[PLW003v3-ER03] | PIN not recognized to reveal UTXO PK

jagdeep sidhu · jagdeep sidhu · commit 8b477e17fbb4 · 2026-01-29T16:40:04.000-08:00
fixes #729
diff --git a/source/assets/locales/de.json b/source/assets/locales/de.json
@@ -166,6 +166,7 @@
     "password": "Passwort",
     "importAccountsWont": "Importierte Konten werden nicht mit Ihrer ursprünglichen Pali-Konto-Geheimen Wiederherstellungsphrase verknüpft.",
     "yourPrivateKey": "Ihr privater Schlüssel",
+    "hardwareWalletPrivateKeyUnavailable": "Hardware-Wallet-Konto: Private Schlüssel verlassen Ledger/Trezor-Geräte nie, daher kann Pali sie nicht exportieren.",
     "utxoKeyOnEvmError": "Dies scheint ein UTXO-Privatschlüssel zu sein. Bitte wechseln Sie zu einem UTXO-Netzwerk (Bitcoin/Syscoin), um ihn zu importieren.",
     "evmKeyOnUtxoError": "Dies scheint ein EVM-Privatschlüssel zu sein. Bitte wechseln Sie zu einem EVM-Netzwerk, um ihn zu importieren.",
     "invalidPrivateKeyFormat": "Ungültiges Privatschlüsselformat",
diff --git a/source/assets/locales/en.json b/source/assets/locales/en.json
@@ -485,6 +485,7 @@
     "password": "Password",
     "importAccountsWont": "Imported accounts won't link to your initial Pali account Secret Recovery Phrase.",
     "yourPrivateKey": "Your Private Key",
+    "hardwareWalletPrivateKeyUnavailable": "Hardware wallet account: Private keys never leave Ledger/Trezor devices, so Pali cannot export them.",
     "utxoKeyOnEvmError": "This appears to be a UTXO private key. Please switch to a UTXO network (Bitcoin/Syscoin) to import it.",
     "evmKeyOnUtxoError": "This appears to be an EVM private key. Please switch to an EVM network to import it.",
     "invalidPrivateKeyFormat": "Invalid private key format",
diff --git a/source/assets/locales/es.json b/source/assets/locales/es.json
@@ -485,6 +485,7 @@
     "enterYourPassword": "Ingresa tu contraseña",
     "importAccountsWont": "Las cuentas importadas no estarán vinculadas a la Frase de Recuperación Secreta de tu cuenta Pali inicial.",
     "yourPrivateKey": "Tu Clave Privada",
+    "hardwareWalletPrivateKeyUnavailable": "Cuenta de monedero hardware: Las claves privadas nunca salen de los dispositivos Ledger/Trezor, por lo que Pali no puede exportarlas.",
     "utxoKeyOnEvmError": "Esto parece ser una clave privada UTXO. Por favor, cambia a una red UTXO (Bitcoin/Syscoin) para importarla.",
     "evmKeyOnUtxoError": "Esto parece ser una clave privada EVM. Por favor, cambia a una red EVM para importarla.",
     "invalidPrivateKeyFormat": "Formato de clave privada inválido",
diff --git a/source/assets/locales/fr.json b/source/assets/locales/fr.json
@@ -166,6 +166,7 @@
     "password": "Mot de passe",
     "importAccountsWont": "Les comptes importés ne seront pas liés à votre phrase de récupération secrète initiale du compte Pali.",
     "yourPrivateKey": "Votre clé privée",
+    "hardwareWalletPrivateKeyUnavailable": "Compte de portefeuille matériel : les clés privées ne quittent jamais les appareils Ledger/Trezor, donc Pali ne peut pas les exporter.",
     "utxoKeyOnEvmError": "Cela semble être une clé privée UTXO. Veuillez basculer vers un réseau UTXO (Bitcoin/Syscoin) pour l'importer.",
     "evmKeyOnUtxoError": "Cela semble être une clé privée EVM. Veuillez basculer vers un réseau EVM pour l'importer.",
     "invalidPrivateKeyFormat": "Format de clé privée invalide",
diff --git a/source/assets/locales/ja.json b/source/assets/locales/ja.json
