Cake Wallet / Monero.com

This commit is a cosmetic fix for the app's light mode theme. It changes several buy/sell screens so they display light-colored icons when the device is in light mode, instead of always showing dark-colored icons. There is no security issue here.

This commit replaces the standard Money.parse() with a new Money.safeParse() when converting cryptocurrency buy/sell quote amounts. The change appears aimed at preventing parsing failures or incorrect handling of numeric strings that could arise from floating-point division results, which in a financial app could lead to wrong displayed prices or transaction amounts. There is no explicit security claim in the commit, and the patch is small and partial, so the security relevance is speculative.

This commit updates a script that downloads a third-party software package called torch_dart used by the Cake Wallet app. It changes the expected fingerprint (a Git commit hash) of the package from one value to another. On its own, this is a routine dependency bump, but because the commit message only says 'bump' and gives no details about what changed in torch_dart, we cannot tell from this diff alone whether the new version fixes a security issue, introduces one, or is benign. The change is not suspicious by itself, but it is also not verifiable as safe without inspecting the upstream torch_dart repository.

This commit replaces the way Cake Wallet stores EVM, Solana, and Tron token lists: it moves them from Hive (a local key-value store) into SQLite (a local SQL database). It also adds migration code that copies existing token data from the old Hive boxes into the new SQLite tables when the app starts or restores a backup. The change is a large data-layer refactor, not a clear security fix or vulnerability. There are some migration edge cases (duplicate wallet names, interrupted migrations, case-insensitive EVM contract addresses) that are explicitly handled and tested.

This commit moves a Bluetooth status check so it runs when the device-connection screen first appears, rather than when the wallet view model is first created. It appears to be a timing or state-refresh bug fix for hardware wallet pairing, not a security vulnerability. There is no evidence in the commit of malicious behavior, exploitation, or a disclosed security issue.

This commit removes a shortcut method that converted cryptocurrency amounts directly into regular 'double' numbers and reverts some earlier helper-function changes. It also fixes one spot where Solana transactions were looking up the wrong asset type. The overall effect is to make amount formatting and parsing go through string-based conversions again, which reduces the risk of tiny rounding errors or precision loss when handling very small crypto balances.

This commit hardens how Cake Wallet handles Bitcoin fee estimates from Electrum servers. Previously, a malicious or misbehaving Electrum server could return extreme or negative fee numbers, which could lead to users paying far too much, far too little, or creating invalid transactions. The patch now clamps fee rates between 0 and 2000 sat/vB, rejects all-zero fee lists, and refuses to build transactions when the computed fee is zero or negative. Most of the rest of the diff is just code formatting cleanup.

This commit adds a missing safety check when users restore an Ethereum-compatible (EVM) wallet from a seed phrase. Before the fix, the app accepted any 12 or 24 words that looked like a mnemonic, even if the words were wrong or the checksum was invalid. That could let a user create a wallet from a typo-ridden seed and later be unable to access their funds. The fix validates the seed phrase's checksum before restoring, and shows a clear error if it is invalid.

This commit slightly increases the size of a small UI box that displays a token icon together with a tiny chain/network badge. It is a visual layout tweak with no security relevance.

This commit is a user-interface change that adds a brief 'Synced' indicator when a wallet finishes synchronizing. It does not change how funds, keys, or network connections are handled, and it does not fix or introduce any security issue visible in the diff.

This commit is a routine user-interface update for Cake Wallet's buy/sell flow. It adds a new fiat-currency picker and a small widget that shows a token icon with its chain/network badge. There is nothing in the changes that suggests a security vulnerability or fix.

This commit is a straightforward user-interface enhancement: it adds country-flag emoji icons next to fiat currency entries in the Cake Wallet app. There is no security-relevant change—no new network calls, no altered permissions, no cryptographic changes, and no data handling modifications.

This commit adds safety checks in a buy/sell screen so the app doesn't try to show pop-ups or navigate after the user has already left the page. It also adds a screen-reader label to the close button and reformats some code. There is no clear security vulnerability being fixed.

