Stack Wallet

This commit is purely a code-formatting cleanup. It adjusts line breaks, indentation, and whitespace across six Dart files to match the project's style rules. No functionality, logic, or security behavior was changed.

This commit changes a single flag in the Firo cryptocurrency wallet code. When creating a special 'ProReg' transaction used for masternode registration, the wallet now marks a small recipient output as 'not change' rather than 'change.' In many wallet designs, change outputs are handled differently from payment outputs—potentially affecting how fees are calculated, how the output is selected in future spending, or how the transaction is displayed to the user. The change is too small and context-free to conclude it fixes a serious vulnerability, but it is a plausible correctness or security-related fix for a coin-specific transaction type.

This commit makes a small UI safety tweak in the transaction confirmation screen of a cryptocurrency wallet. It moves a database lookup slightly later in the code and ensures a state update happens after the screen has finished its initial build, which helps avoid a rare Flutter framework error. There is no direct evidence this fixes a security vulnerability, but it is a defensive safeguard against possible app crashes or inconsistent UI state when checking whether a transaction would accidentally spend a valuable 'ordinal' asset.

This commit updates a submodule called frostdart to version 0.1.3. The stated reason is to pin two related software libraries (openssl and openssl-sys) to versions compatible with an older Rust compiler version (1.71). There is no code change visible in the commit itself, only a submodule pointer update. No security issue is described or evident from the materials provided.

This commit only updates a Git submodule pointer for 'frostdart' inside the Stack Wallet repository. No actual code changes are shown, and no security-related description is provided. On its own, this tells us nothing about whether the submodule update fixes or introduces a security issue.

This commit adds an optional shortcut for Windows builds that downloads a pre-built 'mwebd.exe' program from the internet instead of compiling it from source. It checks the downloaded file against a published SHA-256 hash, but the download itself uses plain HTTPs and the source URL can be overridden by an environment variable. There is no claim in the commit that this fixes a security issue; it appears to be a build-convenience change.

This commit is a performance refactor, not a security fix. It moves a check that warns users if they are about to spend a Bitcoin 'ordinal' inscription UTXO from the UI build path into an asynchronous initialization step, caching the result. The warning itself and the underlying behavior are unchanged. There is no indication this patch addresses a vulnerability or that the prior code was exploitable.

This commit is a defensive hardening patch for the ShopInBit integration in Stack Wallet. It changes how the app handles unexpected status strings and webhook event types from the ShopInBit API. Previously, unknown values were silently forced into a default known value (for example, an unrecognized ticket state was treated as a brand-new ticket). Now unknown values are explicitly marked as 'unknown,' preserved in raw form, and ignored rather than misapplied. This prevents the app from showing wrong order statuses or acting on unexpected events if the ShopInBit API changes its labels or adds new ones.

This commit is a minor code cleanup in the Stack Wallet app's ShopInBit feature. It removes a duplicate line of code and fixes the indentation of some UI widget code. There is no security-relevant change.

This commit simply deletes an unused auto-generated file that registered data adapters for a local database library called Hive. There is no functional code change, no bug fix, and no security-relevant behavior is altered.

This commit removes a small vertical spacing widget (an extra 8-pixel gap) from a settings screen. It is purely a cosmetic/UI layout change and has no security relevance.

This commit only updates a reference (likely a Git submodule or dependency pointer) to a library called libepiccash. No actual code changes are shown, and no security-related description is provided. There is not enough information to determine whether this update fixes a security issue, adds a feature, or is routine maintenance.

This commit adds a safety check to Stack Wallet's Firo Spark auto-minting feature. Previously, if the wallet tried to automatically convert all eligible coins into Spark private coins and somehow produced no transactions, it would silently return an empty result. Now it throws a clear error instead. This prevents the wallet from incorrectly assuming a successful private mint happened when nothing was actually sent.

This commit tightens how Stack Wallet calculates and checks fees when creating privacy-preserving 'Spark mint' transactions for the Firo cryptocurrency. It fixes a loop that could keep charging fees after outputs were drained, adds an error when a user tries to auto-mint all coins but the balance is too small to pay the fee, and adds a final sanity check comparing the expected fee against the actual fee built into the transaction. The changes appear aimed at preventing incorrect or excessive fees, or transactions that fail silently.

