -637,10 +694,9 @@
                 <div class="flex justify-center mb-3">
                     <canvas id="receive-qr"></canvas>
                 </div>
-                <div
+                <div class="border border-border p-2 break-all mb-3 text-xs">
-                    class="border border-border p-2 break-all mb-3 text-xs cursor-pointer"
+                    <span id="receive-dot"></span>
-                >
+                    <span id="receive-address" class="select-all"></span>
-                    <span id="receive-address-block" class="select-all"></span>
                     <span id="receive-etherscan-link"></span>
                 </div>
                 <button

src/popup/index.js

@@ -11,6 +11,7 @@ const home = require("./views/home");
 const welcome = require("./views/welcome");
 const addWallet = require("./views/addWallet");
 const importKey = require("./views/importKey");
+const importXprv = require("./views/importXprv");
 const addressDetail = require("./views/addressDetail");
 const addressToken = require("./views/addressToken");
 const send = require("./views/send");
@@ -55,6 +56,7 @@ const ctx = {
     doRefreshAndRender,
     showAddWalletView: () => addWallet.show(),
     showImportKeyView: () => importKey.show(),
+    showImportXprvView: () => importXprv.show(),
     showAddressDetail: () => addressDetail.show(),
     showAddressToken: () => addressToken.show(),
     showAddTokenView: () => addToken.show(),
@@ -210,6 +212,7 @@ async function init() {
     welcome.init(ctx);
     addWallet.init(ctx);
     importKey.init(ctx);
+    importXprv.init(ctx);
     home.init(ctx);
     addressDetail.init(ctx);
     addressToken.init(ctx);

src/popup/views/addWallet.js

@@ -124,6 +124,11 @@ function init(ctx) {
         "click",
         ctx.showImportKeyView,
     );
+
+    $("btn-add-wallet-import-xprv").addEventListener(
+        "click",
+        ctx.showImportXprvView,
+    );
 }
 
 module.exports = { init, show };

src/popup/views/addressToken.js

@@ -12,7 +12,7 @@ const {
     balanceLine,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
-const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
+const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const {
     formatUsd,
     getPrice,
@@ -96,11 +96,14 @@ function show() {
         const tb = (addr.tokenBalances || []).find(
             (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
         );
-        symbol = resolveSymbol(
+        const tracked = (state.trackedTokens || []).find(
-            tokenId,
+            (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
-            addr.tokenBalances,
-            state.trackedTokens,
         );
+        symbol =
+            (tb && tb.symbol) ||
+            (tracked && tracked.symbol) ||
+            (knownToken && knownToken.symbol) ||
+            "?";
         amount = tb ? parseFloat(tb.balance || "0") : 0;
         price = getPrice(symbol);
     }

src/popup/views/approval.js

@@ -184,15 +184,6 @@ function showTxApproval(details) {
         }
     }
 
-    // Carry decoded calldata info through to success/error views
-    if (decoded) {
-        pendingTxDetails.decoded = {
-            name: decoded.name,
-            description: decoded.description,
-            details: decoded.details,
-        };
-    }
-
     $("approve-tx-hostname").textContent = details.hostname;
     $("approve-tx-from").innerHTML = approvalAddressHtml(state.activeAddress);
 

src/popup/views/confirmTx.js

@@ -95,22 +95,10 @@ function show(txInfo) {
     // Token contract section (ERC-20 only)
     const tokenSection = $("confirm-token-section");
     if (isErc20) {
-        const dot = addressDotHtml(txInfo.token);
         const link = etherscanTokenLink(txInfo.token);
         $("confirm-token-contract").innerHTML =
-            `<div class="flex items-center">` +
+            escapeHtml(txInfo.token) +
-            dot +
+            ` <a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-            `<span class="break-all underline decoration-dashed cursor-pointer" id="confirm-token-contract-copy" data-copy="${escapeHtml(txInfo.token)}">${escapeHtml(txInfo.token)}</span>` +
-            `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
-            `</div>`;
-        if (txInfo.tokenName) {
-            $("confirm-token-contract").innerHTML +=
-                `<div class="mt-1"><span class="text-muted">Name:</span> ${escapeHtml(txInfo.tokenName)}</div>`;
-        }
-        if (txInfo.tokenSymbol) {
-            $("confirm-token-contract").innerHTML +=
-                `<div class="mt-1"><span class="text-muted">Symbol:</span> ${escapeHtml(txInfo.tokenSymbol)}</div>`;
-        }
         tokenSection.classList.remove("hidden");
     } else {
         tokenSection.classList.add("hidden");
@@ -285,13 +273,6 @@ function hidePasswordModal() {
 }
 
