feat: add private key viewing for addresses

Add a 'Show private key' button on the address detail view that opens
a dedicated password-prompt screen with a clear warning about key
sensitivity. After correct password entry, the derived private key is
displayed in a read-only well with a copy button.

- Add getPrivateKeyForAddress() to wallet.js
- Add showPrivateKey view with password verification
- Add clipboard policy section to README explaining why we never
  auto-clear the clipboard
- Register new view in helpers.js VIEWS array and wire up in index.js

Closes #19

.gitignore

@@ -25,4 +25,3 @@ dist/
 
 # Yarn
 .yarn-integrity
-package-lock.json

README.md

@@ -213,6 +213,22 @@ create an address with the same visible characters and trick the user into
 sending funds to it. Showing the complete identifier defeats this class of
 attack.
 
+#### Clipboard Policy
+
+AutistMask never clears or overwrites the user's clipboard. When sensitive data
+such as a private key is copied, it is the user's responsibility to manage their
+clipboard afterwards. We deliberately avoid auto-clearing the clipboard for two
+reasons:
+
+1. **User expectations**: silently modifying the clipboard violates the
+   principle of least surprise. The user initiated the copy and knows the
+   content is sensitive.
+2. **Data safety**: the user may have copied something else important in the
+   intervening time. A timed clipboard clear would destroy that unrelated data.
+
+The warning shown before revealing a private key makes it clear that the key is
+sensitive and that clipboard management is the user's responsibility.
+
 #### Data Model
 
 The core hierarchy is **Wallets → Addresses**:
@@ -316,15 +332,34 @@ transitions.
     - Balance list: ETH + tracked ERC-20 tokens (4 decimal places, USD inline).
       Each balance row is clickable → **AddressToken**
     - Send / Receive / + Token buttons
+    - "Show private key" button
     - Transaction list (with ENS resolution for counterparties)
 - **Transitions**:
     - Tap balance row → **AddressToken** (for that token)
     - "Send" → **Send**
     - "Receive" → **Receive**
     - "+ Token" → **AddToken**
+    - "Show private key" → **ShowPrivateKey**
     - Tap transaction row → **TransactionDetail**
     - "Back" → **Home**
 
+#### ShowPrivateKey
+
+- **When**: User clicked "Show private key" on AddressDetail.
+- **Elements**:
+    - "Back" button
+    - Title: "Display Private Key"
+    - Warning box (lock + money icons) explaining the key controls funds and
+      that the user is responsible for clipboard management
+    - Password input
+    - "Display Private Key" button (with lock + money icons)
+    - After reveal: private key in a read-only well (monospace, select-all),
+      Copy button, Done button
+- **Transitions**:
+    - "Display Private Key" (correct password) → reveals key in-place
+    - "Copy" → copies key to clipboard
+    - "Done" / "Back" → **AddressDetail** (key cleared from DOM)
+
 #### AddressToken
 
 - **When**: User clicked a specific token balance on AddressDetail.

src/popup/index.html

@@ -307,6 +307,15 @@
                     </button>
                 </div>
 
+                <div class="mb-3">
+                    <button
+                        id="btn-show-private-key"
+                        class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"
+                    >
+                        &#128274; Show private key
+                    </button>
+                </div>
+
                 <!-- transactions -->
                 <div class="mt-3">
                     <div class="border-b border-border pb-1 mb-1">
@@ -318,6 +327,77 @@
                 </div>
             </div>
 
+            <!-- ============ SHOW PRIVATE KEY ============ -->
+            <div id="view-show-private-key" class="view hidden">
+                <button
+                    id="btn-show-pk-back"
+                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
+                >
+                    &lt; Back
+                </button>
+                <h2 class="font-bold mb-2">Display Private Key</h2>
+
+                <!-- password prompt section -->
+                <div id="show-pk-prompt">
+                    <div
+                        class="border border-border border-dashed p-3 mb-3 text-xs"
+                    >
+                        <p class="mb-1">
+                            &#128274;&#128176; Your private key controls this
+                            address and all its funds. Anyone who has it can
+                            spend your tokens.
+                        </p>
+                        <p>
+                            Do not share it. Do not paste it into websites. If
+                            you copy it, you are responsible for clearing your
+                            clipboard when you are done.
+                        </p>
+                    </div>
+                    <div class="mb-2">
+                        <label class="block mb-1">Password</label>
+                        <input
+                            type="password"
+                            id="show-pk-password"
+                            class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                            placeholder="Enter your password"
+                        />
+                    </div>
+                    <div
+                        id="show-pk-error"
+                        class="text-xs mb-2 border border-border border-dashed p-1 hidden"
+                    ></div>
+                    <button
+                        id="btn-show-pk-reveal"
+                        class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                    >
+                        &#128274;&#128176; Display Private Key
+                    </button>
+                </div>
+
+                <!-- revealed key section -->
+                <div id="show-pk-key-well" class="hidden">
+                    <div
+                        class="bg-well p-3 mx-1 mb-3 break-all font-mono text-xs select-all"
+                    >
+                        <span id="show-pk-key-value"></span>
+                    </div>
+                    <div class="flex gap-2">
+                        <button
+                            id="btn-show-pk-copy"
+                            class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                        >
+                            Copy
+                        </button>
+                        <button
+                            id="btn-show-pk-done"
+                            class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                        >
+                            Done
+                        </button>
+                    </div>
+                </div>
+            </div>
+
             <!-- ============ ADDRESS-TOKEN DETAIL VIEW ============ -->
             <div id="view-address-token" class="view hidden">
                 <button
@@ -463,12 +543,12 @@
                 </div>
 
