@chainberry/trust-wallet-core 2.5.1 → 2.5.2

package/ChainberryTrustWalletCoreModule.podspec

@@ -19,4 +19,10 @@ Pod::Spec.new do |s|
 
   s.dependency 'ExpoModulesCore'
   s.dependency 'TrustWalletCore', '4.1.19'
+
+  s.test_spec 'ConformanceTests' do |ts|
+    ts.source_files = 'ios/ConformanceTests/*.swift'
+    ts.dependency 'TrustWalletCore', '4.1.19'
+    ts.resources = ['conformance/signing-vectors.json', 'conformance/address-derivation-vectors.json']
+  end
 end

package/README.md

@@ -24,6 +24,34 @@ GitHub Packages auth is still needed (via `GITHUB_ACTOR`/`GITHUB_TOKEN` env vars
 
 Android biometric gating additionally pulls in `androidx.biometric:biometric:1.1.0`.
 
+## Publish
+
+This package is consumed by the app via `file:modules/trust-wallet-core` (see the root
+`package.json`), not an npm workspace under `packages/*` — so, unlike
+`@chainberry/expo-wallet-sdk`, there's no `-w` flag to use; run these from inside this directory.
+There's also no build step: this package ships its TypeScript source directly (`main`/`types`
+point at `src/index.ts`), so no `prepublishOnly` rebuild happens either.
+
+1. Bump the version (in `package.json`, or via):
+   ```sh
+   cd modules/trust-wallet-core
+   npm version patch   # or minor / major
+   ```
+2. Dry-run first — prints exactly what would be published without touching the registry:
+   ```sh
+   npm publish --dry-run
+   ```
+3. Publish for real:
+   ```sh
+   npm publish
+   ```
+   `publishConfig.access: "public"` in this package's own `package.json` already covers the
+   `--access public` flag scoped packages otherwise need.
+
+Requires npm registry publish auth (an `_authToken` for `@chainberry`, e.g. via `.npmrc` — not
+committed to git). This is separate from the GitHub Packages auth mentioned above, which is only
+needed for bumping the pinned Android wallet-core artifact, not for publishing this npm package.
+
 ## Usage
 
 ```ts
@@ -71,11 +99,11 @@ Both platforms pin **Trust Wallet Core 4.1.19** (`com.trustwallet:wallet-core:4.
 
 **Byte-for-byte signing output is verified for 8 of 9 signable chains** in `conformance/signing-vectors.json`, asserted by `src/androidTest/.../SigningConformanceTest.kt`. Each vector calls `ChainSigner.sign()` — the same call path production code uses — with a fixed, deterministic (not necessarily broadcast-valid) unsigned tx. `ton` is verified but _not_ byte-exact-asserted: `signTon()` embeds a wall-clock `expireAt` into the signed payload, so its output legitimately differs every run — the test instead checks the output is a well-formed signed BOC. `bitcoincash` has no signing vector (sending is unsupported, see above).
 
-Both Android suites are CI-gated on every push/PR (`.github/workflows/ci.yml`'s `android-unit-tests` and `android-instrumented-tests` jobs, via `example/` — see that folder's README for why an Expo host app is needed to build this module at all). iOS's CI job is still a structural podspec lint only; see the conformance-suite note below for what's missing to close that gap.
+Both Android suites are CI-gated on every push/PR (`.github/workflows/ci.yml`'s `android-unit-tests` and `android-instrumented-tests` jobs, via `example/` — see that folder's README for why an Expo host app is needed to build this module at all). iOS is CI-gated via the `ios-conformance-tests` job: `expo prebuild` generates the Xcode workspace, `pod install` wires up the `ConformanceTests` test_spec declared in the podspec (CocoaPods includes test_specs automatically — there is no `--include-test-specs` flag), and `xcodebuild test` runs both `AddressDerivationConformanceTests` and `SigningConformanceTests` on an iPhone 16 simulator.
 
 **Tron divergence resolved.** iOS's `signTron` used to hand wallet-core the full `rawJson` and return its own reconstruction, diverging from Android's `txId`-only input + manual JSON reassembly — and `TronSigningInput` has no `rawJson` field in the pinned 4.1.19 anyway, so the old iOS code didn't compile. iOS now signs the same way Android does: `TronSigningInput.txID` set to the digest, signature reassembled into `{...tx, signature}` in app code (see `ios/ChainSigning.swift`'s `signTron`). Same key + same digest is guaranteed to produce the same ECDSA signature, so this is a structural fix, not something that needs a device to confirm.
 
-**iOS conformance suites are written but not yet wired into a runnable target.** `ios/ConformanceTests/AddressDerivationConformanceTests.swift` and `SigningConformanceTests.swift` mirror the Android fixtures above (all 10 address-derivation chains, the same 8 signing vectors, including a `testTron()` that asserts the reassembled signature matches Android's byte-for-byte). Neither file is part of the `ConformanceTests/` SwiftPM package (which still only builds the amount-parsing target — these two `import WalletCore`/`import XCTest`, which that dependency-free package deliberately avoids) or of any Xcode project (`ios/` is gitignored, regenerated by `expo prebuild`, so nothing durable lives there). An iOS engineer still needs to add both files to an XCTest target in the host app's workspace that links `WalletCore.xcframework`, run them on a Mac, and promote `conformance/signing-vectors.json`'s `tron` vector off `"verified-android-only"` once that run confirms the signature match. Until then, `ChainKey.coinType` mapping identically to Android's makes address derivation _likely_ correct on iOS, but this hasn't been independently run on-device.
+**iOS conformance suites are wired via CocoaPods `test_spec`.** `ios/ConformanceTests/AddressDerivationConformanceTests.swift` and `SigningConformanceTests.swift` mirror the Android fixtures above (all 10 address-derivation chains, the same 8 signing vectors, including a `testTron()` that asserts the reassembled signature matches Android's byte-for-byte). Both are declared as a `test_spec 'ConformanceTests'` in `ChainberryTrustWalletCoreModule.podspec`, which links them against `TrustWalletCore 4.1.19` and embeds the JSON fixtures as bundle resources. Running `pod install` from `example/ios` creates the `ChainberryTrustWalletCoreModule-ConformanceTests` scheme in the workspace automatically. The `ConformanceTests/` SwiftPM package continues to test only amount-parsing (no WalletCore dependency, runs standalone via `swift test`). The `tron` signing vector remains `"verified-android-only"` in the JSON until the iOS CI job's first green run confirms the signature matches byte-for-byte.
