Cake Wallet / Monero.com

This commit simply bumps the version and build numbers for the Cake Wallet and Monero.com apps in two shell scripts used for Android and iOS packaging. There are no code changes, no bug fixes, and no security-related modifications visible in the diff.

This commit is a user-interface redesign for the screens that introduce and verify the wallet's recovery seed phrase. It adds new pages, moves image assets, updates navigation, and changes some labels. There is no direct evidence in the diff of a security vulnerability; it appears to be a normal feature/refactoring change.

This commit adds a persistent reminder for users to back up their wallet recovery phrase. It stores a new flag in the app's database, shows a reminder on the dashboard when the wallet has funds, and clears the reminder once the user completes a seed verification flow. It also adds the seed page to the list of screens that always require authentication before opening. There is no direct security vulnerability in the change; it is a user-experience and safety improvement.

This commit only changes translated text strings in the Cake Wallet app. It renames user-facing labels like 'seed' to 'Recovery Phrase' and adds new onboarding messages for the redesigned seed backup flow. There is no code that handles money, keys, network requests, or permissions, and no security bug is introduced or fixed.

This commit adds BIP39 seed phrase support for the Zano cryptocurrency in Cake Wallet, alongside a Zano hard-fork update. It changes how Zano wallets are created, restored, opened, renamed, and saved, and stores the seed/passphrase in encrypted sidecar files. The change also bumps the underlying monero_c library to a newer commit. There is no vendor statement that this fixes a security vulnerability; it reads as a feature/upgrade patch. Some implementation choices (custom key reduction, hard-coded derivation path, fallback to native seed, and sidecar key management) introduce areas where key-handling mistakes could occur, but the diff itself does not show an obvious exploitable bug.

This commit is a routine version bump from 6.4.1 to 6.4.2 for the Cake Wallet/Monero.com apps. It updates translated changelog text, bumps build numbers, refreshes some third-party library references, and adjusts iOS project metadata. There is no code change visible in the diff that fixes or introduces a security vulnerability.

This commit adds a single missing import statement to a Dart file. It does not change any logic, behavior, or security properties of the application. By itself, it is not a security fix or vulnerability.

This commit is a routine code cleanup and bug-fix pass for the buy/sell feature in Cake Wallet. It removes an unused money-parsing helper, fixes memory leaks by disposing controllers and focus nodes, improves localization, and tweaks buy/sell amount calculations. There is no clear security vulnerability introduced or fixed in the diff itself.

This commit changes how the Cake Wallet app tracks Zcash (ZEC) balance data and migration readiness. It adds a lock (mutex) around database access to prevent multiple operations from interfering with each other, and replaces a live balance-checking reaction with a simpler computed property. The changes appear aimed at fixing race-condition or consistency bugs rather than introducing a security vulnerability.

This commit changes a single UI setting in the buy/sell screen so that the currency symbol is no longer shown next to a displayed money amount. It is a cosmetic/layout change with no apparent security relevance.

This update fixes a security weakness in Cake Wallet's WalletConnect feature. Previously, if a user switched to a different wallet inside the app while still connected to a decentralized app (dApp), the dApp could keep sending signing or transaction requests that might be handled by the wrong wallet. The patch now checks that each incoming request truly belongs to the currently active wallet, rejects mismatched requests with a clear message, and refreshes or clears WalletConnect sessions when wallets are switched. It also updates Solana connection identifiers and improves loading/error feedback.

This commit updates the Breez Lightning SDK used by Cake Wallet from version 0.14.0 to 0.23.0 and tweaks the wallet code to match the new SDK's API. It is a routine dependency upgrade, not a clearly labeled security fix. The update could include bug fixes or security improvements from the upstream SDK, but the commit itself does not describe any specific vulnerability or attack.

This commit adds BIP39 seed phrase support for Decred wallets in Cake Wallet. It changes how Decred wallets are created, restored, and saved, including storing an encrypted backup of the seed/passphrase and switching the underlying Decred library call used to build transactions. There is no explicit security bug in the diff, but the change touches sensitive wallet-key handling and transaction creation code, so it warrants careful review.

