Sparrow Wallet

This commit adds support for a newer Bitcoin address format called 'silent payments' when Sparrow Wallet reads wallet labels from files or PDFs. Before this change, the wallet could fail to recognize silent-payment descriptors, so labels tied to those addresses might not be imported or matched correctly. There is no direct evidence this is a security vulnerability—no funds could be stolen—but it is a correctness fix that prevents silent-payment users from silently losing label metadata.

This commit fixes a bug in Sparrow Wallet's handling of silent payments after a blockchain reorganization (reorg). When the blockchain briefly rewinds and then re-adds a transaction at the same height, the wallet might not refresh all of its payment addresses, potentially leaving some balances or transaction statuses outdated. The fix forces a full refresh of all wallet nodes whenever any address was previously invalidated by a reorg, ensuring no stale data is missed.

This commit fixes a bookkeeping bug in Sparrow Wallet for silent-payments wallets. Previously, the wallet could record that it had scanned up to a certain block height before the scan actually finished. If the app then restarted, it might skip scanning that block range and miss payments sent to it. The change makes the wallet wait until a scan has actually covered a block before advancing its stored starting point for the next scan.

This commit only changes the text of an error message shown to users when importing a Bitcoin Secure Multisig Setup (BSMS) record. It makes the message clearer about why Sparrow treats a multi() quorum as a sortedmulti() equivalent and explains that addresses may differ from other signers if they don't sort keys the same way. There is no code behavior change, no vulnerability fix, and no security-relevant logic change.

This commit fixes a timing-related issue in Sparrow Wallet's terminal version. If a user asked to view their wallet seed and the wallet auto-locked before the password-derived key was ready, the app could still try to display the seed using a stale/untrusted state. The patch now checks whether the wallet locked during key derivation and refuses to show the seed if so, preventing possible exposure of the seed when the user no longer has an active unlocked session.

This commit changes how Sparrow Wallet calculates transaction fees. Previously, the wallet trusted the fee value reported by the Electrum server for each transaction. Now, when the wallet already knows the transactions that fund a given transaction's inputs, it calculates the fee directly from those input amounts minus the outputs. The server's reported fee is only used as a fallback when the wallet cannot derive the fee itself. This reduces the risk that a malicious or faulty server could trick the wallet into using an incorrect fee—particularly when the user later tries to bump a transaction's fee using RBF or CPFP.

This commit fixes a logic bug in Sparrow Wallet's Cormorant feature. Previously, when Cormorant was started only to test a connection to a Bitcoin server (not to actually manage wallets), it could still try to check or import wallet descriptors. The fix adds a guard so that wallet import checks are skipped when Cormorant is in 'test server connection' mode. This prevents unintended wallet operations and reduces the risk of exposing wallet information or causing errors during a simple connection test.

This commit adds a way to stop an ongoing background server connection attempt when the user tries to test or switch to a different server. Before the change, a retrying connection could keep running in the background while a new test connection started, causing the two attempts to share or fight over the same network resources. The fix cancels the old attempt first, then starts the new one. It is a reliability/resource-cleanup improvement rather than a clear-cut security vulnerability fix.

This commit fixes a security gap in Sparrow Wallet when merging two partially-signed Bitcoin transactions (PSBTs). Previously, if a newly loaded PSBT was already finalized, Sparrow would copy its signatures and final transaction data into an open transaction without first checking that those signatures were valid. The change adds a verification step so invalid or malicious finalized PSBT data is rejected before it can overwrite the existing transaction.

This commit changes how Sparrow Wallet tracks Electrum server notifications about Bitcoin address activity. Previously, the app remembered every status value it had ever seen for each address and ignored repeats of any earlier value. Now it only remembers the latest status and treats any change—even a return to an earlier value—as a real update. The old behavior could leave the wallet showing transactions that the server no longer has (for example, after a mempool replacement or a chain reorganization), which could mislead users about their balance or transaction history.

This commit fixes a UI behavior in Sparrow Wallet where a user could accidentally paste a secret extended private key (xprv) into the public-key-only 'xpub' field of a watch-only wallet. Previously, the app treated it as valid, offered copy/QR-code export actions, and could leak the private key through those export paths. Now the app rejects xprv input in that field, removes the export context menu, and shows a validation error.

This commit tightens how Sparrow Wallet imports multisig wallet files from Coldcard. Previously, if the file omitted the 'Policy' line or listed fewer cosigner keys than the policy required, Sparrow would silently assume a default 2-of-2 setup. That could let a malformed or attacker-crafted import file create a wallet whose security rules don't match what the user expects. The patch now requires the policy line and verifies the number of cosigner keys matches the declared policy, throwing an error if they don't.

