Stop wallet Label from falling back to the derivation scheme (#7521)
What the developer wrote
Authored by Chukwuleta Tobechi
Stop wallet Label from falling back to the derivation scheme (#7521)
What changed, and why it matters
This commit changes what text BTCPay Server's API returns as the 'Label' for an on-chain wallet. Previously, if no custom label was set, the API would leak the wallet's technical derivation scheme (a string describing how keys are generated) as the label. Now it returns an empty string instead. This is primarily an information-disclosure cleanup, not a direct exploit.
Review whether the derivation scheme was exposed anywhere else in API responses, UI, or logs; confirm that authorized callers still receive needed wallet metadata; no urgent patching required beyond normal update cycle.
Security signals we found
Information disclosure: wallet derivation scheme no longer returned as fallback label
Derivation scheme may include extended public keys or derivation paths
Single-line change with no input validation or access-control modifications
Evidence from the diff
In GreenfieldStoreOnChainWalletsController.cs, ShowOnChainWalletOverview previously set Label = derivationScheme.ToPrettyString(), which exposed the wallet derivation scheme when no explicit label existed. The patch changes this to Label = derivationScheme.Label ?? “”. The derivation scheme can contain xpubs and path information that may be sensitive in some contexts; the patch prevents it from being returned as a fallback label. There is no evidence in the commit of authentication bypass, code execution, or active exploitation.
Changed components
BTCPayServer/Plugins/Wallets/Controllers/GreenfieldStoreOnChainWalletsController.csGreenfield API endpoint ShowOnChainWalletOverviewInspect captured patch +1 / −1
### BTCPayServer/Plugins/Wallets/Controllers/GreenfieldStoreOnChainWalletsController.cs
@@ -70,7 +70,7 @@ public async Task<IActionResult> ShowOnChainWalletOverview(string storeId, strin
return Ok(new OnChainWalletOverviewData()
{
- Label = derivationScheme.ToPrettyString(),
+ Label = derivationScheme.Label ?? "",
Balance = balance.Total.GetValue(network),
UnconfirmedBalance = balance.Unconfirmed.GetValue(network),
ConfirmedBalance = balance.Confirmed.GetValue(network),Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.