                 <!-- ERC-20 token contract (hidden for ETH) -->
-                <div
-                    id="confirm-token-section"
-                    class="bg-hover rounded-md mx-1 p-3 mb-3 text-xs hidden"
-                >
-                    <div class="font-bold mb-2">Token Contract</div>
-                    <div id="confirm-token-contract" class="break-all"></div>
+                <div id="confirm-token-section" class="mb-3 hidden">
+                    <div class="text-xs text-muted mb-1">Token contract</div>
+                    <div
+                        id="confirm-token-contract"
+                        class="text-xs break-all"
+                    ></div>
                 </div>
 
                 <div class="mb-3">
@@ -531,7 +611,6 @@
             <!-- ============ TX SUCCESS ============ -->
             <div id="view-success-tx" class="view hidden">
                 <h2 class="font-bold mb-2">Transaction Confirmed</h2>
-                <div id="success-tx-decoded" class="mb-3 hidden text-xs"></div>
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">Amount</div>
                     <div id="success-tx-summary" class="font-bold"></div>
@@ -637,10 +716,9 @@
                 <div class="flex justify-center mb-3">
                     <canvas id="receive-qr"></canvas>
                 </div>
-                <div
-                    class="border border-border p-2 break-all mb-3 text-xs cursor-pointer"
-                >
-                    <span id="receive-address-block" class="select-all"></span>
+                <div class="border border-border p-2 break-all mb-3 text-xs">
+                    <span id="receive-dot"></span>
+                    <span id="receive-address" class="select-all"></span>
                     <span id="receive-etherscan-link"></span>
                 </div>
                 <button
@@ -1001,18 +1079,18 @@
                             class="text-xs"
                         ></div>
                     </div>
+                    <div id="tx-detail-rawdata-section" class="hidden">
+                        <div class="text-xs text-muted mb-1">Raw data</div>
+                        <div
+                            id="tx-detail-rawdata"
+                            class="text-xs break-all font-mono border border-border border-dashed p-2"
+                        ></div>
+                    </div>
                 </div>
                 <div class="mb-4">
                     <div class="text-xs text-muted mb-1">Transaction hash</div>
                     <div id="tx-detail-hash" class="text-xs break-all"></div>
                 </div>
-                <div id="tx-detail-rawdata-section" class="mb-4 hidden">
-                    <div class="text-xs text-muted mb-1">Raw data</div>
-                    <div
-                        id="tx-detail-rawdata"
-                        class="text-xs break-all font-mono border border-border border-dashed p-2"
-                    ></div>
-                </div>
             </div>
 
             <!-- ============ TRANSACTION APPROVAL ============ -->

src/popup/index.js

@@ -19,6 +19,7 @@ const txStatus = require("./views/txStatus");
 const transactionDetail = require("./views/transactionDetail");
 const receive = require("./views/receive");
 const addToken = require("./views/addToken");
+const showPrivateKey = require("./views/showPrivateKey");
 const settings = require("./views/settings");
 const settingsAddToken = require("./views/settingsAddToken");
 const approval = require("./views/approval");
@@ -56,6 +57,7 @@ const ctx = {
     showAddWalletView: () => addWallet.show(),
     showImportKeyView: () => importKey.show(),
     showAddressDetail: () => addressDetail.show(),
+    showPrivateKey: () => showPrivateKey.show(),
     showAddressToken: () => addressToken.show(),
     showAddTokenView: () => addToken.show(),
     showConfirmTx: (txInfo) => confirmTx.show(txInfo),
@@ -212,6 +214,7 @@ async function init() {
     importKey.init(ctx);
     home.init(ctx);
     addressDetail.init(ctx);
+    showPrivateKey.init(ctx);
     addressToken.init(ctx);
     send.init(ctx);
     confirmTx.init(ctx);

src/popup/views/addressDetail.js

@@ -186,14 +186,10 @@ function renderTransactions(txs) {
     let html = "";
     let i = 0;
     for (const tx of txs) {
-        // For swap transactions, show the user's own labelled wallet
-        // address instead of the contract address (see issue #55).
         const counterparty =
-            tx.direction === "contract" && tx.directionLabel === "Swap"
-                ? tx.from
-                : tx.direction === "sent" || tx.direction === "contract"
-                  ? tx.to
-                  : tx.from;
+            tx.direction === "sent" || tx.direction === "contract"
+                ? tx.to
+                : tx.from;
         const ensName = ensNameMap.get(counterparty) || null;
         const title = addressTitle(counterparty, state.wallets);
         const dirLabel = tx.directionLabel;
@@ -265,6 +261,10 @@ function init(_ctx) {
     });
 
     $("btn-add-token").addEventListener("click", ctx.showAddTokenView);
+
+    $("btn-show-private-key").addEventListener("click", () => {
+        ctx.showPrivateKey();
+    });
 }
 
 module.exports = { init, show };

src/popup/views/addressToken.js

@@ -12,7 +12,7 @@ const {
     balanceLine,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
-const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
+const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const {
     formatUsd,
     getPrice,
@@ -87,7 +87,6 @@ function show() {
 