 
 ## License
 

package/android/src/androidTest/java/com/chainberry/trustwalletcore/AddressDerivationConformanceTest.kt

@@ -44,7 +44,7 @@ class AddressDerivationConformanceTest {
 
     // Chains with expected addresses confirmed against WalletCore 4.1.19, on a real device/emulator.
     // ETH / BNB / POL all share CoinType.ETHEREUM (same secp256k1 key, BIP44 m/44'/60'/0'/0/0).
-    val VERIFIED = mapOf(
+    val verified = mapOf(
       CoinType.ETHEREUM to "0x9858EfFD232B4033E47d90003D41EC34EcaEda94", // ethereum / bnb / polygon
       CoinType.SMARTCHAIN to "0x9858EfFD232B4033E47d90003D41EC34EcaEda94", // bnb (same key as ethereum)
       CoinType.BITCOIN to "bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu",
@@ -63,13 +63,13 @@ class AddressDerivationConformanceTest {
 
     // Steady state is empty — add a chain's CoinType here (and drop it from VERIFIED) only while
     // actively harvesting a newly-added chain's address for the first time.
-    val PENDING = emptyList<CoinType>()
+    val pending = emptyList<CoinType>()
   }
 
   @Test
   fun verifiedAddressesMatch() {
     val wallet = HDWallet(MNEMONIC, "")
-    for ((coin, expected) in VERIFIED) {
+    for ((coin, expected) in verified) {
       val actual = wallet.getAddressForCoin(coin)
       assertEquals("address mismatch for coin=${coin.name}", expected, actual)
     }
@@ -96,7 +96,7 @@ class AddressDerivationConformanceTest {
   @Test
   fun printPendingAddressesForVerification() {
     val wallet = HDWallet(MNEMONIC, "")
-    val lines = PENDING.map { coin -> "  ${coin.name} -> ${wallet.getAddressForCoin(coin)}" }
+    val lines = pending.map { coin -> "  ${coin.name} -> ${wallet.getAddressForCoin(coin)}" }
     println(
       "\n[AddressDerivationConformanceTest] Pending — verify and move to VERIFIED map:\n" +
         lines.joinToString("\n")

package/android/src/androidTest/java/com/chainberry/trustwalletcore/SigningConformanceTest.kt

@@ -125,7 +125,7 @@ class SigningConformanceTest {
     // methodology). "ton" is deliberately absent — signTon() embeds a wall-clock
     // `expireAt = now + 600s` into the signed payload, so its output is never byte-reproducible
     // across runs; see tonVectorIsWellFormed() below for what's actually checked instead.
-    val EXPECTED: Map<String, String> = mapOf(
+    val expectedOutputs: Map<String, String> = mapOf(
       "ethereum" to "0xf86c808504a817c800825208949858effd232b4033e47d90003d41ec34ecaeda94880de0b6b3a76400008026a0b7cca5f69561cd482cec4e692bd2da17d9eb1d6b3a83fe3f7f11d117de99ca97a00ad0dc153460e39b355c226a2744fc2926f84b95b89c954551571f1bbc251478",
       "polygon" to "0x02f874818980843b9aca008509502f9000825208949858effd232b4033e47d90003d41ec34ecaeda94880de0b6b3a764000080c001a038b5c72ee38aa18607462b80ab0cb170a8d4df1c4090ac49acd41d6b4b0f9acca05bdee390ee8a50ff569f55d408371213df72a3065902b07317289b39788cb434",
       "bitcoin" to "0100000000010100000000000000000000000000000000000000000000000000000000000000000000000000000000000250c3000000000000160014c0cebcd6c3d3ca8c75dc5ec62ebe55330ef910e2cebd000000000000160014c0cebcd6c3d3ca8c75dc5ec62ebe55330ef910e20247304402201e8f3663c97712bbf662c96df532e701ca9b660b507ab170d7b4ffbd966d4be0022033bd537c7720b1e7be2b7663d1a0adcbe565ff18a25794aec828015529ab80e101210330d54fd0dd420a6e5f8d3624f5f3482cae350f79d5f0753bf5beef9c2d91af3c00000000",
@@ -160,7 +160,7 @@ class SigningConformanceTest {
   fun signedOutputsMatch() {
     val wallet = HDWallet(MNEMONIC, "")
     for ((chain, pair) in vectors()) {
-      val expected = EXPECTED[chain] ?: continue
+      val expected = expectedOutputs[chain] ?: continue
       val (chainKey, unsignedTx) = pair
       val actual = ChainSigner.sign(chainKey, wallet, unsignedTx, isTestnet = false).signedTx
       assertEquals("signed output mismatch for chain=$chain", expected, actual)

package/android/src/main/java/com/chainberry/trustwalletcore/ChainSigning.kt

@@ -13,14 +13,14 @@ import wallet.core.jni.Hash
 import wallet.core.jni.PrivateKey
 import wallet.core.jni.SolanaTransaction
 import wallet.core.jni.TransactionDecoder
+import wallet.core.jni.proto.Aptos
 import wallet.core.jni.proto.Bitcoin
 import wallet.core.jni.proto.Common
-import wallet.core.jni.proto.Aptos
 import wallet.core.jni.proto.Cosmos
-import wallet.core.jni.proto.Tezos
 import wallet.core.jni.proto.Ethereum
 import wallet.core.jni.proto.Ripple
 import wallet.core.jni.proto.Solana
+import wallet.core.jni.proto.Tezos
 import wallet.core.jni.proto.TheOpenNetwork
 import wallet.core.jni.proto.Tron
 import java.math.BigInteger
@@ -687,10 +687,10 @@ internal fun ChainSigner.buildSummary(chain: ChainKey, unsignedTx: Map<String, A
       val firstContract = (unsignedTx["raw_data"] as? Map<String, Any>)
         ?.let { (it["contract"] as? List<Map<String, Any>>)?.firstOrNull() }
       firstContract?.let { contract ->
-        val type_ = contract["type"] as? String ?: ""
+        val contractType = contract["type"] as? String ?: ""
         val value = (contract["parameter"] as? Map<String, Any>)
           ?.let { it["value"] as? Map<String, Any> }
-        when (type_) {
+        when (contractType) {
           "TransferContract" -> value?.let { v ->
             (v["to_address"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
             (v["amount"] as? Number)?.let { lines += "Amount: ${fmtAmt(it.toDouble() / 1e6)} TRX" }
@@ -710,21 +710,20 @@ internal fun ChainSigner.buildSummary(chain: ChainKey, unsignedTx: Map<String, A
               lines += "Contract call: ${stripped.length / 2} bytes — review carefully"
             }
           }
-          else -> if (type_.isNotEmpty()) lines += "Contract type: $type_ — review carefully"
-        }
-      }
-      (unsignedTx["txID"] as? String)?.let { txId ->
-        val rawHex = unsignedTx["raw_data_hex"] as? String
-        if (rawHex != null) {
-          val computed = java.security.MessageDigest.getInstance("SHA-256")
-            .digest(rawHex.hexToBytes()).toHex()
-          if (computed.lowercase() != txId.lowercase())
-            throw ChainSigningException("TRX txID does not match SHA256(raw_data_hex) — signing refused")
-          lines += "TxID verified ✓"
-        } else {
-          lines += "TxID: ${txId.take(16)}… (raw_data_hex absent — unverified)"
+          else -> if (contractType.isNotEmpty()) lines += "Contract type: $contractType — review carefully"
         }
       }
+      // Verify txID == SHA256(raw_data_hex). Both fields must be present — fail closed if either
+      // is absent so a JS caller cannot suppress the integrity check by omitting raw_data_hex.