This one-line change fixes how the wallet picks the next Spark privacy address. Previously it looked at the current regular receiving address to decide the next Spark address number (diversifier). Now it correctly looks at the current Spark receiving address. Using the wrong starting number could cause address reuse or generate addresses that collide with already-used ones, which weakens the privacy guarantees Spark is designed to provide.

This commit changes how Stack Wallet caches and resets Firo Spark private-balance data. It removes a safety fallback that refetched the full anonymity set when the local cache size looked inconsistent, switches from 'insert-or-ignore' to plain inserts for Spark coins, and simplifies the 'clear Spark cache' button so it only wipes the shared cache and no longer resets per-wallet metadata. A separate change also fixes which address type is used when generating the next Spark receiving address. The overall effect is a reset/rework of private balance tracking, but the commit message and diff alone do not clearly state whether this fixes a security bug or is just a reliability refactor.

This commit only updates the version numbers and cryptographic hashes of several Dart/Flutter test and utility libraries in the pubspec.lock dependency lock file. There is no indication of a security fix, vulnerability patch, or code change affecting the wallet application itself.

This commit is a collection of small fixes in the Stack Wallet app. The most notable changes correct how Firo masternode registration transactions are signed and built, fix a bug where the app might pick the same address for both collateral and owner, and improve how the app detects and navigates after a masternode transaction. There are also UI layout tweaks and a change to the Campfire app configuration so it uses the main Firo network instead of the test network. The commit message gives no indication these are security fixes, and the changes look like ordinary bug fixes rather than patches for an exploitable vulnerability.

This commit is a routine code cleanup: it removes an unused import and a private, never-called method that copied a cryptocurrency address to the clipboard. There is no functional or security change to the app.

This commit is a routine user-interface fix for the ShopInBit shopping feature inside Stack Wallet. It corrects a bug where returning desktop users were not skipping the guidelines screen, makes a submit button sticky, and improves a travel booking form by adding a country dropdown, a details text box, and date pickers. There is no indication this change fixes a security vulnerability.

This commit fixes a user-interface flow bug in the desktop ShopinBit feature. Previously, first-time users were asked for their display name twice and had to go through an extra service overview screen. Now, first-time users enter their name once in setup, see the service overview, and then go straight to the order step. Returning users skip the overview and go directly to the order step. There is no security-relevant change.

This commit tweaks the checkout flow for a third-party shopping integration called ShopInBit. It removes a 'I accept the Terms & Conditions' checkbox from the payment screen, locks the shipping country to whatever was already chosen, fixes a layout overflow on the billing form, and adds a 'View My Requests' button after payment. None of these changes look like a security fix for the wallet itself; they are mostly UI/UX adjustments to a partner service's checkout screens.

This commit fixes three minor bugs in the Stack Wallet app's ShopInBit ticket feature: it now loads missing offer prices in the ticket list and detail screens, adds automatic 30-second polling for new messages in the detail view, and removes a restriction that previously stopped closed/cancelled/refunded tickets from refreshing their messages. There is no clear security problem in the code changes themselves.

This commit is a routine build-system update for a cryptocurrency wallet app. It adds a new automated build workflow for Linux and Android, updates the Docker image used for builds, and changes some scripts to download pre-built crypto libraries from GitHub Releases instead of compiling them from source. There is no direct evidence in the diff of a security vulnerability, malicious code, or a backdoor. However, switching to downloaded pre-built binaries introduces a supply-chain risk: if the download source or release artifacts are compromised, the build pipeline could incorporate malicious native libraries into the wallet without reviewers seeing the source code change.

This commit is almost entirely about making the automated test suite run reliably in CI. It swaps a PowerShell CI workflow for a bash one, adds test helpers and stubs, updates many generated mock files, and makes a small code change so the logger does not call itself forever when it fails. There is no obvious security vulnerability being introduced; the main risk is that a real bug in the logger could now be silently swallowed instead of reported.