Stack Wallet

This is a small UI reliability fix in a cryptocurrency wallet's car-research payment screen. The developer made the 'copy address to clipboard' function wait for the clipboard write to complete before showing a confirmation message, and added a check to avoid using a screen that may have been closed during the operation. It is a routine correctness improvement, not a security fix for an exploitable vulnerability.

This commit is a routine user-interface polish for the ShopinBit payment flow. It changes how a QR-code payment screen is displayed (from a bottom sheet to a dialog), updates a copy icon to match the app's style, and makes the clipboard copy operation wait for completion before showing a confirmation message. There is no security-relevant change.

This commit fixes a UI bug in the Stack Wallet app's ShopinBit payment screen. A loading overlay that appears while refreshing or checking an invoice could get stuck (a 'soft-lock') because it was being shown on a nested navigator instead of the root one. The fix tells the overlay to display on the root navigator so it can be properly dismissed, preventing users from getting stuck on a frozen payment screen.

This commit removes a 'I need recommendations' checkbox from a travel booking form inside the Stack Wallet app. Users must now type a destination city instead of asking for recommendations. There is no security issue visible in the code change.

This commit tightens the shipping/billing name validation in the ShopInBit feature of Stack Wallet. Previously, any non-empty name was accepted; now the name must contain at least two whitespace-separated words (e.g., a first and last name). The change is a client-side form check and does not appear to fix a security vulnerability. It is more likely a business-rule or partner-compliance fix to prevent incomplete names from being submitted to the ShopInBit service. There is no evidence in the commit or supplied references of a security issue, exploit, or disclosure.

This commit is a work-in-progress feature update for the ShopinBit integration inside Stack Wallet. It adds the ability to collect and send a U.S. state or Canadian province/territory when required for delivery or billing addresses. It is not a security patch; it is a functional change to address form handling and API request data. There is no indication in the commit that it fixes a vulnerability, leak, or exploit.

This commit is a UI refactor for the ShopinBit 'car fee' checkout screen. It removes a separate delivery-address form and instead reuses the country already chosen earlier in the request flow, displaying it as read-only billing-country information. The change also splits the country field into a human-readable name plus an ISO code. There is no obvious security bug being fixed; it looks like a normal feature cleanup to reduce duplicated input and prevent inconsistent country data.

This commit is a routine UI tweak for the desktop version of a feature called ShopinBit. It changes the width of a first-run information dialog, removes a Cancel button, adjusts spacing, and indents bullet points. There is nothing here related to security.

A single-line fix changes which app feature flag controls whether a 'Gift cards' button appears in the wallet screen. The old code checked a flag named 'shopinBit' but should have checked 'cakePay'. This is almost certainly a UI/functional bug rather than a security vulnerability, but it could affect whether users see or can access a third-party gift-card service integration.

This commit changes the Stack Wallet app so it keeps checking (polling) the status of certain ShopInBit support tickets even after they are in a final, unchangeable state. Previously, the app stopped polling once a ticket was closed, merged, or refunded. The change removes those stop conditions. On its own, this is a behavior change rather than a direct security flaw, but it could slightly increase network traffic, battery use, and the number of API calls made to the ShopInBit server. There is no evidence in the commit that this fixes a security vulnerability or that it introduces one.

This commit flips a single setting in the Stack Wallet app so that its built-in ShopInBit shopping feature talks to a test/sandbox environment instead of the real production service. The change is explicitly marked with a TODO saying it must be set to false for production. Using sandbox mode in a production release could mean users see fake/test data, make payments that don't result in real orders, or interact with a less secure/test server. However, the diff alone does not prove this change was ever shipped to users, and the commit message only says it is reverting an earlier change that disabled the sandbox.

This commit changes a third-party shopping integration from 'sandbox' (test) mode to live mode. The developer left a note earlier saying it should be set to false in production. The change itself is a normal production toggle, but because it involves real money/purchases and secret API credentials, it is worth reviewing whether this was released safely and whether any test-only behavior or weaker security settings were carried over accidentally.

This commit changes the default Tezos blockchain server used by Stack Wallet from a public Tezos node to Stack Wallet's own node, and adjusts the API endpoint used to check the latest block height. There is no direct evidence in the commit of a security vulnerability, but running wallet traffic through a single party-controlled node and changing the data source for chain state can carry trust and reliability risks.

