Stack Wallet

This commit adds a fallback so that when a Solana token isn't on the built-in default list, the app looks it up in the user's own saved custom-token database. It also refreshes the token balance when the wallet view opens. There is no clear security bug in the change itself; it is a feature/fix for missing custom-token metadata and stale balances.

This commit adds support for saving user-added custom Solana tokens and showing them alongside the wallet's default token list. It also includes minor code cleanup (removing an unused import and reformatting). There is no clear security vulnerability in the change itself.

This commit adds a new storage field to the wallet's metadata for remembering custom Solana token mint addresses. It is a straightforward feature addition with no visible security implications in the code changed.

This commit changes the Stack Wallet app so that users with a 'view-only' wallet can no longer see buttons to buy or renew Spark names (a Firo cryptocurrency feature). It also makes sure the 'Names' menu appears only for the correct wallet types. The change is a UI restriction, not a server-side security fix, and appears aimed at preventing users from accidentally trying actions their wallet cannot perform.

This commit fixes how the Firo/Spark wallet identifies its own change address. Previously, code compared a transaction output's address against the raw 'sparkChangeAddress' object instead of its string value. The fix exposes the change address as a string getter and updates comparisons to use that string. If left unfixed, the wallet could fail to recognize its own change outputs, which might cause incorrect balance calculations or transaction history display, but it does not appear to let an outsider steal funds directly.

This commit makes several user-interface and wallet-management tweaks for Firo 'view-only' wallets in the Stack Wallet app. It adds a new option to create a Spark-specific view-only wallet, moves the 'Spark view key' display behind an authentication step, and cleans up how Spark addresses are generated and saved. There is no clear security vulnerability in the diff itself; it mostly reorganizes existing functionality and adds a new view-only path.

This commit changes the destination address used when paying fees to register a Spark name in the Stack Wallet app. It switches from a 'development fund' address to a 'community fund' address, and updates the underlying library version. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a routine destination-address update, though a typo in one generated constant name (kStage3DCommunityFundAddressTestNet) is introduced.

A developer commented out a redundant call to wallet.init() in the wallet view screen. The change is described as cleanup because the initialization is already performed earlier when entering a wallet. There is no direct evidence in the commit that this fixes a security vulnerability.

This commit is a minor user-interface tweak. It moves the 'Names' button for Spark wallets out of a hidden 'more' menu and into the main visible navigation bar. There is no security change.

This commit removes an unused 'controller' feature from a Flutter UI widget called Options. The change only deletes dead code and reformats some lines for readability. There is no visible security relevance.

This commit adds a missing Dart import for a view-only wallet data model and updates a dependency lock file for the Spark mobile library. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a routine build/import fix.

This commit is purely cosmetic code cleanup after resolving a merge conflict. It reorders two import statements in each file and reformats some Dart code (line breaks, spacing, trailing commas) without changing any logic, behavior, or security controls. There is no security-relevant change.

This commit fixes a bug in the Stack Wallet app where a special internal 'change' address for the Spark privacy feature could accidentally be shown to the user as a normal receiving address. If a user copied and shared that address, funds meant as change from a transaction could be sent to a publicly visible address, weakening the privacy protections that Spark is designed to provide. The fix re-adds checks that skip over the change diversifier when generating addresses to display.

This commit re-adds a try/catch block around wallet initialization code for the Spark privacy feature. It means if something goes wrong while setting up Spark addresses or keys, the app will log the error but still let the user open the wallet, rather than crashing. Most of the change is automatic code formatting. The security relevance is unclear from the commit alone: it could be a stability fix, or it could mask a deeper problem that previously caused crashes.

This commit adds the ability to create and use Firo 'view-only' wallets using a Spark view key. A view-only wallet lets someone see incoming transactions and balances without being able to spend funds. The change adds UI screens to display and restore the Spark view key, and updates the wallet logic so Firo wallets can scan Spark transactions using the view key instead of the full private key. It also blocks spending, minting, and fee estimation in view-only mode. There is no direct evidence in the commit of a security vulnerability, but the change touches sensitive key-handling code and should be reviewed carefully.

This commit adds a privacy flag to the text boxes where users type their wallet recovery phrase (mnemonic seed words). The flag tells the phone's keyboard not to learn or remember those words for personalized suggestions. Without it, sensitive seed words could be stored in the keyboard's user dictionary or cloud-backed learning models, increasing the risk that someone with access to the keyboard data could recover part of a wallet backup.

This commit fixes a bug where creating a new Mimblewimblecoin (MWC) wallet could leave the recovery-phrase passphrase unset (null) instead of setting it to an empty string. The change adds Mimblewimblecoin to the same special-case handling already used for Epiccash and Solana wallets. A null passphrase could cause a crash or unexpected wallet-creation failure, but there is no direct evidence it enables theft of funds or unauthorized access.

This commit only adds dark-mode splash screen background colors to a Flutter mobile app configuration. It is a cosmetic UI change with no security relevance.

This commit changes the default Epic Cash node used by Stack Wallet from an unencrypted HTTP connection to an encrypted HTTPS connection, and switches the domain from epiccash.stackwallet.com to epic.stackwallet.com. The main security improvement is that wallet traffic to the default node is now protected from eavesdropping and tampering on the network. There is no direct evidence in the commit of an active attack or vulnerability disclosure.

This commit is a routine bulk dependency and splash-screen refresh for a cryptocurrency wallet app. It updates many third-party libraries (including ones handling Ethereum, Stellar, encryption, and Bitcoin address derivation), switches some packages to CypherStack's own forks, and adjusts Android/iOS launch screen assets. The commit itself does not describe any security bug or fix, and the code changes visible in the diff are mostly mechanical API adjustments needed to match newer library versions. There is no direct evidence in the commit that a vulnerability was patched, but updating dependencies in a wallet app can indirectly affect security by pulling in upstream fixes or, conversely, introducing new bugs.

This commit simply removes an unused icon library called flutter_feather_icons from the project's dependency list. There is no indication of a security issue, bug fix, or behavior change. It is a routine cleanup change.

This commit adds local caching of pending Solana and SPL token transactions so the wallet UI can show a 'Sending' state immediately, and later updates those records once the network confirms them. It is a feature/refactoring change, not an obvious security fix. There are no clear signs it was released to patch a vulnerability, and no independent researcher or CVE is mentioned.

This commit adds a feature that immediately records a pending Solana token transfer in the local wallet database before the blockchain confirms it. It is a normal UI/UX improvement so users see outgoing transactions faster. There is no direct security vulnerability in the diff, but the code silently ignores database write failures, which could in rare cases leave the wallet's transaction history inconsistent with what was actually broadcast.

This commit updates the Android build tooling for the Stack Wallet app. It bumps the Gradle build tool, Android Gradle Plugin, NDK, and adds ProGuard keep/dontwarn rules needed for flutter_secure_storage. These are routine maintenance changes to keep the app building with newer Android tools; there is no direct evidence in the commit of a security vulnerability being fixed.

This commit simply bumps the minimum required Flutter and Dart versions and updates a few related package versions (including google_fonts and meta). There are no code changes affecting app logic, security controls, or user data handling. It is a routine dependency/maintenance update.