     // Determine token symbol and balance
     let symbol, amount, price;
-    const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
     if (tokenId === "ETH") {
         symbol = "ETH";
         amount = parseFloat(addr.balance || "0");
@@ -96,11 +95,7 @@ function show() {
         const tb = (addr.tokenBalances || []).find(
             (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
         );
-        symbol = resolveSymbol(
-            tokenId,
-            addr.tokenBalances,
-            state.trackedTokens,
-        );
+        symbol = tb ? tb.symbol : "?";
         amount = tb ? parseFloat(tb.balance || "0") : 0;
         price = getPrice(symbol);
     }
@@ -143,32 +138,13 @@ function show() {
         const tb = (addr.tokenBalances || []).find(
             (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
         );
-        const tracked = (state.trackedTokens || []).find(
-            (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
-        );
-        const rawName =
-            (tb && tb.name) ||
-            (tracked && tracked.name) ||
-            (knownToken && knownToken.name) ||
-            null;
-        const rawSymbol =
-            (tb && tb.symbol) ||
-            (tracked && tracked.symbol) ||
-            (knownToken && knownToken.symbol) ||
-            null;
-        const tokenName = rawName ? escapeHtml(rawName) : null;
-        const tokenSymbol = rawSymbol ? escapeHtml(rawSymbol) : null;
-        const tokenDecimals =
-            tb && tb.decimals != null
-                ? tb.decimals
-                : tracked && tracked.decimals != null
-                  ? tracked.decimals
-                  : knownToken && knownToken.decimals != null
-                    ? knownToken.decimals
-                    : null;
+        const tokenName = tb && tb.name ? escapeHtml(tb.name) : null;
+        const tokenSymbol = tb && tb.symbol ? escapeHtml(tb.symbol) : null;
+        const tokenDecimals = tb && tb.decimals != null ? tb.decimals : null;
         const tokenHolders = tb && tb.holders != null ? tb.holders : null;
         const dot = addressDotHtml(tokenId);
         const tokenLink = `https://etherscan.io/token/${escapeHtml(tokenId)}`;
+        const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
         const projectUrl = knownToken && knownToken.url ? knownToken.url : null;
         let infoHtml = `<div class="font-bold mb-2">Contract Address</div>`;
         infoHtml +=

src/popup/views/approval.js

@@ -78,12 +78,10 @@ function decodeCalldata(data, toAddress) {
                     "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
                 );
                 const isUnlimited = rawAmount === maxUint;
-                const amountRaw = isUnlimited
-                    ? "Unlimited"
-                    : formatTxValue(formatUnits(rawAmount, tokenDecimals));
                 const amountStr = isUnlimited
                     ? "Unlimited"
-                    : amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
+                    : formatTxValue(formatUnits(rawAmount, tokenDecimals)) +
+                      (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Approval",
@@ -102,11 +100,7 @@ function decodeCalldata(data, toAddress) {
                             value: spender,
                             address: spender,
                         },
-                        {
-                            label: "Amount",
-                            value: amountStr,
-                            rawValue: amountRaw,
-                        },
+                        { label: "Amount", value: amountStr },
                     ],
                 };
             }
@@ -114,11 +108,9 @@ function decodeCalldata(data, toAddress) {
             if (parsed.name === "transfer") {
                 const to = parsed.args[0];
                 const rawAmount = parsed.args[1];
-                const amountRaw = formatTxValue(
-                    formatUnits(rawAmount, tokenDecimals),
-                );
                 const amountStr =
-                    amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
+                    formatTxValue(formatUnits(rawAmount, tokenDecimals)) +
+                    (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Transfer",
@@ -133,11 +125,7 @@ function decodeCalldata(data, toAddress) {
                             isToken: true,
                         },
                         { label: "Recipient", value: to, address: to },
-                        {
-                            label: "Amount",
-                            value: amountStr,
-                            rawValue: amountRaw,
-                        },
+                        { label: "Amount", value: amountStr },
                     ],
                 };
             }
@@ -175,7 +163,7 @@ function showTxApproval(details) {
                 pendingTxDetails.to = d.address;
             }
             if (d.label === "Amount") {
-                pendingTxDetails.amount = d.rawValue || d.value;
+                pendingTxDetails.amount = d.value;
             }
         }
         if (token) {
@@ -184,15 +172,6 @@ function showTxApproval(details) {
         }
     }
 
-    // Carry decoded calldata info through to success/error views
-    if (decoded) {
-        pendingTxDetails.decoded = {
-            name: decoded.name,
-            description: decoded.description,
-            details: decoded.details,
-        };
-    }
-
     $("approve-tx-hostname").textContent = details.hostname;
     $("approve-tx-from").innerHTML = approvalAddressHtml(state.activeAddress);
 

src/popup/views/confirmTx.js

@@ -95,22 +95,10 @@ function show(txInfo) {
     // Token contract section (ERC-20 only)
     const tokenSection = $("confirm-token-section");
     if (isErc20) {
-        const dot = addressDotHtml(txInfo.token);
         const link = etherscanTokenLink(txInfo.token);
         $("confirm-token-contract").innerHTML =
-            `<div class="flex items-center">` +
-            dot +
-            `<span class="break-all underline decoration-dashed cursor-pointer" id="confirm-token-contract-copy" data-copy="${escapeHtml(txInfo.token)}">${escapeHtml(txInfo.token)}</span>` +
-            `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
-            `</div>`;
-        if (txInfo.tokenName) {
-            $("confirm-token-contract").innerHTML +=
-                `<div class="mt-1"><span class="text-muted">Name:</span> ${escapeHtml(txInfo.tokenName)}</div>`;
-        }
-        if (txInfo.tokenSymbol) {
-            $("confirm-token-contract").innerHTML +=
-                `<div class="mt-1"><span class="text-muted">Symbol:</span> ${escapeHtml(txInfo.tokenSymbol)}</div>`;
-        }
+            escapeHtml(txInfo.token) +
+            ` <a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
         tokenSection.classList.remove("hidden");
     } else {
         tokenSection.classList.add("hidden");
@@ -285,13 +273,6 @@ function hidePasswordModal() {
 }
 
