core: store the seed as bytes, and bind one account per profile

On Postgres a bare ByteString binds as a text literal, so entropy with a
backslash or a high bit was rejected and entropy with a zero byte was
truncated: the BIP-39 test vector stored as an empty seed. Blob columns go
through DB.Binary here, as every other one does.

/_wallet bind with no account moved a profile that already had one to a
fresh account, abandoning the old one without saying so. It refuses now;
moving is asked for by number.

The counter could walk past 2^31, where BIP-32 hardening folds every index
back onto a low one, so a profile handed 2147483648 derived account 0's
keys and printed account 0's path. Binding refuses once the counter is
there, and a very long index is now rejected on its digit count rather than
after reading it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rvc3HbiWBTqbAvRT45G5oX

src/Simplex/Chat/Library/Commands.hs

@@ -1503,8 +1503,7 @@ processChatCommand cxt nm = \case
         pure $ CRWallet user True paths profiles
   APIWalletBind acct_ -> withUser $ \user -> do
     seed <- deviceSeed
-    bound <- withFastStore' $ \db -> bindAccountIndex db user (wsId seed) acct_
-    unless bound $ throwCmdError "another profile uses this account"
+    withFastStore' (\db -> bindAccountIndex db user (wsId seed) acct_) >>= either throwCmdError pure
     processChatCommand cxt nm APIWallet
   APIWalletCreate -> withUser $ \_ -> do
     g <- asks random
@@ -6143,10 +6142,12 @@ chatCommandP =
     quotedP = safeDecodeUtf8 <$> (A.char '"' *> A.takeTill (== '"') <* A.char '"')
     text1P = safeDecodeUtf8 <$> A.takeTill (== ' ')
     char_ = optional . A.char
-    -- BIP-32 hardens at 2^31, and Word32 would wrap
+    -- BIP-32 hardens at 2^31, and Word32 would wrap. Digits are counted before
+    -- they are read, as reading a very long number is not free.
     keyIndexP = do
-      i <- A.decimal :: Parser Integer
-      if i < 0x80000000 then pure (fromIntegral i) else fail "key index too large"
+      ds <- A.takeWhile1 isDigit
+      let i = read (B.unpack ds) :: Integer
+      if B.length ds <= 10 && i < 0x80000000 then pure (fromIntegral i) else fail "key index too large"
 
 displayNameP :: Parser Text
 displayNameP = safeDecodeUtf8 <$> displayNameP_

src/Simplex/Chat/Store/Wallets.hs

@@ -73,13 +73,21 @@ createSeed :: DB.Connection -> ByteString -> IO Bool
 createSeed db entropy =
   getDeviceSeed db >>= \case
     Just _ -> pure False
-    Nothing -> True <$ DB.execute db "INSERT INTO wallet_seeds (seed) VALUES (?)" (Only entropy)
+    Nothing -> True <$ DB.execute db "INSERT INTO wallet_seeds (seed) VALUES (?)" (Only $ DB.Binary entropy)
 
--- | Without an account the next free one is taken. False if another profile
--- holds the account asked for.
-bindAccountIndex :: DB.Connection -> User -> SeedId -> Maybe AccountIndex -> IO Bool
-bindAccountIndex db User {userId} sId = \case
-  Nothing -> True <$ (takeAccountIndex db sId >>= bindUser db userId sId)
+-- | Without an account the next free one is taken, which a profile that has
+-- one does not need: moving to another account is asked for by number.
+bindAccountIndex :: DB.Connection -> User -> SeedId -> Maybe AccountIndex -> IO (Either String ())
+bindAccountIndex db user@User {userId} sId = \case
+  Nothing ->
+    getAccountIndex db user >>= \case
+      Just _ -> pure $ Left "this profile already has an account"
+      Nothing -> do
+        acct <- takeAccountIndex db sId
+        -- BIP-32 hardens at 2^31, and every index above it is the same key again
+        if acct >= 0x80000000
+          then pure $ Left "no free account on this key"
+          else Right () <$ bindUser db userId sId acct
   Just acct -> do
     taken <-
       maybeFirstRow fromOnly $
@@ -88,12 +96,12 @@ bindAccountIndex db User {userId} sId = \case
           "SELECT 1 FROM users WHERE wallet_seed_id = ? AND wallet_account_index = ? AND user_id != ?"
           (sId, fromIntegral acct :: Int64, userId)
     case (taken :: Maybe Int64) of
-      Just _ -> pure False
+      Just _ -> pure $ Left "another profile uses this account"
       Nothing -> do
         bindUser db userId sId (fromIntegral acct)
         -- the counter moves past it, so the next profile is not handed the same one
         setNextAccountIndex db sId (fromIntegral acct + 1)
-        pure True
+        pure $ Right ()
 
 -- | So two profiles cannot be handed the same account.
 takeAccountIndex :: DB.Connection -> SeedId -> IO Int64