Skip to content

saveSecretKey unconditionally overwrites any existing secret with no guard #32

Description

@ndii-dev

secureStorage.ts's saveSecretKey always calls SecureStore.setItemAsync against the same fixed key with no existing-value check. Combined with the create/import screens both calling it, a user who navigates back to /auth/create after already onboarding (e.g. via a deep link, or a stale navigation stack after the missing-persistence bug in a related issue) can silently destroy access to their original address by generating a new one over it, with zero confirmation step.

Definition of done:

  • saveSecretKey (or its callers) refuses to overwrite an existing secret without an explicit, scary, confirmed "replace wallet" step
  • Covers both the create and import entry points
  • Test asserting an existing secret survives an accidental re-entry into either screen

Before opening a PR for this issue, read CONTRIBUTING.md.

This is not a starter-issue. The Definition of done above is the full
acceptance criteria, not a subset to sample from — a PR that addresses part
of it is an unfinished issue, not a smaller one. Your PR must include, in
the PR description itself:

  • Root cause / design-decision rationale in your own words — not a restatement of this issue
  • Every Definition of done bullet above addressed explicitly, with a one-line note on how
  • Evidence the code actually runs: pasted test/build output, a screen recording or before/after screenshots for UI changes, or real (non-mocked) logs for network/contract-facing work
  • New or updated tests included and shown passing (paste the output)
  • Any adjacent/related behavior this issue calls out re-verified, not assumed unaffected

PRs missing these will be sent back before review, not reviewed and rejected — please do this up front.

Metadata

Metadata

Assignees

Labels

GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions