Stack Wallet

This commit fixes how Stack Wallet restores saved cryptocurrency node settings from backups. Previously, the restore code assumed fields like SSL, Tor, and primary-node flags were stored in specific formats (sometimes text, sometimes true/false) and could misread or drop values, potentially restoring a node with the wrong security/privacy settings. The patch introduces a single, tested helper that consistently interprets those fields across old and new backup formats, and also preserves a previously-missing 'node API secret' field during restore.

This commit fixes a bug in how the Stack Wallet app fetches cryptocurrency prices from CoinGecko. Previously, the app tried to match coins by their display name (e.g., 'Bitcoin'), which caused 'Bitcoin Frost' to be missed because its name differs. The change now matches coins by their unique CoinGecko ID instead, so both regular Bitcoin and Bitcoin Frost get correct price data. There is no security vulnerability here—it's a functional bug fix for price display accuracy.

This commit fixes a bug in how Stack Wallet sorts cryptocurrency exchange rate estimates. Previously, the sorting logic was broken: it could place failed/null estimates incorrectly and did not reliably show the best (highest) rate first. The fix ensures better rates appear at the top and failed providers are pushed to the bottom. It is a UI/ordering bug, not a direct theft-of-funds vulnerability, but it could mislead a user into picking a worse exchange rate.

This commit tightens how the wallet parses amounts typed or pasted by users. It now rejects strings that contain plus/minus signs or hidden whitespace characters (like tabs and newlines), and it turns on 'strict' parsing in more places so that spaces inside an amount are not silently ignored. The change is defensive: it reduces the chance that a cleverly crafted amount string could be misread, potentially leading to a wrong payment amount or an unexpected transaction.

This commit fixes a simple math bug that could occur when a cryptocurrency wallet tries to show how far along a restore/sync is, but the current blockchain height is reported as zero. Previously, dividing by zero could produce an invalid result (infinity or 'not a number'). The change makes the progress show 0% until a real chain height is known. It is a robustness fix, not a security vulnerability that an attacker can exploit.

This commit increases the default Peercoin transaction fee rate from 5000 to 10000 satoshis per kilobyte and adds a test to verify the new value. It is a routine fee policy adjustment, not a security fix. The only code change besides the fee value is a minor formatting/indentation cleanup in an unrelated address derivation block.

This commit fixes the minimum spendable amount ('dust limit') for Dash in the Stack Wallet app. It was incorrectly set to 0.01 DASH (1,000,000 satoshis), which is far above Dash's actual network rule of 546 satoshis. The change lowers the limit so users can send smaller valid Dash amounts. A test was added to prevent the value from drifting again.

This commit adds a safety check to prevent a Bitcoin PayNym notification transaction from being built using only Taproot (BIP86) inputs. The new code throws an error if the first input is Taproot, while allowing mixed or non-Taproot inputs. PayNym notification transactions have specific protocol requirements, and using an all-Taproot input set could lead to an invalid or incompatible notification that another wallet might not recognize, potentially causing loss of privacy or failed payments. The change is defensive and includes a unit test.

This commit only updates automatically generated test mock files so they match a new method signature for a network health-check ('ping') call. No real application code, user data, or wallet security behavior changed. It is a routine test-maintenance change with no security relevance.

This commit fixes a sorting bug in how the wallet chooses which coins (UTXOs) to use when sending a BIP47/Paynym notification transaction. The code's comment said taproot coins should be used last and the oldest non-taproot coins first, but the actual sort was doing the opposite for age (newest first). The fix makes the code match the comment. Because notification transactions are special (they reveal a payment code to the recipient), using the wrong coin order could cause the wallet to select a taproot coin when a non-taproot one was available, potentially breaking notification parsing for the receiver or causing the wallet to fall back to a less desirable coin selection.

A one-line fix in the Stack Wallet app changed the Xelis cryptocurrency network setup so that the 'stagenet' (a test-like network) uses the correct stagenet node address, instead of accidentally reusing the 'testnet' case. This appears to be a bug-fix for wallet network selection, not a security vulnerability. There is no evidence in the commit of malicious intent or a disclosed security issue.

This commit fixes a logic bug in how Stack Wallet decides whether to use an Epicbox server or an HTTP/HTTPS receiver when sending Epic Cash transactions. The old code used OR instead of AND when checking for HTTP/HTTPS prefixes, which meant every receiver address was treated as needing an Epicbox check. The new code cleanly separates the two paths and adds a unit test to confirm HTTP/HTTPS addresses bypass Epicbox while email-style Epicbox addresses use it.

This commit fixes a small but meaningful mix-up in the mobile wallet's send screen. The code was reading the desktop fee-rate setting when preparing a Litecoin MWEB (privacy) transaction, instead of reading the mobile fee-rate setting. If the two settings differ, the user could end up paying an unexpected fee, or the transaction might not be built with the fee they actually selected on their phone. There is no direct evidence in the commit of funds being stolen or a remote attacker being able to exploit this.

This commit fixes a single-character bug in the Stack Wallet exchange flow. A double negation (!!) was accidentally used where a single negation (!) was intended. The bug caused the app to require a refund address even from exchanges that do not support one, which could block legitimate transactions. The fix changes the logic so that a refund address is only required when the exchange actually supports it. There is no direct evidence in the commit that this was a security vulnerability, but a mis-gated refund flow could in theory lead to user confusion or funds being sent to an unsupported/invalid refund path.

This commit fixes a bug in the wallet's notification service where checking one trade could accidentally stop all remaining trade checks. The function now correctly continues to the next trade instead of returning early. It also makes the trade-check function properly asynchronous so the periodic timer doesn't wait on it. This is a reliability/bug-fix change with minor security relevance: a stuck or failing trade check could have delayed or suppressed status updates for other trades, potentially hiding problems from the user.

This commit fixes a bug in Stack Wallet's Bitcoin FROST wallet where coins that had already been spent (marked as 'used') could still be selected for new transactions. This could cause the wallet to attempt to spend the same coin twice, leading to failed or invalid transactions. The fix adds a filter to exclude any UTXOs that are marked as used or have an unclear used status.

This is a tiny change to a single automated test file. It makes the test expect different behavior on Linux versus other platforms when setting up a PIN, because Linux does not support the same biometric checks. There is no change to the actual wallet app code that users interact with, so this does not create or fix a security vulnerability.

This commit fixes a UI bug in Stack Wallet's desktop FROST wallet key popup. The previous version accidentally displayed the current FROST keys/config in the section meant to show the previous generation's keys/config. The patch corrects which data is shown in each section and adds a widget test to verify the fix. There is no direct evidence in the commit that this was a security vulnerability, but mislabeling sensitive key material could confuse users.

This commit changes a single constant used to estimate the first block time for the Mimblewimblecoin (MWC) cryptocurrency when restoring a wallet from a date. The old value was too early, which could cause wallet restores to scan blocks that did not exist yet. The new value is later and more accurate. There is no direct security vulnerability here; it is a correctness fix that may affect user experience and restore accuracy.