Skip to content

[Fix] Wallet import fails or decodes the wrong key when mnemonic words are capitalized - #4

Merged
Acktarius merged 2 commits into
mainfrom
fix/mixed-case-mnemonic-decode-2gxmto3vencf1
Aug 27, 2026
Merged

[Fix] Wallet import fails or decodes the wrong key when mnemonic words are capitalized#4
Acktarius merged 2 commits into
mainfrom
fix/mixed-case-mnemonic-decode-2gxmto3vencf1

Conversation

@roomote-conceal-network

Copy link
Copy Markdown

​Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

What changed

mnemonicToPrivateKey now lowercases the entire phrase once at the decode entry point, before any validation or decoding happens. Previously, word validation lowercased a throwaway copy while the checksum derivation and word-list index lookup used the original casing, so a capitalized word (e.g. autocapitalized "Iodine" from a mobile keyboard) made the phrase either fail to decode or decode through a missed word-list lookup that produced wordlist-size indexes and garbage key bytes.

Why this change was made

A user retyping their 25-word phrase on a mobile keyboard with autocapitalize could end up importing nothing or — worse — a valid-looking but wrong private key, with no clear error pointing at the casing. Normalizing case once up front makes word validation, checksum verification, and index lookup all operate on identical input, so any casing variation of a valid mnemonic decodes to the same key it did before.

Impact

Mixed-case mnemonic phrases now decode to exactly the same private key as their lowercase originals, instead of failing or silently decoding a different key. Already-lowercase phrases are unaffected (tolower is a no-op), and rejection behavior is preserved: unknown words and tampered checksums are still rejected exactly as before.

Verified with a standalone g++ harness compiled against both the pre-fix and fixed sources: pre-fix, every mixed-case variant (all-capitalized and single-capitalized word) failed to decode to the correct key; post-fix all variants decode correctly and invalid phrases are still rejected. npm run lint, npm run check, and npm run cpp pass. This repo has no JS test suite, and a full native build requires a host RN app, so those were not run.

@roomote-conceal-network

roomote-conceal-network Bot commented Aug 27, 2026

Copy link
Copy Markdown
Author

No new code issues found. See task

Reviewed cd67814

Acktarius added a commit that referenced this pull request Aug 27, 2026
@Acktarius
Acktarius merged commit ddf1e51 into main Aug 27, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants