SW
← All projectsStack Wallet

Stack Wallet

Actively maintained multi-coin self-custody wallet with Monero support and on-device keys.

MoneroPrivacy protocolsSoftware walletsNormal
Repository coverage

1053 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

338security candidates411second-pass queue749AI analyses
77commits · 30 days
175commits · 60 days
600commits · 180 days
1005commits · 365 days
Backfill bands
Sep 27 → Mar 31404 seen73 candidatesComplete
Mar 31 → Jul 29463 seen238 candidatesComplete
Jul 29 → Aug 2887 seen8 candidatesComplete
Aug 28 → Sep 2753 seen6 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

51/100 average clarity
33Strong · 80–100
316Adequate · 60–79
513Thin · 40–59
191Opaque · 0–39
33security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Navid Rahimi1017154
sneurlax339158241062
julian347112269044
Julian19741144043
Dan Miller831525053
Reuben Yap20318052
Cyrix12615211049
julian-CStack222049
levoncrypto24121043
Tritonn204412052
cassandras-lies413048
NyanCatTW1111045
Analysis record

Published AI watches

Last scanned 3 minutes ago

Informational 24 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1469 from Cyrix126/building_dialog_cancel

This commit fixes a mobile UI bug where pressing Cancel on a 'building transaction' dialog accidentally closed one too many screens. The fix moves the responsibility for closing the dialog into each screen's cancel handler, and prevents er…

No security-relevant signals in the diffUI-only navigation and error-dialog suppression changesNo cryptographic, authentication, authorization, or data-handling changes
94e6da66by Julian+68−8412 files
No security note in commit
Informational 20 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into building_dialog_cancel

This commit is a routine merge from the project's staging branch into a feature branch. The visible code changes fix small UI/UX bugs in Stack Wallet's send screens: clearing an internal address-validation cache when the form is reset, mak…

Clearing stale address-provider state on form reset reduces the risk of stale validation data influencing a subsequent transactionFee-form caching prevents repeated network calls and accidental fee UI flicker/state races on rebuildQR scan buttons are UX additions with no visible parser/validation logic changes
0485b166by Julian+194−56 files
No security note in commit
Informational 17 AI analysisMessage 58 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1468 from Cyrix126/desktop_fee_form_refetch

This commit fixes a desktop wallet bug where the send-fee form would repeatedly re-fetch fee estimates on every screen rebuild, wasting resources and possibly flickering. It now caches the fee estimate and only retries if the previous fetc…

No security-relevant signals present in diff or commit metadataChange is a UI/UX performance and reliability improvement
62432946by Julian+176−52 files
No security note in commit
Informational 17 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into desktop_fee_form_refetch

This commit merges a feature branch into another work-in-progress branch. It adds QR-code scanning buttons to two desktop token send screens and resets an internal address-validation state variable when the send form is cleared. There is n…

State reset added to clearForm() to avoid stale validation dataNew QR scan entry points in token send flows (UI feature, not a vulnerability signal)
8a72c82fby Julian+18−04 files
No security note in commit
Low 32 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1467 from Cyrix126/clear_send_form_validity

This change fixes a UI state bug in the cryptocurrency wallet's send form. When a user clears the send form, the app now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing…

UI state desynchronization between form field and validity indicatorPotential user confusion from stale valid-address stateNo input validation, cryptographic, or network-layer changes
d3383b4eby Julian+2−02 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into clear_send_form_validity

This commit adds a QR code scanner button to two desktop cryptocurrency send forms. It is a straightforward user-interface feature addition with no apparent security relevance.

22560a59by Julian+16−02 files
No security note in commit
Informational 20 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1466 from Cyrix126/desktop_token_qr_button

This commit adds a missing QR code scan button to two desktop token send screens in the Stack Wallet app. It is a straightforward user-interface fix that restores a feature already present on mobile and other send views; there is no indica…

47f6d369by Julian+16−02 files
No security note in commit
Informational 15 AI analysisMessage 18 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

style: format

This commit is purely a code-formatting cleanup. It changes line breaks and indentation in four user-interface files so the code is easier to read, but it does not change what the app actually does. There is no security relevance.