+      val txId = unsignedTx["txID"] as? String
+        ?: throw ChainSigningException("TRX txID missing — signing refused")
+      val rawHex = unsignedTx["raw_data_hex"] as? String
+        ?: throw ChainSigningException("TRX raw_data_hex missing — cannot verify txID, signing refused")
+      val computed = java.security.MessageDigest.getInstance("SHA-256")
+        .digest(rawHex.hexToBytes()).toHex()
+      if (computed.lowercase() != txId.lowercase())
+        throw ChainSigningException("TRX txID does not match SHA256(raw_data_hex) — signing refused")
+      lines += "TxID verified ✓"
     }
     ChainKey.SOLANA -> {
       val info = (unsignedTx["unsignedTxBase64"] as? String)?.let { decodeSolanaForSummary(it) }
@@ -740,14 +739,28 @@ internal fun ChainSigner.buildSummary(chain: ChainKey, unsignedTx: Map<String, A
         if (!info.isTransfer) lines += "Non-transfer instruction — review carefully"
       }
     }
-    ChainKey.SOLANA -> lines += "(Solana — details verified by the network)"
     ChainKey.BITCOINCASH -> {
-      try {
-        val descriptor = JSONObject((unsignedTx["unsignedDescriptorJson"] as? String) ?: "")
-        descriptor.optString("toAddress").takeIf { it.isNotEmpty() }?.let { lines += "To: ${fmtAddr(it)}" }
-        val sats = descriptor.optLong("sendAmountSats", -1L)
-        if (sats >= 0) lines += "Amount: ${fmtAmt(sats.toDouble() / 1e8)} BCH"
-      } catch (_: Exception) {}
+      // Fail closed — if descriptor is absent or unparseable we cannot show what will be signed.
+      val descriptorJson = unsignedTx["unsignedDescriptorJson"] as? String
+        ?: throw ChainSigningException("Cannot decode BCH descriptor — signing refused to prevent blind signing")
+      val descriptor = try {
+        JSONObject(descriptorJson)
+      } catch (_: Exception) {
+        throw ChainSigningException("Cannot parse BCH descriptor JSON — signing refused")
+      }
+      descriptor.optString("toAddress").takeIf { it.isNotEmpty() }?.let { lines += "To: ${fmtAddr(it)}" }
+      val sendSats = descriptor.optLong("sendAmountSats", -1L)
+      if (sendSats >= 0) lines += "Amount: ${fmtAmt(sendSats.toDouble() / 1e8)} BCH"
+      descriptor.optString("changeAddress").takeIf { it.isNotEmpty() }?.let { lines += "Change to: ${fmtAddr(it)}" }
+      val spb = descriptor.optInt("satsPerByte", -1)
+      if (spb >= 0) lines += "Fee rate: $spb sat/vB"
+      @Suppress("UNCHECKED_CAST")
+      val inputTotal = (unsignedTx["inputs"] as? List<Map<String, Any>>)
+        ?.mapNotNull { (it["amountSats"] as? String)?.toLongOrNull() }
+        ?.fold(0L, Long::plus) ?: descriptor.optLong("inputTotalSats", 0L)
+      val changeSats = descriptor.optLong("changeAmountSats", 0L)
+      val totalFee = inputTotal - sendSats.coerceAtLeast(0L) - changeSats
+      if (totalFee > 0) lines += "Total fee: ${fmtAmt(totalFee.toDouble() / 1e8)} BCH"
     }
     ChainKey.COSMOS -> {
       (unsignedTx["toAddress"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
@@ -852,12 +865,16 @@ private fun decodeSolanaForSummary(b64: String): SolanaSummary? {
     }
 
     null
-  } catch (_: Exception) { null }
+  } catch (_: Exception) {
+    null
+  }
 }
 
 private fun txHexToDouble(hex: String): Double = try {
   BigInteger(hex.removePrefix("0x").ifEmpty { "0" }, 16).toDouble()
-} catch (_: NumberFormatException) { 0.0 }
+} catch (_: NumberFormatException) {
+  0.0
+}
 
 private fun fmtAmt(value: Double): String =
   "%.8f".format(value).trimEnd('0').trimEnd('.')

package/android/src/main/java/com/chainberry/trustwalletcore/ChainberryTrustWalletCoreModule.kt

@@ -7,8 +7,8 @@ import expo.modules.kotlin.exception.CodedException
 import expo.modules.kotlin.functions.Coroutine
 import expo.modules.kotlin.modules.Module
 import expo.modules.kotlin.modules.ModuleDefinition
-import kotlinx.coroutines.sync.Mutex
 import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.sync.Mutex
 import wallet.core.jni.HDWallet
 import java.util.UUID
 import kotlin.coroutines.resume
@@ -86,19 +86,21 @@ class ChainberryTrustWalletCoreModule : Module() {
       }
     }
 
-    // strength 128 = 12 words, 256 = 24 words. Returns { walletId, addresses }.
+    // strength 128 = 12 words, 256 = 24 words. Returns { walletId, addresses, isTestnet }.
     // No BIP-39 passphrase support: signTransaction always reconstructs the wallet with an
     // empty passphrase, so accepting one here would derive addresses from a seed different
     // from the one actually used to sign — always pass "" to stay consistent with that.
