Added Bitcoin WIF & Sui Bech32 private key import/export by ethankonk · Pull Request #109 · tkhq/frames

ethankonk · 2026-01-05T20:00:25Z

No description provided.

socket-security · 2026-01-05T20:00:56Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	bech32@2.0.0

View full report

andrewkmin · 2026-01-06T22:52:24Z

export/index.test.js

+  it("encodes sui bech32 private key correctly", async () => {
+    const keySui =
+      "suiprivkey1qpj5xd9396rxsu7h45tzccalhuf95e4pygls3ps9txszn9ywpwsnznaeq0l";
+    const { _, words} = TKHQ.decodeBech32(keySui);


Suggested change

const { _, words} = TKHQ.decodeBech32(keySui);

const { words} = TKHQ.decodeBech32(keySui);

?

andrewkmin · 2026-01-06T22:59:15Z

export/index.test.js

    expect(encodedKey).toEqual(keySol);
  });

+  it("encodes bitcoin WIF private key correctly", async () => {


looks good per https://learnmeabitcoin.com/technical/keys/private-key/wif/#encoding

andrewkmin · 2026-01-06T23:16:09Z

import/package.json

  "dependencies": {
-    "@hpke/core": "1.7.5"
+    "@hpke/core": "1.7.5",
+    "bech32": "^2.0.0"


let's hardpin this version

andrewkmin · 2026-01-07T15:32:53Z

import/src/turnkey-core.js

+      const schemeFlag = bytes[0];
+      const privkey = bytes.slice(1);
+
+      // TODO: schemeFlag = 0 is Ed25519; figure out if we need to support dynamic curve detection or something


did we end up wanting to do anything with schemeFlag?

Ah good catch, forgot about this, I don't think we need to do anything with it since it seems we only support ED25519 keys for SUI anywase, but will leave a modified version of this comment in-case anyone loops back on this in the future.

andrewkmin · 2026-01-07T19:34:09Z

import/src/turnkey-core.js

+      const schemeFlag = bytes[0];
+      const privkey = bytes.slice(1);
+
+      // schemeFlag = 0 is Ed25519; We currently only support Ed25519 keys for SUI so we do not need to check further.


Do we want to ensure that schemeFlag is indeed 0? or can it be fully disregarded?

Hmm, thats actually a good point, will look into whether this actually matters or not real quick

Ok yep turns out the scheme flag is important since the derived addresses would not match the "expected" addresses from the private key imported (since we'd only be deriving ED25519 addresses rather than the expected curve). Will update this!

Although, couldn't we also support SECP256k1 SUI keys in theory? Might test that out as well but that would also open up a new can of worms on the export side... (choosing the correct scheme flag to encode with)

Although, couldn't we also support SECP256k1 SUI keys in theory? Might test that out as well but that would also open up a new can of worms on the export side... (choosing the correct scheme flag to encode with)

yeah that's a good observation! We technically could, but we don't on the mono side at the moment, and I'm not sure we'll need to anytime soon.

Ok we good, just tried and we indeed only support ED25519 SUI address derivation

andrewkmin · 2026-01-07T19:34:15Z

import/src/turnkey-core.js

+
+      if (prefix !== "suiprivkey") {
+        throw new Error(
+          `invalid SUI private key HRP: expoected "suiprivkey", got "${prefix}"`


Suggested change

`invalid SUI private key HRP: expoected "suiprivkey", got "${prefix}"`

`invalid SUI private key human-readable part (HRP): expected "suiprivkey"`

let's refrain from returning prefix in the error message, just out of an abundance of caution, given it's sensitive material.

andrewkmin · 2026-01-07T19:36:44Z

import/index.test.js

+  it("decodes sui bech32 private key correctly", async () => {
+    const keySuiBech32 =
+      "suiprivkey1qpj5xd9396rxsu7h45tzccalhuf95e4pygls3ps9txszn9ywpwsnznaeq0l";
+    const { _, words } = bech32.decode(keySuiBech32);


Suggested change

const { _, words } = bech32.decode(keySuiBech32);

const { words } = bech32.decode(keySuiBech32);

andrewkmin · 2026-01-07T19:37:26Z

export/index.test.js

+    expect(encodedKey).toEqual(keyWif);
+  });
+
+  it("encodes sui bech32 private key correctly", async () => {


can we add some negative test cases (failures) as well? for both this test file as well as import's