ae45aba8by Cyrix126+47−524 files
No security note in commit
Informational 23 AI analysisMessage 62 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

fix: stop estimating the desktop fee for a zero amount

This commit fixes a UI bug in the desktop version of Stack Wallet where the send amount could be lost while the app was trying to estimate transaction fees. The fix keeps the amount 'alive' in memory so fee estimation does not accidentally…

State lifecycle issue in UI provider could lead to loss of user inputFix prevents fee estimation from silently resetting send amount to zeroNo cryptographic, authentication, or network security changes present
90c91bdeby Cyrix126+22−02 files
No security note in commit
Low 32 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

show split tx warning on confirm screen

This commit updates the Stack Wallet app so that when a single payment is broken into multiple cryptocurrency transactions, the user sees a clear warning on the confirmation screen. It also changes the app's internal record-keeping to hand…

UI now warns users when a payment will be split into multiple on-chain transactionsInternal transaction model changed from single txid to list of txidsMultiple confirmation flows updated to iterate over all txids for notes and trade lookups
80343a5aby Julian+376−23916 files
No security note in commit
Informational 18 AI analysisMessage 62 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

fix: stop refetching the desktop fee rates on every rebuild

This commit fixes a performance bug in the desktop version of Stack Wallet where the app repeatedly re-fetched Bitcoin-style fee rates every time the on-screen fee form rebuilt. The change caches the fee result and only fetches again if th…

Unnecessary repeated network requests reducedFuture result cached to avoid re-execution on widget rebuildError path clears cache to allow retry
a1ca9292by Cyrix126+154−52 files
No security note in commit
Low 34 AI analysisMessage 62 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

fix: reset the address validity when clearing the send form

This commit fixes a UI state bug in Stack Wallet's send form. When a user clears the send form, the wallet now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing an old ad…

Stale UI state after form resetAddress validity not synchronized with address field resetPotential UI confusion leading to incorrect send confirmation
43dd0477by Cyrix126+2−02 files
No security note in commit
Low 35 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1450 from Ez3kiel-dev/fix/xelis-integration

This is a large feature/fix merge that restores and rewrites the Xelis (XEL) cryptocurrency integration in Stack Wallet. It swaps the old hand-rolled Xelis code for a new generated native interface (XWF), adds wallet restore/backup support…

Send-flow lifecycle hardening: prepared Xelis transactions are now discarded via cancelSend when the user cancels or the widget is disposedSession-generation checks prevent stale wallet handles from being used after close/reopenMutex serialization added around send preparation, balance, history, and rescan operations
ad945d43by Julian+4298−162634 files
No security note in commit
Low 32 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into fix/xelis-integration

This commit is a large merge that mainly adds integration tests for a desktop 'forgot password' reset feature and makes supporting code changes to safely shut down background database workers during that reset. It also removes a large set …

New integration tests exercise a destructive 'forgot password' data-wipe featureTests assert that password store and wallet key store are deleted on successful resetTests assert that wallet files are deleted while backup and tor state are preserved
b0e5d35aby Julian+2678−330378 files
No security note in commit
Informational 19 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1361 from cypherstack/fix/305-multiline-transaction-notes

This commit lets users type multi-line notes when editing transaction and trade notes, and fixes the desktop layout so long notes scroll instead of breaking the screen. It also swaps the old `mounted` check for the newer `context.mounted` …

5172e63eby Julian+402−1113 files
No security note in commit
Low 32 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into fix/305-multiline-transaction-notes

This commit is a large merge that mainly removes old integration tests and adds new desktop 'forgot password' reset tests. It also adds a safe-shutdown path for background Firo cache workers and databases. The changes look like defensive h…

Added safe shutdown of Firo cache isolates/SQLite databases before reset exitNew integration tests verify desktop forgot-password reset deletes secrets and preserves backupsTest harness intercepts exit() and IOOverrides to observe reset side effects
21491edbby Julian+2352−319075 files
No security note in commit
Moderate 57 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1455 from cypherstack/fix/desktop-pw-reset

This commit fixes the desktop "forgot password" reset flow in Stack Wallet. It adds integration tests that verify the app can securely wipe its own data when a user forgets the desktop password, and it updates the Firo cache worker to clos…

