Electrum

This commit removes a hard crash (assertion) in Electrum's wallet code when a user loads a partially-signed Bitcoin transaction (PSBT) whose calculated fee is negative. Instead of crashing, Electrum now logs a warning and continues. A negative fee can happen if transaction inputs and outputs are crafted or edited in unusual ways. The change prevents a denial-of-service-like crash when opening such a transaction, but it does not by itself fix whatever produced the negative fee.

This commit simply moves a user-interface slider for setting the maximum Lightning Network routing fee from the Settings window into the payment confirmation dialog. It is a usability improvement, not a security fix. There is no change to how payments are authorized, no new code path that could steal funds, and no vulnerability being patched.

This commit fixes a security issue in Electrum's background daemon (the program that stays running to serve wallet requests). Previously, a user could run a command that would instantly strip the RPC password from a running daemon, leaving it unauthenticated for the current session. The daemon would then accept commands from any local program without a password. On the next restart, Electrum would silently generate a new random password, which could lock out legitimate tools. The patch now forbids changing RPC server settings while the daemon is running and ensures a password is always required.

This change makes the two-factor authentication (2FA) QR code in Electrum's mobile/QML interface clickable. On Android, tapping the QR code opens the authenticator app directly with the setup link; on other platforms it copies the secret to the clipboard. It is a small usability improvement, not a security fix. There is no direct evidence of malicious intent or a vulnerability, but it does slightly increase the attack surface by invoking an external app and by copying a sensitive OTP secret to the system clipboard.

This commit changes the Electrum mobile/QML wallet's two-factor authentication (2FA) setup screen so that users can tap the displayed 2FA secret to copy it to the clipboard. Previously the secret had to be written down manually. The change is a straightforward usability improvement and does not appear to be a security fix.

This commit is a minor user-interface cleanup in the Electrum Bitcoin wallet's Qt (desktop) GUI. It changes how an error message is displayed when a wallet fails to load. Previously, some errors were shown using repr(), which can include technical Python object details like class names and quotes; now all such errors are shown using str(), which typically gives a cleaner, more readable message. There is no direct security vulnerability here, but displaying repr() could leak minor implementation details or confuse users.

This commit fixes a bug in Electrum's wallet setup wizard. Previously, if a user tried to import an individual private key for an unusual script type (like p2wsh), the wizard would crash with an internal error instead of showing a friendly message saying it's not supported. The fix catches that internal error and converts it into a user-facing message. It is a robustness improvement, not a fix for a security vulnerability that allows theft or remote attacks.

This commit removes unused code from two helper files (pem.py and x509.py) after the BIP70 payment protocol was removed. It also narrows the certificate-loading function so it only loads the bundled certificate authority list and skips expired certificates instead of rejecting them as errors. There is no security-relevant bug being fixed here; it is a cleanup change.

This commit removes the BIP70 payment protocol from Electrum. BIP70 was the feature that let users pay merchants who sent signed payment requests (like BitPay invoices). The change deletes the code that fetched, verified, and sent those requests, along with the RSA and protobuf code that only BIP70 used. It is a feature-removal cleanup, not a security patch, and it does not introduce a vulnerability.

This commit removes 33 lines of unused, broken code from a file in the Electrum Bitcoin wallet. The deleted code was a standalone test routine for checking saved SSL certificates and could not even run because of a Python import problem. It was not part of the normal wallet operation, so removing it does not create or fix a security vulnerability.

This commit simply removes an unused helper function called _match_hostname from the Electrum source code. The function was only used by tests and is described by the developer as dead code. There is no security-relevant change here.

This commit simply moves an existing safety check from one file to another. It does not add new security behavior or fix a known vulnerability. The check makes sure the system's random number generator appears healthy when Electrum starts.

This is a tiny one-line code cleanup. It adds quote marks around a type hint name so the code does not need that class to be imported at module load time. It does not change what the program does or fix any security problem.

This commit is a user-interface cleanup, not a security fix. It changes how Electrum's desktop and mobile-style GUIs describe new transactions in pop-up notifications: instead of showing a positive or negative number with a plus/minus sign, the notification now explicitly says 'sent' or 'received'. It also moves duplicated notification-building code from the two GUI layers into a shared wallet method. There is no evidence this change addresses a vulnerability.

This commit refactors how Electrum subscribes to Bitcoin addresses when watching Lightning Network channel closes. Previously, checking which transaction spent a channel funding output automatically subscribed to related addresses. Now that subscription is done explicitly and only when actually needed. The change is a defensive cleanup that reduces unnecessary network subscriptions and could prevent a subtle bug where the wallet fails to track important transactions in some edge cases.

This is a tiny follow-up patch that removes a single 'assert' statement in Electrum's Lightning code. The assert was causing the program to crash when checking whether a payment hash was 'public' if the payment preimage was not known. Removing it lets the function return False instead of crashing. This is likely a bug-fix for a crash or denial-of-service condition, but the commit message gives almost no detail and there is no disclosed security context.

This commit adds new filtering options to Electrum's list_channels command. It is a straightforward feature enhancement that lets users view public, private, active, or open Lightning channels. There is no security issue visible in the change.

This commit fixes a crash in Electrum's submarine-swap feature. When a user typed certain amounts (like 20,000 sats) into the swap dialog, a tiny floating-point rounding mismatch made the fee-calculation sanity check fail, returning None where a number was expected and causing a TypeError. The fix changes the fee percentage from a float to a Decimal, which avoids floating-point rounding errors. It is a reliability/bug-fix patch, not a security vulnerability that an attacker can exploit remotely.

This commit changes how Electrum handles 'trampoline' routing packets in the Lightning Network. Previously, trampoline onion packets were forced to a fixed 400-byte size. The patch allows them to be variable length and introduces a new maximum of 500 bytes. The change removes several length checks and restructures how the packet is encoded. Without a vendor statement, it is unclear whether this is a routine protocol update or a security fix, but removing fixed-size validation can sometimes hide or enable bugs if not carefully reviewed.

This commit simply adds a 'Help' button to Electrum's plugin management window that opens the official plugins.electrum.org website in the user's web browser. It is a user-interface convenience change, not a security fix or vulnerability.

This commit fixes a crash in Electrum's swapserver plugin command-line tools. When users ran commands to view swap history or summary, the tool tried to format a missing date for swaps that were still pending, causing an error. The fix now skips pending swaps and only shows confirmed ones.

This commit only reorganizes test files. It moves QML-related unit tests from the tests/ folder into a new tests/qml/ subfolder and updates import paths accordingly. No production code, user-facing behavior, or security-sensitive logic was changed.

This commit removes an 'until' time limit when Electrum asks a Nostr relay for swap server advertisements. Previously, if a user left the swap dialog open for more than an hour, the 'until' timestamp would expire and the relay would stop sending newly created swap server events, causing the client to miss live server offers. The fix keeps a 'since' window and still validates event timestamps when parsing, so backdated or pre-dated events are rejected. It is a reliability/availability fix for swap discovery rather than a cryptographic or theft bug.

This commit is a minor user-interface layout tweak. It changes how a list of swap servers is sized inside a dialog window so the list grows with the window and uses space more efficiently. There is no security relevance.

This commit only moves existing test files for two Electrum plugins (Revealer and Timelock Recovery) into a new tests/plugins/ directory. The code itself is unchanged; it is purely a reorganization of the project's test suite.