Stack Wallet

This commit changes how Stack Wallet manages background listeners for Epic Cash wallets. Previously, a single global listener was stopped and restarted during every wallet refresh, which could cause unnecessary reconnections and possibly interfere with other wallets' listeners in multi-wallet setups. The update makes listeners per-wallet, only stops the listener when there are actually new blocks to scan, and checks whether the listener is still alive before restarting it. The main security-relevant concern is that the old behavior may have left wallets briefly without a listener or restarted listeners unnecessarily, potentially causing missed transaction notifications or race conditions; the new behavior is a hardening improvement rather than an active vulnerability fix.

This commit is a performance optimization for the Firo wallet in Stack Wallet. It replaces many individual ElectrumX server lookups with batched requests when restoring or refreshing a wallet, and it removes some redundant confirmation checks. The changes are mostly about speed and efficiency, not about fixing a security vulnerability. There is one small behavior change: the code now assumes any transaction already recorded with a block height is confirmed, instead of double-checking it every refresh. That is a reasonable optimization for Firo but could theoretically miss a rare blockchain reorganization. No exploit or backdoor is visible in the diff.

This commit is described as a one-line Apple-platform build fix for the Epic Cash cryptocurrency plugin. No diff is available, and the title/message do not mention any security issue, vulnerability, or user-facing bug. There is no evidence this change affects security.

The commit title mentions Apple-related fixes and developer quality-of-life changes for a cryptocurrency plugin called flutter_libepiccash, but the actual code diff was not provided. Without seeing what changed, no security judgment can be made.

This commit adds a new third-party exchange integration called WizardSwap to the Stack Wallet app. The changes are almost entirely normal product code: a new API client, exchange logic, UI widgets, and an SVG logo. The supplied diff does not show any obvious security bug, malicious behavior, or unsafe coding pattern. It is a feature commit, not a security patch or vulnerability disclosure.

This commit only updates a reference (likely a Git submodule pointer) to a dependency called flutter_libepiccash. No actual code changes are shown, and there is no description of any security fix or bug fix. On its own, this commit does not demonstrate any security issue.

This commit fixes a small but meaningful bug in the Nanswap cryptocurrency exchange integration. A trade object was being created with the wrong 'direction' field—it was accidentally copying the 'rateType' value instead of the actual trade direction. This could cause trade records to show incorrect buy/sell direction, potentially confusing users or downstream trade tracking. The rest of the change is just code formatting.

This commit updates the Xelis cryptocurrency integration in Stack Wallet. It switches from a development Git dependency to a pinned published package version, adds support for a new 'stage' test network, fixes a block explorer URL path, and makes address validation aware of which network an address belongs to. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a routine dependency and API alignment update.

This commit is described as fixing a build problem with a component called randomx-rust. No actual code changes are visible because the diff was not provided. Based only on the title and message, this appears to be a routine build fix rather than a security issue.

This commit adds a user-facing option to set a restore/scan height and perform a rescan for the Epic Cash (Mimblewimble) wallet in Stack Wallet. The code itself is a feature addition, but it uses a risky workaround: during a rescan it temporarily deletes and recovers the wallet from the seed phrase, and it rewrites existing transaction IDs by appending a counter so they don't collide in the local database. There is no direct evidence in the commit that this is a security fix or that it fixes a known vulnerability; it appears to be a functional improvement with some fragile data-handling code.

This commit fixes two user-interface bugs in the new transaction-details screen. First, notes attached to Mimblewimble/EPIC transactions were being saved under the wrong ID, so the note could be lost or mismatched. Second, trade cards were incorrectly shown for every outgoing transaction, even when no real trade existed, causing confusing or duplicate UI elements. These are correctness/UX fixes, not remote-exploitable security vulnerabilities.

This commit updates a submodule called flutter_libepiccash to a newer version of the Epic Cash cryptocurrency library. The commit title says it uses a 'patched' version of epic-wallet v4, but the actual code changes are not visible in the provided diff. Without seeing the patch contents, we cannot tell whether this fixes a security bug, adds a feature, or changes behavior in a risky way.