 function init(ctx) {
-    $("confirm-token-section").addEventListener("click", (e) => {
-        const copyEl = e.target.closest("[data-copy]");
-        if (copyEl) {
-            navigator.clipboard.writeText(copyEl.dataset.copy);
-        }
-    });
-
     $("btn-confirm-send").addEventListener("click", () => {
         showPasswordModal();
     });

src/popup/views/helpers.js

@@ -16,6 +16,7 @@ const VIEWS = [
     "import-key",
     "main",
     "address",
+    "show-private-key",
     "address-token",
     "send",
     "confirm-tx",

src/popup/views/home.js

@@ -103,15 +103,10 @@ function renderHomeTxList(ctx) {
     let html = "";
     let i = 0;
     for (const tx of homeTxs) {
-        // For swap transactions, show the user's own labelled wallet
-        // address (the one that initiated the swap) instead of the
-        // contract address which is not useful in the list view.
         const counterparty =
-            tx.direction === "contract" && tx.directionLabel === "Swap"
-                ? tx.from
-                : tx.direction === "sent" || tx.direction === "contract"
-                  ? tx.to
-                  : tx.from;
+            tx.direction === "sent" || tx.direction === "contract"
+                ? tx.to
+                : tx.from;
         const dirLabel = tx.directionLabel;
         const amountStr = tx.value
             ? escapeHtml(tx.value + " " + tx.symbol)

src/popup/views/receive.js

@@ -1,10 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    formatAddressHtml,
-    addressTitle,
-} = require("./helpers");
+const { $, showView, showFlash, addressDotHtml } = require("./helpers");
 const { state, currentAddress } = require("../../shared/state");
 const QRCode = require("qrcode");
 
@@ -18,12 +12,8 @@ const EXT_ICON =
 function show() {
     const addr = currentAddress();
     const address = addr ? addr.address : "";
-    const title = address ? addressTitle(address, state.wallets) : null;
-    const ensName = addr ? addr.ensName || null : null;
-    $("receive-address-block").innerHTML = address
-        ? formatAddressHtml(address, ensName, null, title)
-        : "";
-    $("receive-address-block").dataset.full = address;
+    $("receive-dot").innerHTML = address ? addressDotHtml(address) : "";
+    $("receive-address").textContent = address;
     const link = address ? `https://etherscan.io/address/${address}` : "";
     $("receive-etherscan-link").innerHTML = link
         ? `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`
@@ -60,16 +50,8 @@ function show() {
 }
 
 function init(ctx) {
-    $("receive-address-block").addEventListener("click", () => {
-        const addr = $("receive-address-block").dataset.full;
-        if (addr) {
-            navigator.clipboard.writeText(addr);
-            showFlash("Copied!");
-        }
-    });
-
     $("btn-receive-copy").addEventListener("click", () => {
-        const addr = $("receive-address-block").dataset.full;
+        const addr = $("receive-address").textContent;
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");

src/popup/views/send.js

@@ -10,11 +10,7 @@ const {
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
-const {
-    KNOWN_SYMBOLS,
-    TOKEN_BY_ADDRESS,
-    resolveSymbol,
-} = require("../../shared/tokenList");
+const { KNOWN_SYMBOLS } = require("../../shared/tokenList");
 
 const EXT_ICON =
     `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
@@ -77,11 +73,7 @@ function updateSendBalance() {
         const tb = (addr.tokenBalances || []).find(
             (t) => t.address.toLowerCase() === token.toLowerCase(),
         );
-        const symbol = resolveSymbol(
-            token,
-            addr.tokenBalances,
-            state.trackedTokens,
-        );
+        const symbol = tb ? tb.symbol : "?";
         const bal = tb ? tb.balance || "0" : "0";
         $("send-balance").textContent =
             "Current balance: " + bal + " " + symbol;
@@ -128,28 +120,12 @@ function init(_ctx) {
 
         let tokenSymbol = null;
         let tokenBalance = null;
-        let tokenName = null;
         if (token !== "ETH") {
             const tb = (addr.tokenBalances || []).find(
                 (t) => t.address.toLowerCase() === token.toLowerCase(),
             );
-            tokenSymbol = resolveSymbol(
-                token,
-                addr.tokenBalances,
-                state.trackedTokens,
-            );
+            tokenSymbol = tb ? tb.symbol : "?";
             tokenBalance = tb ? tb.balance || "0" : "0";
-            // Resolve token name from balances, tracked tokens, or known list
-            const lower = token.toLowerCase();
-            tokenName =
-                (tb && tb.name) ||
-                (
-                    (state.trackedTokens || []).find(
-                        (t) => t.address.toLowerCase() === lower,
-                    ) || {}
-                ).name ||
-                (TOKEN_BY_ADDRESS.get(lower) || {}).name ||
-                null;
         }
 
         ctx.showConfirmTx({
@@ -161,7 +137,6 @@ function init(_ctx) {
             balance: addr.balance,
             tokenSymbol: tokenSymbol,
             tokenBalance: tokenBalance,
-            tokenName: tokenName,
         });
     });
 