andrewkmin · 2026-01-07T20:28:12Z

export/index.template.html

        }

+        /**
+         * Decodes a base58-check-encoded string into a buffer


Suggested change

* Decodes a base58-check-encoded string into a buffer

* Encodes a base58-check-encoded string into a buffer

``` ?

andrewkmin · 2026-01-07T20:29:45Z

export/index.template.html

+                );
+              }
+
+              const version = 0x80; // mainnet version byte TODO: support testnet? how would we know which to use?


ah, I think this is also to be addressed. Have you been able to test exporting mainnet vs testnet? I figure we'd want to be able to support both; if necessary, we could introduce another case: BITCOIN_MAINNET_WIF, BITCOIN_TESTNET_WIF 😿

Ahhh yes that would be an issue.. will fix that up as well. I think supporting another case would be the cleanest way of doing it. Can't really think of another way atm

andrewkmin · 2026-01-08T17:06:04Z

import/src/turnkey-core.js

+      const keyAndFlags = payload.subarray(1);
+
+      // 0x80 = mainnet, 0xEF = testnet
+      if (version !== 0x80 && version !== 0xEF) {


What are your thoughts on ensuring BITCOIN_MAINNET_WIF aligns with 0x80 and BITCOIN_TESTNET_WIF with 0xEF?

As in link a reference to double check? Or kind of always ensure we use the right values? I don't think the standard should ever change right?

andrewkmin · 2026-01-26T21:25:17Z

export/index.test.js

+    expect(encodedKey).toEqual(keySui);
+  });
+
+  // SUI Bech32 export negative tests


nice to have: test that checks for invalid encoding eg SUI_BECH33 etc

andrewkmin · 2026-01-26T21:26:04Z

export/index.test.js

+  });
+
+  // Bitcoin WIF export negative tests
+  it("rejects bitcoin WIF encoding with wrong private key length", async () => {


nice to have: test that checks for invalid encoding eg BITCOIN_FAKENET_WIF etc

andrewkmin · 2026-01-26T21:28:44Z

import/src/turnkey-core.js

+
+  // Verify checksum
+  for (let i = 0; i < 4; i++) {
+    if (checksum[i] !== computedChecksum[i]) {


can we just check if checksum and computedChecksum are equivalent straight up? instead of looping

ethankonk force-pushed the ethan/wif-bech32-pk-import-export-2 branch 3 times, most recently from 9a7c8bd to 0bcb477 Compare January 6, 2026 17:29

andrewkmin reviewed Jan 7, 2026

View reviewed changes

ethankonk force-pushed the ethan/wif-bech32-pk-import-export-2 branch from 0bcb477 to c4cc20b Compare January 7, 2026 15:21

andrewkmin reviewed Jan 7, 2026

View reviewed changes

andrewkmin previously approved these changes Jan 7, 2026

View reviewed changes

ethankonk dismissed andrewkmin’s stale review via bfb5d72 January 7, 2026 15:56

ethankonk force-pushed the ethan/wif-bech32-pk-import-export-2 branch from c4cc20b to bfb5d72 Compare January 7, 2026 15:56

andrewkmin reviewed Jan 7, 2026

View reviewed changes

ethankonk force-pushed the ethan/wif-bech32-pk-import-export-2 branch 2 times, most recently from 3f79b23 to 0278efc Compare January 8, 2026 16:32

andrewkmin reviewed Jan 8, 2026

View reviewed changes

andrewkmin previously approved these changes Jan 8, 2026

View reviewed changes

ethankonk dismissed andrewkmin’s stale review via c4a669a January 12, 2026 16:04

ethankonk force-pushed the ethan/wif-bech32-pk-import-export-2 branch 5 times, most recently from 7bb2faa to 7d10c10 Compare January 12, 2026 16:18

added Bitcoin WIF & Sui Bech32 private key import/export

20a6009

ethankonk force-pushed the ethan/wif-bech32-pk-import-export-2 branch from 7d10c10 to 20a6009 Compare January 12, 2026 16:21

andrewkmin previously approved these changes Jan 26, 2026

View reviewed changes

addressed comments

44cf19b

ethankonk dismissed andrewkmin’s stale review via 44cf19b January 26, 2026 22:36

andrewkmin approved these changes Jan 26, 2026

View reviewed changes

ethankonk merged commit 599aac8 into main Jan 27, 2026
23 checks passed

ethankonk deleted the ethan/wif-bech32-pk-import-export-2 branch January 27, 2026 00:03

	const { _, words} = TKHQ.decodeBech32(keySui);
	const { words} = TKHQ.decodeBech32(keySui);

	`invalid SUI private key HRP: expoected "suiprivkey", got "${prefix}"`
	`invalid SUI private key human-readable part (HRP): expected "suiprivkey"`

	const { _, words } = bech32.decode(keySuiBech32);
	const { words } = bech32.decode(keySuiBech32);

	* Decodes a base58-check-encoded string into a buffer
	* Encodes a base58-check-encoded string into a buffer
	``` ?

Comments

Conversation

ethankonk commented Jan 5, 2026

Uh oh!

socket-security bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

socket-security bot commented Jan 5, 2026 •

edited

Loading