Desktop password reset now closes Firo cache workers and SQLite databases before deleting app data, reducing the risk of data leakage or corruption during wipeNew integration tests assert that a successful reset removes password store (hive/desktopdata.hive), wallet key store (isar/desktopStore.isar), and wallet files while preserving backups and tor stateFailed reset scenario leaves a .reset-pending marker and removes password/key stores first, preventing the reset from being undone after partial deletion
055e6c6bby Julian+1077−297154 files
No security note in commit
Low 37 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into fix/desktop-pw-reset

This commit is a large merge that mainly adds a new 'prove you own a Spark address' feature to the Stack Wallet app, plus some related fixes. It also updates a dependency that handles SOCKS5 proxy connections and changes how the app decide…

New cryptographic signing path added: SparkInterface.signMessage now delegates to Spark ownership proof creation using the wallet's private key and spark derivation path.Ownership proof code rejects view-only wallets and blank messages, and searches a 100-address lookahead for the requested address before signing.Dependency upgrade: socks5_proxy 1.0.3+dev.3 -> 2.1.1, which may change SOCKS5/Tor proxy behavior; a new test verifies hostname/onion routing through a fake SOCKS server.
d9b5cc02by Julian+1275−21923 files
No security note in commit
Low 34 AI analysisMessage 83 · Strong
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1439 from navidR/dev/navidr/spark-name-verification

This commit adds a new feature to Stack Wallet that lets users prove they own a Spark (privacy) address by generating a cryptographic ownership proof. It also improves the sign/verify screens so view-only wallets can still verify proofs, a…

New cryptographic proof generation using private key material (privateKeyHex, spendKeyIndex, diversifier) inside an isolateView-only wallet guard added for proof creation (throws if isViewOnly)Message whitespace now preserved for pasted/typed challenge messages, preventing proof/verification mismatches caused by silent trimming
a5411a50by Julian+1097−16616 files
No security note in commit
Low 39 AI analysisMessage 60 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into dev/navidr/spark-name-verification

This commit merges several changes into a development branch. The most notable security-relevant change is a fix for how the Trocador exchange service routes traffic: it now automatically uses Tor (an anonymity network) when the user has T…

Trocador exchange API previously forced clearnet (`isOnion: false`) at every call site, bypassing Tor even when enabledNew `_useTor` getter centralizes Tor routing decision based on app feature flag and user preferenceOnion service address rotated to a new v3 .onion hostname
92955848by Julian+122−507 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedfix epic gecko nameby julian · e0413aa2 · Jan 27, 2026 · 1 fileMessage 28 · OpaqueInformational 19Details
Commit message · julian

fix epic gecko name

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 19/100

This commit fixes a lookup in the Stack Wallet app so it can find the Epic Cash cryptocurrency when its display name is 'Epic Private Internet Cash'. Without this change, the app might fail to recognize or handle Epic Cash correctly when that specific name is used. There is no direct evidence this is a security vulnerability.

AI review queuedadd option to choose between spark and transparent addresses during swap when selecting choose from stack to fill in an addressby julian · 6e981ef0 · Jan 27, 2026 · 9 filesMessage 50 · ThinInformational 19Details
Commit message · julian

add option to choose between spark and transparent addresses during swap when selecting choose from stack to fill in an address

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit updates the wallet's exchange and buy flows so that when a user picks one of their own wallets to receive a swap, they can now choose between a private 'Spark' address and a regular 'Transparent' address for Firo. Previously the app only offered one default address type. The change is a user-facing feature improvement, not a security fix, and the diff does not show any vulnerability being patched.

Security candidatefix firo getAddressType to account for spark addressesby julian · 9e3763a3 · Jan 27, 2026 · 1 fileMessage 50 · ThinLow 35Details
Commit message · julian

fix firo getAddressType to account for spark addresses

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 35/100

This commit fixes how Stack Wallet classifies Firo Spark addresses. Before the fix, the wallet likely treated Spark addresses as a different, possibly unsupported address type because it didn't have a dedicated check. The fix adds a method that first checks if an address is a Spark address and, if so, returns the correct type; otherwise it falls back to the existing logic. This is a correctness fix that could prevent user-facing errors or misrouting of transactions involving Spark addresses.