This commit is a user-interface code cleanup for the transaction details screen in Stack Wallet. It refactors repeated layout code into smaller reusable widgets, adjusts some text styles and dialog widths, and moves the block-explorer warning dialog into a new widget. There is no change to security-sensitive logic, cryptography, network handling, or data storage.

This commit fixes a fee-calculation bug in the Spark privacy-coin minting code. The wallet was estimating transaction fees using a virtual size that was too small, which could lead to transactions paying too little in network fees. Such underpaid transactions may get stuck, fail to confirm, or be rejected by the network. The patch adds a 10-byte safety buffer to the size estimate and adds a debug log line to make future fee mismatches easier to spot.

This is a routine maintenance commit for the Stack Wallet app. It updates the Xelis cryptocurrency library, bumps several Flutter and Android build dependencies, and adjusts the code to match a newer version of the Xelis FFI API. There is no clear security fix or vulnerability being patched in the visible changes. The commit is described by its author as a miscellaneous compatibility update.

This commit is a large internal cleanup that renames Solana token-related code from 'SPL' naming to 'SOL' naming across the Stack Wallet app. It does not change how tokens are stored, validated, or sent. There is no visible security fix or vulnerability being patched in the diff.

This commit is a code cleanup that changes how the Stack Wallet app loads Solana token information. Previously, the app looked up tokens in a hard-coded default list and then in the local database. Now it relies primarily on the local database. The change removes duplicated lookup logic and moves wallet initialization to happen when a user selects a token rather than when the token view screen opens. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a refactoring to make Solana token handling consistent with how other tokens are handled.

This commit refactors how Solana (SPL) tokens are added and managed in Stack Wallet so they follow the same pattern already used for Ethereum tokens. It removes a large block of debug-only ownership-check code and replaces direct database updates with a new wallet method, `updateSolanaTokens`. It also makes sure the default Solana token list is seeded into the database if it is empty, mirroring existing Ethereum behavior. There is no direct evidence in the commit that this fixes an active security vulnerability, but it removes code that performed RPC calls and ownership checks from the UI layer, which reduces the attack surface and potential for mistakes.

This commit changes how custom Solana token addresses are stored internally from a 'Set' (which automatically removes duplicates and ignores order) to a 'List' (which preserves order and allows duplicates) to match how Ethereum tokens are handled. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a consistency or data-type alignment change.

This commit only renames user-facing labels and code comments from 'SPL' to 'SOL' to reflect that the wallet supports both older SPL and newer Token-2022 Solana tokens. No program logic, calculations, network calls, or security behavior was changed.

This commit trims the built-in list of Solana tokens shown in the wallet. Instead of shipping a hardcoded default token list and merging it with user-added tokens, the app now only shows tokens that are already stored in its local database. This is a code cleanup/refactoring change; it does not fix a known exploit or change cryptographic behavior.

This commit adds support for Solana SPL tokens in the wallet's 'add wallet' list. It is a feature addition that mirrors existing Ethereum token functionality, with no apparent security-relevant changes.

This commit changes how transaction fees are estimated across many cryptocurrency wallets in the Stack Wallet app. The old formula used regular math with decimal numbers, which could lose precision or round incorrectly on very large fee values. The new formula uses exact integer (BigInt) arithmetic. The change is likely a bug-fix or hardening improvement rather than an active vulnerability, but it touches fee logic for many coins so it has broad reach.

This commit only adds a warning log message when a Spark mint transaction's calculated fee is too low. It does not change any logic, checks, or behavior. The same exception was already being thrown before; now the app also records an explanatory message for debugging.

This commit is mostly code formatting, but it includes two small functional changes in the Solana custom-token screen: it now safely parses the 'decimals' value from fetched metadata instead of assuming it is a whole number, and it reads wallet info once with a non-reactive lookup rather than setting up a live watch. These are minor robustness fixes; there is no clear security vulnerability being patched.