Cake Wallet / Monero.com

This commit is a routine cleanup: it changes some quote styles in Dart code from single to double quotes, adds a blank line, and updates translated text strings in several language files. There is no security-relevant change.

This commit is a routine UI cleanup. It swaps a custom checkbox drawing for a shared checkbox widget, changes two icon colors from light blue to white, and reorders some translated text strings in the Brazilian Portuguese language file. There is no security-relevant change visible in the diff.

This commit fixes how Cake Wallet's EVM (Ethereum-compatible) wallets sign and verify messages. It switches message encoding from ASCII to UTF-8, removes a third-party signature utility, and adds stricter checks on the address and signature format. The change appears to be a bug fix for incorrect or unreliable signature verification, which could previously fail or behave unexpectedly for non-ASCII messages or malformed inputs.

This commit fixes two related problems in Cake Wallet's CSV transaction-history export. First, user notes attached to transactions were being left blank in the exported file. Second, and more importantly, the CSV export did not protect against spreadsheet formula injection: a transaction note, trade memo, or other text that starts with characters like =, +, -, @, tab, or carriage return could be interpreted as a formula by Excel, LibreOffice, or Google Sheets when the CSV is opened. That could be abused to trick users into clicking malicious links, leak data from other cells, or run commands. The patch now prefixes such values with a single quote so spreadsheets treat them as plain text, and it also properly quotes carriage returns so rows don't get broken.

This commit changes the default Arbitrum network server used by the wallet from one provider (nownodes.io) to another (publicnode.com), and adds several new decorative icon images. The server change could affect reliability or privacy for users who rely on the default node, but there is no direct evidence of a security vulnerability in the code change itself.

This update fixes a bug where entering special non-number values like 'Infinity' or 'NaN' as a crypto amount could slip past safety checks. Because the wallet treats an amount of zero as 'send everything' (sweep-all), a bad amount that collapsed to zero could unexpectedly drain the whole account. The patch adds stronger checks in the amount-parsing code and refuses to create transactions with zero or infinite amounts.

This is a tiny UI timing fix in a cryptocurrency wallet's dashboard screen. It moves a changelog popup so it runs after the current frame is rendered, rather than immediately after a short delay. There is no security-relevant change visible in the diff.

This patch fixes a bug where Cake Wallet's Monero module could skip actually opening a wallet and instead leave the user looking at the previously opened wallet without any warning. The old code tracked the 'last opened wallet' path and, if the requested path matched it, simply did nothing. That state tracking was unreliable and could become stale, so the app might appear to load a wallet while silently staying on the wrong one. The fix removes that shortcut and always performs the real open-wallet work, including error checks.

This commit changes how Cake Wallet encrypts and decrypts wallet backup files. It removes an older, weaker encryption method (Salsa20) and switches to a stronger one (XChaCha20) for all platforms. It also adds automatic migration: when the app opens an old Salsa20 wallet file, it re-encrypts it with the stronger method. The change touches code that handles wallet seeds/private keys, so a mistake here could put users' funds at risk, but the patch itself appears to be a hardening fix rather than an introduction of a new vulnerability.

This commit is a routine user-interface redesign for the Cake Wallet home screen. It moves the wallet name and account customizer into a new top bar, adds an 'Accounts' entry in settings, and adds or updates widget tests. There is no indication in the commit that it fixes a security vulnerability or changes security-sensitive logic such as authentication, encryption, key handling, or transaction signing.

This commit makes two small UI/logic fixes in the buy/sell flow of the Cake Wallet app. It disables the Continue button when the amount field is empty, and it avoids a crash when converting an empty fiat amount to crypto or when no exchange rate is available. These are defensive hardening changes rather than a fix for an active security vulnerability.

This commit is a purely cosmetic UI tweak. It makes a hero image shorter (from about 228 pixels to 175 pixels) and adds 24 pixels of empty space above it on seed-related pages. There is no security relevance.

This commit only updates documentation. It replaces placeholder build instructions in the README with links to current platform-specific guides, fixes two broken links in a developer guide that pointed to a renamed file, and updates copyright years from 2018-2023 to 2018-2025. No code, configuration, or executable files were changed, so there is no security impact.