     // isTestnet selects the address format for BTC/LTC/BCH (see ChainSigner.addressForChain) —
-    // every other chain's address is the same on mainnet and testnet.
+    // every other chain's address is the same on mainnet and testnet. This value is persisted
+    // as immutable per-wallet metadata (NativeWalletStore.WalletRecord) — signTransaction reads
+    // it back from there instead of accepting it as a parameter, so it can never drift.
     AsyncFunction("createWallet") Coroutine { strength: Int, isTestnet: Boolean ->
       val wallet = HDWallet(strength, "")
       persistNewWallet(wallet, isTestnet)
     }
 
     // One-time mnemonic exposure from JS, at import only — never retained after this call.
-    // Returns { walletId, addresses }. No BIP-39 passphrase support (see `createWallet`).
+    // Returns { walletId, addresses, isTestnet }. No BIP-39 passphrase support (see `createWallet`).
     AsyncFunction("importWallet") Coroutine { mnemonic: String, isTestnet: Boolean ->
       val wallet = HDWallet(mnemonic, "") // throws on invalid mnemonic
       persistNewWallet(wallet, isTestnet)
@@ -106,8 +108,8 @@ class ChainberryTrustWalletCoreModule : Module() {
 
     // Reads only the ungated metadata store — no biometric prompt.
     AsyncFunction("listWallets") {
-      NativeWalletStore.loadMetadata(context).map { (walletId, addresses) ->
-        mapOf("walletId" to walletId, "addresses" to addresses)
+      NativeWalletStore.loadMetadata(context).map { (walletId, record) ->
+        mapOf("walletId" to walletId, "addresses" to record.addresses, "isTestnet" to record.isTestnet)
       }
     }
 
@@ -133,9 +135,11 @@ class ChainberryTrustWalletCoreModule : Module() {
     }
 
     // Triggers the native biometry/device-credential prompt, then signs entirely in-process.
-    // Returns { signedTx, meta? }. isTestnet must match whatever `createWallet`/`importWallet`
-    // used — see ChainSigner.keyForChain (a mismatch signs with the wrong key for BTC/LTC).
-    AsyncFunction("signTransaction") Coroutine { walletId: String, chain: String, unsignedTx: Map<String, Any>, isTestnet: Boolean ->
+    // Returns { signedTx, meta? }. Network mode (mainnet/testnet) is read from the wallet's own
+    // persisted record, not accepted as a parameter — see ChainSigner.keyForChain and
+    // NativeWalletStore.WalletRecord for why a caller-supplied value here could sign with the
+    // wrong key for BTC/LTC.
+    AsyncFunction("signTransaction") Coroutine { walletId: String, chain: String, unsignedTx: Map<String, Any> ->
       val id = NativeWalletStore.validateWalletId(walletId)
       val chainKey = ChainKey.fromJs(chain)
       confirmTransaction(chainKey, unsignedTx)
@@ -145,22 +149,21 @@ class ChainberryTrustWalletCoreModule : Module() {
       // Backfill any addresses missing from metadata (chains added after wallet was created).
       // Runs silently after the biometric gate — no extra prompt needed.
       val metadata = NativeWalletStore.loadMetadata(context).toMutableMap()
-      @Suppress("UNCHECKED_CAST")
-      val storedAddresses = (metadata[id] as? Map<String, String>)?.toMutableMap()
-      if (storedAddresses != null) {
-        var changed = false
-        for (chainEntry in ChainKey.entries) {
-          val key = chainEntry.name.lowercase()
-          if (!storedAddresses.containsKey(key)) {
-            storedAddresses[key] = ChainSigner.addressForChain(wallet, chainEntry, isTestnet)
-            changed = true
-          }
-        }
-        if (changed) {
-          metadata[id] = storedAddresses
-          runCatching { NativeWalletStore.saveMetadata(context, metadata) }
+      val record = metadata[id] ?: throw NativeWalletStoreError.NotFound(id)
+      val isTestnet = record.isTestnet
+      val storedAddresses = record.addresses.toMutableMap()
+      var changed = false
+      for (chainEntry in ChainKey.entries) {
+        val key = chainEntry.name.lowercase()
+        if (!storedAddresses.containsKey(key)) {
+          storedAddresses[key] = ChainSigner.addressForChain(wallet, chainEntry, isTestnet)
+          changed = true
         }
       }
+      if (changed) {
+        metadata[id] = record.copy(addresses = storedAddresses)
+        runCatching { NativeWalletStore.saveMetadata(context, metadata) }
+      }
       val result = ChainSigner.sign(chainKey, wallet, unsignedTx, isTestnet)
       val response = mutableMapOf<String, Any>("signedTx" to result.signedTx)
       result.meta?.let { response["meta"] = it }
@@ -175,8 +178,8 @@ class ChainberryTrustWalletCoreModule : Module() {
     }
   }
 
-  /// Shows a native AlertDialog with decoded tx details before biometric auth fires.
-  /// The user must tap "Confirm & Sign" — cancelling throws UserCancelled.
+  // Shows a native AlertDialog with decoded tx details before biometric auth fires.
+  // The user must tap "Confirm & Sign" — cancelling throws UserCancelled.
   private suspend fun confirmTransaction(chain: ChainKey, unsignedTx: Map<String, Any>) {
     val message = ChainSigner.buildSummary(chain, unsignedTx)
     suspendCancellableCoroutine<Unit> { continuation ->
@@ -211,7 +214,7 @@ class ChainberryTrustWalletCoreModule : Module() {
 
     try {
       val metadata = NativeWalletStore.loadMetadata(context).toMutableMap()
-      metadata[walletId] = addresses
+      metadata[walletId] = NativeWalletStore.WalletRecord(isTestnet, addresses)
       NativeWalletStore.saveMetadata(context, metadata)
     } catch (e: Exception) {
       // The mnemonic/key is already persisted but has no metadata pointer — compensate by
@@ -222,6 +225,6 @@ class ChainberryTrustWalletCoreModule : Module() {
       throw e
     }
 
-    return mapOf("walletId" to walletId, "addresses" to addresses)
+    return mapOf("walletId" to walletId, "addresses" to addresses, "isTestnet" to isTestnet)
   }
 }

package/android/src/main/java/com/chainberry/trustwalletcore/NativeWalletStore.kt

@@ -80,8 +80,7 @@ enum class AuthMode(val aliasInfix: String) {
  * Extends `CodedException` directly (rather than a flat `Exception`) so `.code` survives the
  * Expo bridge losslessly with no extra wrapping step.
