Stack Wallet

This commit updates the Stack Wallet app's package dependencies and adds an override so that a specific Bitcoin-related library (bitcoindart) is pinned to a CypherStack-controlled version. The stated reason is to fix a dependency conflict introduced by another package (bip47). The change itself is a build/dependency configuration update, not a code-level security fix. There is no direct evidence in the commit that this resolves a vulnerability, only that it resolves a dependency issue.

This commit updates a Windows build script for a cryptographic library (secp256k1) used by Stack Wallet. It turns on the 'recovery' module, which is needed to recover public keys from signatures, and cleans up old build directories before compiling. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a build-configuration correction to make the wallet compile and function correctly on Windows.

This commit changes a Linux build script for the secp256k1 cryptographic library so that it explicitly enables the 'recovery' module. The recovery module allows a wallet to recover the public key from a digital signature, which is needed for some Bitcoin-style transaction verification. Without this module enabled, the built library would lack those functions, which could cause wallet operations to fail or fall back to less secure behavior. The change itself is a build-configuration fix, not an active exploit.

This commit changes a Windows build script used in WSL to compile the secp256k1 cryptographic library. It turns on the 'recovery' module, which adds support for recovering public keys from signatures, and adds a cleanup step to remove old build files. This is most likely a build-fix or feature-enablement rather than a security patch, but enabling extra cryptographic modules can have security implications depending on how the resulting library is used.

This commit changes how Stack Wallet proves ownership of a PayNym identity. PayNyms are reusable payment codes in Bitcoin-style wallets. The old code signed raw bytes directly with the notification key; the new code signs using the standard 'Bitcoin message' format (the same kind of signature used by wallet message-signing features). The change likely fixes a compatibility or security issue where PayNym servers or counterparties could not properly verify the old signature, which could prevent claiming a PayNym or allow signature misuse.

This commit adds two new screens to the Stack Wallet app for a third-party shopping service called ShopInBit: one screen lets users review a purchase offer, and another lets them enter a shipping address. The code itself is a normal feature addition, but it does a few things that could matter for security and privacy: it sends the user's shipping address (name, street, city, postal code, country) to ShopInBit's servers, it silently ignores server errors and continues to the payment screen anyway, and it splits the full name into first/last name in a crude way. There is no sign in the commit that this is described as a security fix or that any vulnerability was reported.

This commit adds two new user interface screens for a feature called ShopInBit: one for collecting a billing address for a car research fee, and another for confirming and sending a cryptocurrency payment. It also registers the new address screen in the app's route list. There is no indication in the code that this fixes a security bug; it appears to be ordinary feature development.

This commit adds four new screens that walk a user through creating a ShopInBit order inside the Stack Wallet app. It is purely a feature addition: collecting a display name, showing service guidelines, and submitting a request description and delivery country to the ShopInBit service. There is no indication in the commit that this fixes a security bug or introduces a vulnerability.

This commit adds new screens for managing ShopInBit support tickets inside the Stack Wallet app. It lets users view ticket status, read messages, and send replies. The code also renders images embedded in messages by decoding base64 data. There is no clear security bug, but the image decoding and HTML stripping are done with simple regular expressions, which could be fragile if a malicious server sends unusual message content. The commit itself is a feature addition, not a fix.

This commit adds new data models and database schema for a feature called ShopInBit. It defines how the app will store shopping/concierge ticket information locally, including order details, shipping addresses, messages, and status. There is no security fix or vulnerability present in this commit—it is purely new feature code.

This commit adds a new feature: a Dart client and service layer for integrating with the ShopInBit API inside the Stack Wallet app. It lets the wallet talk to ShopInBit to create support tickets, upload messages/attachments, manage vouchers, handle car-research invoices, register push notifications, and verify webhooks. The code also adds generic HTTP PATCH and DELETE helpers. From the diff alone there is no clear security bug, but several design choices are worth reviewing: the service defaults to sandbox mode, customer keys are stored in the app's general preferences box, and attachment URLs can optionally put authentication tokens in query parameters where they may leak in logs or referrers.

This commit only adds new Dart data-model classes for a third-party shopping service called ShopInBit. It defines how the app represents things like addresses, tickets, payments, vouchers, and API errors. There is no executable network, authentication, or business logic here, and nothing in the commit changes existing behavior or fixes a known problem. It is a routine feature addition with no direct security relevance.

This commit fixes a bug in Stack Wallet's Firo masternode registration feature. Previously, the wallet would redundantly send another 1000 FIRO inside the registration transaction itself, using that new output as collateral. The updated code instead uses an existing 1000 FIRO unspent output (UTXO) in the wallet as collateral, which is the correct behavior for Firo masternodes. The change also adds checks that the collateral exists, is confirmed, is exactly 1000 FIRO, and is signed with the correct private key. This prevents users from accidentally spending an extra 1000 FIRO and makes the registration compatible with standard Firo masternode requirements.

This commit is a minor user-interface improvement. It changes the transaction confirmation screen so that when sending a token, the token's short name (ticker) is shown in the desktop send-authorization widget instead of falling back to the main coin name. There is no security-relevant change visible in the code.

This commit fixes two bugs in Stack Wallet's support for the Particl cryptocurrency. First, it corrects how the app reads transaction data returned by ElectrumX servers, replacing a brittle type cast with safer loop-based lookup. Second, it removes a hack that stripped trailing zero bytes from raw Particl transaction hex, and instead passes a flag so the underlying library produces the correct hex directly. These are correctness fixes for transaction building and UTXO parsing; they do not appear to be security patches for an exploitable vulnerability, but the removed hex-stripping hack could theoretically have produced malformed transactions.