Stack Wallet

This commit is a large UI refactor of the Stack Wallet 'ShopInBit' payment flow. It extracts duplicated payment-method selection and QR-code dialogs into a shared widget, fixes some navigation bugs after a payment is sent, and tightens the USDT Ethereum-address detection. There is no obvious new security vulnerability in the diff, but the change is substantial and unreviewed, so it could contain subtle bugs.

This commit changes which version of the 'Spark Mobile' cryptographic library Stack Wallet uses. It switches from the official Firo project repository to a fork maintained by Cypher Stack (the same company that makes Stack Wallet) and updates the pinned commit hash. The change itself does not show any vulnerability in the code, but it is a supply-chain-style update: the wallet now depends on a different copy of a library that handles sensitive private-key and transaction operations for the Firo cryptocurrency. Without knowing what changed between the two commit hashes, we cannot say whether this makes users safer or less safe.

This commit fixes a small parsing bug in the Stack Wallet app's ShopInBit feature. The app reads a 'state/province' line from a support ticket message. Previously it only looked for lines starting with 'Delivery state:', but now it also accepts 'State:'. A user-facing loading message was also reworded from 'Updating available countries' to 'Checking available countries'. There is no clear security relevance in the change itself.

This commit finishes adding support for a new cryptocurrency exchange partner called LetsExchange to the Stack Wallet app. It adds the exchange's logo, wires up its name in currency lookup and trade-detail screens, adds its API credentials placeholders to build scripts, removes its response bodies from debug logs, and excludes it from a Trocador aggregator filter. There is no security fix or vulnerability visible in the changes.

This commit fixes how the Stack Wallet calculates the size of a special 'Spark Name' fee script when building cryptocurrency transactions. Previously, the wallet appears to have used a fixed estimate (noProofNameTxData!.size) and did not account for the extra bytes added by embedding the Spark Name data into the output script. The patch now measures the actual increase in script size and adds that delta to the transaction size used for fee estimation. If left unfixed, transactions with Spark Names could have had fees that did not cover the real transaction size, potentially causing the transaction to be rejected, delayed, or underpaid.

This commit only adds a new automated test that checks whether a regular expression correctly accepts or rejects certain Spark Name characters (hyphens/periods vs underscores). It does not change any production wallet code, fix a bug, or alter behavior users would see.

This commit updates the Stack Wallet app to use a newer version of the underlying Spark library and changes how 'Spark Name' registration fees are calculated. The title says it rejects invalid Spark Name characters, but the actual code diff mainly removes a manual size adjustment for the special name-tag output and updates a dependency. The security relevance is not clearly spelled out in the commit itself, and the change appears to be a partial fix or cleanup rather than a complete, self-contained security patch.

This commit fixes how the Stack Wallet calculates transaction fees for a feature called Spark Name registration. Previously, the wallet did not correctly account for the extra data added to the transaction when registering a Spark Name, and it also treated name-registration payments like ordinary 'send all' transactions. The fix ensures the fee is sized properly and that the miner fee is never subtracted from the amount being sent for a name registration. In practical terms, before the fix a user registering a Spark Name might have paid an unexpectedly low fee, causing the transaction to be rejected or delayed by the network, or the wallet might have tried to subtract the fee from the registration amount, potentially sending less than intended.

This tiny commit reverts a database version bump and fixes a typo in a messaging refresh call. It appears to be a quick correction of an accidental change rather than a security fix. There is no clear security relevance visible in the code itself.

This commit only updates automatically generated test mock files to match recent changes in the real code interfaces. It does not change any production code, user-facing behavior, or security-sensitive logic. The modifications adjust mock return types for a notification-index helper and add a mock for a new HTTP post-bytes method used in tests.

This commit is a feature refactor that adds a new in-app notification system for ShopInBit support tickets. It introduces a local database table for notifications, merges those notifications into the existing notification feed, and marks tickets/notifications as read when the user views them. There is no clear security vulnerability in the diff, but the change touches notification plumbing and local database migrations, so it carries normal implementation risk.

