Cake Wallet / Monero.com

This commit fixes a simple but meaningful math bug caused by missing parentheses. In the original code, the conversion from fiat to crypto amount was calculated incorrectly because division happened before the fallback to zero. Depending on the value of quote.rate, this could produce wrong crypto amounts when a user buys or sells cryptocurrency through the app. The fix makes sure the fiat amount is determined first, then divided by the exchange rate.

This commit changes how the app converts a user's entered fiat amount into a cryptocurrency amount when getting a price quote. Previously, if the user's input couldn't be parsed as a number, the app would crash. Now it treats invalid input as zero instead. This is a defensive fix that prevents a crash but may silently produce a zero quote for bad input, which could confuse users. It is not obviously a security vulnerability on its own.

This commit changes how the app handles fiat amounts typed by users. In some countries, people use a comma (,) as the decimal separator instead of a period (.). The app now converts any commas to periods before processing the amount. This is likely a bug-fix for incorrect amounts, payment failures, or wrong quotes when buying or selling cryptocurrency. It is not clearly a security fix, but bad number parsing in a buy/sell flow can cause real money errors.

This commit makes the displayed cryptocurrency amount for a buy/sell quote nullable and adds a safer parsing helper. Previously, if a quote's rate produced an unparsable amount, the app could crash when formatting the value on several buy/sell screens. The change lets the app show an empty string instead of crashing. It is a robustness fix for a UI/data-handling edge case, not an obvious security vulnerability.

This commit is a follow-up bug-fix patch after a larger 'AnyPay' feature rollout. It corrects a copy-paste error where Zcash and Decred shared the same transaction-priority storage key, adds missing Dogecoin transaction-priority support, fixes a Flutter/MobX state-management warning, and moves an object initialization out of a field declaration into the widget's initState() method. None of these changes appear to be security fixes on their own; they are stability and correctness cleanups.

This is a small UI fix in the buy/sell confirmation screen. It hides the 'payment method' row when a selected quote has no payment method title, preventing an empty or confusing label from appearing. There is no indication this is a security issue.

This commit fixes a display/calculation bug when buying or selling Nano cryptocurrency through Cake Wallet. Nano supports very small decimal amounts (up to 30 places). The app was trying to format the calculated crypto amount using all of those decimals, which caused an error because the formatting function only supports up to 20 decimal places. The fix caps the decimals at 20. This is primarily a reliability/usability bug, not a direct security vulnerability, though it could cause failed transactions or user confusion in the buy/sell flow.

This commit removes a single '@computed' annotation from a Dart method in a cryptocurrency wallet app. The change is a code-style or framework-migration edit. There is no indication it fixes or introduces a security issue.

This commit is a cosmetic fix for the app's light mode theme. It changes several buy/sell screens so they display light-colored icons when the device is in light mode, instead of always showing dark-colored icons. There is no security issue here.

This commit replaces the standard Money.parse() with a new Money.safeParse() when converting cryptocurrency buy/sell quote amounts. The change appears aimed at preventing parsing failures or incorrect handling of numeric strings that could arise from floating-point division results, which in a financial app could lead to wrong displayed prices or transaction amounts. There is no explicit security claim in the commit, and the patch is small and partial, so the security relevance is speculative.

This commit updates a script that downloads a third-party software package called torch_dart used by the Cake Wallet app. It changes the expected fingerprint (a Git commit hash) of the package from one value to another. On its own, this is a routine dependency bump, but because the commit message only says 'bump' and gives no details about what changed in torch_dart, we cannot tell from this diff alone whether the new version fixes a security issue, introduces one, or is benign. The change is not suspicious by itself, but it is also not verifiable as safe without inspecting the upstream torch_dart repository.

This is a large feature commit that introduces a new 'AnyPay' service layer for routing cryptocurrency payments and swaps inside Cake Wallet. It refactors how the app parses payment requests, detects recipient networks, switches wallets, and handles deep links. The changes are mostly architectural and user-facing, but because they touch sensitive flows such as wallet switching, address parsing, and cross-chain swaps, they could introduce security bugs if the new routing logic makes incorrect decisions. The commit does not appear to be a disclosed security fix, and no CVE or vendor security statement is present.

This commit replaces the way Cake Wallet stores EVM, Solana, and Tron token lists: it moves them from Hive (a local key-value store) into SQLite (a local SQL database). It also adds migration code that copies existing token data from the old Hive boxes into the new SQLite tables when the app starts or restores a backup. The change is a large data-layer refactor, not a clear security fix or vulnerability. There are some migration edge cases (duplicate wallet names, interrupted migrations, case-insensitive EVM contract addresses) that are explicitly handled and tested.

This commit moves a Bluetooth status check so it runs when the device-connection screen first appears, rather than when the wallet view model is first created. It appears to be a timing or state-refresh bug fix for hardware wallet pairing, not a security vulnerability. There is no evidence in the commit of malicious behavior, exploitation, or a disclosed security issue.