Stack Wallet

This commit adds a warning message shown to users when they are about to spend a Bitcoin UTXO that contains an ordinal inscription. It is a user-interface safety feature, not a fix for a code vulnerability. It helps prevent users from accidentally spending or losing valuable or meaningful inscription assets.

This is a small, defensive bug fix in the Xelis cryptocurrency wallet's shutdown code. Before the change, the wallet always tried to put itself into 'offline mode' when exiting, even if it was already offline. After the change, it first checks whether the wallet is actually online and only then switches to offline mode. The main risk is avoiding unnecessary or incorrect state changes during shutdown, which could potentially cause crashes, resource leaks, or confusion in wallet state. There is no direct evidence of a security vulnerability being exploited.

This commit fixes a small but meaningful bug in how Stack Wallet builds Particl cryptocurrency transactions. The code was accidentally reading the script signature from the first input for every input, instead of reading the correct one for each input. That could corrupt the transaction data the wallet stores or signs, potentially causing invalid transactions, failed sends, or in the worst case a security issue if the wrong data is signed. The fix changes one index from 'first input' to 'current input'.

This commit changes a single number used when building Particl cryptocurrency transactions. The previous value (1) was replaced with 160, which appears to be the correct transaction version for the Particl network. Using the wrong version could cause transactions to be rejected by the network or behave unexpectedly, but the commit itself is a straightforward fix rather than an attack or vulnerability patch.

This commit fixes how the Particl wallet reads transaction input data, specifically the 'witness' field, by switching to a dedicated parser instead of manually pulling fields. The change suggests the previous code may have misread or mishandled witness data, which could cause incorrect transaction details, failed transactions, or wallet display errors for Particl users. There is no claim in the commit that this is a security fix, and no independent security analysis is supplied.

This commit fixes a bug in how Stack Wallet checks whether a Particl coin can be spent. Previously, the wallet looked at every output in the entire transaction to decide if a single coin (UTXO) was blocked. If any unrelated output in the same transaction was a blind/confidential/data/staking output, the wallet would wrongly mark the user's spendable coin as blocked too. Now it only checks the specific output that actually belongs to the coin in question. This is a correctness fix that could prevent coins from being incorrectly frozen or hidden from the user, but it does not appear to be a direct theft or remote-code-execution vulnerability.

This commit changes how the Stack Wallet app detects Litecoin Ordinals (a type of digital collectible). Instead of asking a third-party service (litescribe.io) which inscriptions belong to a wallet address, the app now asks its own ord-litecoin.stackwallet.com server directly about each transaction output. The change removes a heuristic that blocked small outputs as 'possible ordinals' only when an address-level check passed, and instead checks each output directly. There is no clear security bug being fixed, but the commit does switch data sources and removes some protective logic around small-value outputs.

This commit fixes a small user-interface label bug on the desktop send confirmation screen. Previously, when sending a token (for example, an Ethereum ERC-20 token), the prompt incorrectly showed the parent coin's ticker (e.g., ETH) instead of the token's own ticker (e.g., USDT). The change lets the screen receive and display the correct token ticker. It is a cosmetic fix, not a security fix.

This commit removes a custom Epicbox server implementation from the Stack Wallet app and switches the UI to use a built-in list of default Epicbox servers. It also adds delete buttons for custom servers and changes how default servers are stored. There is no clear security fix here; it looks like a feature refactor or cleanup that may have minor side effects on how server settings are saved and restored.

This commit adds a new mobile screen for managing 'Epicbox' servers used by Epic Cash wallets. It lets users add, edit, and pick custom server addresses. The change is a feature addition; there is no direct evidence in the commit that it fixes a security bug or introduces a clear vulnerability, but it does expose network endpoint configuration to the user and performs live connection tests from the app.

This commit tidies up a Dart file that decides what text label to show for cryptocurrency transactions (for example, 'Received', 'Sending', or 'Cancelled'). It removes a large block of duplicated code and changes the logic that decides when a transaction is 'waiting for sender' or 'waiting for receiver' so it also considers whether an optional on-chain note is present. The change is a code cleanup with a small logic adjustment; there is no direct evidence it fixes a security vulnerability.

This commit fixes a likely data-labeling bug in the Epic Cash wallet code. The previous code assigned the sender's address to a transaction output (money received) and the recipient's address to a transaction input (money spent). The swap corrects this so outputs are labeled with the recipient's address and inputs with the sender's address. This is primarily a correctness/display issue rather than a direct theft vulnerability, but it could mislead users or downstream features about where funds came from or went.