  */
-sealed class NativeWalletStoreError private constructor(code: String, message: String, cause: Throwable? = null) :
-  CodedException(code, message, cause) {
+sealed class NativeWalletStoreError private constructor(code: String, message: String, cause: Throwable? = null) : CodedException(code, message, cause) {
 
   class NotFound(walletId: String) :
     NativeWalletStoreError("ERR_WALLET_NOT_FOUND", "Wallet not found: $walletId")
@@ -542,17 +541,27 @@ object NativeWalletStore {
     }
   }
 
-  // MARK: - Metadata (ungated: walletId -> { chain: address })
+  // MARK: - Metadata (ungated: walletId -> { isTestnet, addresses: { chain: address } })
+
+  /** A wallet's network mode is fixed at creation time ([ChainberryTrustWalletCoreModule
+   * .persistNewWallet]) and never changes thereafter — [isTestnet] is the authoritative value
+   * `signTransaction` must derive/sign with, replacing the old pattern of accepting it fresh as
+   * a parameter on every call (see docs/adr and the security remediation this type was
+   * introduced for). */
+  data class WalletRecord(val isTestnet: Boolean, val addresses: Map<String, String>)
 
   /** Atomically replaces [target] via a temp-file write + `File.renameTo` (an atomic
    * `rename(2)` on the same filesystem/mount, since the temp file is created alongside
    * [target] in the same directory) — never a direct in-place overwrite, which could leave a
    * torn file if the process is killed mid-write. Pure/`File`-based so it's unit-testable on
    * the plain JVM without an Android `Context`. */
-  internal fun saveMetadataToFile(target: File, wallets: Map<String, Map<String, String>>) {
+  internal fun saveMetadataToFile(target: File, wallets: Map<String, WalletRecord>) {
     val root = JSONObject()
-    for ((walletId, addresses) in wallets) {
-      root.put(walletId, JSONObject(addresses as Map<*, *>))
+    for ((walletId, record) in wallets) {
+      val entry = JSONObject()
+      entry.put("isTestnet", record.isTestnet)
+      entry.put("addresses", JSONObject(record.addresses as Map<*, *>))
+      root.put(walletId, entry)
     }
     val temp = File(target.parentFile, "$METADATA_FILE.tmp-${System.nanoTime()}")
     try {
@@ -569,32 +578,41 @@ object NativeWalletStore {
 
   /** Distinguishes "no metadata has ever been written" (legitimately empty) from a genuine
    * parse/corruption failure, which now throws a typed [NativeWalletStoreError.Corrupted]
-   * instead of letting a raw, uncaught `JSONException` leak through the Expo bridge.
-   * Pure/`File`-based so it's unit-testable on the plain JVM without an Android `Context`. */
-  internal fun loadMetadataFromFile(file: File): Map<String, Map<String, String>> {
+   * instead of letting a raw, uncaught `JSONException`/[org.json.JSONException] leak through
+   * the Expo bridge. A record missing `isTestnet` or `addresses` (e.g. data written by a
+   * pre-migration build under the old flat schema) is treated the same way — corrupted, not
+   * silently reinterpreted — there is no legacy-shape fallback. Pure/`File`-based so it's
+   * unit-testable on the plain JVM without an Android `Context`. */
+  internal fun loadMetadataFromFile(file: File): Map<String, WalletRecord> {
     if (!file.exists()) return emptyMap()
     val root = try {
       JSONObject(file.readText())
     } catch (e: JSONException) {
       throw NativeWalletStoreError.Corrupted("metadata.json is not valid JSON", e)
     }
-    val result = mutableMapOf<String, Map<String, String>>()
-    for (walletId in root.keys()) {
-      val addressesJson = root.getJSONObject(walletId)
-      val addresses = mutableMapOf<String, String>()
-      for (chain in addressesJson.keys()) {
-        addresses[chain] = addressesJson.getString(chain)
+    val result = mutableMapOf<String, WalletRecord>()
+    try {
+      for (walletId in root.keys()) {
+        val entry = root.getJSONObject(walletId)
+        val isTestnet = entry.getBoolean("isTestnet")
+        val addressesJson = entry.getJSONObject("addresses")
+        val addresses = mutableMapOf<String, String>()
+        for (chain in addressesJson.keys()) {
+          addresses[chain] = addressesJson.getString(chain)
+        }
+        result[walletId] = WalletRecord(isTestnet, addresses)
       }
-      result[walletId] = addresses
+    } catch (e: JSONException) {
+      throw NativeWalletStoreError.Corrupted("metadata.json entry has an unexpected shape", e)
     }
     return result
   }
 
-  fun saveMetadata(context: Context, wallets: Map<String, Map<String, String>>) {
+  fun saveMetadata(context: Context, wallets: Map<String, WalletRecord>) {
     saveMetadataToFile(metadataFile(context), wallets)
   }
 
-  fun loadMetadata(context: Context): Map<String, Map<String, String>> {
+  fun loadMetadata(context: Context): Map<String, WalletRecord> {
     return loadMetadataFromFile(metadataFile(context))
   }
 

package/android/src/test/java/com/chainberry/trustwalletcore/NativeWalletStoreTest.kt

@@ -69,13 +69,28 @@ class NativeWalletStoreTest {
   fun metadata_roundTrips() {
     val file = File(tmp.root, "metadata.json")
     val wallets = mapOf(
-      "id-1" to mapOf("ethereum" to "0xabc"),
-      "id-2" to mapOf("bitcoin" to "bc1abc"),
+      "id-1" to NativeWalletStore.WalletRecord(isTestnet = false, addresses = mapOf("ethereum" to "0xabc")),
+      "id-2" to NativeWalletStore.WalletRecord(isTestnet = true, addresses = mapOf("bitcoin" to "bc1abc")),
     )
     NativeWalletStore.saveMetadataToFile(file, wallets)
     assertEquals(wallets, NativeWalletStore.loadMetadataFromFile(file))
   }
 
+  @Test
+  fun metadata_legacyFlatShapeThrowsCorrupted_notSilentlyMisread() {
+    // Data written by a pre-migration build (walletId -> {chain: address} with no
+    // isTestnet/addresses wrapper) must never be silently reinterpreted — there is no
+    // migration path, so this must surface as Corrupted, same as any other unexpected shape.
