fix(backend-e2e): stabilize PR #860 platform-wallet e2e suite + SEC-001 hardening

src/backend_task/error.rs

@@ -278,10 +278,27 @@ pub enum TaskError {
     /// migration outcome is logged where it happens; no secret or raw error
     /// string is stored here.
     #[error(
-        "Some of this identity's keys could not be protected this time, so it is not fully protected yet. Check available disk space, then try protecting this identity again."
+        "Some of this identity's keys are not fully protected yet. \
+        Close and reopen the application, then try protecting this identity again."
     )]
     IdentityKeyProtectionIncomplete,
 
+    /// SEC-001 fail-closed guard at the opt-in protect boundary: the identity
+    /// still carries one or more keys saved in the legacy on-disk format this
+    /// version can neither read nor migrate into the protected store. Unlike
+    /// resident plaintext — which the load-path migration finishes on the next
+    /// launch — there is NO automatic migration for these keys, so reopening the
+    /// application would loop on the same error. The only way forward is to add
+    /// the identity again from its recovery phrase or private key, which replaces
+    /// the legacy key entries with ones this version can protect. Fieldless: the
+    /// offending key's presence is logged at the guard; no secret or raw error
+    /// string is stored here.
+    #[error(
+        "Some of this identity's keys are saved in an older format that cannot be protected. \
+        Load this identity again using its recovery phrase or private key, then try protecting it."
+    )]
+    IdentityKeyProtectionLegacyFormat,
+
     /// The DET wallet-metadata sidecar (alias / `is_main` /
     /// `core_wallet_name`) could not be read or written. Distinct from
     /// [`Self::WalletStorage`] because the cause sits in the cross-

src/backend_task/identity/mod.rs

@@ -889,11 +889,11 @@ impl AppContext {
         inputs: BTreeMap<dash_sdk::dpp::address_funds::PlatformAddress, Credits>,
         wallet_seed_hash: WalletSeedHash,
     ) -> Result<BackendTaskSuccessResult, TaskError> {
-        use crate::model::fee_estimation::PlatformFeeEstimator;
         use dash_sdk::platform::transition::top_up_identity_from_addresses::TopUpIdentityFromAddresses;
 
-        // Estimate fee for top-up from platform addresses
-        let estimated_fee = PlatformFeeEstimator::new().estimate_identity_topup();
+        // Estimate the top-up fee with the active network fee multiplier
+        // (context estimator) so the figure shown to the user is accurate.
+        let estimated_fee = self.fee_estimator().estimate_identity_topup();
 
         tracing::info!(
             "top_up_identity_from_platform_addresses: identity={}, inputs={:?}",

src/backend_task/identity/protect_identity_keys.rs

@@ -167,7 +167,22 @@ fn validate_protection_password(password: &Secret) -> Result<(), TaskError> {
 /// (`AtWalletDerivationPath`) and already-vaulted (`InVault`) keys carry no
 /// resident plaintext, so a legitimately keyless / wallet-derived identity is
 /// never rejected.
+///
+/// Also rejects legacy `Encrypted` keys (decode-only, no current producer):
+/// their vault scheme is also `Absent`, so the seal step would silently skip
+/// them and issue a false-protected result. See [`KeyStorage::has_encrypted_legacy_keys`].
+///
+/// The two rejections carry DIFFERENT recovery actions, so they map to distinct
+/// errors: resident plaintext is finished by the load-path migration on the next
+/// launch ([`TaskError::IdentityKeyProtectionIncomplete`] → "close and reopen"),
+/// whereas a legacy `Encrypted` key has no migration path
+/// ([`TaskError::IdentityKeyProtectionLegacyFormat`] → "load the identity again").
+/// Legacy keys are checked first: re-loading the identity also clears any
+/// resident plaintext, so it is the single action that resolves both.
 fn reject_resident_identity_plaintext(private_keys: &KeyStorage) -> Result<(), TaskError> {
+    if private_keys.has_encrypted_legacy_keys() {
+        return Err(TaskError::IdentityKeyProtectionLegacyFormat);
+    }
     if private_keys.has_plaintext_for_vault() {
         return Err(TaskError::IdentityKeyProtectionIncomplete);
     }
@@ -217,12 +232,12 @@ fn seal_identity_keys(
 }
 
