Cake Wallet / Monero.com

This is a small UI fix in the buy/sell confirmation screen. It hides the 'payment method' row when a selected quote has no payment method title, preventing an empty or confusing label from appearing. There is no indication this is a security issue.

This commit fixes a display/calculation bug when buying or selling Nano cryptocurrency through Cake Wallet. Nano supports very small decimal amounts (up to 30 places). The app was trying to format the calculated crypto amount using all of those decimals, which caused an error because the formatting function only supports up to 20 decimal places. The fix caps the decimals at 20. This is primarily a reliability/usability bug, not a direct security vulnerability, though it could cause failed transactions or user confusion in the buy/sell flow.

This commit removes a single '@computed' annotation from a Dart method in a cryptocurrency wallet app. The change is a code-style or framework-migration edit. There is no indication it fixes or introduces a security issue.

This commit is a cosmetic fix for the app's light mode theme. It changes several buy/sell screens so they display light-colored icons when the device is in light mode, instead of always showing dark-colored icons. There is no security issue here.

This commit replaces the standard Money.parse() with a new Money.safeParse() when converting cryptocurrency buy/sell quote amounts. The change appears aimed at preventing parsing failures or incorrect handling of numeric strings that could arise from floating-point division results, which in a financial app could lead to wrong displayed prices or transaction amounts. There is no explicit security claim in the commit, and the patch is small and partial, so the security relevance is speculative.

This commit updates a script that downloads a third-party software package called torch_dart used by the Cake Wallet app. It changes the expected fingerprint (a Git commit hash) of the package from one value to another. On its own, this is a routine dependency bump, but because the commit message only says 'bump' and gives no details about what changed in torch_dart, we cannot tell from this diff alone whether the new version fixes a security issue, introduces one, or is benign. The change is not suspicious by itself, but it is also not verifiable as safe without inspecting the upstream torch_dart repository.

This is a large feature commit that introduces a new 'AnyPay' service layer for routing cryptocurrency payments and swaps inside Cake Wallet. It refactors how the app parses payment requests, detects recipient networks, switches wallets, and handles deep links. The changes are mostly architectural and user-facing, but because they touch sensitive flows such as wallet switching, address parsing, and cross-chain swaps, they could introduce security bugs if the new routing logic makes incorrect decisions. The commit does not appear to be a disclosed security fix, and no CVE or vendor security statement is present.

This commit replaces the way Cake Wallet stores EVM, Solana, and Tron token lists: it moves them from Hive (a local key-value store) into SQLite (a local SQL database). It also adds migration code that copies existing token data from the old Hive boxes into the new SQLite tables when the app starts or restores a backup. The change is a large data-layer refactor, not a clear security fix or vulnerability. There are some migration edge cases (duplicate wallet names, interrupted migrations, case-insensitive EVM contract addresses) that are explicitly handled and tested.

This commit moves a Bluetooth status check so it runs when the device-connection screen first appears, rather than when the wallet view model is first created. It appears to be a timing or state-refresh bug fix for hardware wallet pairing, not a security vulnerability. There is no evidence in the commit of malicious behavior, exploitation, or a disclosed security issue.

This commit improves Bitcoin/Litecoin privacy in Cake Wallet by making coin selection less predictable. Previously, the wallet chose coins in a fixed order (based on address creation and age), which outside observers could use to fingerprint the wallet or trace its funds. The patch shuffles candidate coins using a secure random source, tries to build changeless transactions when possible, and also randomizes coin order in RBF fee-bump and PayJoin flows. It also adds a CI guard to skip Linux builds on fork pull requests because secrets are unavailable there.

This commit changes how Cake Wallet sets the 'locktime' field on outgoing Bitcoin transactions. Previously, Cake Wallet apparently left this value at zero, which made its transactions stand out and easier to track. Now it sets the locktime to the current blockchain height when the wallet is synced, matching common behavior used by other Bitcoin wallets. This is a privacy improvement, not a fix for a vulnerability that lets someone steal funds directly.