+    val file = File(tmp.root, "metadata.json")
+    file.writeText("""{"id-1":{"ethereum":"0xabc"}}""")
+    try {
+      NativeWalletStore.loadMetadataFromFile(file)
+      fail("expected Corrupted for legacy flat-shape metadata")
+    } catch (e: NativeWalletStoreError.Corrupted) {
+      // expected
+    }
+  }
+
   @Test
   fun metadata_missingFileIsEmptyMap() {
     val file = File(tmp.root, "does-not-exist.json")
@@ -99,7 +114,7 @@ class NativeWalletStoreTest {
   @Test
   fun metadata_failedWrite_leavesExistingFileUntouched() {
     val target = File(tmp.root, "metadata.json")
-    val original = mapOf("id-1" to mapOf("ethereum" to "0xabc"))
+    val original = mapOf("id-1" to NativeWalletStore.WalletRecord(isTestnet = false, addresses = mapOf("ethereum" to "0xabc")))
     NativeWalletStore.saveMetadataToFile(target, original)
 
     // Making the parent directory read-only blocks creating the temp file at all (the
@@ -111,7 +126,10 @@ class NativeWalletStoreTest {
     target.parentFile!!.setWritable(false)
     try {
       try {
-        NativeWalletStore.saveMetadataToFile(target, mapOf("id-2" to mapOf("bitcoin" to "bc1xyz")))
+        NativeWalletStore.saveMetadataToFile(
+          target,
+          mapOf("id-2" to NativeWalletStore.WalletRecord(isTestnet = false, addresses = mapOf("bitcoin" to "bc1xyz"))),
+        )
         // Some filesystems/CI runners ignore setWritable(false) for the owner (e.g. root).
         // If the write unexpectedly succeeded, there's nothing to assert here.
       } catch (e: NativeWalletStoreError.PermissionDenied) {

package/ios/ChainSigning.swift

@@ -779,21 +779,23 @@ enum ChainSigner {
           }
         }
       }
-      if let txID = unsignedTx["txID"] as? String {
-        // Verify txID == SHA256(raw_data_hex) to detect a mismatched digest.
-        if let rawHex = unsignedTx["raw_data_hex"] as? String,
-           let rawBytes = hexData(rawHex) {
-          let computed = Hash.sha256(data: rawBytes)
-          let computedHex = computed.map { String(format: "%02x", $0) }.joined()
-          guard computedHex.lowercased() == txID.lowercased() else {
-            throw Exception(name: "TxIntegrityFailed",
-              description: "TRX txID does not match SHA256(raw_data_hex) — signing refused")
-          }
-          lines.append("TxID verified ✓")
-        } else {
-          lines.append("TxID: \(txID.prefix(16))… (raw_data_hex absent — unverified)")
-        }
+      // Verify txID == SHA256(raw_data_hex). raw_data_hex must be present — fail closed if absent
+      // so a JS caller cannot suppress the integrity check by omitting the field.
+      guard let txID = unsignedTx["txID"] as? String else {
+        throw Exception(name: "TxIntegrityFailed", description: "TRX txID missing — signing refused")
+      }
+      guard let rawHex = unsignedTx["raw_data_hex"] as? String,
+            let rawBytes = hexData(rawHex) else {
+        throw Exception(name: "TxIntegrityFailed",
+          description: "TRX raw_data_hex missing — cannot verify txID, signing refused")
+      }
+      let computed = Hash.sha256(data: rawBytes)
+      let computedHex = computed.map { String(format: "%02x", $0) }.joined()
+      guard computedHex.lowercased() == txID.lowercased() else {
+        throw Exception(name: "TxIntegrityFailed",
+          description: "TRX txID does not match SHA256(raw_data_hex) — signing refused")
       }
+      lines.append("TxID verified ✓")
 
     case .solana:
       // Decode the pre-built tx to extract recipient and lamports (SOL) or destination and
@@ -812,14 +814,26 @@ enum ChainSigner {
       }
 
     case .bitcoincash:
-      if let descriptorJson = unsignedTx["unsignedDescriptorJson"] as? String,
-         let data = descriptorJson.data(using: .utf8),
-         let descriptor = try? JSONSerialization.jsonObject(with: data) as? [String: Any] {
-        if let to = descriptor["toAddress"] as? String { lines.append("To: \(fmtAddr(to))") }
-        if let sats = (descriptor["sendAmountSats"] as? NSNumber)?.int64Value {
-          lines.append("Amount: \(fmtAmt(Double(sats) / 1e8)) BCH")
-        }
+      // Fail closed — if descriptor is absent or unparseable we cannot show what will be signed.
+      guard let descriptorJson = unsignedTx["unsignedDescriptorJson"] as? String,
+            let data = descriptorJson.data(using: .utf8),
+            let descriptor = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+        throw Exception(name: "UndecodableTx",
+          description: "Cannot decode BCH descriptor — signing refused to prevent blind signing")
       }
+      if let to = descriptor["toAddress"] as? String { lines.append("To: \(fmtAddr(to))") }
+      if let sats = (descriptor["sendAmountSats"] as? NSNumber)?.int64Value {
+        lines.append("Amount: \(fmtAmt(Double(sats) / 1e8)) BCH")
+      }
+      if let change = descriptor["changeAddress"] as? String { lines.append("Change to: \(fmtAddr(change))") }
+      if let spb = (descriptor["satsPerByte"] as? NSNumber)?.intValue { lines.append("Fee rate: \(spb) sat/vB") }
+      let bchInputs = (descriptor["inputs"] as? [[String: Any]])?
+        .compactMap { ($0["amountSats"] as? NSNumber)?.int64Value }
+        .reduce(Int64(0), +) ?? 0
+      let bchSend = (descriptor["sendAmountSats"] as? NSNumber)?.int64Value ?? 0
+      let bchChange = (descriptor["changeAmountSats"] as? NSNumber)?.int64Value ?? 0
+      let bchFee = bchInputs - bchSend - bchChange
+      if bchFee > 0 { lines.append("Total fee: \(fmtAmt(Double(bchFee) / 1e8)) BCH") }
 
     case .cosmos:
       if let to = unsignedTx["toAddress"] as? String { lines.append("To: \(fmtAddr(to))") }

package/ios/ChainberryTrustWalletCoreModule.swift

@@ -19,12 +19,14 @@ public class ChainberryTrustWalletCoreModule: Module {
       NativeWalletStore.reconcileOrphans()
     }
 
-    // strength 128 = 12 words, 256 = 24 words. Returns { walletId, addresses }.
