Sparrow Wallet

This commit fixes a minor user-facing bug in Sparrow Wallet where the app failed to recognize legacy multisig wallet descriptors if they used uppercase letters (for example, 'MULTI(' instead of 'multi('). As a result, Sparrow would not show its usual warning that it only supports BIP67-compatible sorted multisig wallets, and it would not automatically sort the public keys. The change makes the detection case-insensitive by using a regular expression pattern instead of a simple lowercase string check. This is a usability and correctness fix rather than a serious security vulnerability.

This commit tightens wallet validation in Sparrow Wallet. It replaces a simple validity check with a more detailed one that reports specific problems, and it prevents users from creating or loading wallets whose number of cosigners exceeds what the chosen Bitcoin script type supports. It also fixes UI slider behavior so the maximum cosigner count stays within allowed limits when the script type changes. The changes are defensive: they catch misconfigurations earlier and give clearer error messages, which reduces the chance of accidentally using an invalid or unsupported wallet.

This commit changes Sparrow Wallet so that BIP353 human-readable payment names (like a Bitcoin email address) are resolved through the user's configured SOCKS proxy instead of directly over the internet. It also updates a related database field from seconds to milliseconds for storing key/seed creation times. The main security angle is privacy: without the proxy, DNS-style lookups for payment recipients could leak the recipient name and the user's IP address to DNS servers or observers. The change routes that traffic through Tor or another proxy if one is set. The database rename is a code-quality change and does not appear to be a security fix by itself.

This commit fixes privacy gaps in Sparrow Wallet when it connects through Tor or another proxy. Previously, the app could accidentally ask the computer's normal DNS resolver to translate server names, which could reveal which Bitcoin servers a user was trying to reach. It also could connect to local-network addresses directly even when a proxy was on, potentially bypassing Tor. The patch makes the app treat unknown hostnames as remote when a proxy is active and avoid resolving them locally, and it ensures Tor connections use the proxy for name resolution rather than the local system.

This commit fixes a bug in how Sparrow Wallet finds and deletes old wallet backups. Previously, the backup cleanup logic used loose pattern matching that could accidentally treat backups of one wallet as if they belonged to another wallet with a similar name. For example, a wallet named 'Savings' might incorrectly match backup files for 'SavingsX' or 'Savings.old'. The result could be that backups of a different wallet get deleted, or that cleanup of the intended wallet's backups fails. The patch replaces the loose prefix-and-date check with a strict regular expression that requires an exact wallet name, a complete 14-digit timestamp, and a matching file extension. New unit tests confirm that only correctly named backups are selected.

This commit adds safety checks to the Bitcoin wallet Sparrow when it receives block-chain tip announcements from an Electrum server. It now verifies that the announced block header is properly formatted, not timestamped too far in the future, and meets the proof-of-work target encoded in the header itself. It also warns the user if the server stops sending new blocks for more than two hours, which can indicate a stale or malicious server. These changes reduce the risk of a hostile or malfunctioning server misleading the wallet about the state of the Bitcoin network.

This commit fixes a bug in Sparrow Wallet's password-change feature. Previously, when a user changed the password on a wallet file whose name was a prefix of another wallet file (for example, 'Savings' and 'Savings.old'), the underlying H2 database tool would also re-encrypt the sibling wallet file. That could corrupt or lock the sibling wallet. The fix copies the target wallet to its own temporary directory, performs the encryption change there, verifies it, and then atomically replaces the original file so no other wallet files are touched.

This commit fixes a bug in how Sparrow Wallet reads data from Keycard hardware wallets. Previously, the code trusted the length declared inside a card response without checking whether that many bytes actually exist. A malicious or malfunctioning card could claim a huge length, causing the app to read past the end of the buffer and potentially return fabricated zero-filled data. The patch now rejects responses whose declared length is truncated, oversized, or malformed, and adds tests to confirm the new behavior.

This commit fixes a bug in Sparrow Wallet's terminal (command-line) watch-only wallet creation. Previously, a user could accidentally paste an extended private key (xprv) into a dialog meant only for public keys or output descriptors, and the wallet would silently fail or create an empty wallet. Now the app rejects xprv keys with a clear error message and also shows import errors to the user instead of logging them silently.

This commit fixes a bug in Sparrow Wallet's import of wallet labels. Previously, labels for multi-signature participants (keystores) could be too long or identical to each other, which could make the wallet file impossible to reopen. The change now truncates long labels and rejects duplicates during import, preventing the wallet from becoming unopenable.

This update makes Sparrow Wallet automatically tighten the file permissions on wallet and backup folders so only the computer's owner can read them. Previously, if those folders already existed with looser permissions (for example, created by an older version or another user), other accounts on the same machine might have been able to read wallet files. The change also adds a warning if the app cannot fix the permissions.