This commit simply hides the 'Masternodes' menu option for Firo wallets in both mobile and desktop versions of Stack Wallet. The underlying masternode management code is not removed or changed, only the user-facing button that opens it is commented out. The commit message says this is a temporary disablement 'until its fixed,' but gives no details about what is broken or whether it is security-related.

This commit tidies up the Firo masternode creation screen. It adds a button-lock so pressing 'Create Masternode' repeatedly doesn't fire multiple times, wraps long-running balance checks in loading spinners, and replaces several hand-built confirmation dialogs with a single reusable dialog widget. There is no obvious security vulnerability being fixed here; it reads as a routine UI polish and bug-fix change.

This commit adds a new third-party cryptocurrency exchange integration called LetsExchange to the Stack Wallet app. It is a feature addition, not a bug fix. The code introduces network calls to LetsExchange's API, handles user funds routing through that service, and embeds an affiliate/referral ID in transaction requests. There is no direct evidence in the commit of a vulnerability, but integrating a new financial service always carries security and trust risks that warrant review.

This commit simply swaps the default web address used to look up Fact0rn transactions in Stack Wallet. The old explorer (factexplorer.io) was reportedly not working, so the developer reverted to the official explorer.fact0rn.io. There is no code change that handles private keys, balances, or network connections differently. At most, users who click a transaction link may now land on a working website instead of a broken one.

This commit simply swaps the default server address used by the Stack Wallet app for the Fact0rn cryptocurrency from one Project Factor server (electrumx1) to another (electrumx2). It is a routine infrastructure update. There is no direct evidence in the commit that this fixes a security vulnerability, but changing default servers can be relevant to trust and availability.

This commit fixes a user-interface bug in the Salvium wallet. When the wallet tried to connect to a network node, the code that reports 'connected' or 'connection failed' was disabled by comment marks, so users saw 'Connecting...' forever even though the connection had already failed. The change simply re-enables those two status updates, making the sync status accurate. It is a reliability/usability fix, not a security vulnerability.

This change alters how a wallet feature called ShopInBit refreshes support-ticket details. Previously it fired three API calls at once; now it first checks ticket status and skips the other two calls if the server returns a 403 'permission denied' response. The stated goal is simply to reduce unnecessary network traffic. There is no direct evidence in the commit that this fixes a security vulnerability, but it does reduce the amount of ticket-related data the app requests when the user is no longer authorized to view a ticket.

This commit updates the wallet's integration with a third-party shopping service. The service's API now labels certain records as 'receipts', and the wallet now skips those records when refreshing ticket data. This appears to be a correctness or data-handling fix rather than a security vulnerability. There is no indication it fixes an exploit or protects user funds directly.

This commit fixes a data-handling bug in a car-research invoice payment screen. Previously, when the app polled the server for invoice status and discovered a newly created support ticket, it did not save that ticket to the local database. The patch adds logic to fetch the full ticket details from the server and store a minimal local record so the rest of the app can see and update it later. There is no indication this is a security vulnerability; it appears to be a functional bug fix.

This commit changes how a wallet app parses invoice data from a partner service. Previously, missing or malformed date/number fields were handled gracefully by returning null or skipping them. Now, those same missing or malformed fields will cause the parsing to crash with an exception. The commit title says this ungraceful failure is intentional. This is a defensive change: it makes the app fail loudly instead of silently accepting bad data, which can prevent subtle bugs or misuse. However, it is not a typical security patch and could in theory be abused if an attacker can feed malformed JSON to the app to trigger a crash (denial of service).

This commit removes an unused field called customerKey from a data structure used when the app talks to the ShopInBit service. There is no security fix here; it is a small cleanup that deletes dead code.

This commit removes a safety check and some explanatory comments from a Flutter screen that shows a fallback dialog when a car purchase ticket takes too long to appear. The removed 'mounted' check ensured the screen still existed before showing a dialog. On its own, this change does not create a security issue; it is a minor code-cleanup change that slightly increases the theoretical risk of a harmless UI crash if the screen is closed at exactly the wrong moment.