+    // strength 128 = 12 words, 256 = 24 words. Returns { walletId, addresses, isTestnet }.
     // No BIP-39 passphrase support: signTransaction always reconstructs the wallet with an
     // empty passphrase, so accepting one here would derive addresses from a seed different
     // from the one actually used to sign — always pass "" to stay consistent with that.
     // isTestnet selects the address format for BTC/LTC/BCH (see ChainSigner.address(for:)) —
-    // every other chain's address is the same on mainnet and testnet.
+    // every other chain's address is the same on mainnet and testnet. This value is persisted
+    // as immutable per-wallet metadata (NativeWalletStore.WalletRecord) — signTransaction reads
+    // it back from there instead of accepting it as a parameter, so it can never drift.
     AsyncFunction("createWallet") { (strength: Int, isTestnet: Bool) throws -> [String: Any] in
       guard let wallet = HDWallet(strength: Int32(strength), passphrase: "") else {
         throw Exception(name: "WalletError", description: "Failed to generate wallet")
@@ -37,7 +39,7 @@ public class ChainberryTrustWalletCoreModule: Module {
     }
 
     // One-time mnemonic exposure from JS, at import only — never retained after this call.
-    // Returns { walletId, addresses }. No BIP-39 passphrase support (see `createWallet`).
+    // Returns { walletId, addresses, isTestnet }. No BIP-39 passphrase support (see `createWallet`).
     AsyncFunction("importWallet") { (mnemonic: String, isTestnet: Bool) throws -> [String: Any] in
       guard let wallet = HDWallet(mnemonic: mnemonic, passphrase: "") else {
         throw Exception(name: "InvalidMnemonic", description: "Invalid mnemonic phrase")
@@ -52,8 +54,8 @@ public class ChainberryTrustWalletCoreModule: Module {
     // Reads only the ungated metadata store — no biometric prompt.
     AsyncFunction("listWallets") { () throws -> [[String: Any]] in
       do {
-        return try NativeWalletStore.loadMetadata().map { walletId, addresses in
-          ["walletId": walletId, "addresses": addresses]
+        return try NativeWalletStore.loadMetadata().map { walletId, record in
+          ["walletId": walletId, "addresses": record.addresses, "isTestnet": record.isTestnet]
         }
       } catch let e as NativeWalletStoreError {
         throw e.asException
@@ -86,9 +88,11 @@ public class ChainberryTrustWalletCoreModule: Module {
     }
 
     // Triggers the native biometry/passcode prompt, then signs entirely in-process.
-    // Returns { signedTx, meta? }. isTestnet must match whatever `createWallet`/`importWallet`
-    // used — see ChainSigner.key(for:) (a mismatch signs with the wrong key for BTC/LTC).
-    AsyncFunction("signTransaction") { (walletId: String, chain: String, unsignedTx: [String: Any], isTestnet: Bool) async throws -> [String: Any] in
+    // Returns { signedTx, meta? }. Network mode (mainnet/testnet) is read from the wallet's own
+    // persisted record, not accepted as a parameter — see ChainSigner.key(for:) and
+    // NativeWalletStore.WalletRecord for why a caller-supplied value here could sign with the
+    // wrong key for BTC/LTC.
+    AsyncFunction("signTransaction") { (walletId: String, chain: String, unsignedTx: [String: Any]) async throws -> [String: Any] in
       do {
         let id = try NativeWalletStore.validateWalletId(walletId)
         let chainKey = try ChainKey(fromJs: chain)
@@ -102,19 +106,21 @@ public class ChainberryTrustWalletCoreModule: Module {
         // (e.g. chains added after the wallet was created). Runs silently after the
         // biometric gate — no extra prompt needed.
         var metadata = try NativeWalletStore.loadMetadata()
-        if var storedAddresses = metadata[id] {
-          var changed = false
-          for chain in ChainKey.allCases {
-            if storedAddresses[chain.rawValue] == nil {
-              storedAddresses[chain.rawValue] = ChainSigner.address(for: chain, wallet: wallet, isTestnet: isTestnet)
-              changed = true
-            }
-          }
-          if changed {
-            metadata[id] = storedAddresses
-            try? NativeWalletStore.saveMetadata(metadata)
+        guard var record = metadata[id] else {
+          throw NativeWalletStoreError.notFound(walletId: id)
+        }
+        let isTestnet = record.isTestnet
+        var changed = false
+        for chain in ChainKey.allCases {
+          if record.addresses[chain.rawValue] == nil {
+            record.addresses[chain.rawValue] = ChainSigner.address(for: chain, wallet: wallet, isTestnet: isTestnet)
+            changed = true
           }
         }
+        if changed {
+          metadata[id] = record
+          try? NativeWalletStore.saveMetadata(metadata)
+        }
         let result = try ChainSigner.sign(chain: chainKey, wallet: wallet, unsignedTx: unsignedTx, isTestnet: isTestnet)
         var response: [String: Any] = ["signedTx": result.signedTx]
         if let meta = result.meta { response["meta"] = meta }
@@ -248,7 +254,7 @@ public class ChainberryTrustWalletCoreModule: Module {
     try NativeWalletStore.saveMnemonic(wallet.mnemonic, walletId: walletId)
     do {
       var metadata = try NativeWalletStore.loadMetadata()
-      metadata[walletId] = addresses
+      metadata[walletId] = NativeWalletStore.WalletRecord(isTestnet: isTestnet, addresses: addresses)
       try NativeWalletStore.saveMetadata(metadata)
     } catch {
       // The mnemonic is already persisted but has no metadata pointer — compensate by
@@ -259,7 +265,7 @@ public class ChainberryTrustWalletCoreModule: Module {
       throw error
     }
 
-    return ["walletId": walletId, "addresses": addresses]
+    return ["walletId": walletId, "addresses": addresses, "isTestnet": isTestnet]
   }
 
   /// Prompts biometry-or-device-passcode via `.deviceOwnerAuthentication` (Apple's

package/ios/ConformanceTests/SigningConformanceTests.swift

@@ -43,13 +43,10 @@ class SigningConformanceTests: XCTestCase {
   }
 
   private func loadFixture() throws -> FixtureFile {
-    let thisFile = URL(fileURLWithPath: #filePath)
-    let url = thisFile
-      .deletingLastPathComponent()
-      .deletingLastPathComponent()
-      .deletingLastPathComponent()
-      .appendingPathComponent("conformance/signing-vectors.json")
-      .standardizedFileURL
+    guard let url = Bundle(for: SigningConformanceTests.self)
+      .url(forResource: "signing-vectors", withExtension: "json") else {
+      throw XCTSkip("signing-vectors.json not found in test bundle")
+    }
     return try JSONDecoder().decode(FixtureFile.self, from: Data(contentsOf: url))
   }
 

package/ios/NativeWalletStore.swift

@@ -173,15 +173,24 @@ enum NativeWalletStore {
     }
   }
 
-  // MARK: - Metadata (ungated: walletId -> { chain: address })
+  // MARK: - Metadata (ungated: walletId -> { isTestnet, addresses: { chain: address } })
+
+  /// A wallet's network mode is fixed at creation time (`ChainberryTrustWalletCoreModule
+  /// .persistNewWallet`) and never changes thereafter — `isTestnet` is the authoritative value
+  /// `signTransaction` must derive/sign with, replacing the old pattern of accepting it fresh as
+  /// a parameter on every call.