@@ -166,6 +166,7 @@
     "password": "パスワード",
     "importAccountsWont": "インポートされたアカウントは、初期のPaliアカウント秘密リカバリーフレーズにリンクされません。",
     "yourPrivateKey": "あなたの秘密鍵",
+    "hardwareWalletPrivateKeyUnavailable": "ハードウェアウォレットアカウント: 秘密鍵は Ledger/Trezor デバイスから決して外部に出ないため、Pali ではエクスポートできません。",
     "utxoKeyOnEvmError": "これはUTXO秘密鍵のようです。インポートするにはUTXOネットワーク（Bitcoin/Syscoin）に切り替えてください。",
     "evmKeyOnUtxoError": "これはEVM秘密鍵のようです。インポートするにはEVMネットワークに切り替えてください。",
     "invalidPrivateKeyFormat": "無効な秘密鍵フォーマット",
diff --git a/source/assets/locales/ko.json b/source/assets/locales/ko.json
@@ -166,6 +166,7 @@
     "password": "비밀번호",
     "importAccountsWont": "가져온 계정은 초기 Pali 계정 비밀 복구 구문에 연결되지 않습니다.",
     "yourPrivateKey": "개인 키",
+    "hardwareWalletPrivateKeyUnavailable": "하드웨어 지갑 계정: 개인 키는 Ledger/Trezor 기기 밖으로 절대 나가지 않으므로 Pali에서 내보낼 수 없습니다.",
     "utxoKeyOnEvmError": "이것은 UTXO 개인 키로 보입니다. 가져오려면 UTXO 네트워크(Bitcoin/Syscoin)로 전환하세요.",
     "evmKeyOnUtxoError": "이것은 EVM 개인 키로 보입니다. 가져오려면 EVM 네트워크로 전환하세요.",
     "invalidPrivateKeyFormat": "잘못된 개인 키 형식",
diff --git a/source/assets/locales/pt.json b/source/assets/locales/pt.json
@@ -478,6 +478,7 @@
     "password": "Senha",
     "importAccountsWont": "As contas importadas não se vincularão à sua Frase de Recuperação Secreta inicial da conta Pali.",
     "yourPrivateKey": "Sua Chave Privada",
+    "hardwareWalletPrivateKeyUnavailable": "Conta de carteira de hardware: As chaves privadas nunca saem dos dispositivos Ledger/Trezor, portanto o Pali não pode exportá-las.",
     "utxoKeyOnEvmError": "Isso parece ser uma chave privada UTXO. Por favor, mude para uma rede UTXO (Bitcoin/Syscoin) para importá-la.",
     "evmKeyOnUtxoError": "Isso parece ser uma chave privada EVM. Por favor, mude para uma rede EVM para importá-la.",
     "invalidPrivateKeyFormat": "Formato de chave privada inválido",
diff --git a/source/assets/locales/ru.json b/source/assets/locales/ru.json
@@ -166,6 +166,7 @@
     "password": "Пароль",
     "importAccountsWont": "Импортированные аккаунты не будут связаны с вашей изначальной секретной фразой восстановления аккаунта Pali.",
     "yourPrivateKey": "Ваш приватный ключ",
+    "hardwareWalletPrivateKeyUnavailable": "Аппаратный кошелёк: приватные ключи никогда не покидают устройства Ledger/Trezor, поэтому Pali не может их экспортировать.",
     "utxoKeyOnEvmError": "Это похоже на приватный ключ UTXO. Пожалуйста, переключитесь на сеть UTXO (Bitcoin/Syscoin), чтобы импортировать его.",
     "evmKeyOnUtxoError": "Это похоже на приватный ключ EVM. Пожалуйста, переключитесь на сеть EVM, чтобы импортировать его.",
     "invalidPrivateKeyFormat": "Неверный формат приватного ключа",
diff --git a/source/assets/locales/zh.json b/source/assets/locales/zh.json
@@ -166,6 +166,7 @@
     "password": "密码",
     "importAccountsWont": "导入的账户不会链接到您初始的Pali账户密钥恢复短语。",
     "yourPrivateKey": "您的私钥",
+    "hardwareWalletPrivateKeyUnavailable": "硬件钱包账户：私钥永远不会离开 Ledger/Trezor 设备，因此 Pali 无法导出它们。",
     "utxoKeyOnEvmError": "这似乎是一个UTXO私钥。请切换到UTXO网络（Bitcoin/Syscoin）以导入它。",
     "evmKeyOnUtxoError": "这似乎是一个EVM私钥。请切换到EVM网络以导入它。",
     "invalidPrivateKeyFormat": "无效的私钥格式",
diff --git a/source/components/Header/AccountMenu.tsx b/source/components/Header/AccountMenu.tsx
@@ -1,6 +1,7 @@
 import { Menu } from '@headlessui/react';
 import React from 'react';
 import { useTranslation } from 'react-i18next';
+import { useSelector } from 'react-redux';
 