This commit fixes a small logic bug in how Stack Wallet displays the status of certain transactions. Previously, the app did not count an optional on-chain note as one of the messages, so it could show the wrong status label (for example, saying it is still waiting for the sender when it should already be waiting for confirmations). There is no sign this can be used to steal funds or attack users; it is mainly a user-interface correctness fix.

This commit changes how Stack Wallet handles Epic Cash receiving addresses when the Epic Box server (a messaging relay for this privacy coin) is changed. It removes some default servers, renames others, and adds logic to regenerate and store the wallet's receiving address whenever the Epic Box configuration changes. The change appears to be a bug fix to keep the wallet's displayed address in sync with the active relay server, rather than a security vulnerability fix.

This commit simply removes the word "(optional)" from two on-screen labels in the Stack Wallet app. The labels now say "On chain Note" instead of "On chain Note (optional)". There is no code behavior change, no security fix, and no vulnerability being addressed. It is a minor user-interface wording update.

This commit changes how the Epic Cash wallet picks its Epicbox server configuration. Previously it always used a hardcoded default server. Now it first tries to read a user-stored configuration from secure device storage and only falls back to the default if none exists or it cannot be parsed. The change is a feature improvement, not a direct security fix, but it reduces reliance on a single hardcoded server.

This commit adds a new user-interface feature for managing 'Epic Box' servers in the Stack Wallet desktop app. It lets users add, edit, test, and connect to custom Epic Cash (EPIC) relay servers. The change is a feature addition, not a documented security fix. There are no obvious remote-code-execution or data-theft bugs visible in the diff, but it does introduce network calls to user-supplied hosts and stores custom server entries, which could in principle be abused by a malicious server or a social-engineering attack if input validation or TLS handling elsewhere is weak.

This commit changes two places in a cryptocurrency wallet app where it connects to ElectrumX servers. Previously, one connection accepted unverified TLS/SSL certificates (acceptUnverified: true), which could let a malicious server impersonate a legitimate one. The patch disables that behavior (acceptUnverified: false) and also explicitly disables it in a connection-check helper. In plain terms, the wallet will now refuse to trust servers that cannot prove their identity with a valid certificate, reducing the risk of man-in-the-middle attacks.

This is a tiny code-quality change that replaces a regular HTTP client instance with a constant one. It does not fix a security bug and does not change what the app does or how it connects to the internet.

This commit fixes a database cleanup routine that deletes a wallet's blockchain data (transactions, addresses, and unspent coins). Previously, the code counted records outside of the write transaction, then opened a transaction to delete them. If data changed between the count and the deletion, the loop logic could behave incorrectly. The fix moves the counts inside the same write transaction and increases the batch size from 50 to 100. There is no claim in the commit that this is a security fix, and no public references tie it to an incident.

This commit adds error logging when deleting a wallet fails, and makes minor code cleanups. It does not fix the underlying deletion failure or change how the app behaves when an error occurs. The user still sees the same result, but developers now get a log entry to help diagnose problems.

This commit is purely a code-style and formatting cleanup. It extracts two long user-facing text strings into named constants and adjusts indentation to match the project's formatting rules. There is no change to app behavior, security logic, or user-visible wording.

This is a small UI stability fix in a Dart/Flutter transaction list screen. It checks whether the widget is still on screen before calling setState after an asynchronous data update, preventing a common Flutter runtime error when a user navigates away before the update arrives. There is no indication this affects funds, keys, network traffic, or app permissions.

This commit optimizes how the wallet prepares private Spark coin spends. It adds a check that throws an error if no spendable coins exist, and it changes the code to only fetch data for the specific coin groups the user actually owns, rather than scanning every group ID from 1 up to the latest one. This is a performance and robustness improvement, not a clear security fix, though it may reduce exposure to certain failure modes.

This commit fixes a race condition in how a background worker (called an 'isolate') for the Spark privacy feature is initialized. Previously, if two parts of the app tried to start the isolate at nearly the same time, both could try to create it, which could waste resources, cause errors, or leave the wallet in an inconsistent state. The fix uses a one-time 'Completer' so that any concurrent callers wait for the first initialization to finish instead of spawning duplicate isolates.