This update fixes how Cake Wallet displays Zcash transactions. Previously, outgoing transaction fees were shown as zero and transaction timestamps could be wrong or missing. The patch makes fees show the real network fee and improves date/time handling for transactions. There is no direct evidence in the commit of a security vulnerability being exploited, but incorrect fee and time data could mislead users or cause accounting problems.

This commit fixes two user-facing bugs in Cake Wallet's Zcash handling. First, it ensures the correct transparent Zcash address is used when sending funds to an exchange, which could previously lead to deposits going to the wrong address type. Second, it makes wallet restore respect the block height the user typed in, and allows that height to contain grouping separators like commas. The changes are bug fixes rather than a disclosed security vulnerability, but the wrong-address issue has clear financial-impact potential.

This commit improves accessibility for users who rely on screen readers (VoiceOver on iOS, TalkBack on Android). The app's 'swipe to confirm' control did not work well with screen readers because they intercept swipe gestures. The change adds a plain button fallback when a screen reader is active, so blind or low-vision users can still confirm transactions and approvals. It is an accessibility/usability fix, not a security vulnerability fix.

This is a large user-interface redesign for Cake Wallet's 'AnyPay' payment flow. It changes how the app parses payment QR codes and links for Ethereum, Solana, and Tron, adds network selection, and integrates swaps when the scanned payment is on a different network than the current wallet. The commit also fixes several amount-formatting bugs for tokens that do not use 18 decimal places, which could previously cause wrong payment amounts to be sent.

This commit prevents users from rotating (regenerating) a Bitcoin Lightning address in the Cake Wallet app. Previously, the app may have allowed address regeneration for Lightning addresses, which could cause confusion, lost incoming payments, or funds sent to an old/unexpected address. The fix adds a guard that throws an error if code tries to rotate a Lightning address, and updates the UI logic to recognize when a Lightning address type is selected.

This commit only updates German translation strings in a single language file. It removes a few duplicate entries, fixes typos, rewords some user-facing messages, and adds new German translations for recently introduced app features. There are no code or security changes.

This commit fixes how Zcash wallet transactions display recipient addresses. Previously, the app could misidentify which addresses belong to the user's own wallet, causing it to show the wrong address (or even the user's own address) as the destination for a payment. The fix builds a single, authoritative list of addresses the wallet actually owns and uses that to decide which outputs are real external payments. There is no direct evidence this is a security vulnerability that can be exploited by an attacker; it appears to be a UI correctness bug that could confuse users or make transaction records less trustworthy.

This commit adds a new Solana token called 'The Bitcoin Bull' (TBB) to Cake Wallet's default token list and introduces a Jupiter verification check to help flag potentially scam tokens. It also includes many unrelated translation string updates. The main security-relevant change is the new Jupiter verification lookup, which makes the wallet trust tokens verified by Jupiter when users add custom Solana tokens. There is no direct evidence of a vulnerability being fixed or introduced, but the change alters how the app decides whether a token is trustworthy.

This commit adds a user-interface feature for Zcash wallets that displays an informational modal when the user's funds are being automatically migrated to the new Zcash 'Ironwood' network upgrade. It does not change how funds are secured, sent, or received; it only shows explanatory text and a 'Learn more' link. There is no indication of a security vulnerability in this change.

This commit changes how Cake Wallet's Zcash wallet calculates and displays balances that are still 'confirming' or otherwise unavailable. It filters out tiny 'dust' notes from the unavailable balance, adjusts which note pools are considered spendable during the Zcash Ironwood network upgrade, and changes the bitmask used when building transactions. The main user-visible effect is that small unspendable notes no longer appear as 'confirming' balance, which could previously make users think they had funds that were not actually usable.

This commit improves accessibility for screen-reader users in the Cake Wallet app's new dashboard. It adds labels and roles to navigation tabs, balance cards, buttons, and status indicators so assistive technology can describe them properly. There is no security-relevant change here.

This commit is a routine German translation update. It changes wording in user-facing text (for example, replacing 'Tausch' with 'Swap' and 'Gelder' with 'Guthaben'), adds a few missing translated strings, and updates navigation instructions. There are no code, logic, or security changes.