 import {
   AddUserSvg,
@@ -11,6 +12,7 @@ import {
 } from 'components/Icon/Icon';
 import { useUtils } from 'hooks/index';
 import { useController } from 'hooks/useController';
+import { RootState } from 'state/store';
 import { KeyringAccountType } from 'types/network';
 import {
   createNavigationContext,
@@ -23,6 +25,12 @@ export const AccountMenu: React.FC = () => {
   const { navigate } = useUtils();
   const { controllerEmitter, handleWalletLockedError } = useController();
   const { t } = useTranslation();
+  const activeAccountMeta = useSelector(
+    (state: RootState) => state.vault.activeAccount
+  );
+  const isHardwareAccount =
+    activeAccountMeta?.type === KeyringAccountType.Ledger ||
+    activeAccountMeta?.type === KeyringAccountType.Trezor;
   const setActiveAccount = async (id: number, type: KeyringAccountType) => {
     try {
       await controllerEmitter(['wallet', 'setAccount'], [Number(id), type]);
@@ -87,24 +95,26 @@ export const AccountMenu: React.FC = () => {
         </li>
       </Menu.Item>
 
-      <Menu.Item>
-        <li
-          onClick={() => {
-            const returnContext = createNavigationContext('/home');
-            navigateWithContext(
-              navigate,
-              '/settings/account/private-key',
-              { fromMenu: true },
-              returnContext
-            );
-          }}
-          className="py-1.5 cursor-pointer px-6 w-full backface-visibility-hidden flex items-center gap-3 justify-start text-white text-sm font-medium hover:bg-brand-blue500 hover:bg-opacity-20 active:bg-opacity-40 focus:outline-none transition-colors duration-200"
-        >
-          <KeySvg className="mb-2 text-brand-white" />
+      {!isHardwareAccount && (
+        <Menu.Item>
+          <li
+            onClick={() => {
+              const returnContext = createNavigationContext('/home');
+              navigateWithContext(
+                navigate,
+                '/settings/account/private-key',
+                { fromMenu: true },
+                returnContext
+              );
+            }}
+            className="py-1.5 cursor-pointer px-6 w-full backface-visibility-hidden flex items-center gap-3 justify-start text-white text-sm font-medium hover:bg-brand-blue500 hover:bg-opacity-20 active:bg-opacity-40 focus:outline-none transition-colors duration-200"
+          >
+            <KeySvg className="mb-2 text-brand-white" />
 
-          <span>{t('accountMenu.yourKeys')}</span>
-        </li>
-      </Menu.Item>
+            <span>{t('accountMenu.yourKeys')}</span>
+          </li>
+        </Menu.Item>
+      )}
 
