Sparrow Wallet

This commit fixes two situations where Sparrow Wallet could get stuck in an endless loop while talking to a hardware card (Coldcard/Satochip). Previously, if the card refused a 'wait' request or repeatedly rejected the secure channel setup, the software would retry forever. Now it throws an error or stops after three retries. This is a reliability/DoS fix rather than a direct theft-of-funds bug, but an attacker who can make the card misbehave could freeze the wallet interface.

This commit fixes a bug where Sparrow Wallet's connection to a Bitcoin Core node could hang forever if the node accepted the connection but never replied. The patch adds sensible time limits for making and reading connections, while carefully allowing very long waits only for two specific Bitcoin Core operations that legitimately take hours. Without the fix, a user connecting to a slow, stuck, or maliciously unresponsive node could have their wallet interface freeze indefinitely.

This commit fixes a bug in Sparrow Wallet's connection to Electrum servers. Previously, when waiting for a server reply, the timeout only applied to acquiring an internal lock, not to the actual wait for data. A server that accepted a request but never answered could cause the wallet to hang forever instead of timing out. The patch makes the timeout cover the entire wait and adds tests to prove the hang is gone and that the connection can recover on the next request.

This commit fixes a race condition in Sparrow Wallet's payment screen. When a user types a human-readable payment name (like a DNS-based address), every keystroke that forms a valid name triggers a slow background lookup. If the user keeps typing or changes the recipient, an older lookup could finish later and overwrite the current recipient address with the wrong one. The fix checks that the lookup result still matches what the user has actually typed before applying it.

This commit replaces ordinary shuffling with a cryptographically secure random number generator when selecting which coins (UTXOs) to use in Bitcoin transactions and when ordering transaction inputs and outputs. The change makes it harder for an observer to guess or reproduce the wallet's choices, which can reduce privacy risks and certain fee-sniping attacks. The actual security improvement depends on code inside the updated 'drongo' submodule that is not shown in the diff.

This change adds a warning when a user scans a QR code containing a seed phrase whose checksum is invalid. Previously, Sparrow would silently create a wallet keystore from the bad seed. With a bad checksum, other wallets will reject the same seed words, so any bitcoin sent to that wallet could become unrecoverable from the backup. The patch asks the user to confirm before proceeding.

This commit hardens Sparrow Wallet so that unexpected failures while reading pasted transactions or transactions fetched from Electrum servers are caught and handled gracefully, instead of crashing the application. It also updates the 'drongo' subproject, which likely contains related parsing code. The change is defensive and improves robustness, but the commit message does not frame it as a security fix.

This commit fixes a cleanup step in Sparrow Wallet. When a wallet is unloaded, the code now explicitly drops its reference to the derived encryption key, which may help the Java garbage collector reclaim the key material sooner and reduces the window in which a sensitive key could linger in memory. The change is defensive and small, but it does not by itself prove an exploitable vulnerability.

This commit fixes a bug in how Sparrow Wallet names its internal H2 database files. Previously, the app stripped every occurrence of the wallet file extension from the full file path, not just the trailing one. That meant a wallet file named something like 'backup.mv.db2.mv.db' would accidentally write its database data to a different file ('backup2') instead of the file Sparrow was tracking. The fix removes only the final extension. The bug could cause wallet data to be written to or read from the wrong file, potentially leading to data loss, confusion, or cross-wallet contamination, though direct theft of funds is not evident from the change.

This commit fixes a timing bug in Sparrow Wallet's download verification dialog. Previously, if a user started a new file verification while an earlier one was still running, the old verification could finish later and overwrite the new results on screen. That could briefly show a wrong file as 'verified' or 'matched.' The fix adds a counter so results from an outdated verification are ignored, and it cancels any running checks before starting a new one.

This commit adds a confirmation step when completing an unfinished multi-signature (multisig) Bitcoin wallet by importing a coordinator's configuration. Before the change, Sparrow would silently replace the user's local cosigner list and signing rules with whatever the imported file contained. After the change, the user must review and approve the required number of signatures (quorum), the list of cosigners, and which of their own keys are included before the wallet is updated. This reduces the risk that a malicious or incorrect import could trick the user into a wallet they cannot truly control or co-sign.

This commit changes Sparrow Wallet so that when it fails to import Bitcoin Core wallet descriptors, the user is shown a clear error dialog or terminal message instead of the failure being hidden in logs. Previously, descriptor import failures were only logged, which could leave users unaware that their transaction history or balances might be incomplete. The change improves visibility and reliability but does not introduce or fix a traditional security vulnerability.

This commit adds a safety check on a fee rate value that a Bitcoin server sends to the Sparrow Wallet app. Before, the app would trust and use whatever number the server provided for the minimum relay fee. Now, if that number is negative or unreasonably high, the app ignores it and falls back to a safe built-in default. This protects users from a malicious or buggy server tricking the wallet into using bad fee rates that could delay, overpay, or otherwise mishandle transactions.

This commit adds a warning to Sparrow Wallet when a user connects to a Bitcoin Core node that is neither on their own computer/local network nor a Tor onion address. Previously, users could unknowingly route Bitcoin Core RPC traffic over the public internet, exposing their wallet data and RPC credentials. The change also improves how Sparrow decides whether an address is 'local' and fixes a UI bug where settings panes were recreated each time they were opened. It is a defensive hardening change rather than a fix for an active exploit.