 /// Verify `password` opens EVERY already-`Protected` key in `keys`, before any
-/// sealing mutates the vault. Enforces SEC-001's one-password-per-identity
-/// invariant on a Mixed-state opt-in re-run: if a prior partial run sealed some
-/// keys under password A and the user now supplies password B, the mismatch
+/// vault mutation. Both SEC-001 migrations call this up front so they are atomic
+/// by construction: if `password` fails to open any protected key, the mismatch
 /// surfaces from `get_protected` as [`TaskError::IdentityKeyPassphraseIncorrect`]
-/// (no oracle) with zero state changes. Keyless (`Unprotected`) and `Absent`
-/// keys impose no password constraint and are skipped.
+/// (no oracle) with zero state changes — opt-in can't seal the rest under a
+/// second password, and opt-out can't strip a prefix before aborting. Keyless
+/// (`Unprotected`) and `Absent` keys impose no password constraint and are skipped.
 fn verify_existing_protection_password(
     view: &IdentityKeyView<'_>,
     keys: &IdentityKeySet,
@@ -246,6 +261,11 @@ fn unseal_identity_keys(
     keys: &IdentityKeySet,
     password: &SecretString,
 ) -> Result<usize, TaskError> {
+    // SEC-001 atomic opt-out: prove `password` opens EVERY `Protected` key
+    // BEFORE downgrading any label (mirrors the opt-in preflight), so a password
+    // that opens only a prefix can't leave that prefix stripped. Mismatch → no-op.
+    verify_existing_protection_password(view, keys, password)?;
+
     let mut reverted = 0usize;
     for (target, key_id) in keys {
         if view.scheme(target, *key_id)? == SecretScheme::Protected {
@@ -364,6 +384,50 @@ mod tests {
         assert_eq!(view.scheme(&M, 1).unwrap(), SecretScheme::Protected);
     }
 
+    /// SEC-001 atomic opt-out (CWE-460): on a Mixed-password identity — key 0
+    /// sealed under password A, key 1 under password B — an opt-out with
+    /// password A must NOT downgrade the key it CAN open before aborting on the
+    /// one it cannot. The one-password invariant forbids this state, but a
+    /// tampered or legacy vault could still present it, so opt-out must be
+    /// all-or-nothing by construction. The all-keys preflight rejects up front
+    /// with `IdentityKeyPassphraseIncorrect`, leaving BOTH keys protected — no
+    /// silent partial protection downgrade. Without the preflight, key 0 (which
+    /// password A opens, and which sorts first) would be stripped to keyless
+    /// plaintext while key 1 stayed sealed.
+    #[test]
+    fn unseal_mixed_password_aborts_without_partial_downgrade() {
+        let dir = tempfile::tempdir().unwrap();
+        let store = fresh_store(dir.path());
+        let view = IdentityKeyView::new(&store, [0x08u8; 32]);
+        let pw_a = SecretString::new("password-for-key-zero");
+        let pw_b = SecretString::new("password-for-key-one-");
+        // (M, 0) sorts before (M, 1): a downgrade-as-you-go loop would reach
+        // key 0 first and strip it before failing the password check on key 1.
+        view.store_protected(&M, 0, &[0x80; 32], &pw_a).unwrap();
+        view.store_protected(&M, 1, &[0x81; 32], &pw_b).unwrap();
+        let keys = key_set(&[(M, 0), (M, 1)]);
+
+        let err = unseal_identity_keys(&view, &keys, &pw_a)
+            .expect_err("password A does not open key 1 — opt-out must abort");
+        assert!(
+            matches!(err, TaskError::IdentityKeyPassphraseIncorrect),
+            "expected IdentityKeyPassphraseIncorrect, got {err:?}"
+        );
+        // Neither key was downgraded: key 0 — which password A COULD open — is
+        // still Protected because the preflight ran before any mutation.
+        assert_eq!(view.scheme(&M, 0).unwrap(), SecretScheme::Protected);
+        assert_eq!(view.scheme(&M, 1).unwrap(), SecretScheme::Protected);
+        // The sealed bytes are intact under each key's original password.
+        assert_eq!(
+            *view.get_protected(&M, 0, &pw_a).unwrap().unwrap(),
+            [0x80; 32]
+        );
+        assert_eq!(
+            *view.get_protected(&M, 1, &pw_b).unwrap().unwrap(),
+            [0x81; 32]
+        );
+    }
+
     /// A partial-crash mix (some keys Tier-2, some Tier-1) re-runs to a clean,
     /// fully-protected state — the same-label upsert never loses a key.
     #[test]
@@ -497,6 +561,23 @@ mod tests {
         ks
     }
 