 function init(ctx) {
-    $("confirm-token-section").addEventListener("click", (e) => {
-        const copyEl = e.target.closest("[data-copy]");
-        if (copyEl) {
-            navigator.clipboard.writeText(copyEl.dataset.copy);
-        }
-    });
-
     $("btn-confirm-send").addEventListener("click", () => {
         showPasswordModal();
     });

src/popup/views/home.js

@@ -235,7 +235,7 @@ function render(ctx) {
         html += `<div>`;
         html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
         html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
-        if (wallet.type === "hd") {
+        if (wallet.type === "hd" || wallet.type === "xprv") {
             html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
         }
         html += `</div>`;

src/popup/views/importXprv.js

@@ -0,0 +1,106 @@
+const { $, showView, showFlash } = require("./helpers");
+const { hdWalletFromXprv, isValidXprv } = require("../../shared/wallet");
+const { encryptWithPassword } = require("../../shared/vault");
+const { state, saveState } = require("../../shared/state");
+const { scanForAddresses } = require("../../shared/balances");
+
+function show() {
+    $("import-xprv-key").value = "";
+    $("import-xprv-password").value = "";
+    $("import-xprv-password-confirm").value = "";
+    showView("import-xprv");
+}
+
+function init(ctx) {
+    $("btn-import-xprv-confirm").addEventListener("click", async () => {
+        const xprv = $("import-xprv-key").value.trim();
+        if (!xprv) {
+            showFlash("Please enter your extended private key.");
+            return;
+        }
+        if (!isValidXprv(xprv)) {
+            showFlash("Invalid extended private key.");
+            return;
+        }
+        let result;
+        try {
+            result = hdWalletFromXprv(xprv);
+        } catch (e) {
+            showFlash("Invalid extended private key.");
+            return;
+        }
+        const { xpub, firstAddress } = result;
+        const duplicate = state.wallets.find(
+            (w) =>
+                (w.type === "hd" || w.type === "xprv") &&
+                w.addresses[0] &&
+                w.addresses[0].address.toLowerCase() ===
+                    firstAddress.toLowerCase(),
+        );
+        if (duplicate) {
+            showFlash("This key is already added (" + duplicate.name + ").");
+            return;
+        }
+        const pw = $("import-xprv-password").value;
+        const pw2 = $("import-xprv-password-confirm").value;
+        if (!pw) {
+            showFlash("Please choose a password.");
+            return;
+        }
+        if (pw.length < 12) {
+            showFlash("Password must be at least 12 characters.");
+            return;
+        }
+        if (pw !== pw2) {
+            showFlash("Passwords do not match.");
+            return;
+        }
+        const encrypted = await encryptWithPassword(xprv, pw);
+        const walletNum = state.wallets.length + 1;
+        const wallet = {
+            type: "xprv",
+            name: "Wallet " + walletNum,
+            xpub: xpub,
+            encryptedSecret: encrypted,
+            nextIndex: 1,
+            addresses: [
+                { address: firstAddress, balance: "0.0000", tokenBalances: [] },
+            ],
+        };
+        state.wallets.push(wallet);
+        state.hasWallet = true;
+        await saveState();
+        ctx.renderWalletList();
+        showView("main");
+
+        // Scan for used HD addresses beyond index 0.
+        showFlash("Scanning for addresses...", 30000);
+        const scan = await scanForAddresses(xpub, state.rpcUrl);
+        if (scan.addresses.length > 1) {
+            wallet.addresses = scan.addresses.map((a) => ({
+                address: a.address,
+                balance: "0.0000",
+                tokenBalances: [],
+            }));
+            wallet.nextIndex = scan.nextIndex;
+            await saveState();
+            ctx.renderWalletList();
+            showFlash("Found " + scan.addresses.length + " addresses.");
+        } else {
+            showFlash("Ready.", 1000);
+        }
+
+        ctx.doRefreshAndRender();
+    });
+
+    $("btn-import-xprv-back").addEventListener("click", () => {
+        if (!state.hasWallet) {
+            showView("welcome");
+        } else {
+            ctx.renderWalletList();
+            showView("main");
+        }
+    });
+}
+
+module.exports = { init, show };

src/popup/views/receive.js

@@ -1,10 +1,4 @@
-const {
+const { $, showView, showFlash, addressDotHtml } = require("./helpers");
-    $,
-    showView,
-    showFlash,
-    formatAddressHtml,
-    addressTitle,
-} = require("./helpers");
 const { state, currentAddress } = require("../../shared/state");
 const QRCode = require("qrcode");
 
