Electrum

This change fixes a bug in Electrum's mobile/QML wallet interface where paid Lightning invoices were being deleted from the wallet's records. The fix moves the 'don't delete paid invoices' protection into the core wallet code so it applies consistently, and it also prevents deletion of invoices that are still 'in flight' (payment pending). Keeping paid invoice records is important because they are needed to show transaction history and to prove a payment was made. Deleting them could cause confusion, accounting problems, or loss of payment evidence.

This commit fixes a bug in the Electrum Bitcoin wallet where deleting a paid or in-flight Lightning invoice/request could incorrectly erase important payment records. The change now preserves those records when a payment has already completed or is still pending, preventing loss of payment history and avoiding a minor privacy leak if an in-flight payment later fails.

This change tightens up Electrum's crash reporter so it cannot be flooded with an unbounded number of exceptions. Before the patch, every unhandled exception was placed in an internal queue with no size limit, which could slowly consume memory if something kept crashing. The patch caps that queue at 100 entries and logs exceptions immediately instead of silently holding them. It is a hardening fix rather than a fix for an active attack.

This commit refactors how Electrum stores Lightning channel backups on disk. It converts backup records from a flexible JSON-style format into a stricter binary format, and adds a one-time database upgrade routine. The change is primarily a code-quality and data-format cleanup, not a fix for an active security flaw. However, any database migration that touches sensitive key material carries a small risk of corruption or mis-handling of secrets if the conversion has bugs.

This commit only adds a new automated test. It does not change any production wallet code, fix a bug, or alter how user funds are handled. The test verifies that Electrum can correctly upgrade an old test wallet database containing Lightning channel backups from database version 71 to version 72. It is a quality-assurance change, not a security patch.

This commit is a small code cleanup in Electrum's Bitcoin transaction handling. It merges two duplicate functions for writing variable-length integer sizes and adds explicit error checks for invalid values (negative numbers or numbers too large). The change makes the code more consistent and slightly safer, but it does not appear to fix any active security vulnerability or change behavior in normal use.

This commit only adjusts Python type hints and one test counter variable. It does not change any runtime behavior, so it cannot introduce or fix a security vulnerability on its own.

This commit is a defensive hardening fix for Electrum's Lightning channel watcher. It wraps each individual sweep operation in a try/except block so that if one output fails or crashes, the remaining outputs are still swept. Previously, an unhandled exception during one sweep could stop the entire process, potentially leaving funds unclaimed. The commit does not itself introduce a vulnerability; it reduces the risk of losing funds due to a crash or edge-case bug during channel closure recovery.

This commit fixes a class of crash bugs in Electrum's Qt/QML graphical user interface. When a user closes a dialog or window while a background task is still running, the background task can try to talk to a Qt object that has already been destroyed, causing a RuntimeError and possibly crashing the app. The patch adds a helper that safely ignores these 'already destroyed' errors instead of letting them propagate. It does not appear to be a security vulnerability that an attacker can exploit to steal funds or run malicious code; it is a stability/robustness fix.

This commit fixes a bug in the Electrum Bitcoin wallet that could crash or fail when trying to move funds from a watch-only wallet that only has imported addresses (no private keys). The fix makes the wallet more careful when it doesn't know the exact script type for an address, returning 'unknown' instead of crashing, and only setting a script descriptor when one actually exists. There is no direct evidence this was a security vulnerability exploitable by an attacker; it appears to be a reliability/functional bug fix.

This is a purely cosmetic change to a test file. It wraps two existing test blocks inside Python 'subTest' contexts so that if one part fails, the other still runs and the failure message is clearer. No production code was changed, and no security behavior is affected.

This commit refactors how Electrum's submarine-swap server pays Lightning invoices from clients. The main visible change is that the swap server no longer maintains its own retry queue for pending invoices; instead it delegates directly to the wallet's existing invoice-payment logic, which now rejects duplicate in-flight payment attempts. A new regression test confirms that a second payment attempt with the same payment hash is blocked while the first is still running. The commit also fixes a small bug where an HTTP endpoint called a coroutine without awaiting it. Overall the change looks like a hardening/cleanup rather than an obvious vulnerability fix, but it removes a custom retry mechanism and tightens duplicate-payment protection, which can have security relevance in Lightning.