This commit hides certain wallet features in the Cake Wallet app when they cannot actually work—specifically for hardware wallets, air-gapped wallets, and wallets that do not contain a private key. The changes prevent users from seeing or tapping options like Payjoin, Lightning, silent payments, message signing/verification, MWEB, and some log exports when those features are unsupported. It is a defensive UI fix rather than a patch for an active exploit.

This commit fixes several Solana wallet bugs and security issues in Cake Wallet. The main security-relevant changes are: (1) preventing users from accidentally sending the wrong token when two tokens share the same symbol, by matching on the unique mint address instead of the symbol; (2) using the correct token decimals from the blockchain rather than defaulting to zero, so amounts are parsed and displayed accurately; (3) adding a warning and proper accounting for the extra SOL cost when a recipient's token account must be created; and (4) improving signature verification and transaction-history parsing. The commit title and message explicitly call these 'security issues' and mention an audit list.

This commit is a pure whitespace/indentation fix that reverts an unrelated formatting change. It moves one closing brace to the correct indentation level. There is no functional code change and no security relevance.

This commit simply undoes a prior formatting-only change in a single Dart file. It reverts a line break so that a fallback token definition appears on one line instead of two. There is no functional code change, no security fix, and no behavior alteration.

This commit is a routine UI polish/fix. It swaps plain text widgets for specialized money/currency widgets in buy/sell screens and fixes indentation in a hardware-wallet connection callback. There is no clear security-relevant change.

This commit changes the source of a software dependency called rive_common from one GitHub account (MrCyjaneK) to another (malik1004x). Dependencies are external code packages the app relies on. Switching to a different, unverified source could introduce malicious or vulnerable code into the wallet app, but the commit itself does not show any harmful code—only the source change. There is no vendor explanation or security disclosure provided.

This commit changes how the app converts a crypto amount into a fiat money value. It swaps strict number parsing for safer versions that fall back to zero when the input is invalid, instead of crashing. This is a defensive fix that prevents unhandled exceptions if a user's entered amount cannot be parsed as a number.

This commit fixes a simple but meaningful math bug caused by missing parentheses. In the original code, the conversion from fiat to crypto amount was calculated incorrectly because division happened before the fallback to zero. Depending on the value of quote.rate, this could produce wrong crypto amounts when a user buys or sells cryptocurrency through the app. The fix makes sure the fiat amount is determined first, then divided by the exchange rate.

This commit changes how the app converts a user's entered fiat amount into a cryptocurrency amount when getting a price quote. Previously, if the user's input couldn't be parsed as a number, the app would crash. Now it treats invalid input as zero instead. This is a defensive fix that prevents a crash but may silently produce a zero quote for bad input, which could confuse users. It is not obviously a security vulnerability on its own.

This commit changes how the app handles fiat amounts typed by users. In some countries, people use a comma (,) as the decimal separator instead of a period (.). The app now converts any commas to periods before processing the amount. This is likely a bug-fix for incorrect amounts, payment failures, or wrong quotes when buying or selling cryptocurrency. It is not clearly a security fix, but bad number parsing in a buy/sell flow can cause real money errors.

This commit makes the displayed cryptocurrency amount for a buy/sell quote nullable and adds a safer parsing helper. Previously, if a quote's rate produced an unparsable amount, the app could crash when formatting the value on several buy/sell screens. The change lets the app show an empty string instead of crashing. It is a robustness fix for a UI/data-handling edge case, not an obvious security vulnerability.

This commit is a follow-up bug-fix patch after a larger 'AnyPay' feature rollout. It corrects a copy-paste error where Zcash and Decred shared the same transaction-priority storage key, adds missing Dogecoin transaction-priority support, fixes a Flutter/MobX state-management warning, and moves an object initialization out of a field declaration into the widget's initState() method. None of these changes appear to be security fixes on their own; they are stability and correctness cleanups.