AI review queuedenable firo masternodes uiby julian · 824795ae · Jan 26, 2026 · 2 filesMessage 35 · OpaqueInformational 17Details
Commit message · julian

enable firo masternodes ui

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit simply turns on an existing user-interface menu option for Firo masternodes in the Stack Wallet app. It uncomments two previously disabled UI blocks so that Firo wallet users can navigate to the masternodes screen. There is no code change to security logic, cryptography, networking, or data handling in the diff itself.

AI review queuedFix IP and port serialization in Firo masternode transactions.by cassandras-lies · d3eb10a3 · Jan 26, 2026 · 1 fileMessage 50 · ThinModerate 56Details
Commit message · cassandras-lies

Fix IP and port serialization in Firo masternode transactions.

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Moderate 56/100

This commit fixes how IP addresses and port numbers are packed into Firo masternode registration transactions in the Stack Wallet mobile/desktop wallet. The previous code reversed the IP octets and used little-endian byte order for the port, which would produce an incorrectly formatted network message. The patch now keeps IP octets in normal order and writes the port in network (big-endian) byte order, matching standard Firo protocol expectations. It also rejects port 0 as invalid. A wallet using the old code would likely create masternode transactions that other Firo nodes could not correctly interpret, leading to registration failures or misdirected masternode announcements.

AI review queuedthis shouldn't affect anything too negativelyby julian · e8cb0218 · Jan 24, 2026 · 1 fileMessage 45 · ThinLow 30Details
Commit message · julian

this shouldn't affect anything too negatively

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 30/100

This small change adds a safety check before updating Epic Cash wallet configuration. Previously, the app would try to update configuration even if the wallet object didn't exist, which could cause a crash. Now it skips the update if the wallet is missing. This is a defensive bug-fix that likely prevents a runtime error rather than a security vulnerability.

Security candidateadd synchronous address validate callby Julian · 24c5840b · Jan 24, 2026 · 3 filesMessage 45 · ThinLow 41Details
Commit message · Julian

add synchronous address validate call

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
defensive validationcryptography-sensitive pathsigning or wallet path
AI analysis · Low 41/100

This commit replaces a very weak Epic Cash address check with a proper synchronous validation call. Previously, the app considered any string containing an '@' symbol to be a valid Epicbox address, and any non-empty string longer than 10 characters to be valid otherwise. That could have allowed users to send funds to malformed or attacker-controlled addresses. The patch now delegates validation to the underlying Epic Cash library, which should reject invalid addresses correctly.

Security candidatefix epic lmao configby Julian · 53fa71b5 · Jan 24, 2026 · 4 filesMessage 28 · OpaqueLow 45Details
Commit message · Julian

fix epic lmao config

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 45/100

This commit rewrites how the Epic Cash wallet stores and uses its configuration. Previously, the app saved a full JSON node/wallet configuration in secure storage and reused it later. Now it only stores a simple 'true' flag there and rebuilds the configuration fresh each time from the currently selected node. The change also removes iOS-specific path rewriting that happened when reading the stored config. The commit message is jokey ('fix epic lmao config'), so the security intent is unclear, but the change could fix a bug where stale or incorrect node settings were reused after the user changed nodes.

Security candidatefix: fix Epic listener issueby sneurlax · c4a95d25 · Jan 23, 2026 · 1 fileMessage 57 · ThinInformational 0Details
Commit message · sneurlax

fix: fix Epic listener issue

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 0/100

We cannot evaluate this commit. The actual code changes (diff) were not provided, and there are no verified public references. The title mentions fixing an 'Epic listener issue' in a cryptocurrency plugin, but without seeing what changed, we cannot tell whether this is a routine bug fix or something with security implications.

AI review queuedfix a couple issuesby Julian · 3c809bb0 · Jan 23, 2026 · 2 filesMessage 28 · OpaqueLow 34Details
Commit message · Julian

fix a couple issues

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Low 34/100

This commit changes how the Epic Cash wallet is initialized and opened. It removes a dedicated wallet-open method, moves the open-wallet call into the general init flow, and switches the wallet-recovery call to be awaited properly. The changes look like bug fixes to wallet lifecycle handling rather than an obvious security patch, but the commit message gives no details and there are no external references.

Security candidatechore: update flutter_libepiccash refby sneurlax · 822d759e · Jan 23, 2026 · 1 fileMessage 47 · ThinInformational 4Details
Commit message · sneurlax

chore: update flutter_libepiccash ref

47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 4/100

This commit only updates a reference (likely a Git submodule pointer) to a plugin called flutter_libepiccash. No actual code changes are shown, and there is no description of any security fix. On its own, this commit does not demonstrate any vulnerability or security improvement.