@@ -18,12 +12,8 @@ const EXT_ICON =
 function show() {
     const addr = currentAddress();
     const address = addr ? addr.address : "";
-    const title = address ? addressTitle(address, state.wallets) : null;
+    $("receive-dot").innerHTML = address ? addressDotHtml(address) : "";
-    const ensName = addr ? addr.ensName || null : null;
+    $("receive-address").textContent = address;
-    $("receive-address-block").innerHTML = address
-        ? formatAddressHtml(address, ensName, null, title)
-        : "";
-    $("receive-address-block").dataset.full = address;
     const link = address ? `https://etherscan.io/address/${address}` : "";
     $("receive-etherscan-link").innerHTML = link
         ? `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`
@@ -60,16 +50,8 @@ function show() {
 }
 
 function init(ctx) {
-    $("receive-address-block").addEventListener("click", () => {
-        const addr = $("receive-address-block").dataset.full;
-        if (addr) {
-            navigator.clipboard.writeText(addr);
-            showFlash("Copied!");
-        }
-    });
-
     $("btn-receive-copy").addEventListener("click", () => {
-        const addr = $("receive-address-block").dataset.full;
+        const addr = $("receive-address").textContent;
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");

src/popup/views/send.js

@@ -10,11 +10,7 @@ const {
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
-const {
+const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-    KNOWN_SYMBOLS,
-    TOKEN_BY_ADDRESS,
-    resolveSymbol,
-} = require("../../shared/tokenList");
 
 const EXT_ICON =
     `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
@@ -77,11 +73,15 @@ function updateSendBalance() {
         const tb = (addr.tokenBalances || []).find(
             (t) => t.address.toLowerCase() === token.toLowerCase(),
         );
-        const symbol = resolveSymbol(
+        const knownToken = TOKEN_BY_ADDRESS.get(token.toLowerCase());
-            token,
+        const tracked = (state.trackedTokens || []).find(
-            addr.tokenBalances,
+            (t) => t.address.toLowerCase() === token.toLowerCase(),
-            state.trackedTokens,
         );
+        const symbol =
+            (tb && tb.symbol) ||
+            (tracked && tracked.symbol) ||
+            (knownToken && knownToken.symbol) ||
+            "?";
         const bal = tb ? tb.balance || "0" : "0";
         $("send-balance").textContent =
             "Current balance: " + bal + " " + symbol;
@@ -128,28 +128,20 @@ function init(_ctx) {
 
         let tokenSymbol = null;
         let tokenBalance = null;
-        let tokenName = null;
         if (token !== "ETH") {
             const tb = (addr.tokenBalances || []).find(
                 (t) => t.address.toLowerCase() === token.toLowerCase(),
             );
-            tokenSymbol = resolveSymbol(
+            const knownTk = TOKEN_BY_ADDRESS.get(token.toLowerCase());
-                token,
+            const trackedTk = (state.trackedTokens || []).find(
-                addr.tokenBalances,
+                (t) => t.address.toLowerCase() === token.toLowerCase(),
-                state.trackedTokens,
             );
+            tokenSymbol =
+                (tb && tb.symbol) ||
+                (trackedTk && trackedTk.symbol) ||
+                (knownTk && knownTk.symbol) ||
+                "?";
             tokenBalance = tb ? tb.balance || "0" : "0";
-            // Resolve token name from balances, tracked tokens, or known list
-            const lower = token.toLowerCase();
-            tokenName =
-                (tb && tb.name) ||
-                (
-                    (state.trackedTokens || []).find(
-                        (t) => t.address.toLowerCase() === lower,
-                    ) || {}
-                ).name ||
-                (TOKEN_BY_ADDRESS.get(lower) || {}).name ||
-                null;
         }
 
         ctx.showConfirmTx({
@@ -161,7 +153,6 @@ function init(_ctx) {
             balance: addr.balance,
             tokenSymbol: tokenSymbol,
             tokenBalance: tokenBalance,
-            tokenName: tokenName,
         });
     });
 

src/popup/views/transactionDetail.js

@@ -143,10 +143,11 @@ function render() {
             typeEl.textContent = tx.directionLabel;
             typeSection.classList.remove("hidden");
         }
+        if (headingEl) headingEl.textContent = tx.directionLabel;
     } else {
         if (typeSection) typeSection.classList.add("hidden");
+        if (headingEl) headingEl.textContent = "Transaction";
     }
-    if (headingEl) headingEl.textContent = "Transaction";
 
     // Hide calldata and raw data sections; re-fetch if this is a contract call
     const calldataSection = $("tx-detail-calldata-section");

src/popup/views/txStatus.js

@@ -8,7 +8,6 @@ const {
     addressTitle,
     escapeHtml,
 } = require("./helpers");
-const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
@@ -122,51 +121,11 @@ function showSuccess(txInfo, txHash, blockNumber) {
         to: txInfo.to,
         hash: txHash,
         blockNumber: blockNumber,
-        decoded: txInfo.decoded || null,
     };
     renderSuccess();
     ctx.doRefreshAndRender();
 }
 
