Repository navigation
Export the private key of the active chain's wallet - #350
Merged
Merged
Conversation
The export-key page read useEthereumEmbeddedWallet unconditionally, so on a Solana project it resolved no matching account and every export failed the active-account assertion. The page now selects the hook for the configured chain, and the owner-key explanation is scoped to Ethereum smart accounts, which are the only accounts that have one. A failed export also rendered one blanket sentence whatever went wrong. It now reports the error's own short message and keeps the blanket sentence as the fallback. The exported-key fixture is a repeated character rather than a realistic base58 string, which the secret scanner reads as a live credential. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
commit: |
Merged
This was referenced Sep 17, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces #345, rebuilt on current
mainwith the secret-scanner failure fixed. Same change, same author; #345's single commit could not be made to pass gitleaks without rewriting it, since CI scans the wholeBASE_SHA..HEADrange and the finding is in that commit.What
The modal's "Export key" page calls
useEthereumEmbeddedWallet()unconditionally. On a Solana project that hook resolves no matching account, socaptureActiveAccountIdentityhandsassertActiveEmbeddedAccountanEVMidentity whileembeddedWallet.get()returns the liveSVMaccount. The assertion throwsWalletNotConnectedErrorand the page renders it as "You cannot export the private key for this wallet." — for every Solana user, always. The call never reaches the SDK.Export itself is chain-agnostic:
openfort-js'sexportPrivateKeyissigner.export()through the iframe, anduseSolanaEmbeddedWalletalready exposes the same action, returning the base58 secret key.Change
ExportKeyselects the hook for the configuredchainType, the wayLoadWallets,RecoverandSignMessagealready do.ownerAddress, so the copy never applied there.shortMessageand keeps the blanket sentence as the fallback. Every failure previously rendered identically, including transient ones like a wallet that is still reconnecting.generic-api-key, entropy 4.99), and AGENTS.md asks fixtures to use obviously fake values. The allowlist was the wrong place for it: that list is for values published by design, and the test only checks that the page renders whatever the hook returns.Tests
src/__tests__/pages/ExportKey.test.tsx— four cases: exports through the Solana hook on a Solana project (and never touches the Ethereum one), the same for Ethereum, the owner-key copy appears only for an Ethereum smart account, and a failure surfaces its own reason.Per AGENTS.md, verified against this branch: restoring
const wallet = ethereumWalletfails the two Solana-path cases.pnpm check,pnpm check:types,pnpm test:unit(889) andpnpm scan:secretspass locally.Not verified
Not exercised in a real browser against a live embedded signer. The chain routing and error reporting are covered at the page level; a devnet export through
<OpenfortButton />on a Solana project is worth doing before release.Reported by a Solana devnet integrator alongside #341 and #342.
🤖 Generated with Claude Code