Ack/dev

[Acktarius]

No description provided.

[roomote-conceal-network]

1 issue outstanding. See task

• Add regression coverage for mixed-case mnemonic decode (cpp/Mnemonics/Mnemonics.cpp:32-43)

Review of 7be6a81 (PR is already merged, so this is post-merge follow-up input)

Verified clean:

• Mnemonics casing fix (correct and important): I compiled Mnemonics.cpp standalone against both base and head. On base, a phrase with a miscased word (e.g. unUsual) passed the checksum — which only hashes the first 3 chars of each word — and the val % wlLen == w1 check, silently decoding a wrong private key (a fund-loss-class bug). On head, the same phrase decodes to the correct key, and negative cases (unknown word, swapped checksum words) are still rejected. All downstream consumers (hasValidChecksum, getWordIndexes, the loop) now use the normalized vector consistently, and mn_decode reaches the fix via the string overload.
• Mnemonics.h: #pragma once + direct #include <string> are correct; matches the convention of every other header under cpp/. clang-format --dry-run --Werror passes on both changed C++ files.
• Peer dependency changes: react ^19.1.1 → ^19.1.0 and react-native ~0.82.0 → >=0.81.0 <0.83.0 are pure broadenings, consistent between package.json and package-lock.json, and don't conflict with devDependencies.

One low-severity follow-up: the repo has no tests at all, and a fix of this severity should get a regression test (details in the inline comment).

_{Reviewed 7be6a81}

[roomote-conceal-network]

🟢 Low: no regression coverage for the mixed-case mnemonic fix

I verified this fix empirically: on main before this PR, a phrase with a miscased word in position 2/3 of a word triple (e.g. unUsual) passed the checksum and the val % wlLen == w1 check, silently decoding a wrong private key (bytes 8–10 differed from the lowercase decode — a fund-loss-class bug). With this normalization the same phrase decodes correctly, and invalid words / tampered checksums are still rejected.

Given that severity, the fix deserves a regression test so it can't be reintroduced. The repo currently has no test script at all; even a small standalone C++ roundtrip check (compilable in CI with just g++, no JS test framework needed) would lock this behavior in:

Suggested change

	/* Normalize to lower case up front so word validation, checksum
	derivation, and word list index lookups all operate on the same
	casing; otherwise a mixed-case phrase can pass validation while
	the index lookup misses and decodes a wrong private key */
	std::vector<std::string> normalizedWords;
	normalizedWords.reserve(words.size());
	for (const auto &word : words) {
	std::string lowerWord = word;
	std::transform(lowerWord.begin(), lowerWord.end(), lowerWord.begin(), ::tolower);
	normalizedWords.push_back(std::move(lowerWord));
	}
	/* Regression-tested: a miscased word previously bypassed the checksum
	(first 3 chars) and word-index lookups here, silently producing a
	wrong private key; normalization must run before every consumer. */
	std::vector<std::string> normalizedWords;

Example invariant to test: mnemonicToPrivateKey(privateKeyToMnemonic(k)) equals mnemonicToPrivateKey(mixedCaseVariantOfThatPhrase) equals k, for variants that uppercase any character at any position, plus negative cases (unknown word, swapped words).