src/popup/views/showPrivateKey.js

@@ -0,0 +1,79 @@
+const { $, showView, showFlash, showError, hideError } = require("./helpers");
+const { state } = require("../../shared/state");
+const { decryptWithPassword } = require("../../shared/vault");
+const { getPrivateKeyForAddress } = require("../../shared/wallet");
+
+let ctx;
+let revealed = false;
+
+function show() {
+    revealed = false;
+    $("show-pk-password").value = "";
+    $("show-pk-key-well").classList.add("hidden");
+    $("show-pk-key-value").textContent = "";
+    $("show-pk-prompt").classList.remove("hidden");
+    hideError("show-pk-error");
+    showView("show-private-key");
+}
+
+function init(_ctx) {
+    ctx = _ctx;
+
+    $("btn-show-pk-back").addEventListener("click", () => {
+        clearKey();
+        ctx.showAddressDetail();
+    });
+
+    $("btn-show-pk-reveal").addEventListener("click", async () => {
+        const pw = $("show-pk-password").value;
+        if (!pw) {
+            showError("show-pk-error", "Please enter your password.");
+            return;
+        }
+
+        const wallet = state.wallets[state.selectedWallet];
+        let decryptedSecret;
+        try {
+            decryptedSecret = await decryptWithPassword(
+                wallet.encryptedSecret,
+                pw,
+            );
+        } catch (_e) {
+            showError("show-pk-error", "Wrong password.");
+            return;
+        }
+
+        const privateKey = getPrivateKeyForAddress(
+            wallet,
+            state.selectedAddress,
+            decryptedSecret,
+        );
+
+        revealed = true;
+        $("show-pk-prompt").classList.add("hidden");
+        $("show-pk-key-well").classList.remove("hidden");
+        $("show-pk-key-value").textContent = privateKey;
+        hideError("show-pk-error");
+    });
+
+    $("btn-show-pk-copy").addEventListener("click", () => {
+        const key = $("show-pk-key-value").textContent;
+        if (key) {
+            navigator.clipboard.writeText(key);
+            showFlash("Copied!");
+        }
+    });
+
+    $("btn-show-pk-done").addEventListener("click", () => {
+        clearKey();
+        ctx.showAddressDetail();
+    });
+}
+
+function clearKey() {
+    revealed = false;
+    $("show-pk-key-value").textContent = "";
+    $("show-pk-password").value = "";
+}
+
+module.exports = { init, show };

src/popup/views/transactionDetail.js

@@ -37,19 +37,11 @@ function blockieHtml(address) {
     return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
-function etherscanLinkHtml(url) {
-    return (
-        `<a href="${url}" target="_blank" rel="noopener" ` +
-        `class="inline-flex items-center"` +
-        `>${EXT_ICON}</a>`
-    );
-}
-
 function txAddressHtml(address, ensName, title) {
     const blockie = blockieHtml(address);
     const dot = addressDotHtml(address);
     const link = `https://etherscan.io/address/${address}`;
-    const extLink = etherscanLinkHtml(link);
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
     let html = `<div class="mb-1">${blockie}</div>`;
     if (title) {
         html += `<div class="font-bold">${escapeHtml(title)}</div>`;
@@ -58,10 +50,10 @@ function txAddressHtml(address, ensName, title) {
         html +=
             `<div class="flex items-center">${dot}` +
             copyableHtml(ensName, "") +
-            `</div>` +
-            `<div class="flex items-center">${dot}` +
-            copyableHtml(address, "break-all") +
             extLink +
+            `</div>` +
+            `<div class="break-all">` +
+            copyableHtml(address, "break-all") +
             `</div>`;
     } else {
         html +=
@@ -75,7 +67,7 @@ function txAddressHtml(address, ensName, title) {
 
 function txHashHtml(hash) {
     const link = `https://etherscan.io/tx/${hash}`;
-    const extLink = etherscanLinkHtml(link);
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
     return copyableHtml(hash, "break-all") + extLink;
 }
 
@@ -101,6 +93,9 @@ function show(tx) {
         },
     };
     render();
+    if (tx.isContractCall || tx.direction === "contract") {
+        loadCalldata(tx.hash, tx.to);
+    }
 }
 
 function render() {
@@ -143,20 +138,15 @@ function render() {
             typeEl.textContent = tx.directionLabel;
             typeSection.classList.remove("hidden");
         }
+        if (headingEl) headingEl.textContent = tx.directionLabel;
     } else {
         if (typeSection) typeSection.classList.add("hidden");
+        if (headingEl) headingEl.textContent = "Transaction";
     }
-    if (headingEl) headingEl.textContent = "Transaction";
 
-    // Hide calldata and raw data sections; re-fetch if this is a contract call
+    // Hide calldata section by default; loadCalldata will show it if needed
     const calldataSection = $("tx-detail-calldata-section");
     if (calldataSection) calldataSection.classList.add("hidden");
-    const rawDataSection = $("tx-detail-rawdata-section");
-    if (rawDataSection) rawDataSection.classList.add("hidden");
-
-    if (tx.isContractCall || tx.direction === "contract") {
-        loadCalldata(tx.hash, tx.to);
-    }
 
     $("tx-detail-time").textContent =
         isoDate(tx.timestamp) + " (" + timeAgo(tx.timestamp) + ")";
@@ -203,20 +193,9 @@ async function loadCalldata(txHash, toAddress) {
             for (const d of decoded.details || []) {
                 detailsHtml += `<div class="mb-2">`;
                 detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
-                if (d.address && d.isToken) {
-                    // Token entry: show symbol on its own line, then dot + address + Etherscan link
+                if (d.address) {
                     const dot = addressDotHtml(d.address);
-                    const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
-                    if (tokenSymbol) {
-                        detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
-                    }
-                    const etherscanUrl = `https://etherscan.io/token/${d.address}`;
-                    detailsHtml += `<div class="flex items-center">${dot}${copyableHtml(d.address, "break-all")}${etherscanLinkHtml(etherscanUrl)}</div>`;
-                } else if (d.address) {
-                    // Protocol/contract entry: show name + Etherscan link
-                    const dot = addressDotHtml(d.address);
-                    const etherscanUrl = `https://etherscan.io/address/${d.address}`;
-                    detailsHtml += `<div class="flex items-center">${dot}${copyableHtml(d.value, "break-all")}${etherscanLinkHtml(etherscanUrl)}</div>`;
+                    detailsHtml += `<div>${dot}${copyableHtml(d.value, "break-all")}</div>`;
                 } else {
                     detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
                 }
@@ -240,16 +219,13 @@ async function loadCalldata(txHash, toAddress) {
 
         section.classList.remove("hidden");
 
-        // Bind copy handlers for new elements (including raw data now outside section)
-        const copyTargets = [section, rawSection].filter(Boolean);
-        for (const container of copyTargets) {
-            container.querySelectorAll("[data-copy]").forEach((el) => {
-                el.onclick = () => {
-                    navigator.clipboard.writeText(el.dataset.copy);
-                    showFlash("Copied!");
-                };
-            });
-        }
+        // Bind copy handlers for new elements
+        section.querySelectorAll("[data-copy]").forEach((el) => {
+            el.onclick = () => {
+                navigator.clipboard.writeText(el.dataset.copy);
+                showFlash("Copied!");
+            };
+        });
     } catch (e) {
         log.errorf("loadCalldata failed:", e.message);
     }

src/popup/views/txStatus.js

@@ -8,7 +8,6 @@ const {
     addressTitle,
     escapeHtml,
 } = require("./helpers");
-const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
@@ -122,51 +121,11 @@ function showSuccess(txInfo, txHash, blockNumber) {
         to: txInfo.to,
         hash: txHash,
         blockNumber: blockNumber,
-        decoded: txInfo.decoded || null,
     };
     renderSuccess();
     ctx.doRefreshAndRender();
 }
 
-function tokenLabel(address) {
-    const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
-    return t ? t.symbol : null;
-}
-
-function etherscanTokenLink(address) {
-    return `https://etherscan.io/token/${address}`;
-}
-
-function decodedDetailsHtml(decoded) {
-    if (!decoded || !decoded.details) return "";
-    let html = "";
-    if (decoded.name) {
-        html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Action</div>`;
-        html += `<div class="font-bold">${escapeHtml(decoded.name)}</div></div>`;
-    }
-    if (decoded.description) {
-        html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Description</div>`;
-        html += `<div>${escapeHtml(decoded.description)}</div></div>`;
-    }
-    for (const d of decoded.details) {
-        html += `<div class="mb-2">`;
-        html += `<div class="text-xs text-muted mb-1">${escapeHtml(d.label)}</div>`;
-        if (d.address) {
-            if (d.isToken) {
-                const sym = tokenLabel(d.address) || "Unknown token";
-                html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
-                html += toAddressHtml(d.address);
-            } else {
-                html += toAddressHtml(d.address);
-            }
-        } else {
-            html += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
-        }
-        html += `</div>`;
-    }
-    return html;
-}
-
 function renderSuccess() {
     const d = state.viewData;
     if (!d || !d.hash) return;
@@ -174,16 +133,6 @@ function renderSuccess() {
     $("success-tx-to").innerHTML = toAddressHtml(d.to);
     $("success-tx-block").textContent = String(d.blockNumber);
     $("success-tx-hash").innerHTML = txHashHtml(d.hash);
-
-    // Show decoded calldata details if present
-    const decodedEl = $("success-tx-decoded");
-    if (decodedEl && d.decoded) {
-        decodedEl.innerHTML = decodedDetailsHtml(d.decoded);
-        decodedEl.classList.remove("hidden");
-    } else if (decodedEl) {
-        decodedEl.classList.add("hidden");
-    }
-
     attachCopyHandlers("view-success-tx");
     showView("success-tx");
 }

src/shared/balances.js

@@ -85,7 +85,6 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
 
             balances.push({
                 address: item.token.address_hash,
-                name: item.token.name || "",
                 symbol: item.token.symbol || "???",
                 decimals: decimals,
                 balance: bal,

src/shared/tokenList.js

@@ -3645,27 +3645,10 @@ async function getTopTokenPrices(n) {
     return prices;
 }
 
-// Resolve a token symbol from multiple sources, never returning "?".
-function resolveSymbol(tokenAddress, tokenBalances, trackedTokens) {
-    const lower = (tokenAddress || "").toLowerCase();
-    const tb = (tokenBalances || []).find(
-        (t) => t.address.toLowerCase() === lower,
-    );
-    if (tb && tb.symbol) return tb.symbol;
-    const known = TOKEN_BY_ADDRESS.get(lower);
-    if (known && known.symbol) return known.symbol;
-    const tracked = (trackedTokens || []).find(
-        (t) => t.address.toLowerCase() === lower,
-    );
-    if (tracked && tracked.symbol) return tracked.symbol;
-    return lower.slice(0, 10) + "\u2026";
-}
-
 module.exports = {
     TOKENS,
     TOKEN_BY_ADDRESS,
     KNOWN_SYMBOLS,
     getTopTokens,
     getTopTokenPrices,
-    resolveSymbol,
 };

