Stack Wallet

This commit refactors how the app decides which wallet setup path to use when restoring or verifying a wallet. It replaces exact class-name checks (like 'is this specifically a Monero wallet?') with broader category checks (like 'is this a CryptoNote-style wallet?'). This is mostly a code cleanup, but it could fix a subtle bug where a new or inherited wallet type would accidentally skip the restore-specific initialization and instead run a normal setup, potentially causing setup problems rather than direct theft of funds.

This commit fixes several bugs in Stack Wallet's backup restore flow. The most notable change is that retrying a failed wallet restore now properly re-initializes the wallet (including opening it for Cryptonote-based coins like Monero) before attempting recovery, instead of calling recover() on a wallet that may not be ready. It also moves an Android file-write operation to a background isolate to avoid blocking the user interface, and makes a wallet ID lookup more forgiving when a backed-up wallet no longer exists.

This commit fixes a display bug in the Stack Wallet app where Spark cryptocurrency names owned by the user were not showing as confirmed in the names view. The change simplifies how the wallet decides which Spark names belong to the user by removing a filter that excluded names already known locally. There is no indication this is a security vulnerability.

This commit is a routine code cleanup. It removes a separate Solana-specific token address provider and folds its logic into the general wallet token address provider. There is no visible security fix or behavior change beyond simplifying where token addresses are read from.

This commit is a small code cleanup in the Stack Wallet app. It changes how zero token balances are created so that only one zero-value object is reused instead of making four separate ones. There is no visible security problem or user-facing behavior change.

This commit finishes a previously incomplete Solana token-balance feature. Before the change, the app showed a hard-coded zero balance for Solana tokens and could not refresh a token wallet on its own. After the change, real token balances are read from the Solana blockchain, stored in a local database, and displayed in the wallet. The change also makes the refresh button refresh the token balance instead of only the parent Solana wallet. There is no direct evidence in the commit of a security vulnerability, but it replaces a placeholder with real balance handling, which is a functional fix that could affect user funds if it had bugs.

This commit changes how Stack Wallet displays Solana token balances. It replaces a live blockchain balance lookup with a temporary placeholder that always reports zero balance. The change is described by the developer as a preparatory step toward a database-backed design similar to Ethereum tokens. Because the balance shown to users will be zero until the follow-up work is completed, users could be misled about their token holdings, and send-flow checks that rely on this provider may behave incorrectly. There is no evidence in the commit that this is being exploited or that it was reported as a security issue.

This commit updates the Monero wallet library used by Stack Wallet (cs_monero from version 2.0.0 to 3.1.0) and changes many wallet operations from synchronous to asynchronous. The visible changes are mostly mechanical: adding 'await' and 'Future' return types so the app waits for the underlying C++ Monero code to finish before continuing. There is also a small change to app-exit behavior on Linux and extra debug logging. The commit does not describe any security bug, and the diff itself does not show an obvious vulnerability. However, because it touches sensitive wallet operations (keys, balances, transaction keys, seeds, syncing) and upgrades a major dependency, it could indirectly affect security or stability if the new library version fixed or introduced issues not visible in this repository's diff.

This commit fixes a crash in the desktop Solana token send screen. Previously, the app assumed a wallet value was always present and used a forced '!' operator, which would throw an error if the wallet data was still loading or missing. Now it checks for null and shows a 'Loading token data...' message instead of crashing.

This commit fixes a small UI consistency bug for Solana token wallets. Previously, the token wallet screen always showed itself as 'synced' when first opened, even if the parent Solana wallet was still syncing. Now it checks the parent wallet's actual sync state and shows 'syncing' if appropriate. There is no direct security vulnerability here; it is a correctness and user-experience fix.

This commit finishes a previously empty 'update balance' feature for Solana tokens in a crypto wallet. It now fetches the user's token balance from the Solana network when the wallet refreshes. The change is a normal feature completion and does not appear to introduce a security vulnerability, though it touches code that handles private wallet addresses and RPC communication.

This commit replaces placeholder Solana token fee estimates with real ones fetched from the Solana network. Previously the wallet used a hard-coded 5000 lamport fee and threw an error when asked for fee details. Now it builds a sample token transfer transaction and asks the Solana RPC node how much that transaction would cost. This is a normal feature improvement and does not appear to introduce a security vulnerability.

