From 6d0592c9347d3d8918db35bba12f7a4fc7318445 Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@zoso.dev>
Date: Sun, 26 Apr 2026 13:16:11 -0700
Subject: [PATCH] Extract child key derivation function selection into separate
 function for reuse and to fix coin value.

---
 src/lib/vault/vault-worker.ts | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index efe4d7f..39fc3ae 100644
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -173,14 +173,10 @@ async function derive (index?: number): Promise<Record<string, number | ArrayBuf
 		if (typeof index !== 'number') {
 			throw new Error('Invalid wallet account index')
 		}
-		const derive = _type === 'BIP-44'
-			? Bip44.ckd('ed25519 seed', _seed, BIP44_COIN_NANO, index)
-			: _type === 'Exodus'
-				? Bip44.ckd('Bitcoin seed', _seed, 0x100, index, 0, 0)
-				: Blake2b.ckd(_seed, index)
-		return derive.then(result => {
+		return _ckd(index).then(result => {
 			const prv = new Uint8Array(result)
 			const pub = nano25519_derive(prv)
+			prv.fill(0)
 			_timer = new VaultTimer(() => lock(), _timeout)
 			return { index, publicKey: pub.buffer }
 		})
@@ -242,13 +238,11 @@ async function sign (index?: number, data?: ArrayBuffer): Promise<Record<string,
 		if (data == null) {
 			throw new Error('Data to sign not found')
 		}
-		const derive = _type === 'BLAKE2b'
-			? Blake2b.ckd(_seed, index)
-			: Bip44.ckd(_type === 'Exodus' ? 'Bitcoin seed' : 'ed25519 seed', _seed, BIP44_COIN_NANO, index)
-		return derive.then(result => {
+		return _ckd(index).then(result => {
 			const prv = new Uint8Array(result)
 			const pub = nano25519_derive(prv)
 			const sig = nano25519_sign(new Uint8Array(data), new Uint8Array([...prv, ...pub]))
+			prv.fill(0)
 			_timer = new VaultTimer(() => lock(), _timeout)
 			return { signature: sig.buffer }
 		})
@@ -478,6 +472,23 @@ function _extractData (action: string, data: Record<string, unknown>) {
 	}
 }
 
+function _ckd (index: number): Promise<ArrayBuffer> {
+	if (_seed == null) {
+		throw new Error('Wallet seed not found')
+	}
+	switch (_type) {
+		case ('BIP-44'): {
+			return Bip44.ckd('ed25519 seed', _seed, BIP44_COIN_NANO, index)
+		}
+		case ('Exodus'): {
+			return Bip44.ckd('Bitcoin seed', _seed, 0x100, index, 0, 0)
+		}
+		default: {
+			return Blake2b.ckd(_seed, index)
+		}
+	}
+}
+
 /**
 * Encrypts an existing seed or mnemonic+salt and returns the initialization
 * vector, salt, and encrypted data representing the wallet in a locked state.
-- 
2.47.3