This commit fixes a bug in Sparrow Wallet where cancelling a password change could leave the wallet unencrypted in memory for the rest of the session. Previously, the software decrypted the wallet to prepare for a new password, but if the user cancelled, it never re-encrypted it. Now it re-encrypts with the existing key when the change is abandoned. This is a security fix for a local, user-interactive edge case.

This commit changes how Sparrow Wallet handles data received from an Electrum server about silent payments. Previously, if one entry in a batch was malformed, the entire scan batch would abort. Now, the wallet logs a warning and skips only the bad entry. This makes the wallet more resilient to bad server data, but also means a malicious or buggy server could silently feed malformed entries and have them ignored rather than trigger a visible failure. There is no direct evidence in the commit that this is exploitable to steal funds, but it removes a fail-stop behavior.

This commit fixes a crash in Sparrow Wallet's Payjoin feature. When receiving a Payjoin proposal, the wallet tries to restore original payment input details. Previously, if the original PSBT input lacked a final script signature or final witness, the code would throw a NullPointerException and crash. The patch now safely handles those missing fields by setting the restored values to null instead of crashing.

This commit tightens how Sparrow Wallet handles its proxy setting. Previously, a user could enable 'use proxy' even if no proxy server was actually configured, or the app could save an empty/whitespace proxy server value. The change now disables the proxy setting automatically when no valid proxy server is configured, trims whitespace from the proxy host, and treats blank host values as invalid. This is a defensive hardening fix that prevents the wallet from accidentally running without the privacy/protection the user expected from a proxy.

This commit fixes a minor user-facing bug in Sparrow Wallet where the app failed to recognize legacy multisig wallet descriptors if they used uppercase letters (for example, 'MULTI(' instead of 'multi('). As a result, Sparrow would not show its usual warning that it only supports BIP67-compatible sorted multisig wallets, and it would not automatically sort the public keys. The change makes the detection case-insensitive by using a regular expression pattern instead of a simple lowercase string check. This is a usability and correctness fix rather than a serious security vulnerability.

This commit tightens wallet validation in Sparrow Wallet. It replaces a simple validity check with a more detailed one that reports specific problems, and it prevents users from creating or loading wallets whose number of cosigners exceeds what the chosen Bitcoin script type supports. It also fixes UI slider behavior so the maximum cosigner count stays within allowed limits when the script type changes. The changes are defensive: they catch misconfigurations earlier and give clearer error messages, which reduces the chance of accidentally using an invalid or unsupported wallet.

This commit changes Sparrow Wallet so that BIP353 human-readable payment names (like a Bitcoin email address) are resolved through the user's configured SOCKS proxy instead of directly over the internet. It also updates a related database field from seconds to milliseconds for storing key/seed creation times. The main security angle is privacy: without the proxy, DNS-style lookups for payment recipients could leak the recipient name and the user's IP address to DNS servers or observers. The change routes that traffic through Tor or another proxy if one is set. The database rename is a code-quality change and does not appear to be a security fix by itself.

This commit fixes privacy gaps in Sparrow Wallet when it connects through Tor or another proxy. Previously, the app could accidentally ask the computer's normal DNS resolver to translate server names, which could reveal which Bitcoin servers a user was trying to reach. It also could connect to local-network addresses directly even when a proxy was on, potentially bypassing Tor. The patch makes the app treat unknown hostnames as remote when a proxy is active and avoid resolving them locally, and it ensures Tor connections use the proxy for name resolution rather than the local system.

This commit fixes a bug in how Sparrow Wallet finds and deletes old wallet backups. Previously, the backup cleanup logic used loose pattern matching that could accidentally treat backups of one wallet as if they belonged to another wallet with a similar name. For example, a wallet named 'Savings' might incorrectly match backup files for 'SavingsX' or 'Savings.old'. The result could be that backups of a different wallet get deleted, or that cleanup of the intended wallet's backups fails. The patch replaces the loose prefix-and-date check with a strict regular expression that requires an exact wallet name, a complete 14-digit timestamp, and a matching file extension. New unit tests confirm that only correctly named backups are selected.

This commit adds safety checks to the Bitcoin wallet Sparrow when it receives block-chain tip announcements from an Electrum server. It now verifies that the announced block header is properly formatted, not timestamped too far in the future, and meets the proof-of-work target encoded in the header itself. It also warns the user if the server stops sending new blocks for more than two hours, which can indicate a stale or malicious server. These changes reduce the risk of a hostile or malfunctioning server misleading the wallet about the state of the Bitcoin network.

This commit fixes a bug in Sparrow Wallet's password-change feature. Previously, when a user changed the password on a wallet file whose name was a prefix of another wallet file (for example, 'Savings' and 'Savings.old'), the underlying H2 database tool would also re-encrypt the sibling wallet file. That could corrupt or lock the sibling wallet. The fix copies the target wallet to its own temporary directory, performs the encryption change there, verifies it, and then atomically replaces the original file so no other wallet files are touched.