-function tokenLabel(address) {
-    const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
-    return t ? t.symbol : null;
-}
-
-function etherscanTokenLink(address) {
-    return `https://etherscan.io/token/${address}`;
-}
-
-function decodedDetailsHtml(decoded) {
-    if (!decoded || !decoded.details) return "";
-    let html = "";
-    if (decoded.name) {
-        html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Action</div>`;
-        html += `<div class="font-bold">${escapeHtml(decoded.name)}</div></div>`;
-    }
-    if (decoded.description) {
-        html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Description</div>`;
-        html += `<div>${escapeHtml(decoded.description)}</div></div>`;
-    }
-    for (const d of decoded.details) {
-        html += `<div class="mb-2">`;
-        html += `<div class="text-xs text-muted mb-1">${escapeHtml(d.label)}</div>`;
-        if (d.address) {
-            if (d.isToken) {
-                const sym = tokenLabel(d.address) || "Unknown token";
-                html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
-                html += toAddressHtml(d.address);
-            } else {
-                html += toAddressHtml(d.address);
-            }
-        } else {
-            html += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
-        }
-        html += `</div>`;
-    }
-    return html;
-}
-
 function renderSuccess() {
     const d = state.viewData;
     if (!d || !d.hash) return;
@@ -174,16 +133,6 @@ function renderSuccess() {
     $("success-tx-to").innerHTML = toAddressHtml(d.to);
     $("success-tx-block").textContent = String(d.blockNumber);
     $("success-tx-hash").innerHTML = txHashHtml(d.hash);
-
-    // Show decoded calldata details if present
-    const decodedEl = $("success-tx-decoded");
-    if (decodedEl && d.decoded) {
-        decodedEl.innerHTML = decodedDetailsHtml(d.decoded);
-        decodedEl.classList.remove("hidden");
-    } else if (decodedEl) {
-        decodedEl.classList.add("hidden");
-    }
-
     attachCopyHandlers("view-success-tx");
     showView("success-tx");
 }

src/shared/tokenList.js

@@ -3645,27 +3645,10 @@ async function getTopTokenPrices(n) {
     return prices;
 }
 
-// Resolve a token symbol from multiple sources, never returning "?".
-function resolveSymbol(tokenAddress, tokenBalances, trackedTokens) {
-    const lower = (tokenAddress || "").toLowerCase();
-    const tb = (tokenBalances || []).find(
-        (t) => t.address.toLowerCase() === lower,
-    );
-    if (tb && tb.symbol) return tb.symbol;
-    const known = TOKEN_BY_ADDRESS.get(lower);
-    if (known && known.symbol) return known.symbol;
-    const tracked = (trackedTokens || []).find(
-        (t) => t.address.toLowerCase() === lower,
-    );
-    if (tracked && tracked.symbol) return tracked.symbol;
-    return lower.slice(0, 10) + "\u2026";
-}
-
 module.exports = {
     TOKENS,
     TOKEN_BY_ADDRESS,
     KNOWN_SYMBOLS,
     getTopTokens,
     getTopTokenPrices,
-    resolveSymbol,
 };

src/shared/wallet.js

@@ -24,6 +24,26 @@ function hdWalletFromMnemonic(mnemonic) {
     return { xpub, firstAddress };
 }
 
+function hdWalletFromXprv(xprv) {
+    const root = HDNodeWallet.fromExtendedKey(xprv);
+    if (!root.privateKey) {
+        throw new Error("Not an extended private key (xprv).");
+    }
+    const node = root.derivePath("44'/60'/0'/0");
+    const xpub = node.neuter().extendedKey;
+    const firstAddress = node.deriveChild(0).address;
+    return { xpub, firstAddress };
+}
+
+function isValidXprv(key) {
+    try {
+        const node = HDNodeWallet.fromExtendedKey(key);
+        return !!node.privateKey;
+    } catch {
+        return false;
+    }
+}
+
 function addressFromPrivateKey(key) {
     const w = new Wallet(key);
     return w.address;
@@ -38,6 +58,11 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
         );
         return node.deriveChild(addrIndex);
     }
+    if (walletData.type === "xprv") {
+        const root = HDNodeWallet.fromExtendedKey(decryptedSecret);
+        const node = root.derivePath("44'/60'/0'/0");
+        return node.deriveChild(addrIndex);
+    }
     return new Wallet(decryptedSecret);
 }
 
@@ -49,6 +74,8 @@ module.exports = {
     generateMnemonic,
     deriveAddressFromXpub,
     hdWalletFromMnemonic,
+    hdWalletFromXprv,
+    isValidXprv,
     addressFromPrivateKey,
     getSignerForAddress,
     isValidMnemonic,