fix: clear registered tokens and nano contracts when exiting a hardware wallet

[raul-oliveira]

Acceptance Criteria

• Exiting a hardware wallet and importing a software wallet in the same session no longer keeps the hardware wallet's registered tokens.
• The nano contract "Caller Address" no longer stays stuck on the previous hardware wallet's address.
• Addresses the "Hardware wallet data kept between sessions" item from QA report HathorNetwork/internal-issues#540.

Root cause (from the QA flow)

Repro: open a hardware (Ledger) wallet → quit the Hathor app on the device → without closing the desktop app, import a software wallet. The hardware wallet's custom tokens are still shown, and a nano contract tx keeps the old caller address.

When a hardware wallet is locked, App.js sends it to the Wallet Type screen via LOCAL_STORE.cleanWallet(). That method cleared only the wallet-identity keys (IS_HARDWARE_KEY, CLOSED_KEY, ACCESS_DATA_KEY) and left the wallet-scoped REGISTERED_TOKENS_KEY, REGISTERED_NANOCONTRACTS_KEY and TOKEN_SIGNATURES_KEY in localStorage. Unlike the software "reset all data" flow (which calls resetStorage and clears every key), this hardware path skips resetStorage, so the next wallet re-reads the stale registered data. The stuck caller address is the leftover registered nano contract's stored address.

Proposed solution

Add an opt-in cleanRegisteredData flag to cleanWallet and set it on the hardware-exit branch, clearing those three wallet-scoped keys at the wallet switch. The redux token/nano-contract state is repopulated from the now-empty keys when the next wallet loads. Other cleanWallet callers keep their current behavior (the flag defaults to false), so the passphrase and logout flows are unchanged.

No new dependencies.

Security Checklist

• Make sure you do not include new dependencies in the project unless strictly necessary and do not include dev-dependencies as production ones. More dependencies increase the possibility of one of them being hijacked and affecting us.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7494c620-5f1b-48a7-b99a-fb96608ae1fc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch raul-oliveira/fix/hardware-wallet-data-leak-on-switch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}