This commit adds a new cryptocurrency exchange integration called CypherGoat to the Stack Wallet app. It lets users compare rates and create swaps through the CypherGoat service. The change is a normal feature addition, but it does introduce a new external API dependency and sends user-provided wallet addresses and trade details to api.cyphergoat.com. There is no direct evidence of a security vulnerability in the code itself, but any new third-party integration carries standard risks: the server could be compromised, the connection could be intercepted if certificate pinning is absent, or the API could return malicious data that the app might not fully validate.

This commit only changes the marketing description text for a third-party concierge shopping service called ShopinBit. It rewords what users see on screen but does not alter any code behavior, security logic, or data handling.

This commit adds the ability to attach files to customer-support messages in the ShopInBit feature of Stack Wallet. It introduces file picking, client-side type and size checks, and a multipart upload path to the server. The change is a feature addition, not a documented security fix. There are no obvious remote-code-execution or data-theft bugs visible in the diff, but the new code handles user-chosen files and uploads them over the network, which always carries some privacy and abuse risk.

This commit fixes how timestamps are stored for a built-in shopping/ticket feature. Previously, database columns used Drift's default dateTime type, which truncates fractional seconds. The patch switches those columns to store ISO 8601 UTC strings with millisecond precision and normalizes message timestamps to UTC. This is a data-integrity/correctness fix rather than a security vulnerability; it prevents subtle ordering or duplicate-detection bugs but does not create a direct path for an attacker to steal funds or run code.

This commit refines how the wallet app checks for updates to ShopInBit support tickets. It reduces unnecessary API calls by only fetching full ticket details and messages when something has actually changed, and it tightens the code so that newly created ticket records must always have complete data. There is no obvious security vulnerability here; it is primarily a performance and robustness improvement.

This small change makes the app keep checking for updates on a 'ShopInBit ticket' page even when the desktop app window is not in focus. Previously, the app would pause polling when backgrounded and resume when the user returned. Now on desktop it never pauses. This is a behavior change, not a clear security fix or vulnerability. It could slightly increase background network activity and keep a connection alive longer, but there is no direct evidence it introduces a security flaw.

This commit is a small code-quality cleanup in a cryptocurrency wallet app. It replaces a hardcoded text string ('NEW') and a hardcoded status value with references to a shared enum definition. There is no direct evidence in the commit that this fixes an exploitable security vulnerability; it appears to be a maintainability improvement that reduces the chance of future typos or mismatched status values.

This commit is a purely cosmetic UI change. It swaps the ShopinBit service icon from a generic settings-style icon to a dedicated 'SIB' logo, hard-coding the logo colors to match the previous style. It also removes a settings gear icon from the mobile services page. There is no security-relevant change visible in the diff.

This commit is a routine UI cleanup of a travel-booking form inside the Stack Wallet app. It removes unused date-mode options (flexible dates, trip length, month/year pickers), simplifies the arrangement choices, reorders a text box, and changes one label to mention that users can paste a link. There is no security-relevant change visible in the code.

This commit changes how often the app checks for updates on a support ticket and skips re-downloading the full ticket details when the app already has them. It is a routine performance and responsiveness improvement, not a security fix. There is no indication it addresses a vulnerability.

This commit moves two existing app features—gift cards and concierge services—from a wallet-specific menu to the main home screen on mobile. It is a user-interface navigation change, not a security fix or vulnerability patch. There is no indication it fixes a bug that could be exploited.

This commit adds on-screen warnings telling users to send only USDT (TRC20) to a displayed address and not to send plain TRX. It is a user-interface safety hint, not a code change that fixes a software vulnerability. There is no evidence in the commit of an exploit, bug, or security flaw being patched.

This commit is a purely cosmetic UI change. It adjusts the width and button height of a confirmation dialog on desktop versions of the app. There is no security relevance.

This commit simply changes the user interface for entering a billing/shipping name. Instead of one 'Full name' text box that the app later tried to split into first and last names, it now shows two separate boxes labeled 'First name' and 'Last name'. There is no security fix or vulnerability here; it is a routine UI and data-handling refactor.