This commit adds a 5-second timeout and a small cache to a helper that runs the 'git describe' command when Electrum's crash reporter builds a diagnostic report. The change mainly prevents the crash reporter from hanging on slow filesystems. A code comment also flags that the helper searches the system path for a program named 'git', which could theoretically be abused if an attacker controls the program search path, but the commit does not claim this is an exploitable vulnerability.

This commit adds internal consistency checks to make sure a wallet, its lightning component, and the network layer all share the same configuration object. It is a defensive hardening change: it does not fix an active bug by itself, but makes future misconfigurations fail loudly during development/testing rather than silently causing odd behavior.

This commit adds internal consistency checks (assertions) to make sure that a wallet, its lightning worker, and the network connection all share the same configuration object. It is a hardening/test-quality change only; it does not fix any user-facing bug or vulnerability and does not change runtime behavior except to fail loudly during tests or development if the invariant is violated.

This change fixes a programming mistake in Electrum's mobile/QML user interface where the trustedcoin two-factor authentication (2FA) plugin stored wallet, transaction, and callback information as shared class-level data instead of per-use data. In practice, this could mean that if multiple wallets or transactions requested an OTP at the same time, the wrong wallet or transaction could be signed, or a stale callback could run. The patch scopes those values to each individual OTP request so they cannot collide or leak across requests.

This patch fixes a small bug in how Electrum checks proof-of-work (PoW) nonces from Nostr swap server announcements. Previously, a missing or negative nonce was treated as having zero PoW, which is correct for missing nonces but the code also allowed negative nonces to be passed into the hash calculation. The patch now explicitly rejects negative nonces and moves the PoW check inside the try block so any parsing error skips the announcement. In practical terms, a malicious or buggy swap server could have advertised a negative nonce; depending on the exact behavior of the hash function with negative numbers, this could have caused a crash, incorrect PoW evaluation, or unexpected filtering of swap servers.

This commit fixes a small bug in Electrum's submarine swap feature. When a swap server advertises itself using a Nostr event, the client checks a 'proof-of-work nonce' to verify the server did enough computational work. Before the patch, a negative nonce could slip through and be treated as valid, potentially letting a low-effort or malicious swap server bypass the anti-spam check. The fix treats negative nonces the same as a missing nonce (zero proof-of-work bits).

This change fixes a bug in Electrum wallet backups. Previously, when creating a backup of a wallet that had Lightning (Bitcoin's layer-2 network) enabled, the backup code was incorrectly wiping out the Lightning private key from the backup copy. A backup without this key cannot fully restore the wallet's Lightning funds and state. The fix simply stops removing that key, so backups remain complete and recoverable.

This commit fixes a bug in Electrum's wallet backup feature. Previously, when creating a backup, the software incorrectly wiped a private Lightning key ('lightning_privkey2') from non-deterministic Lightning wallets. That meant backups could be incomplete and users might not be able to recover their Lightning funds from the backup. The fix simply stops removing that key during backup.

This commit is a routine version bump and release-notes update for Electrum 4.8.1. It does not change any executable code, only the version string and the changelog. The changelog itself lists many fixes from prior commits, but this specific commit only packages those notes for release.

This commit is purely a user-interface styling tweak for the one-time password (OTP) dialog in Electrum's QML (mobile-style) GUI. It sets the character used to calculate the input field width to '8', adds left/right padding to that width calculation, and changes how an error label is horizontally centered. There is no security-relevant change.

This patch fixes a crash in Electrum's submarine swap feature when using Nostr direct messages. If a Nostr server sent the same reply twice, the code tried to complete an already-completed 'future' object, which raises an exception in Python's asyncio. The fix ignores duplicate or unknown replies instead of crashing. A malicious or misbehaving swap server could potentially trigger this to disrupt a user's swap transport/connection.

This commit removes an unused software dependency called protobuf. The dependency was originally added years ago to support a Bitcoin payment protocol feature (BIP 70) that has since been removed from Electrum. Keeping protobuf in the requirements list was causing installation failures on newer systems because an old version of protobuf cannot build with current Python packaging tools. There is no security vulnerability here—this is a cleanup fix for a broken build/install process.

This change makes Electrum's wallet handle unusual or unrecognized Bitcoin signature hash types without crashing. Previously, if a transaction input used a sighash value not in the hardcoded list, the code would throw a KeyError exception. The patch now maps unknown sighash values to a warning labeled 'INSANE_SIGHASH'. This is a defensive hardening fix: it prevents an unexpected transaction from causing an unhandled error and instead reports it as a dangerous condition.