src/shared/uniswap.js

@@ -161,157 +161,6 @@ function decodeWrapEth(input) {
     }
 }
 
-// V4 inner action IDs
-const V4_SWAP_EXACT_IN_SINGLE = 0x06;
-const V4_SWAP_EXACT_IN = 0x07;
-const V4_SWAP_EXACT_OUT_SINGLE = 0x08;
-const V4_SWAP_EXACT_OUT = 0x09;
-const V4_SETTLE = 0x0b;
-const V4_TAKE = 0x0e;
-
-// Decode V4_SWAP (command 0x10) input bytes.
-// The input is ABI-encoded as (bytes actions, bytes[] params).
-// We extract token addresses from SETTLE (input) and TAKE (output) sub-actions,
-// and swap amounts from the swap sub-actions.
-function decodeV4Swap(input) {
-    try {
-        const d = coder.decode(["bytes", "bytes[]"], input);
-        const actions = getBytes(d[0]);
-        const params = d[1];
-
-        let settleToken = null;
-        let takeToken = null;
-        let amountIn = null;
-        let amountOutMin = null;
-
-        for (let i = 0; i < actions.length; i++) {
-            const actionId = actions[i];
-            try {
-                if (actionId === V4_SETTLE) {
-                    // SETTLE: (address currency, uint256 maxAmount, bool payerIsUser)
-                    const s = coder.decode(
-                        ["address", "uint256", "bool"],
-                        params[i],
-                    );
-                    settleToken = s[0];
-                } else if (actionId === V4_TAKE) {
-                    // TAKE: (address currency, address recipient, uint256 amount)
-                    const t = coder.decode(
-                        ["address", "address", "uint256"],
-                        params[i],
-                    );
-                    takeToken = t[0];
-                } else if (
-                    actionId === V4_SWAP_EXACT_IN ||
-                    actionId === V4_SWAP_EXACT_IN_SINGLE
-                ) {
-                    // Extract amounts from exact-in swap actions
-                    if (actionId === V4_SWAP_EXACT_IN) {
-                        // ExactInputParams: (address currencyIn,
-                        //   tuple(address,uint24,int24,address,bytes)[] path,
-                        //   uint128 amountIn, uint128 amountOutMin)
-                        try {
-                            const s = coder.decode(
-                                [
-                                    "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
-                                ],
-                                params[i],
-                            );
-                            if (!settleToken) settleToken = s[0][0];
-                            const path = s[0][1];
-                            if (path.length > 0 && !takeToken) {
-                                takeToken = path[path.length - 1][0];
-                            }
-                            if (!amountIn) amountIn = s[0][2];
-                            if (!amountOutMin) amountOutMin = s[0][3];
-                        } catch {
-                            // Fall through — SETTLE/TAKE will provide tokens
-                        }
-                    } else {
-                        // ExactInputSingleParams: (tuple(address,address,uint24,int24,address) poolKey,
-                        //   bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
-                        try {
-                            const s = coder.decode(
-                                [
-                                    "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
-                                ],
-                                params[i],
-                            );
-                            const poolKey = s[0][0];
-                            const zeroForOne = s[0][1];
-                            if (!settleToken)
-                                settleToken = zeroForOne
-                                    ? poolKey[0]
-                                    : poolKey[1];
-                            if (!takeToken)
-                                takeToken = zeroForOne
-                                    ? poolKey[1]
-                                    : poolKey[0];
-                            if (!amountIn) amountIn = s[0][2];
-                            if (!amountOutMin) amountOutMin = s[0][3];
-                        } catch {
-                            // Fall through
-                        }
-                    }
-                } else if (
-                    actionId === V4_SWAP_EXACT_OUT ||
-                    actionId === V4_SWAP_EXACT_OUT_SINGLE
-                ) {
-                    if (actionId === V4_SWAP_EXACT_OUT) {
-                        try {
-                            const s = coder.decode(
-                                [
-                                    "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
-                                ],
-                                params[i],
-                            );
-                            if (!takeToken) takeToken = s[0][0];
-                            const path = s[0][1];
-                            if (path.length > 0 && !settleToken) {
-                                settleToken = path[path.length - 1][0];
-                            }
-                        } catch {
-                            // Fall through
-                        }
-                    } else {
-                        try {
-                            const s = coder.decode(
-                                [
-                                    "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
-                                ],
-                                params[i],
-                            );
-                            const poolKey = s[0][0];
-                            const zeroForOne = s[0][1];
-                            if (!settleToken)
-                                settleToken = zeroForOne
-                                    ? poolKey[0]
-                                    : poolKey[1];
-                            if (!takeToken)
-                                takeToken = zeroForOne
-                                    ? poolKey[1]
-                                    : poolKey[0];
-                        } catch {
-                            // Fall through
-                        }
-                    }
-                }
-            } catch {
-                // Skip sub-actions we can't decode
-            }
-        }
-
-        return {
-            tokenIn: settleToken,
-            tokenOut: takeToken,
-            amountIn,
-            amountOutMin,
-        };
-    } catch {
-        return null;
-    }
-}
-
 // Try to decode a Universal Router execute() call.
 // Returns { name, description, details } matching the format used by
 // the approval UI, or null if the calldata is not a recognised execute().
@@ -384,19 +233,6 @@ function decode(data, toAddress) {
                     }
                 }
 