This commit adds a user-facing warning dialog when a BitBox02 hardware wallet fails an attestation check. Attestation is a process that helps verify the device is genuine and not a counterfeit or tampered unit. Previously, a failed attestation may not have been clearly communicated to the user. The change improves security by warning users not to store funds on a device that failed verification until they confirm it externally. It is a defensive hardening change, not an active vulnerability fix.

This commit strengthens how Sparrow Wallet checks Payjoin proposals received from a payment receiver. Payjoin lets a receiver add their own inputs to a transaction to improve privacy. The changes add missing checks that could previously let a malicious or buggy receiver: (1) silently lower the transaction fee rate, (2) add key-path or signature data that leaks wallet information, (3) substitute the payment output even when no change output exists, or (4) return arbitrary error text that the wallet would show to the user. The patch also fixes handling for modern Taproot (P2TR) transactions, which were not being copied or validated correctly. A new set of unit tests confirms these protections.

This commit tightens how Sparrow Wallet handles multi-part QR codes used to import older wallet data. It limits part numbers to four digits and rejects impossible values (like part 0 of 0, or part 5 of 2). The change prevents the app from allocating huge arrays or getting confused by malformed QR frames, which could otherwise crash or freeze the wallet during a scan.

This commit removes leftover code that checked whether signatures from hardware card signers were valid, but then threw away the result. The signatures are still verified later by a different part of the wallet when the signed transaction is combined. The change is essentially a cleanup with no known security flaw, though it slightly reduces defense-in-depth by removing an early, unused sanity check.

This commit hardens how Sparrow Wallet imports wallet files from other tools. It adds checks that reject malformed or inconsistent imports—such as a multisig setup that says it needs 3 signers but only provides 2 keys, or a coordinator file that would silently make the wallet derive different Bitcoin addresses than the rest of the signing group. The change is defensive: it makes the wallet refuse suspicious imports rather than accepting them.

This commit simply adds a SECURITY.md file to the repository. It is a documentation-only change that tells people how to report security bugs privately and how the project handles vulnerability disclosures. It does not change any code, fix any bug, or introduce any new feature that could affect users directly.

This commit tightens how Sparrow Wallet saves and reuses TLS certificates for private servers. Previously, any certificate that passed a basic CA check was saved as 'CA validated' even if it didn't actually match the server's hostname. That could let a malicious or misconfigured server trick the wallet into trusting the wrong certificate. Now the app also checks that the certificate's hostname matches the server, and it no longer deletes certificates that are merely 'not yet valid' (which can happen if the user's computer clock is wrong).

This commit removes several calls that tried to wipe private-key material from memory. The developer says these wipes were 'ineffective' because the underlying ECKey object still held the secret bytes. The change is a cleanup, but it slightly increases the window during which private key bytes may sit in memory. It does not introduce a remotely exploitable bug; the main risk is a small worsening of local memory-exposure hygiene.

This commit adds checks to make sure that when Sparrow Wallet asks an Electrum server for a specific Bitcoin transaction, the server actually returns the transaction that was requested. Before this change, a malicious or buggy server could return a different transaction than the one asked for, and Sparrow might trust it as if it were the right one. The fix verifies the transaction ID (a fingerprint of the transaction) matches in three places where transactions are fetched from the server.

This commit simply rotates four logo images by 90 degrees. It changes only SVG graphics files and does not touch any code, cryptography, wallet logic, or network behavior. There is no security relevance.

This commit is a routine version bump from 2.5.3 to 2.5.4. It only changes version strings in four files: the build configuration, macOS packaging metadata, in-app version constant, and documentation for reproducible builds. There are no code logic changes, bug fixes, or security-related modifications visible in the diff.

This commit tightens how Sparrow Wallet treats labels made only of spaces or tabs during wallet label import and export. Previously, a label consisting solely of whitespace was considered a real label; now it is treated as blank and skipped. The change also renames an unrelated UI field from 'useDustLimitField' to 'ignoreDustField' for clarity. There is no direct security vulnerability here, but the fix prevents minor data-quality issues and avoids surprising behavior where whitespace-only labels are exported or imported as meaningful labels.

This commit adds a user-facing checkbox labeled 'Ignore dust' to the private-key sweep feature in Sparrow Wallet. When enabled, very small ('dust') unspent outputs linked to the swept key are excluded from the transaction. This is a usability and privacy improvement, not a security fix, because dust outputs are often sent by third parties to track wallets or to make sweeps uneconomical due to fees. There is no evidence in the commit or supplied references that this addresses a vulnerability or was disclosed as a security issue.