This commit fixes how Solana token (SPL) amounts are displayed and confirmed in Stack Wallet's transaction confirmation screen. Previously, the app likely treated SPL tokens like Ethereum tokens, which could cause wrong decimal places, wrong token symbols, or even sending/confirming with incorrect values. The change adds separate code paths for Solana tokens so the correct token info is used for formatting, price lookup, and confirming the send.

This commit adds the ability to send Solana SPL tokens from the desktop version of Stack Wallet. It replaces a placeholder 'WIP' screen with a real send form and wires it up to Solana-specific wallet code. The change is a feature implementation, not a security fix. There is no evidence in the commit or supplied references that this addresses a vulnerability, breach, or disclosed security issue.

This commit fixes a race condition in the Solana token transaction list widget. Previously, the widget tried to set up a database query and stream listener during initialization, before the wallet data was guaranteed to be ready. This could lead to crashes or a broken transaction list. The fix delays query setup until the wallet is available, and safely handles cases where the listener hasn't been created yet.

This commit adds the first working code for sending Solana token (SPL) transfers inside Stack Wallet. It replaces a mock placeholder with real transaction building, signing, and broadcasting. The change is normal feature work, but it contains a known-incomplete helper for deriving recipient token addresses: the function falls back to returning the recipient's main wallet address instead of the correct associated token account, and the code itself admits this is a placeholder. If that fallback path is ever used, tokens could be sent to an address that does not actually hold the SPL token, risking loss of funds. The commit also exposes a wallet's signing keypair to a child token wallet, which is expected for this design but increases the attack surface if the token-wallet code is ever compromised.

This commit adds optional privacy hardening features to the Stack Wallet mobile app. Users can now enable a 'Cover in background' screen and, on Android, 'Disable screenshots.' These are defensive controls that make it harder for someone to capture the app's contents from the recent-apps switcher or via screenshots. There is no indication this commit fixes an active security flaw or introduces malicious behavior; it is a feature addition.

This commit replaces placeholder/mock Solana token balances with real on-chain balance lookups and shows the correct token name and symbol in the user interface. It is a normal feature-completion change, not a security fix. There are no clear signs of malicious code, but the new code silently returns a zero balance whenever anything goes wrong, which could mislead users about their actual holdings.

This commit is a routine user-interface polish: it adds the Solana coin icon asset, wires it up so Solana/SPL token screens show the correct icon, and replaces a placeholder TODO mint address with the actual token address. There is no security-relevant change.

This commit adds a Solana-specific token transaction list widget and wires up the SolanaTokenAPI to use the wallet's real RPC client instead of a placeholder. It is a feature/fix for displaying SPL token transactions and checking token ownership. There is no direct evidence in the commit of a security vulnerability being patched.

This commit is a minor user-interface tweak for the desktop version of Stack Wallet. It wraps a wallet name text widget so long names are truncated with an ellipsis instead of overflowing their container. There is no security relevance in the change.

This commit is a minor code cleanup in a Dart HTTP helper class. It adds a constant constructor and reformats some code onto fewer lines. There is no change to behavior, no bug fix, and no security relevance visible in the diff.

This commit fixes a simple but important logic bug in a Dart helper class. The code was checking whether a function was null, but then doing the exact opposite of what it should: when the function existed, it did nothing; when it was missing, it tried to call the missing function and would have crashed. The fix flips the condition so the existing function is called and the alternative code path is used only when arguments are needed. The bug appears to be a plain coding mistake rather than a deliberate security flaw, but in a wallet app any crash or unexpected behavior during sensitive operations is worth treating carefully.

This commit changes how Stack Wallet's Android backup feature picks a save location. Instead of asking the user to choose a single file, it now asks the user to choose a folder. It also switches the auto-backup writer to use a helper that works with Android's Storage Access Framework (SAF), and it disables old-backup cleanup on Android because the SAF library cannot delete files. The change appears to be a bug fix for backups failing or misbehaving on Android due to file-path restrictions, not a fix for an active security vulnerability.

This commit adds a brand-new desktop screen for sending Solana SPL tokens. It is a UI placeholder/replacement for an Ethereum-only transaction list, not a security patch. There is no evidence in the commit message or diff of a vulnerability being fixed.