+    /// A `KeyStorage` holding a single legacy `Encrypted` key — the decode-only
+    /// variant an old DET version left behind. Its vault scheme is `Absent` (no
+    /// migration path), so the seal step would silently skip it.
+    fn ks_with_encrypted_legacy() -> KeyStorage {
+        let pv = PlatformVersion::latest();
+        let mut ks = KeyStorage::default();
+        let k = IdentityPublicKey::random_key(1, Some(1), pv);
+        ks.private_keys.insert(
+            (M, k.id()),
+            (
+                QualifiedIdentityPublicKey::from(k),
+                PrivateKeyData::Encrypted(vec![0x33; 48]),
+            ),
+        );
+        ks
+    }
+
     /// A `KeyStorage` whose keys are all legitimately not-resident: one already
     /// vault-backed (`InVault`) and one wallet-derived (`AtWalletDerivationPath`,
     /// whose vault scheme is `Absent` by design, not by a failed migration).
@@ -593,6 +674,22 @@ mod tests {
         );
     }
 
+    /// SEC-001 fail-closed: an identity carrying a legacy `Encrypted` key (no
+    /// migration path) is rejected with the dedicated
+    /// [`TaskError::IdentityKeyProtectionLegacyFormat`] — NOT the resident-
+    /// plaintext `IdentityKeyProtectionIncomplete` — so the user is told to load
+    /// the identity again rather than uselessly close and reopen.
+    #[test]
+    fn protect_rejects_legacy_encrypted_key_with_distinct_error() {
+        let ks = ks_with_encrypted_legacy();
+        let err = reject_resident_identity_plaintext(&ks)
+            .expect_err("legacy Encrypted key must fail closed");
+        assert!(
+            matches!(err, TaskError::IdentityKeyProtectionLegacyFormat),
+            "expected IdentityKeyProtectionLegacyFormat, got {err:?}"
+        );
+    }
+
     /// No false positive: an identity whose keys are wallet-derived
     /// (`AtWalletDerivationPath`, legitimately `Absent`) or already vault-backed
     /// (`InVault`) carries no resident plaintext and is accepted — opt-in must

src/backend_task/identity/top_up_identity.rs

@@ -2,7 +2,6 @@ use crate::backend_task::error::TaskError;
 use crate::backend_task::identity::{IdentityTopUpInfo, TopUpIdentityFundingMethod};
 use crate::backend_task::{BackendTaskSuccessResult, FeeResult};
 use crate::context::AppContext;
-use crate::model::fee_estimation::PlatformFeeEstimator;
 use dash_sdk::dpp::identity::accessors::{IdentityGettersV0, IdentitySettersV0};
 
 impl AppContext {
@@ -17,7 +16,11 @@ impl AppContext {
         } = input;
 
         let balance_before = qualified_identity.identity.balance();
-        let estimated_fee = PlatformFeeEstimator::new().estimate_identity_topup();
+        // This estimate is shown to the user and feeds the actual-fee
+        // plausibility band, so it must track the active network fee multiplier —
+        // use the context estimator rather than the hardcoded default.
+        let fee_estimator = self.fee_estimator();
+        let estimated_fee = fee_estimator.estimate_identity_topup();
 
         // Both wallet-funded top-up paths (fresh asset lock or resume from a
         // tracked asset lock) run end-to-end through the upstream
@@ -61,9 +64,7 @@ impl AppContext {
 
         let actual_fee = match amount_duffs_for_fee {
             Some(amount) => {
-                let expected_credits = amount.saturating_mul(1000);
-                let balance_increase = new_balance.saturating_sub(balance_before);
-                expected_credits.saturating_sub(balance_increase)
+                fee_estimator.resolve_identity_topup_actual_fee(amount, balance_before, new_balance)
             }
             None => estimated_fee,
         };

