Stack Wallet

This commit changes the Tor privacy service in Stack Wallet so only one copy of the service can run at a time (a 'singleton'). Before, each call could create a fresh instance, which could lead to multiple Tor connections or inconsistent state. The patch itself is a defensive code-quality fix; it does not show an active attack or known breach.

This commit is purely a code formatting change (Dart autoformat) on a single file. It only adjusts whitespace, line breaks, and indentation without changing any logic, variable names, function calls, or behavior. There is no security relevance.

This commit adds a new utility module for handling Electrum-style cryptocurrency seed phrases, plus tests. It does not fix any bug or change existing behavior; it is a work-in-progress feature addition. There is nothing in the commit that suggests a security vulnerability or a security patch.

This is a large routine release merge for Stack Wallet v2.4.0. It adds thousands of project files including source code, assets, build scripts, tests, and GitHub workflow files. There is no specific security fix or vulnerability patch visible in the supplied portion of the diff, and no security-relevant description from the vendor.

This commit is a large merge from the 'main' branch into 'staging' for the Stack Wallet project. It adds many files including project configuration, assets, source code, tests, and documentation. There is no indication in the commit message or visible changes that this is a security fix or introduces a security vulnerability. It appears to be a routine synchronization of branches.

This commit changes how an Ethereum token wallet first refreshes its data. It adds a one-time workaround that forces the parent Ethereum wallet to fully sync before the token wallet refreshes for the first time. The developer explicitly labels this as an unverified and untested hack. The change also includes minor code formatting cleanups. There is no direct evidence in the commit that this fixes a security vulnerability; it appears aimed at preventing stale or incorrect balance/transaction state when a token wallet is first used.

This commit changes how the Stack Wallet app on Android reads and writes files. It replaces a workaround that directly reached into shared phone storage with the proper Android Storage Access Framework (SAF), which asks the user to pick a folder or file before the app can use it. That is generally a security improvement because it reduces the app's direct access to files it does not own. However, the change is large, touches backup/restore code, and some backup paths still appear to use direct file access on non-Android platforms, so it should be reviewed carefully rather than treated as purely safe.

This commit rewrites how Stack Wallet creates its encrypted backup (.swb) files. The main functional change is that the encryption helper no longer writes the file itself; instead it returns the encrypted text, and the caller writes it to disk. On Android, the file is now written with a plain file API to a user-chosen location (a TODO comment notes that Storage Access Framework support is still pending). The change also enables Android users to pick a backup folder, which they could not do before. There is no direct evidence in the commit that this fixes a known security vulnerability, but it does change where sensitive backup data is stored and how file-overwrite behavior is handled.

This commit is purely a code-formatting cleanup. It changes whitespace, line breaks, and indentation in a single Dart file that handles the backup creation screen. No functionality, logic, or security behavior was altered.

This commit fixes a bug in the Stack Wallet app when sending the full balance of a Xelis cryptocurrency wallet. Previously, when a user chose 'send all,' the app did not subtract the network transaction fee from the amount being sent, which could cause the transaction to fail or attempt to spend more than the wallet held. The patch now detects 'send all' and reduces the recipient's amount by the estimated fee. It also restricts this code path to exactly one recipient and updates some unrelated dependency versions in pubspec.lock.

This commit changes how Stack Wallet's Cardano wallet checks account balances and transaction history. Previously, the app directly asked a Blockfrost service for a list of funds/transactions for the current receiving address. If the address had never been used on the network, that request could fail or behave inconsistently. Now the app first asks Blockfrost whether the address exists, explicitly handles the common '404 Not found' response, and skips the fund/transaction queries for unseen addresses. This is a robustness/cleanup change rather than a clear security fix, but it removes a class of unhandled API errors that could affect wallet behavior.

This commit fixes a UI bug in the wallet overview screen. Previously, the code was modifying a shared list of wallet data directly (for example, filtering out wallets for other coins). Because that list came from a shared app state provider, the changes could unexpectedly affect other parts of the app. The fix makes a local copy of the list before filtering so the original shared data stays unchanged. This is a correctness/defensive-coding fix, not a direct security vulnerability.