Security candidatefinish up delete epic walletby Julian · 3c5c7473 · Jan 23, 2026 · 4 filesMessage 45 · ThinInformational 15Details
Commit message · Julian

finish up delete epic wallet

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit changes how an Epic Cash cryptocurrency wallet is deleted. Previously, the delete command was called directly on an open wallet object. Now the code first closes the wallet, then calls a static delete method that only needs the wallet's configuration string. This looks like a routine cleanup to avoid deleting a wallet that is still open, which could prevent crashes or incomplete deletion. There is no clear security vulnerability visible in the diff itself.

Security candidatewrap epicwallet in dyn obj.by Julian · 9e5d2b97 · Jan 23, 2026 · 5 filesMessage 45 · ThinLow 27Details
Commit message · Julian

wrap epicwallet in dyn obj.

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 27/100

This commit is a code cleanup/refactor for the Epic Cash wallet integration. It replaces direct use of a specific library object with a generic 'dynamic object' wrapper and changes how the wallet is passed around. There is no clear security bug introduced or fixed in the visible diff. The change removes storing a raw wallet handle in secure storage, which could be a minor hardening improvement, but the commit message does not frame it as a security fix.

AI review queuedformattingby Julian · ee522c38 · Jan 23, 2026 · 2 filesMessage 0 · OpaqueInformational 15Details
Commit message · Julian

formatting

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only reformats Dart code—breaking a long return-type line and collapsing some function-call arguments onto single lines. There are no functional changes, no bug fixes, and no security alterations.

AI review queuedopenWallet exampleby Julian · 3e27a371 · Jan 23, 2026 · 2 filesMessage 18 · OpaqueInformational 15Details
Commit message · Julian

openWallet example

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit updates the Epic Cash wallet integration so that opening a wallet now requires an extra configuration value (epicboxConfig) and returns a wrapped wallet object instead of a plain string. It appears to be a routine API/example update with no obvious security relevance.

AI review queuedfix(epic): adjust exit behaviorby sneurlax · b1162d20 · Jan 23, 2026 · 1 fileMessage 57 · ThinLow 34Details
Commit message · sneurlax

fix(epic): adjust exit behavior

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 34/100

This commit changes how Stack Wallet's Epic Cash wallet shuts down and restarts its background listener. The old code forcibly closed the wallet object on every exit, which could leave the listener in a broken or stale state. The new code keeps the wallet object alive, stops only the listener, and ensures the listener is restarted when the wallet is reopened. This is a reliability fix that may also prevent bugs where the wallet appears online but cannot receive transactions.

Security candidatefix(epic): update flutter_libepiccash workerby sneurlax · 0038f752 · Jan 23, 2026 · 1 fileMessage 57 · ThinInformational 24Details
Commit message · sneurlax

fix(epic): update flutter_libepiccash worker

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 24/100

This is a one-line change to a plugin called flutter_libepiccash, which handles Epic Cash cryptocurrency operations in Stack Wallet. The commit title says it 'updates' a worker, but the actual code change is not visible because the diff was not provided. Without seeing what was changed, it is impossible to tell whether this fixes a security problem, a stability bug, or something routine.

AI review queuedfix(epic): fix wallet opening and handling, add open, remove ensureWalletOpenby sneurlax · ed18ba26 · Jan 23, 2026 · 1 fileMessage 62 · AdequateLow 34Details
Commit message · sneurlax

fix(epic): fix wallet opening and handling, add open, remove ensureWalletOpen

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 34/100

This commit restructures how the Epic Cash wallet is opened in the Stack Wallet mobile app. It replaces an automatic 'open if needed' helper with a single explicit open() step that must be called first. The change also makes wallet recovery and re-initialization close the old wallet handle before creating a new one, and it starts the Epic Box listener in more places. The commit looks like a bug-fix/refactoring change rather than a clear security patch, but it removes a pattern where wallet operations could silently re-load the wallet on demand, which could have helped avoid inconsistent or duplicate wallet states.

