Stack Wallet

This commit adds a new user-interface feature for managing 'Epic Box' servers in the Stack Wallet desktop app. It lets users add, edit, test, and connect to custom Epic Cash (EPIC) relay servers. The change is a feature addition, not a documented security fix. There are no obvious remote-code-execution or data-theft bugs visible in the diff, but it does introduce network calls to user-supplied hosts and stores custom server entries, which could in principle be abused by a malicious server or a social-engineering attack if input validation or TLS handling elsewhere is weak.

This commit changes two places in a cryptocurrency wallet app where it connects to ElectrumX servers. Previously, one connection accepted unverified TLS/SSL certificates (acceptUnverified: true), which could let a malicious server impersonate a legitimate one. The patch disables that behavior (acceptUnverified: false) and also explicitly disables it in a connection-check helper. In plain terms, the wallet will now refuse to trust servers that cannot prove their identity with a valid certificate, reducing the risk of man-in-the-middle attacks.

This is a tiny code-quality change that replaces a regular HTTP client instance with a constant one. It does not fix a security bug and does not change what the app does or how it connects to the internet.

This commit fixes a database cleanup routine that deletes a wallet's blockchain data (transactions, addresses, and unspent coins). Previously, the code counted records outside of the write transaction, then opened a transaction to delete them. If data changed between the count and the deletion, the loop logic could behave incorrectly. The fix moves the counts inside the same write transaction and increases the batch size from 50 to 100. There is no claim in the commit that this is a security fix, and no public references tie it to an incident.

This commit adds error logging when deleting a wallet fails, and makes minor code cleanups. It does not fix the underlying deletion failure or change how the app behaves when an error occurs. The user still sees the same result, but developers now get a log entry to help diagnose problems.

This commit is purely a code-style and formatting cleanup. It extracts two long user-facing text strings into named constants and adjusts indentation to match the project's formatting rules. There is no change to app behavior, security logic, or user-visible wording.

This is a small UI stability fix in a Dart/Flutter transaction list screen. It checks whether the widget is still on screen before calling setState after an asynchronous data update, preventing a common Flutter runtime error when a user navigates away before the update arrives. There is no indication this affects funds, keys, network traffic, or app permissions.

This commit optimizes how the wallet prepares private Spark coin spends. It adds a check that throws an error if no spendable coins exist, and it changes the code to only fetch data for the specific coin groups the user actually owns, rather than scanning every group ID from 1 up to the latest one. This is a performance and robustness improvement, not a clear security fix, though it may reduce exposure to certain failure modes.

This commit fixes a race condition in how a background worker (called an 'isolate') for the Spark privacy feature is initialized. Previously, if two parts of the app tried to start the isolate at nearly the same time, both could try to create it, which could waste resources, cause errors, or leave the wallet in an inconsistent state. The fix uses a one-time 'Completer' so that any concurrent callers wait for the first initialization to finish instead of spawning duplicate isolates.

This commit fixes a lookup in the Stack Wallet app so it can find the Epic Cash cryptocurrency when its display name is 'Epic Private Internet Cash'. Without this change, the app might fail to recognize or handle Epic Cash correctly when that specific name is used. There is no direct evidence this is a security vulnerability.

This commit updates the wallet's exchange and buy flows so that when a user picks one of their own wallets to receive a swap, they can now choose between a private 'Spark' address and a regular 'Transparent' address for Firo. Previously the app only offered one default address type. The change is a user-facing feature improvement, not a security fix, and the diff does not show any vulnerability being patched.

This commit fixes how Stack Wallet classifies Firo Spark addresses. Before the fix, the wallet likely treated Spark addresses as a different, possibly unsupported address type because it didn't have a dedicated check. The fix adds a method that first checks if an address is a Spark address and, if so, returns the correct type; otherwise it falls back to the existing logic. This is a correctness fix that could prevent user-facing errors or misrouting of transactions involving Spark addresses.

This commit simply turns on an existing user-interface menu option for Firo masternodes in the Stack Wallet app. It uncomments two previously disabled UI blocks so that Firo wallet users can navigate to the masternodes screen. There is no code change to security logic, cryptography, networking, or data handling in the diff itself.

This commit fixes how IP addresses and port numbers are packed into Firo masternode registration transactions in the Stack Wallet mobile/desktop wallet. The previous code reversed the IP octets and used little-endian byte order for the port, which would produce an incorrectly formatted network message. The patch now keeps IP octets in normal order and writes the port in network (big-endian) byte order, matching standard Firo protocol expectations. It also rejects port 0 as invalid. A wallet using the old code would likely create masternode transactions that other Firo nodes could not correctly interpret, leading to registration failures or misdirected masternode announcements.

This small change adds a safety check before updating Epic Cash wallet configuration. Previously, the app would try to update configuration even if the wallet object didn't exist, which could cause a crash. Now it skips the update if the wallet is missing. This is a defensive bug-fix that likely prevents a runtime error rather than a security vulnerability.

This commit replaces a very weak Epic Cash address check with a proper synchronous validation call. Previously, the app considered any string containing an '@' symbol to be a valid Epicbox address, and any non-empty string longer than 10 characters to be valid otherwise. That could have allowed users to send funds to malformed or attacker-controlled addresses. The patch now delegates validation to the underlying Epic Cash library, which should reject invalid addresses correctly.