This commit changes how the Cake Wallet app manages its software building blocks (Dart/Flutter dependencies). It removes many per-package lock files, pins more dependencies to specific Git commit hashes instead of branch names, adds shared override files, and updates CI build scripts. The main security angle is supply-chain hardening: pinning to exact Git commits makes it harder for an attacker to silently swap in a malicious version of a library. However, the commit is a broad refactor, and the diff does not show a specific vulnerability being fixed or any malicious code being introduced. It is best treated as a defensive hygiene improvement.

This commit removes a shortcut method that converted cryptocurrency amounts directly into regular 'double' numbers and reverts some earlier helper-function changes. It also fixes one spot where Solana transactions were looking up the wrong asset type. The overall effect is to make amount formatting and parsing go through string-based conversions again, which reduces the risk of tiny rounding errors or precision loss when handling very small crypto balances.

This commit hardens how Cake Wallet handles Bitcoin fee estimates from Electrum servers. Previously, a malicious or misbehaving Electrum server could return extreme or negative fee numbers, which could lead to users paying far too much, far too little, or creating invalid transactions. The patch now clamps fee rates between 0 and 2000 sat/vB, rejects all-zero fee lists, and refuses to build transactions when the computed fee is zero or negative. Most of the rest of the diff is just code formatting cleanup.

This commit adds a missing safety check when users restore an Ethereum-compatible (EVM) wallet from a seed phrase. Before the fix, the app accepted any 12 or 24 words that looked like a mnemonic, even if the words were wrong or the checksum was invalid. That could let a user create a wallet from a typo-ridden seed and later be unable to access their funds. The fix validates the seed phrase's checksum before restoring, and shows a clear error if it is invalid.

This commit slightly increases the size of a small UI box that displays a token icon together with a tiny chain/network badge. It is a visual layout tweak with no security relevance.

This commit is a routine version bump to 6.4.1 plus a small user-interface fix for a changelog text overflow and an iOS minimum version update. It also refreshes translated release notes and updates a dependency reference for the Trezor hardware wallet integration. There is no indication of a security fix or vulnerability being addressed.

This commit is a user-interface change that adds a brief 'Synced' indicator when a wallet finishes synchronizing. It does not change how funds, keys, or network connections are handled, and it does not fix or introduce any security issue visible in the diff.

This commit is a routine user-interface update for Cake Wallet's buy/sell flow. It adds a new fiat-currency picker and a small widget that shows a token icon with its chain/network badge. There is nothing in the changes that suggests a security vulnerability or fix.

This commit is a straightforward user-interface enhancement: it adds country-flag emoji icons next to fiat currency entries in the Cake Wallet app. There is no security-relevant change—no new network calls, no altered permissions, no cryptographic changes, and no data handling modifications.

This commit adds safety checks in a buy/sell screen so the app doesn't try to show pop-ups or navigate after the user has already left the page. It also adds a screen-reader label to the close button and reformats some code. There is no clear security vulnerability being fixed.

This update fixes how Cake Wallet displays Zcash transactions. Previously, outgoing transaction fees were shown as zero and transaction timestamps could be wrong or missing. The patch makes fees show the real network fee and improves date/time handling for transactions. There is no direct evidence in the commit of a security vulnerability being exploited, but incorrect fee and time data could mislead users or cause accounting problems.

This commit fixes two user-facing bugs in Cake Wallet's Zcash handling. First, it ensures the correct transparent Zcash address is used when sending funds to an exchange, which could previously lead to deposits going to the wrong address type. Second, it makes wallet restore respect the block height the user typed in, and allows that height to contain grouping separators like commas. The changes are bug fixes rather than a disclosed security vulnerability, but the wrong-address issue has clear financial-impact potential.

This commit improves accessibility for users who rely on screen readers (VoiceOver on iOS, TalkBack on Android). The app's 'swipe to confirm' control did not work well with screen readers because they intercept swipe gestures. The change adds a plain button fallback when a screen reader is active, so blind or low-vision users can still confirm transactions and approvals. It is an accessibility/usability fix, not a security vulnerability fix.

This is a large user-interface redesign for Cake Wallet's 'AnyPay' payment flow. It changes how the app parses payment QR codes and links for Ethereum, Solana, and Tron, adds network selection, and integrates swaps when the scanned payment is on a different network than the current wallet. The commit also fixes several amount-formatting bugs for tokens that do not use 18 decimal places, which could previously cause wrong payment amounts to be sent.