Security candidatefix(epic): shared static workerby sneurlax · b148fd8a · Jan 23, 2026 · 1 fileMessage 57 · ThinInformational 24Details
Commit message · sneurlax

fix(epic): shared static worker

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 24/100

This is a one-line change inside the Epic Cash cryptocurrency plugin that the developer describes as fixing a 'shared static worker.' Without seeing the actual code change, it is impossible to tell whether this is a routine bug fix or a security-sensitive correction. The phrase suggests a static/shared resource may have been handled incorrectly, which can sometimes lead to crashes or race conditions, but no security impact is confirmed by the materials.

Security candidatefix(epic): fix return types and response handling for epic cashby sneurlax · 6c4c31d1 · Jan 23, 2026 · 1 fileMessage 62 · AdequateInformational 24Details
Commit message · sneurlax

fix(epic): fix return types and response handling for epic cash

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 24/100

This is a one-line change to Epic Cash cryptocurrency plugin code, described as fixing return types and response handling. Without seeing the actual code change, we cannot determine whether this is a routine bug fix or something with security consequences. The description does not mention security.

Security candidatefix(epic): apply new flutter_libepiccash patterns to epic cash wallet implby sneurlax · 446ea11a · Jan 23, 2026 · 3 filesMessage 62 · AdequateLow 37Details
Commit message · sneurlax

fix(epic): apply new flutter_libepiccash patterns to epic cash wallet impl

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 37/100

This commit updates how the Epic Cash wallet in Stack Wallet talks to its underlying Rust library (flutter_libepiccash). It moves some configuration data (epicboxConfig) into wallet load/create calls and removes it from individual transaction/address calls, matching a new library API. It also replaces a real address-validation check with a very simple length check, which could let users paste in malformed or wrong addresses. The change looks like a compatibility/refactoring patch rather than a deliberate security fix, but the weaker address check is a small security regression.

Security candidatefix(epic): mirror cs_monero isolate pattern for flutter_epiccash & wallet implby sneurlax · b687b5e8 · Jan 23, 2026 · 2 filesMessage 95 · StrongLow 31Details
Commit message · sneurlax

fix(epic): mirror cs_monero isolate pattern for flutter_epiccash & wallet impl

TODO: test more, merge to flutter_libepiccash#main, update flutter_libepiccash submodule ref here, open PR to merge from here to staging

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 31/100

This commit refactors how the Epic Cash wallet in Stack Wallet talks to its underlying Rust library. Instead of repeatedly reading a wallet handle from secure storage and passing it to a global library interface, it now keeps an in-memory wallet object (an 'EpicWallet') and runs operations on that object, often inside a separate worker isolate. The change also adds explicit wallet-close calls on shutdown. The overall direction improves isolation and cleanup, but the commit is described as a work-in-progress ('TODO: test more'), so it may not be a complete or fully tested security fix.

Security candidatefix(epic): protect epic openWallet with mutexby sneurlax · ca011780 · Jan 21, 2026 · 1 fileMessage 57 · ThinLow 31Details
Commit message · sneurlax

fix(epic): protect epic openWallet with mutex

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Low 31/100

This commit adds a mutex (a simple locking mechanism) around the Epic Cash wallet's openWallet function to prevent multiple operations from running on it at the same time. Without the lock, concurrent calls could potentially corrupt wallet state or cause crashes. The change is very small and the actual code diff was not available, so the exact risk is hard to judge.

AI review queueddisplay sol memo in guiby julian · 860ac3d8 · Jan 20, 2026 · 4 filesMessage 38 · OpaqueInformational 15Details
Commit message · julian

display sol memo in gui

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds a user-interface feature that displays Solana transaction memos in the wallet app. It reads existing on-chain memo data and shows it to the user, but does not change how transactions are created, signed, or validated. There is no security-relevant change visible in the code.

AI review queuedrefactor amount formatter to handle unified eth/sol contractsby julian · 00be7286 · Jan 20, 2026 · 16 filesMessage 50 · ThinLow 26Details
Commit message · julian

refactor amount formatter to handle unified eth/sol contracts

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 26/100

This commit is a code cleanup that merges two separate ways of handling Ethereum and Solana token amounts into one shared path. It does not appear to fix an active security bug, but it removes duplicated logic that could previously have led to inconsistent token display or parsing. The change is mostly internal refactoring across wallet balance and transaction screens.