Sparrow Wallet

This commit fixes a UI display bug in Sparrow Wallet's signature progress bar. When a multi-signature Bitcoin transaction becomes finalized, extra signatures beyond the required threshold are discarded. Previously, the progress bar did not remove the visual segments representing those discarded signatures, which could leave the bar showing more segments than actually exist. The fix cleans up those surplus segments and resets progress to zero for any segment whose signature was removed. There is no direct evidence this affects funds or transaction security.

This commit changes how Sparrow Wallet builds QR codes for partially-signed Bitcoin transactions (PSBTs). For certain hardware wallets (Krux), it now includes extra data (the full previous transaction, called 'non-witness utxo') in the QR code when the transaction has more than one input. This extra data is needed by some devices to verify inputs securely, but it also makes the QR code larger and slower to scan. The change appears to be a correctness/usability fix for hardware signing rather than a traditional software vulnerability.

This commit updates a linked subproject called 'lark' with the stated goal of preventing Trezor hardware wallet pairing credentials and older v1 message payloads from being written to application logs. If successful, it reduces the risk that sensitive wallet communication secrets could leak through log files, which might otherwise be read by malware, backups, or support staff. However, the actual code changes are inside the subproject and not visible in this commit, so we can only judge from the commit message.

This commit updates a submodule called 'drongo' with a one-line change whose message says it now checks silent payment metadata against every transaction input, not just the eligible ones. Silent payments are a privacy feature for Bitcoin. The change sounds like a security fix because verifying only some inputs could let a malicious or malformed PSBT (a partially-signed Bitcoin transaction) slip past checks. However, the actual code change is just a submodule pointer bump, so we cannot see the real code fix from this commit alone.

This commit updates a submodule called 'drongo' inside the Sparrow Wallet project. The title says it now explicitly rejects a partially-signed Bitcoin transaction (PSBT) if it has been signed over silent payment outputs that were not actually computed. In plain terms, it tries to prevent a wallet from accepting a transaction signature that covers hidden recipient addresses it never verified. We cannot see the actual code change because only the submodule commit hash changed.

This commit fixes a security gap in Sparrow Wallet when merging two partially-signed Bitcoin transactions (PSBTs). Previously, if a newly loaded PSBT was already finalized, Sparrow would copy its signatures and final transaction data into an open transaction without first checking that those signatures were valid. The change adds a verification step so invalid or malicious finalized PSBT data is rejected before it can overwrite the existing transaction.

This commit fixes a UI behavior in Sparrow Wallet where a user could accidentally paste a secret extended private key (xprv) into the public-key-only 'xpub' field of a watch-only wallet. Previously, the app treated it as valid, offered copy/QR-code export actions, and could leak the private key through those export paths. Now the app rejects xprv input in that field, removes the export context menu, and shows a validation error.

This commit adds safety checks in the Sparrow Bitcoin wallet to verify Silent Payment output scripts before exporting, copying, combining, or sending a transaction to a hardware device for signing. Silent Payments are a privacy feature that lets someone generate a unique receiving address from a public 'silent' address. The change makes sure the wallet can prove the claimed payment address is correct before the user signs or shares the transaction, reducing the risk of sending funds to a wrong or attacker-controlled address.

This commit fixes a UI bug in the Sparrow Bitcoin wallet. When a user opened a fully signed transaction while offline, or when the connected server could not provide every previous transaction input, the wallet failed to display the transaction's signature details and the broadcast controls. The patch makes the wallet derive and show the signature progress bar directly from the signed transaction data in those cases, instead of waiting for server data that may never arrive.

This commit changes how Sparrow Wallet checks that a connected hardware wallet is the correct one before letting the user display a receiving address, sign a message, or discover keystores. Previously, the app disabled the relevant buttons if the device's reported fingerprint did not match the wallet. The problem is that a PIN-protected device reports no fingerprint until after the PIN is entered, so the old check happened too early and could be bypassed. The new code waits until after PIN entry, re-enumerates the device to get its real fingerprint, and only then enables or disables the button. This prevents a user from accidentally using the wrong hardware wallet and, for example, displaying or signing with keys that do not belong to their wallet.

This commit changes how Sparrow Wallet's download verifier handles large manifest files. Previously, if a downloaded manifest exceeded 100 KB, the software would reject it outright and stop verification. Now, if the oversized file does not look like a manifest (no PGP signed-message header and no typical hash lines), it is treated as a release file that the signature signs directly. The change also adds a more descriptive error message. The commit title frames this as reporting an oversized manifest rather than only verifying the signature, suggesting a fix for a verification-logic edge case.

This commit adds a 'confirm your passphrase' step when importing a Bitcoin wallet seed in two places: the desktop wallet import screen and the terminal/command-line wallet creation. Previously, if a user typed a BIP39 passphrase (the extra password that unlocks a hidden wallet) with a typo, Sparrow would silently create a different wallet. The user might then send funds to addresses they do not actually control or cannot later reproduce. The fix forces the user to type the passphrase twice so typos are caught immediately.

