Bump version. update README, RELEASE-NOTES

README.md

@@ -2,6 +2,10 @@
 
 A minimal ethereum javascript wallet.
 
+## Security advisory
+
+Please make sure to update to version 2.3.3. Previous versions contained a bug that could generate addresses that were unrelated to the HD seed if the wrong value of `pwDerivedKey` was passed in to `generateNewAddress()`. This could lead to loss of funds.
+
 ## About
 
 LightWallet is a HD wallet that can store your private keys encrypted in the browser to allow you to run Ethereum dapps even if you're not running a local Ethereum node. It uses [BIP32][] and [BIP39][] to generate an HD tree of addresses from a randomly generated 12-word seed.

RELEASE-NOTES.md

@@ -1,5 +1,10 @@
 # Release Notes #
 
+## Version 2.3.3 - 2016-05-26 ##
+
+* Fixed a bug which would create random addresses if the wrong
+  pwDerivedKey was used.
+
 ## Version 2.3.2 - 2016-04-06 ##
 
 * Add "var" statements for function declarations. Thanks to [dalexj](https://github.com/dalexj) and [pipermerriam](https://github.com/pipermerriam).

dist/lightwallet.js

@@ -390,11 +390,16 @@ KeyStore.prototype._generatePrivKeys = function(pwDerivedKey, n, hdPathString) {
   }
 
   var hdRoot = KeyStore._decryptString(this.ksData[hdPathString].encHdPathPriv, pwDerivedKey);
+
+  if (hdRoot.length === 0) {
+    throw new Error('Provided password derived key is wrong');
+  }
+
   var keys = [];
   for (var i = 0; i < n; i++){
     var hdprivkey = new bitcore.HDPrivateKey(hdRoot).derive(this.ksData[hdPathString].hdIndex++);
     var privkeyBuf = hdprivkey.privateKey.toBuffer();
-    
+
     var privkeyHex = privkeyBuf.toString('hex');
     if (privkeyBuf.length < 16) {
       // Way too small key, something must have gone wrong
@@ -479,7 +484,7 @@ KeyStore.prototype.isDerivedKeyCorrect = function(pwDerivedKey) {
   }
 
   return false;
-  
+
 };
 
 // Takes keystore serialized as string and returns an instance of KeyStore

package.json

@@ -1,6 +1,6 @@
 {
   "name": "eth-lightwallet",
-  "version": "2.3.2",
+  "version": "2.3.3",
   "description": "A lightweight ethereum javascript wallet.",
   "main": "index.js",
   "repository": {