Stack Wallet

This commit adds a missing Dart import for a view-only wallet data model and updates a dependency lock file for the Spark mobile library. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a routine build/import fix.

This commit is purely cosmetic code cleanup after resolving a merge conflict. It reorders two import statements in each file and reformats some Dart code (line breaks, spacing, trailing commas) without changing any logic, behavior, or security controls. There is no security-relevant change.

This commit fixes a bug in the Stack Wallet app where a special internal 'change' address for the Spark privacy feature could accidentally be shown to the user as a normal receiving address. If a user copied and shared that address, funds meant as change from a transaction could be sent to a publicly visible address, weakening the privacy protections that Spark is designed to provide. The fix re-adds checks that skip over the change diversifier when generating addresses to display.

This commit re-adds a try/catch block around wallet initialization code for the Spark privacy feature. It means if something goes wrong while setting up Spark addresses or keys, the app will log the error but still let the user open the wallet, rather than crashing. Most of the change is automatic code formatting. The security relevance is unclear from the commit alone: it could be a stability fix, or it could mask a deeper problem that previously caused crashes.

This commit adds the ability to create and use Firo 'view-only' wallets using a Spark view key. A view-only wallet lets someone see incoming transactions and balances without being able to spend funds. The change adds UI screens to display and restore the Spark view key, and updates the wallet logic so Firo wallets can scan Spark transactions using the view key instead of the full private key. It also blocks spending, minting, and fee estimation in view-only mode. There is no direct evidence in the commit of a security vulnerability, but the change touches sensitive key-handling code and should be reviewed carefully.

This commit adds a privacy flag to the text boxes where users type their wallet recovery phrase (mnemonic seed words). The flag tells the phone's keyboard not to learn or remember those words for personalized suggestions. Without it, sensitive seed words could be stored in the keyboard's user dictionary or cloud-backed learning models, increasing the risk that someone with access to the keyboard data could recover part of a wallet backup.

This commit fixes a bug where creating a new Mimblewimblecoin (MWC) wallet could leave the recovery-phrase passphrase unset (null) instead of setting it to an empty string. The change adds Mimblewimblecoin to the same special-case handling already used for Epiccash and Solana wallets. A null passphrase could cause a crash or unexpected wallet-creation failure, but there is no direct evidence it enables theft of funds or unauthorized access.

This commit only adds dark-mode splash screen background colors to a Flutter mobile app configuration. It is a cosmetic UI change with no security relevance.

This commit changes the default Epic Cash node used by Stack Wallet from an unencrypted HTTP connection to an encrypted HTTPS connection, and switches the domain from epiccash.stackwallet.com to epic.stackwallet.com. The main security improvement is that wallet traffic to the default node is now protected from eavesdropping and tampering on the network. There is no direct evidence in the commit of an active attack or vulnerability disclosure.

This commit is a routine bulk dependency and splash-screen refresh for a cryptocurrency wallet app. It updates many third-party libraries (including ones handling Ethereum, Stellar, encryption, and Bitcoin address derivation), switches some packages to CypherStack's own forks, and adjusts Android/iOS launch screen assets. The commit itself does not describe any security bug or fix, and the code changes visible in the diff are mostly mechanical API adjustments needed to match newer library versions. There is no direct evidence in the commit that a vulnerability was patched, but updating dependencies in a wallet app can indirectly affect security by pulling in upstream fixes or, conversely, introducing new bugs.

This commit simply removes an unused icon library called flutter_feather_icons from the project's dependency list. There is no indication of a security issue, bug fix, or behavior change. It is a routine cleanup change.

This commit adds local caching of pending Solana and SPL token transactions so the wallet UI can show a 'Sending' state immediately, and later updates those records once the network confirms them. It is a feature/refactoring change, not an obvious security fix. There are no clear signs it was released to patch a vulnerability, and no independent researcher or CVE is mentioned.

This commit adds a feature that immediately records a pending Solana token transfer in the local wallet database before the blockchain confirms it. It is a normal UI/UX improvement so users see outgoing transactions faster. There is no direct security vulnerability in the diff, but the code silently ignores database write failures, which could in rare cases leave the wallet's transaction history inconsistent with what was actually broadcast.

This commit updates the Android build tooling for the Stack Wallet app. It bumps the Gradle build tool, Android Gradle Plugin, NDK, and adds ProGuard keep/dontwarn rules needed for flutter_secure_storage. These are routine maintenance changes to keep the app building with newer Android tools; there is no direct evidence in the commit of a security vulnerability being fixed.

This commit simply bumps the minimum required Flutter and Dart versions and updates a few related package versions (including google_fonts and meta). There are no code changes affecting app logic, security controls, or user data handling. It is a routine dependency/maintenance update.

This commit refactors how the app decides which wallet setup path to use when restoring or verifying a wallet. It replaces exact class-name checks (like 'is this specifically a Monero wallet?') with broader category checks (like 'is this a CryptoNote-style wallet?'). This is mostly a code cleanup, but it could fix a subtle bug where a new or inherited wallet type would accidentally skip the restore-specific initialization and instead run a normal setup, potentially causing setup problems rather than direct theft of funds.

This commit fixes several bugs in Stack Wallet's backup restore flow. The most notable change is that retrying a failed wallet restore now properly re-initializes the wallet (including opening it for Cryptonote-based coins like Monero) before attempting recovery, instead of calling recover() on a wallet that may not be ready. It also moves an Android file-write operation to a background isolate to avoid blocking the user interface, and makes a wallet ID lookup more forgiving when a backed-up wallet no longer exists.

This commit fixes a display bug in the Stack Wallet app where Spark cryptocurrency names owned by the user were not showing as confirmed in the names view. The change simplifies how the wallet decides which Spark names belong to the user by removing a filter that excluded names already known locally. There is no indication this is a security vulnerability.

This commit is a routine code cleanup. It removes a separate Solana-specific token address provider and folds its logic into the general wallet token address provider. There is no visible security fix or behavior change beyond simplifying where token addresses are read from.

This commit is a small code cleanup in the Stack Wallet app. It changes how zero token balances are created so that only one zero-value object is reused instead of making four separate ones. There is no visible security problem or user-facing behavior change.

This commit finishes a previously incomplete Solana token-balance feature. Before the change, the app showed a hard-coded zero balance for Solana tokens and could not refresh a token wallet on its own. After the change, real token balances are read from the Solana blockchain, stored in a local database, and displayed in the wallet. The change also makes the refresh button refresh the token balance instead of only the parent Solana wallet. There is no direct evidence in the commit of a security vulnerability, but it replaces a placeholder with real balance handling, which is a functional fix that could affect user funds if it had bugs.