This commit only changes on-screen text labels and help messages in the wallet import flow. It clarifies that when using SLIP39 'shamir secret sharing' recovery, any passphrase applies to the whole reconstructed wallet secret, not to each individual recovery share. There is no code behavior change, no bug fix, and no security vulnerability being patched.

This commit updates two internal library submodules (drongo and lark) used by the Sparrow Wallet. The stated purpose is to require an anti-klepto protection feature for BitBox02 hardware wallets and to fix a Taproot signing issue. The actual code changes are not visible in this commit—only the submodule pointers were moved to new commits—so we cannot directly inspect what was fixed. Anti-klepto protections reduce the risk of a compromised hardware wallet leaking private key material through biased signatures. A Taproot signing issue could, in principle, affect the ability to spend or the validity of signatures, but the diff gives no details.

This commit only adds explanatory comments to existing code. It does not change any behavior. The comments clarify that a fallback to a standard SecureRandom is not a security weakness and is practically unreachable in the bundled Java runtime. There is no functional change to how random numbers are generated for wallet seed phrases.

This commit updates a subproject dependency called 'drongo' and adds a test. The title says the update makes an ECIES (a type of encryption) MAC comparison run in constant time, which is a defensive fix against timing attacks that could let someone guess a wallet password faster. The new test checks that entering the wrong password produces a clear 'invalid password' error rather than a vague import error. No direct code change is shown in the diff for the crypto routine itself; it lives inside the updated submodule.

This commit changes how Sparrow Wallet handles a wrong BIP38 passphrase when sweeping an encrypted private key. Previously, entering the wrong passphrase cleared the entire encrypted key text, forcing the user to retype it. Now, the app simply shows an 'Incorrect passphrase' error and asks again, leaving the encrypted key in place. It is a usability improvement, not a security fix, and does not appear to prevent or introduce any exploit.

This commit adds a cryptographic fingerprint (SHA-256 checksum) to the project's Gradle wrapper configuration. The wrapper is the tool that downloads the Gradle build system when developers compile the wallet. Pinning the checksum helps ensure that a compromised or tampered Gradle download is detected before it can run during the build process. Two Git submodules named drongo and lark were also updated, but no details about their changes are provided in the diff.

This commit fixes a privacy/security issue where Sparrow Wallet's debug log could accidentally record the username and password used to connect to a Bitcoin Core node. When debug logging was enabled, the app printed the full internal configuration of a component called bwt, including the 'bitcoind_auth' field that contained the user's Core RPC credentials. The patch now replaces that credential with '*****' before writing it to the log. This reduces the risk that sensitive credentials leak into log files, which could then be exposed when users share logs for troubleshooting.

This commit improves the wallet's login confirmation message when using the Auth47 authentication protocol. Previously, the wallet only told the user which website would receive the login response (the callback). Now it also shows the 'resource' the challenge is actually signed for, and warns if the resource differs from the callback. This helps prevent a malicious or misconfigured service from tricking a user into signing a login challenge for one site while sending the response to another.

This commit fixes a logic bug in Sparrow Wallet's update checker. Previously, the app would accept and remember a new software version number from an online file before checking whether that file was properly signed. If an attacker could tamper with the version-check file, they could make the wallet believe a fake newer version existed, even though the signature check would later fail. The patch moves the signature verification earlier and adds null-safety checks, so only properly signed version information is trusted.

This commit fixes a bug in Sparrow Wallet's terminal (command-line) watch-only wallet creation. Previously, a user could accidentally paste an extended private key (xprv) into a dialog meant only for public keys or output descriptors, and the wallet would silently fail or create an empty wallet. Now the app rejects xprv keys with a clear error message and also shows import errors to the user instead of logging them silently.

This update makes Sparrow Wallet automatically tighten the file permissions on wallet and backup folders so only the computer's owner can read them. Previously, if those folders already existed with looser permissions (for example, created by an older version or another user), other accounts on the same machine might have been able to read wallet files. The change also adds a warning if the app cannot fix the permissions.

This commit adds a user-facing warning dialog when a BitBox02 hardware wallet fails an attestation check. Attestation is a process that helps verify the device is genuine and not a counterfeit or tampered unit. Previously, a failed attestation may not have been clearly communicated to the user. The change improves security by warning users not to store funds on a device that failed verification until they confirm it externally. It is a defensive hardening change, not an active vulnerability fix.

This commit strengthens how Sparrow Wallet checks Payjoin proposals received from a payment receiver. Payjoin lets a receiver add their own inputs to a transaction to improve privacy. The changes add missing checks that could previously let a malicious or buggy receiver: (1) silently lower the transaction fee rate, (2) add key-path or signature data that leaks wallet information, (3) substitute the payment output even when no change output exists, or (4) return arbitrary error text that the wallet would show to the user. The patch also fixes handling for modern Taproot (P2TR) transactions, which were not being copied or validated correctly. A new set of unit tests confirms these protections.