       <Menu.Item>
         <li
diff --git a/source/components/Input/ValidatedPasswordInput.tsx b/source/components/Input/ValidatedPasswordInput.tsx
@@ -98,6 +98,7 @@ export const ValidatedPasswordInput: React.FC<IValidatedPasswordInputProps> = ({
   const formRef = useRef(form);
   const nameRef = useRef(name);
   const errorMessageRef = useRef(errorMessage);
+  const validationRunIdRef = useRef(0);
 
   // Update refs when props change
   useEffect(() => {
@@ -129,12 +130,28 @@ export const ValidatedPasswordInput: React.FC<IValidatedPasswordInputProps> = ({
         return;
       }
 
+      // Mark this run as the latest. Any older async results should be ignored.
+      const runId = ++validationRunIdRef.current;
+
       setIsValidating(true);
       setValidationStatus('');
 
+      // Clear any previous error immediately so the UI doesn't flash red while validating
+      if (formRef.current) {
+        formRef.current.setFields([
+          {
+            name: nameRef.current,
+            errors: [],
+          },
+        ]);
+      }
+
       try {
         const result = await onValidateRef.current(password);
 
+        // Ignore stale results (user typed again while this was running)
+        if (runId !== validationRunIdRef.current) return;
+
         setValidationStatus('success');
 
         // Clear form field errors if form is provided
@@ -153,6 +170,10 @@ export const ValidatedPasswordInput: React.FC<IValidatedPasswordInputProps> = ({
         }
       } catch (error) {
         console.error('Password validation error:', error);
+
+        // Ignore stale errors (user typed again while this was running)
+        if (runId !== validationRunIdRef.current) return;
+
         setValidationStatus('error');
 
         // Set form field error if form is provided
@@ -170,7 +191,10 @@ export const ValidatedPasswordInput: React.FC<IValidatedPasswordInputProps> = ({
           onValidationErrorRef.current(error);
         }
       } finally {
-        setIsValidating(false);
+        // Only the latest run should control the loading state
+        if (runId === validationRunIdRef.current) {
+          setIsValidating(false);
+        }
       }
     };
 
diff --git a/source/pages/Settings/PrivateKey.tsx b/source/pages/Settings/PrivateKey.tsx
@@ -8,6 +8,7 @@ import { Card, CopyCard, ValidatedPasswordInput } from 'components/index';
 import { useAdjustedExplorer, useUtils } from 'hooks/index';
 import { useController } from 'hooks/useController';
 import { RootState } from 'state/store';
+import { KeyringAccountType } from 'types/network';
 import { ellipsis } from 'utils/index';
 
 const PrivateKeyView = () => {
@@ -23,6 +24,9 @@ const PrivateKeyView = () => {
   const isBitcoinBased = useSelector(
     (state: RootState) => state.vault.isBitcoinBased
   );
+  const isHardwareAccount =
+    activeAccountMeta.type === KeyringAccountType.Ledger ||
+    activeAccountMeta.type === KeyringAccountType.Trezor;
 
   const { useCopyClipboard, alert } = useUtils();
 
@@ -111,64 +115,84 @@ const PrivateKeyView = () => {
         </CopyCard>
       )}
 
