Cake Wallet / Monero.com

This commit is a routine German translation update. It adds, removes, and tweaks German text strings used in the app's user interface. There is no code change and no security impact.

This change makes Bitcoin transactions shuffle the order of their inputs (the coins being spent). Shuffling input order is a common privacy improvement because it makes it harder for outside observers to guess which inputs belong to the same wallet or link transactions together. It does not fix a crash, theft bug, or direct exploit.

This commit makes several small UI and error-handling tweaks in a cryptocurrency wallet app. The most user-relevant change is that address and amount text fields now disable autocorrect and predictive suggestions, which reduces the chance that a sensitive crypto address or amount gets leaked to a third-party keyboard/cloud service. Other changes clean up clipboard pasting, Bluetooth error handling, and which non-fatal errors are suppressed. There is no obvious severe security bug being fixed, but the autocorrect change is a privacy improvement.

This commit is a routine UI polish: it adds bottom padding to a transaction history list and renames an internal counter from 'enabledProviders' to 'enabledProvidersCount' to make the code clearer. There is no security change.

This commit fixes two bugs in Cake Wallet's exchange flow. First, when creating a trade record for the NEAR Intents exchange provider, the app was accidentally recording the 'from' currency as both the source and destination currency. Second, the code that checks whether the user's wallet can send funds for a trade was refactored to return error strings instead of throwing exceptions, and logging of those errors was moved to the caller. The first fix is a real functional bug that could mislead users about what they are receiving in a trade. The second is mostly a code-quality and reliability improvement.

This commit wraps a lightning balance lookup in a try/catch so that if the lookup fails, the app logs an error instead of crashing or throwing an unhandled exception. It is a defensive reliability fix; there is no direct evidence it fixes an exploitable security vulnerability.

This commit refactors how Cake Wallet renames cryptocurrency wallets. Previously, each wallet type had its own rename code that opened the wallet, copied specific files, and deleted the old directory. The new code centralizes the file-copying logic and makes the process more consistent across Bitcoin-like coins, Litecoin, Bitcoin Cash, Dogecoin, EVM chains, Solana, and Tron. The change appears to be a code-quality and reliability improvement rather than an obvious security fix, but it does address some risky patterns in the old rename implementation—such as deleting the old wallet directory before confirming the new one is valid, and not checking whether the destination wallet already exists.

This commit changes the source of a software dependency (ledger-usb-plus) from a third-party developer's repository to Cake Wallet's own fork, and updates which version is used. The stated reason is to fix Android CI (continuous integration). There is no direct evidence in the commit that this is a security fix, but switching dependency sources can carry supply-chain security implications that are worth reviewing.

This commit is a purely cosmetic UI fix for the wallet type selection screen in the Cake Wallet app. It wraps a list container in a rounded clipping widget, slightly increases row height from 48 to 50 pixels, and adjusts indentation. There is no security-relevant change.

This change stops Payjoin transactions from using unconfirmed (0-confirmation) coins as inputs when the wallet is acting as the receiver in a Payjoin swap. Before the fix, the receiver could accidentally propose or sign a Payjoin that relied on coins that had not yet been mined into a block. Such coins can disappear, be double-spent, or get replaced, which could cause the Payjoin to fail, be invalid, or expose the receiver to loss or confusion. The fix adds an optional 'confirmed only' filter and turns it on for Payjoin receiver candidate inputs.

This commit strengthens the wallet's automatic detection and handling of scam, spam, and impersonator tokens on Ethereum-compatible (EVM) chains and Solana. It adds checks for suspicious names/symbols (e.g., fake 'ETH', 'SOL', 'USDC', or tokens with 'airdrop', 'claim', URLs), prevents auto-enabling tokens that look like well-known coins but aren't verified, and uses Moralis API data such as price, value, verified-contract status, and security score to decide whether a discovered token should be shown as enabled. It also re-runs a one-time cleanup on existing tokens to reclassify any previously missed scams. There is no direct exploit fixed in the diff; rather, it is a defensive hardening change against social-engineering/token-spam attacks.

This commit changes how Cake Wallet handles Bitcoin transactions when it cannot fetch all of their 'input' transaction data from the Electrum server. Previously, such transactions were skipped entirely and not shown in the wallet. Now they are still parsed and displayed, but with a warning ('Transaction has missing data') and a null fee. The change also makes the list of input transactions nullable and adds null checks in fee-calculation and replace-by-fee code paths, throwing errors if input data is missing there. This is primarily a robustness/usability fix, but it touches transaction parsing and fee logic, which are security-sensitive areas.

This is a large code refactor of Cake Wallet's address resolver feature, which turns human-readable names (like Twitter handles, ENS domains, or email-style addresses) into cryptocurrency addresses. The change reorganizes existing lookup logic into a cleaner provider/service pattern and adds new address sources such as Nostr, BIP353, and Zcash names. It is primarily a structural rewrite rather than an obvious security fix, but because it touches many parts of how the app decides where to send money, any bugs in the new resolver could lead to payments going to the wrong address.

This commit adds a new piece of information—the Lightning Network payment preimage—to the transaction details screen. The preimage is a proof that a Lightning payment completed, and it is already stored in the wallet's existing payment data. The change simply displays it to the user, similar to showing a receipt number. There is no indication it introduces a security vulnerability.

This commit contains three small, unrelated fixes. One adds a safety catch around a Lightning wallet disconnect call so the app doesn't crash if disconnect fails. Another trims spaces and trailing currency text from amount inputs before converting them to numbers, which could prevent user input errors or unexpected parsing. The third is an Italian translation correction for the word 'change'. There is no clear security vulnerability being patched.