src/backend_task/wallet/generate_receive_address.rs

@@ -1,4 +1,5 @@
 use crate::backend_task::BackendTaskSuccessResult;
+use crate::backend_task::error::TaskError;
 use crate::context::AppContext;
 use crate::model::wallet::WalletSeedHash;
 use std::sync::Arc;
@@ -8,9 +9,64 @@ impl AppContext {
     pub(crate) async fn generate_receive_address(
         self: &Arc<Self>,
         seed_hash: WalletSeedHash,
-    ) -> Result<BackendTaskSuccessResult, crate::backend_task::error::TaskError> {
+    ) -> Result<BackendTaskSuccessResult, TaskError> {
+        // A seed hash that matches no wallet in the local store is a genuine
+        // "not found". This is distinct from a known wallet whose backend is
+        // still loading: the backend reports the latter as the transient,
+        // retryable `WalletNotLoaded`. Resolving the existence question here,
+        // where the DET-side wallet store lives, keeps that distinction honest
+        // instead of collapsing both cases into `WalletNotLoaded`.
+        if !self.wallets.read()?.contains_key(&seed_hash) {
+            return Err(TaskError::WalletNotFound);
+        }
         let backend = self.wallet_backend()?;
         let address = backend.next_receive_address(&seed_hash).await?;
         Ok(BackendTaskSuccessResult::GeneratedReceiveAddress { seed_hash, address })
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::app_dir::ensure_env_file;
+    use crate::context::connection_status::ConnectionStatus;
+    use crate::database::test_helpers::create_database_at_path;
+    use crate::utils::tasks::TaskManager;
+    use dash_sdk::dpp::dashcore::Network;
+
+    /// Regression for #860: a receive-address request for a seed hash that
+    /// matches no locally-stored wallet must return `WalletNotFound`, NOT the
+    /// transient `WalletNotLoaded`. The existence check runs before the wallet
+    /// backend is consulted, so this holds even with no backend wired.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn unknown_seed_hash_returns_wallet_not_found() {
+        let temp_dir = tempfile::tempdir().expect("tempdir");
+        let data_dir = temp_dir.path().to_path_buf();
+        ensure_env_file(&data_dir);
+        let db = Arc::new(create_database_at_path(&data_dir.join("data.db")).expect("db"));
+        let app_kv = AppContext::open_app_kv(&data_dir).expect("app kv");
+        let secret_store = AppContext::open_secret_store(&data_dir).expect("secret store");
+        let ctx = AppContext::new(
+            data_dir,
+            Network::Testnet,
+            db,
+            Arc::new(TaskManager::new()),
+            Arc::new(ConnectionStatus::new()),
+            egui::Context::default(),
+            app_kv,
+            secret_store,
+        )
+        .expect("offline testnet AppContext::new");
+
+        // No wallets are loaded, so any seed hash is genuinely unknown.
+        let unknown: WalletSeedHash = [0xAB; 32];
+        let err = ctx
+            .generate_receive_address(unknown)
+            .await
+            .expect_err("an unknown seed hash must fail, not succeed");
+        assert!(
+            matches!(err, TaskError::WalletNotFound),
+            "expected WalletNotFound, got {err:?}"
+        );
+    }
+}

src/context/identity_db.rs

@@ -308,7 +308,7 @@ fn migrate_keystore_to_vault(
         );
         return KeystoreMigration::ProtectedSkipped;
     }
-    let before = qi.private_keys.clone();
+    let mut before = qi.private_keys.clone();
     let taken = qi.private_keys.take_plaintext_for_vault();
     let view = crate::wallet_backend::IdentityKeyView::new(secret_store, *id);
     if let Err(e) = view.store_all(&taken) {
@@ -322,6 +322,13 @@ fn migrate_keystore_to_vault(
         return KeystoreMigration::VaultWriteFailed;
     }
     let migrated = taken.len();
+    // The migrated plaintext now lives only in the vault; drop the `taken` copy
+    // (it zeroizes on drop) so its key bytes do not linger across the DB write.
+    drop(taken);
+    // SEC-002: the vault write succeeded — the rollback clone is no longer
+    // needed. Zeroize its plaintext bytes (Clear/AlwaysClear) before it drops
+    // so no identity private key lingers in freed heap.
+    let _ = before.take_plaintext_for_vault();
     if let Err(e) = persist(qi) {
         tracing::warn!(
             target = "context::identity_db",