-                if (cmdId === 0x10) {
-                    const v4 = decodeV4Swap(inputs[i]);
-                    if (v4) {
-                        if (!inputToken && v4.tokenIn) inputToken = v4.tokenIn;
-                        if (!outputToken && v4.tokenOut)
-                            outputToken = v4.tokenOut;
-                        if (!inputAmount && v4.amountIn)
-                            inputAmount = v4.amountIn;
-                        if (!minOutput && v4.amountOutMin)
-                            minOutput = v4.amountOutMin;
-                    }
-                }
-
                 if (cmdId === 0x0c) {
                     hasUnwrapWeth = true;
                 }

src/shared/wallet.js

@@ -41,6 +41,18 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
     return new Wallet(decryptedSecret);
 }
 
+function getPrivateKeyForAddress(walletData, addrIndex, decryptedSecret) {
+    if (walletData.type === "hd") {
+        const node = HDNodeWallet.fromPhrase(
+            decryptedSecret,
+            "",
+            BIP44_ETH_PATH,
+        );
+        return node.deriveChild(addrIndex).privateKey;
+    }
+    return decryptedSecret;
+}
+
 function isValidMnemonic(mnemonic) {
     return Mnemonic.isValidMnemonic(mnemonic);
 }
@@ -51,5 +63,6 @@ module.exports = {
     hdWalletFromMnemonic,
     addressFromPrivateKey,
     getSignerForAddress,
+    getPrivateKeyForAddress,
     isValidMnemonic,
 };

tests/uniswap.test.js

@@ -1,10 +1,9 @@
-const { AbiCoder, Interface, solidityPacked, getBytes } = require("ethers");
+const { AbiCoder, Interface, solidityPacked } = require("ethers");
 const uniswap = require("../src/shared/uniswap");
 
 const ROUTER_ADDR = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
 const USDT_ADDR = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
 const WETH_ADDR = "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2";
-const USDC_ADDR = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
 const USER_ADDR = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 
 // AutistMask's first-ever swap, 2026-02-27.
@@ -257,87 +256,6 @@ describe("uniswap decoder", () => {
         expect(amount.value).toBe("5.0000 USDT");
     });
 
-    // This test validates the decodeV4Swap() fix: a V4 ERC20→ERC20 swap
-    // (USDT→USDC) where the token addresses are ONLY discoverable inside
-    // the V4_SWAP sub-actions (SETTLE/TAKE). Before decodeV4Swap() was added,
-    // command 0x10 was opaque and this would decode as "Uniswap Swap" with
-    // no token info (or "ETH → ETH"). Now it correctly shows "USDT → USDC".
-    test("decodes V4_SWAP ERC20→ERC20 tokens via SETTLE/TAKE (regression: #59)", () => {
-        // Build a V4_SWAP input with SETTLE(USDT) + SWAP_EXACT_IN_SINGLE + TAKE(USDC)
-        const V4_SETTLE = 0x0b;
-        const V4_SWAP_EXACT_IN_SINGLE = 0x06;
-        const V4_TAKE = 0x0e;
-
-        // actions: SETTLE, SWAP_EXACT_IN_SINGLE, TAKE
-        const actions = new Uint8Array([
-            V4_SETTLE,
-            V4_SWAP_EXACT_IN_SINGLE,
-            V4_TAKE,
-        ]);
-
-        // SETTLE params: (address currency, uint256 maxAmount, bool payerIsUser)
-        const settleParam = coder.encode(
-            ["address", "uint256", "bool"],
-            [USDT_ADDR, 5000000n, true],
-        );
-
-        // SWAP_EXACT_IN_SINGLE params:
-        // (tuple(address,address,uint24,int24,address) poolKey, bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
-        const swapParam = coder.encode(
-            [
-                "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
-            ],
-            [
-                [
-                    [
-                        USDT_ADDR,
-                        USDC_ADDR,
-                        100, // fee
-                        1, // tickSpacing
-                        "0x0000000000000000000000000000000000000000", // hooks
-                    ],
-                    true, // zeroForOne
-                    5000000n, // amountIn (5 USDT)
-                    4900000n, // amountOutMin (4.9 USDC)
-                    "0x", // hookData
-                ],
-            ],
-        );
-
-        // TAKE params: (address currency, address recipient, uint256 amount)
-        const takeParam = coder.encode(
-            ["address", "address", "uint256"],
-            [USDC_ADDR, USER_ADDR, 0n],
-        );
-
-        // Encode the V4_SWAP input: (bytes actions, bytes[] params)
-        const v4Input = coder.encode(
-            ["bytes", "bytes[]"],
-            [actions, [settleParam, swapParam, takeParam]],
-        );
-
-        // Build execute() with PERMIT2_PERMIT (0x0a) + V4_SWAP (0x10)
-        // The permit provides the input token, but V4_SWAP must provide
-        // the OUTPUT token — without decodeV4Swap, output would be unknown.
-        const data = buildExecute(
-            solidityPacked(["uint8", "uint8"], [0x0a, 0x10]),
-            [encodePermit2(USDT_ADDR, 5000000n, ROUTER_ADDR), v4Input],
-            9999999999n,
-        );
-
-        const result = uniswap.decode(data, ROUTER_ADDR);
-        expect(result).not.toBeNull();
-        // Before decodeV4Swap fix: name would be "Swap USDT → ETH" or "Uniswap Swap"
-        // After fix: correctly identifies both tokens from V4 sub-actions
-        expect(result.name).toBe("Swap USDT \u2192 USDC");
-
-        const tokenIn = result.details.find((d) => d.label === "Token In");
-        expect(tokenIn.value).toContain("USDT");
-
-        const steps = result.details.find((d) => d.label === "Steps");
-        expect(steps.value).toContain("V4 Swap");
-    });
-
     test("handles unknown tokens gracefully", () => {
         const fakeToken = "0x1111111111111111111111111111111111111111";
         const data = buildExecute(