Stack Wallet

This commit updates the Windows build pipeline for a small helper program called mwebd, which Stack Wallet uses for Litecoin MWEB privacy features. It bumps the mwebd version from v0.1.8 to v0.1.19, switches to a newer Go compiler, removes an old workaround that disabled part of the upstream plugin, and fixes a checksum comparison bug caused by Windows file paths. There is no direct evidence in the commit that this fixes a security vulnerability, but updating dependencies and removing workarounds can have security side effects.

This commit updates the project's Docker build image to install the Go programming language toolchain. It downloads Go 1.24.13 from the official Go website, verifies the file's integrity using a published SHA-256 checksum, extracts it, and adds it to the container's system PATH. The change appears to be a routine CI/build environment update rather than a security fix or vulnerability patch. There is no direct evidence in the commit that this addresses a security issue.

This commit rewrites how Stack Wallet calculates fees for MWEB (a privacy feature in Litecoin). It introduces a new helper module that reconciles the estimated fee against what the transaction actually pays, and loops up to 10 times to fix mismatches. The change appears to be a bug-fix/refactor of fee arithmetic rather than a new feature or an obvious security patch. There is no vendor statement that this fixes a security vulnerability.

This commit fixes a bug in the FROST Bitcoin wallet's coin-selection retry logic. Previously, when the first attempt to build a transaction didn't have enough funds, the code tried to add extra UTXOs but used a Set (which ignores duplicates and has no guaranteed order) and also accidentally included the current UTXO again instead of only the remaining ones. The fix switches to an ordered List and correctly picks/removes the next UTXO. This could have caused transaction building to fail, loop incorrectly, or select the wrong inputs.

This commit updates a single Flutter package dependency called flutter_mwebd from version 0.0.1-pre.11 to 0.0.1-pre.12. The change is routine maintenance: it bumps the version number in the project's lock file and in a template used to generate package configuration. The commit message gives no details about what changed in the new version or whether it fixes any security issue. Without access to the upstream package's changelog, we cannot determine if this update addresses a vulnerability.

This commit simply bumps the minimum Flutter version from 3.44.8 to 3.44.9 across build configuration files, a Dockerfile, and a dependency lock file. It is a routine tooling/maintenance update with no visible security relevance.

This commit is purely a code-style reformat. It changes whitespace, line breaks, and indentation in four Dart files to satisfy the project's continuous integration (CI) formatter. No program logic, behavior, or security-sensitive code was altered.

This commit fixes how custom transaction fees are calculated for MWEB (a privacy feature in Litecoin) in Stack Wallet. Previously, when a user set a custom fee in 'satoshis per virtual byte' (sats/vByte), the app sometimes used the wrong fee rate or mixed up per-byte and per-kilobyte units. The fix makes the code consistently convert sats/vByte to a per-kilobyte rate before sending it to the MWEB library. A new test confirms that a custom sats/vByte setting now overrides the default per-kilobyte rate. This is a correctness bug that could cause users to overpay or underpay fees, and underpayment could potentially delay or stall transactions.

This commit rewrites how Stack Wallet's Xelis wallet handles background synchronization. It replaces a single refresh lock with a new 'operation coordinator' and an 'event batcher' that groups rapid blockchain notifications before acting on them. The stated goal is to fix race conditions and inconsistent state caused by the old mutex-based design. The change is defensive refactoring rather than a patch for a known exploit, but concurrency bugs in wallet code can historically lead to incorrect balances, missed transactions, or crashes.

This commit adds a cleanup routine for Ethereum transactions that were replaced by another transaction with the same nonce. In Ethereum, if you send a second transaction with the same sequence number (nonce) but a higher fee, the first one can be dropped by the network. Stack Wallet previously kept these dropped transactions visible as 'pending' forever. The new code detects them by checking the blockchain and removes them from the local transaction list. It is a bug-fix/quality improvement rather than an active remote hack vulnerability.

This commit simply deletes two unused helper functions that converted numbers between different locale formats (for example, swapping commas and periods used as decimal separators). Because the functions were not being used anywhere in the app, removing them does not change app behavior and does not fix or introduce a security issue.

This commit fixes a state-carryover bug in the desktop version of Stack Wallet. A global fee-rate setting was not being reset when a user opened a new send form, so a custom fee chosen in one wallet could silently carry over to another wallet's send form. If the user did not notice, a transaction could be sent with an unexpected (possibly very low or very high) custom fee. The patch resets the fee type to 'average' each time the desktop send form is initialized.

This commit fixes how the wallet's search and filter features interpret typed-in amounts. Previously, the app assumed everyone uses a dot (.) as the decimal separator and parsed amounts in a way that could misread or silently mishandle values for some currencies. Now it respects the user's locale (e.g., comma for German) and uses the coin's own precision rules. There is no direct evidence this was a security vulnerability, but incorrect amount parsing in a wallet can lead to users selecting wrong coins or filters, so it is treated as a correctness/reliability fix rather than an exploit.

This commit fixes how the wallet builds payment QR codes and web links so that the amount is written in a standard, locale-independent decimal format and uses the correct parameter names for Monero-family coins. Before, a user in a country that uses a comma as the decimal separator could generate a QR code with an amount another wallet might misread, and Monero-style URIs used non-standard fields. The change also adds input formatting and parsing helpers to keep the user's typed amount consistent with their locale while exporting a canonical decimal string.

This commit is a hardening and bug-fix patch for Stack Wallet's send screens. It changes how payment amounts are entered, parsed, and displayed so the wallet respects the user's locale (for example, comma vs. period as a decimal separator) without losing or misinterpreting values. It also stops using formatted fee strings for internal calculations, instead keeping fees as raw numeric Amount objects, and adds validation for Ethereum transaction nonces so only whole numbers are accepted. The changes reduce the chance that a user accidentally sends the wrong amount because the app misread a pasted QR-code amount or a locale-formatted number.

This commit fixes how Stack Wallet handles Ethereum transaction fees. Previously, the app appears to have treated 'max base fee' and 'priority fee' as separate fields, which could let users set a priority fee higher than the total fee cap or set a total cap too low to cover the network's base fee. The patch makes the 'max fee per gas' the hard total cap, validates that the priority fee fits inside it, and uses the same cap and gas limit both when building the transaction and when showing the maximum possible fee. It also improves input validation so malformed gas limits are rejected and fee numbers are properly localized for different languages.