This commit is mostly a user-interface wording change: it replaces the word 'seed' with 'recovery phrase' across many languages and fixes a few related navigation and reminder-handling edge cases. The code changes do not introduce obvious security vulnerabilities, nor do they fix a clearly exploitable flaw. The most notable functional change is that the app now correctly decides when to show a recovery-phrase backup reminder, and it restores the previous reminder state if saving fails. This is a reliability/usability improvement rather than a security patch.

This commit fixes app crashes and broken number formatting that could happen when the wallet was set to certain less-common languages such as Yoruba, Hausa, or Guarani. It makes the app fall back to English formatting when the device's locale has no number-formatting data, and it prevents invalid locale codes from being restored from saved settings. There is no sign this was a security flaw that could steal funds; it is best described as a reliability/UX fix.

This is a routine version-bump release candidate for Cake Wallet/Monero.com (6.4.4). The visible code changes are mostly version numbers, localized changelogs, dependency updates, and two small functional tweaks: disabling the 'Swaps.XYZ' exchange provider by default and adding a re-entrancy guard to the Solana NFT send button so it cannot be double-pressed while the authentication prompt is showing. Nothing in the diff clearly indicates a security vulnerability or a malicious change, but the patch is a release candidate rather than a focused security fix, so the actual security-relevant code is only a small fraction of the commit.

This commit is a feature update for Cake Wallet that improves Solana NFT support (sending, ownership badges, persistent imports) and adds several security hardening measures. It does not appear to be a patch for an active exploit. The security-relevant changes include sanitizing NFT names/descriptions to stop malicious metadata from hiding or reordering text, restricting image URLs to HTTPS/IPFS gateways to avoid unsafe schemes, verifying an asset really is an NFT before sending, and adding safety checks when fetching off-chain metadata. There are also unrelated Monero background-sync and dependency changes.

This commit simply turns off an advertisement banner for a Litecoin privacy feature (MWEB) in the app's dashboard. It is a product/marketing change, not a security fix.

This commit fixes a wallet setup flow where a user-added custom server node was saved but not actually selected for use. It also adds a safeguard so node-change notifications only reconnect the active wallet when the node's cryptocurrency type matches the wallet's type. The practical effect is to prevent the wallet from silently ignoring a user's custom node choice or from trying to connect a wallet to an incompatible node.

This commit fixes a UI progress-bar issue in the Monero wallet. During the initial warm-up of the underlying wallet engine, the sync progress could stop redrawing and appear frozen. The change also prevents the app from accidentally starting two simultaneous node-height checks and adds better error logging. There is no direct evidence this is a security vulnerability.

This commit refactors how Cake Wallet builds Bitcoin and Litecoin transactions for hardware wallets (Ledger, Trezor, BitBox). It mainly improves change-output handling, derivation-path reporting, and adds a new Litecoin Trezor signing path. There is no explicit security bug fix in the commit message, but the changes touch sensitive transaction-assembly code where mistakes could affect how much money is sent or which addresses are shown on the device screen.

This commit is a routine code cleanup titled "fix: lint issues". It only refactors how theme colors are accessed in several user-interface screens and widgets, switching from a local variable to inline lookups. There is no change to app behavior, security logic, or user-facing functionality.

This commit adds a friendly in-app reminder for users who have cryptocurrency in their wallet but have not yet backed up their recovery phrase. It shows a card on the home screen and offers a guided flow to view or dismiss the reminder. There is no security vulnerability here; it is a user-experience and safety feature.

This commit adds one line to make sure a fallback locktime value is copied from a Bitcoin transaction into a PSBT (Partially Signed Bitcoin Transaction) data structure during parsing. A locktime is a standard Bitcoin field that controls when a transaction can be mined. The change appears to be a missing-field fix rather than a security patch, and there is no direct evidence in the commit that it fixes an active vulnerability.

This commit only updates translation files (string resources) for the Cake Wallet app across many languages. It adds new user-facing text labels and descriptions for upcoming or existing app features, but does not change any program logic, security code, cryptography, network handling, or wallet behavior. There is no indication of a security fix or vulnerability.