This change fixes a bug in Sparrow Wallet where freezing a coin (UTXO) that was being used in a replacement transaction could silently remove the input and accidentally break the transaction's privacy-related outputs. Now, if removing the frozen coin would be unsafe, the wallet clears the replacement transaction instead of silently altering it. This is a correctness and safety improvement rather than a typical remote-exploitable vulnerability.

This commit adds safety checks in the Sparrow Bitcoin wallet to verify Silent Payment output scripts before exporting, copying, combining, or sending a transaction to a hardware device for signing. Silent Payments are a privacy feature that lets someone generate a unique receiving address from a public 'silent' address. The change makes sure the wallet can prove the claimed payment address is correct before the user signs or shares the transaction, reducing the risk of sending funds to a wrong or attacker-controlled address.

This commit changes how Sparrow Wallet shows a transaction's block height when the connected server cannot prove the transaction is actually in that block. Previously, the transaction tab would label such a height as 'Unverified' while waiting for proof. Now it shows the height plainly, and only after the server has had a fair chance to prove it and fails does it add an 'Unverified' warning. The change also makes the transaction-tab verification use the same retry logic and user-facing reporting that wallet history verification already uses, so a momentary server hiccup is not treated as a server lie.

This commit fixes a logic gap in Sparrow Wallet's settings form. When a user changes wallet settings, the app checks whether the wallet's receiving addresses would change, so it can warn or take appropriate action. The check already compared regular extended public keys, but it forgot to compare 'silent payment scan addresses'—a newer Bitcoin privacy feature. Without this comparison, changing the silent-payment scan key might not be detected as an address change, potentially causing the wallet to show stale or incorrect addresses without warning.

This commit fixes a small UI bug in Sparrow Wallet's transaction signing dialog. When a user chooses the risky 'SIGHASH_NONE' option, Sparrow shows a warning asking if they are sure. Previously, clicking 'No' reverted the choice, but closing/dismissing the warning box without answering left the risky option selected. The fix now reverts the choice whenever the user does not explicitly click 'Yes'.

This commit fixes a bug in Sparrow Wallet's text input handling for Bitcoin amounts and transaction fees. Previously, if a user typed something like '0abc', the wallet would partially match only the '0' and treat the amount as zero, silently dropping the invalid trailing characters. This could let a user accidentally (or be tricked into) entering an amount that the wallet interprets as zero when they intended something else. The fix now only keeps a zero value if the entire typed text is a valid amount, not just a partial match.

This commit changes Sparrow Wallet so that when you open a transaction in the transaction tab, the block height claimed by the server is not automatically trusted. Instead, the wallet now asks the server for a cryptographic proof (a Merkle proof) that the transaction really is in that block. Until the proof arrives and checks out, the height is shown as 'Unverified'. Previously, the transaction tab would display the server's claimed height and block hash as if they were confirmed facts, even though they came only from the server. This change closes a trust gap: a malicious or mistaken server could no longer make an unconfirmed or differently-located transaction appear confirmed in the UI simply by reporting a fake height or block hash.

This commit hardens Sparrow Wallet against a malicious or misbehaving Electrum server that tries to 'rewind' the blockchain tip to a height below the last built-in checkpoint after it has already announced a higher tip. Previously, such a fake low announcement could have been accepted for public servers that are required to verify transactions, potentially letting the server hide or rewrite recent history. The fix refuses those regressive announcements and adds tests to confirm the behavior.

This commit fixes a UI bug in the Sparrow Bitcoin wallet. When a user opened a fully signed transaction while offline, or when the connected server could not provide every previous transaction input, the wallet failed to display the transaction's signature details and the broadcast controls. The patch makes the wallet derive and show the signature progress bar directly from the signed transaction data in those cases, instead of waiting for server data that may never arrive.

This commit fixes a UI behavior in Sparrow Wallet where a user-entered HTTPS scheme for a Bitcoin Core server was not being remembered. Previously, if a user typed or selected an HTTPS Bitcoin Core URL, the wallet could silently fall back to HTTP when the host or port was edited, potentially sending wallet traffic over an unencrypted connection. The patch now records that a specific host was intended to use HTTPS and keeps using HTTPS for that host unless the host is changed. This is a security-relevant correctness fix for connection configuration, not an active exploit in the code itself.