The commit title says it updates MWC (a cryptocurrency plugin) with Windows-related changes. No actual diff content was provided, and there are no verified references. There is no visible evidence this change is security-related.

This commit appears to be a one-line change to a Windows build script for a cryptographic plugin. No diff content is available, and there are no accompanying references describing a security issue. There is no basis to treat this as a security-relevant change.

The commit title says it updates a Windows build script for the Epic Cash cryptocurrency plugin. No actual code diff is available, and there are no verified references. There is no visible evidence of a security issue.

This commit removes an unnecessary Windows DLL file from being bundled with the Epic Cash cryptocurrency plugin. A DLL is a shared library file Windows programs use. Bundling an unneeded DLL is generally a cleanup or build-size issue, not a security vulnerability. There is no direct evidence in the commit that this change fixes an exploitable security flaw.

This commit adds a build script variant that works on Windows Subsystem for Linux (WSL) for a component called frostdart. There is no indication of a security vulnerability or user-facing bug fix; it appears to be a developer tooling/compatibilty improvement.

This commit fixes a Windows build/packaging mistake where the wrong filename for a MimbleWimbleCoin (MWC) library was being installed. The old name 'libmwc_cash_wallet.dll' has been corrected to 'libmwc_wallet.dll'. There is no direct evidence in the commit of a security vulnerability; it appears to be a build fix to ensure the correct native library is bundled with the Windows app.

This commit fixes a Dart/Flutter UI layout bug caused by a merge conflict. A spacing widget (SizedBox) and a text container (RoundedWhiteContainer) were accidentally separated, so the text container was always shown instead of only for certain coin types. The fix wraps both inside the same conditional block so they appear together only when restoring specific wallet types (Chinese 25-word seed, Epiccash, or Mimblewimblecoin). It is a visual/layout correction, not a cryptographic or network security fix.

This commit changes the macOS app build settings to exclude the older Intel x86_64 processor architecture. It only affects how the app is compiled for Apple Silicon Macs and does not appear to be a security fix. There is no evidence of a vulnerability being patched.

This commit simply changes the default server address that Stack Wallet uses for the FACT0RN cryptocurrency, switching from electrumx.fact0rn.io to electrumx1.projectfactor.io. There is no direct evidence in the commit that this is a security fix, but changing a default server can have security implications if the old server is untrusted or unavailable. Without vendor context, the security relevance is uncertain.

This commit is a minor maintenance update for the Monero (XMR) and Wownero (WOW) parts of Stack Wallet. It bumps two internal library versions from 1.1.0 to 1.1.1 and adds an import for a Salvium-related interface. There is no direct evidence in the commit itself that this fixes a security vulnerability. It looks like a routine dependency refresh.

This commit refactors how the Xelis wallet code keeps track of an open wallet. Previously, the wallet library internally cached wallets by their string ID and looked them up by that ID for every operation. Now, the wallet object itself is returned and stored directly, and most operations use that stored object instead of the ID. The change also removes duplicate-wallet checks and makes the interface constructor a constant. There is no direct evidence this fixes a known exploit, but it removes a class of bugs where the wrong wallet could be targeted if the ID-to-wallet mapping got out of sync.

This commit is a routine internal refactor of how the app tracks its Mimblewimble (MWEB) background server. It replaces a map indexed by cryptocurrency network with a map that stores both the server handle and the client handle together, and makes the server interface constructor a compile-time constant. There is no user-facing change and no security fix or vulnerability introduced in the diff.

This commit adds a safety check in two cryptocurrency wallet files. Before refreshing the list of spendable coins (UTXOs), the code now verifies the wallet object actually exists. If it doesn't, it logs a warning and returns early instead of crashing. The title 'downgrade errors to warnings' suggests this is a defensive change to prevent null-pointer crashes during wallet operations.