+  struct WalletRecord: Codable {
+    var isTestnet: Bool
+    var addresses: [String: String]
+  }
 
   /// Atomically replaces the metadata blob via `SecItemUpdate` when it already exists,
   /// falling back to `SecItemAdd` only on the very first write. Unlike the mnemonic item,
   /// the metadata item carries no `SecAccessControl`, so there's no access-control-change
   /// obstacle to updating in place — this removes the delete-then-add race window entirely
   /// (a crash between delete and add used to be able to lose the index outright).
-  static func saveMetadata(_ wallets: [String: [String: String]]) throws {
-    let data = try JSONSerialization.data(withJSONObject: wallets)
+  static func saveMetadata(_ wallets: [String: WalletRecord]) throws {
+    let data = try JSONEncoder().encode(wallets)
     let baseQuery: [String: Any] = [
       kSecClass as String: kSecClassGenericPassword,
       kSecAttrService as String: metadataService,
@@ -208,8 +217,10 @@ enum NativeWalletStore {
   /// from a genuine read/corruption failure, which now throws instead of being silently
   /// masked as an empty map. Masking it was the root cause of the "transient read failure
   /// followed by createWallet overwrites the index" scenario: a real failure here must abort
-  /// the caller, not look identical to "no wallets yet".
-  static func loadMetadata() throws -> [String: [String: String]] {
+  /// the caller, not look identical to "no wallets yet". Data written by a pre-migration build
+  /// (walletId -> {chain: address} with no isTestnet/addresses wrapper) fails to decode and is
+  /// treated the same as any other corruption — there is no legacy-shape fallback.
+  static func loadMetadata() throws -> [String: WalletRecord] {
     let query: [String: Any] = [
       kSecClass as String: kSecClassGenericPassword,
       kSecAttrService as String: metadataService,
@@ -224,7 +235,7 @@ enum NativeWalletStore {
     guard status == errSecSuccess, let data = result as? Data else {
       throw classify(status)
     }
-    guard let obj = try? JSONSerialization.jsonObject(with: data) as? [String: [String: String]] else {
+    guard let obj = try? JSONDecoder().decode([String: WalletRecord].self, from: data) else {
       throw NativeWalletStoreError.corrupted("metadata JSON is unreadable")
     }
     return obj

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chainberry/trust-wallet-core",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "description": "Expo native module wrapping Trust Wallet Core for native-only HD wallet custody, address derivation, and transaction signing (Ethereum, BNB, Polygon, Solana, Tron, TON, Bitcoin, Bitcoin Cash, Litecoin, XRP) — mnemonic/private keys never cross the JS bridge",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/index.ts

@@ -31,6 +31,9 @@ export type Chain =
 export type WalletSummary = {
   walletId: string;
   addresses: Record<Chain, string>;
+  /** Fixed at creation time and persisted as immutable native wallet metadata — the
+   * authoritative source `signTransaction` derives/signs with for this wallet. */
+  isTestnet: boolean;
 };
 
 export type SignResult = {
@@ -46,7 +49,9 @@ const TrustWalletCore = requireNativeModule("TrustWalletCore");
  * would derive addresses from a seed different from the one actually used to sign.
  * `isTestnet` selects the address format for BTC/LTC/BCH (every other chain's address is
  * identical on mainnet and testnet) — callers should pass `IS_TESTNET` from
- * `@/constants/wallet-env`. */
+ * `@/constants/wallet-env`. The value passed here is permanent: it's persisted as immutable
+ * per-wallet metadata and later read back by `signTransaction` for this wallet — it cannot be
+ * changed or overridden after creation. */
 export async function createWallet(
   strength: 128 | 256 = 128,
   isTestnet = false,
@@ -56,7 +61,7 @@ export async function createWallet(
 
 /** One-time mnemonic exposure from the caller — persisted natively immediately, never
  * retained in JS after this call returns. No BIP-39 passphrase support (see `createWallet`).
- * `isTestnet` — see `createWallet`. */
+ * `isTestnet` — see `createWallet` (same permanence guarantee applies). */
 export async function importWallet(
   mnemonic: string,
   isTestnet = false,
@@ -74,21 +79,16 @@ export async function deleteWallet(walletId: string): Promise<void> {
 }
 
 /** Triggers the native biometry/passcode prompt, then signs entirely in-process —
- * only signed transaction bytes/hex cross back. `isTestnet` must match whatever
- * `createWallet`/`importWallet` used for this wallet (see those for why) — pass
- * `IS_TESTNET` from `@/constants/wallet-env`. */
+ * only signed transaction bytes/hex cross back. Network mode (mainnet/testnet) is not
+ * accepted here: the native module reads it from the wallet's own persisted record (set once,
+ * at `createWallet`/`importWallet` time), so it can never drift from what created the
+ * wallet's addresses. */
 export async function signTransaction(
   walletId: string,
   chain: Chain,
   unsignedTx: Record<string, unknown>,
-  isTestnet = false,
 ): Promise<SignResult> {
-  return TrustWalletCore.signTransaction(
-    walletId,
-    chain,
-    unsignedTx,
-    isTestnet,
-  );
+  return TrustWalletCore.signTransaction(walletId, chain, unsignedTx);
 }
 
 /** The one sanctioned mnemonic exposure — explicit backup/reveal flow only, gated behind