-      <Form
-        validateMessages={{ default: '' }}
-        name="phraseview"
-        form={form}
-        labelCol={{ span: 8 }}
-        wrapperCol={{ span: 16 }}
-        autoComplete="off"
-      >
-        <ValidatedPasswordInput
-          onValidate={validatePassword}
-          onValidationSuccess={handleValidationSuccess}
-          onValidationError={handleValidationError}
-          placeholder={t('settings.enterYourPassword')}
+      {isHardwareAccount ? (
+        <Card type="info" className="my-4">
+          <p>{t('settings.hardwareWalletPrivateKeyUnavailable')}</p>
+        </Card>
+      ) : (
+        <Form
+          validateMessages={{ default: '' }}
+          name="phraseview"
           form={form}
-          name="password"
-          className="my-4"
-        />
-      </Form>
-
-      {/* Private key display - view-only, no copy to prevent clipboard attacks */}
-      <div className="w-full md:max-w-md bg-bkg-4 border border-bkg-4 p-4 text-xs rounded-lg">
-        <div className="flex items-center justify-between w-full">
-          <p>{t('settings.yourPrivateKey')}</p>
-          {valid && currentXprv && (
-            <button
-              type="button"
-              onClick={() => setIsPrivateKeyVisible(!isPrivateKeyVisible)}
-              className="p-1 rounded hover:bg-gray-700 transition-colors duration-200"
-              title={isPrivateKeyVisible ? 'Hide' : 'Show'}
-            >
-              {isPrivateKeyVisible ? (
-                <img
-                  className="w-[18px] max-w-none cursor-pointer hover:cursor-pointer z-20"
-                  src="/assets/all_assets/visibleEye.svg"
-                  alt="Hide"
-                />
-              ) : (
-                <img
-                  className="w-[18px] max-w-none cursor-pointer hover:cursor-pointer z-20"
-                  src="/assets/all_assets/notVisibleEye.svg"
-                  alt="Show"
-                />
-              )}
-            </button>
-          )}
-        </div>
-        <div
-          className={`select-none ${
-            valid && currentXprv && !isPrivateKeyVisible ? 'filter blur-sm' : ''
-          }`}
+          labelCol={{ span: 8 }}
+          wrapperCol={{ span: 16 }}
+          autoComplete="off"
         >
-          <p>
-            {valid && activeAccount.xpub
-              ? ellipsis(currentXprv, 4, 16)
-              : '********...************'}
-          </p>
-        </div>
-      </div>
+          <ValidatedPasswordInput
+            onValidate={validatePassword}
+            onValidationSuccess={handleValidationSuccess}
+            onValidationError={handleValidationError}
+            placeholder={t('settings.enterYourPassword')}
+            form={form}
+            name="password"
+            className="my-4"
+          />
+        </Form>
+      )}
+
+      {!isHardwareAccount && (
+        <>
+          {/* Private key display - view-only, no copy to prevent clipboard attacks */}
+          <div className="w-full md:max-w-md bg-bkg-4 border border-bkg-4 p-4 text-xs rounded-lg">
+            <div className="flex items-center justify-between w-full">
+              <p>{t('settings.yourPrivateKey')}</p>
+              {valid && currentXprv && (
+                <button
+                  type="button"
+                  onClick={() => setIsPrivateKeyVisible(!isPrivateKeyVisible)}
+                  className="p-1 rounded hover:bg-gray-700 transition-colors duration-200"
+                  title={isPrivateKeyVisible ? 'Hide' : 'Show'}
+                >
+                  {isPrivateKeyVisible ? (
+                    <img
+                      className="w-[18px] max-w-none cursor-pointer hover:cursor-pointer z-20"
+                      src="/assets/all_assets/visibleEye.svg"
+                      alt="Hide"
+                    />
+                  ) : (
+                    <img
+                      className="w-[18px] max-w-none cursor-pointer hover:cursor-pointer z-20"
+                      src="/assets/all_assets/notVisibleEye.svg"
+                      alt="Show"
+                    />
+                  )}
+                </button>
+              )}
+            </div>
+            <div
+              className={`${
+                valid && currentXprv && !isPrivateKeyVisible
+                  ? 'select-none filter blur-sm'
+                  : ''
+              }`}
+            >
+              <p
+                className={`${
+                  valid && currentXprv && isPrivateKeyVisible
+                    ? 'font-mono break-all'
+                    : ''
+                }`}
+              >
+                {valid && currentXprv
+                  ? isPrivateKeyVisible
+                    ? currentXprv
+                    : ellipsis(currentXprv, 4, 16)
+                  : '********...************'}
+              </p>
+            </div>
+          </div>
+        </>
+      )}
 
       {isBitcoinBased && (
         <div className="w-full flex items-center justify-center text-brand-white hover:text-brand-deepPink100 my-6">
