CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 34 Monero

CW-1194-Add-Arbitrum-Wallet (#2587)

CW2da3ba57 View source ↗
Public commit record

What the developer wrote

Authored by David Adegoke

98/100 · Strong
CW-1194-Add-Arbitrum-Wallet (#2587)

* feat: initialize cw_arbitrum package with essential files

- Implement ArbitrumClient for transaction handling
- Add ArbitrumWallet and related classes for wallet management
- Establish transaction history and info classes for Arbitrum transactions
- Add ArbitrumWalletService for wallet operations and management

* feat: Add arbitrum related secrets to workflow

* feat: Add nodes for arbitrum

* feat: Add Arbitrum support to cryptocurrency handling

* refactor: Update Arbitrum currency references from 'ARB' to 'ETH'

* feat: Add Arbitrum support to wallet type and transaction handling

* feat: Add Arbitrum URL schemes to Android and iOS configurations

* feat: Add Arbitrum SVG icons and a WebP image

* feat: Setup Arbitrum proxy

* fix: Add localization

* feat: Integrate Arbitrum support across various configurations and files

- Updated cakewallet.bat to include Arbitrum in app configuration.
- Added Arbitrum node list to pubspec_base.yaml.
- Modified Android, iOS, Linux, and macOS app configuration scripts to support Arbitrum.
- Introduced Arbitrum output path and generation logic in configure.dart.
- Enhanced wallet type and pubspec generation to include Arbitrum.
- Added Arbitrum-related secrets in secret_key.dart.

* feat: Enhance Arbitrum integration with new URI class and updates across various components

- Introduced ArbitrumURI class for handling Arbitrum payment URIs.
- Updated seed validator, wallet creation service, and other components to support Arbitrum.
- Added Arbitrum node handling in default settings migration and node list management.
- Enhanced preferences and settings store to include Arbitrum-specific configurations.
- Updated QR utility and token utilities to accommodate Arbitrum functionalities.

* feat: Add Arbitrum support to various buy providers

- Updated DFXBuyProvider, KryptonimBuyProvider, OnRamperBuyProvider, and RobinhoodBuyProvider to include Arbitrum wallet type and blockchain references.
- Enhanced integration for Arbitrum across multiple components to ensure consistent support.

* feat: Implement Arbitrum support in wallet selection and settings

- Added Arbitrum wallet type handling in common test flows and wallet services.
- Integrated Arbitrum icons in desktop wallet selection and menu widgets.
- Updated privacy settings to include ArbiScan options.
- Enhanced key service to support Arbitrum private and public key retrieval.

* feat: Expand Arbitrum support across various view models and components

- Integrated Arbitrum wallet type handling in advanced privacy settings, transaction details, and wallet management.
- Added Arbitrum-specific methods for transaction and wallet creation, restoration, and fee management.
- Updated dashboard and home settings to accommodate Arbitrum functionalities, including token management and transaction display.
- Enhanced exchange and send view models to support Arbitrum transactions and currency handling.
- Included Arbitrum in wallet address list and privacy settings for improved user experience.

* refactor: Simplify token initialization in Arbitrum wallet service

- Removed the migration flag from the addInitialTokens method in ArbitrumWalletService.
- Updated addInitialTokens method in ArbitrumWallet to handle existing tokens more efficiently.
- Enhanced initial token retrieval logic in DefaultArbitrumErc20Tokens to prioritize iconPath assignment.
- Improved token update logic in BaseWallet for consistency across wallet services.

* chore: Update Dart SDK constraints in pubspec.yaml

* fix: Update file paths for arbitrum assets

* fix: Correct box name formatting in Arbitrum wallet initialization

* Update .github/workflows/pr_test_build_android.yml [skip ci

* Update .github/workflows/pr_test_build_android.yml

* fix: Add missing evm params

* fix: Remove duplicate method declaration

* refactor: simplify isSwapsXyzSendingEVMTokenSwap check

* fix: Update arbitrum configs with sql storage update

* feat: Add estimated fee retrieval for Arbitrum and revamp priority fee handling for EVMChainWallet

* refactor: Update transaction priority handling and estimated fee calculations across EVMChain chains, also remove priority fee levels for Arbitrum

---------

Co-authored-by: Omar Hatem <omarh.ismail1@gmail.com>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This is a large feature commit that adds support for the Arbitrum (ARB) blockchain to the Cake Wallet app. It introduces a new Arbitrum wallet package, transaction handling, default token lists, node lists, UI icons, and integration with buy/sell providers and settings. There is no explicit security fix or vulnerability disclosure in the commit message or diff. The changes mostly mirror how existing EVM chains (Ethereum, Polygon, Base) are already handled. A few code-quality observations exist, such as a hard-coded Etherscan API key dependency and a minor syntax issue in a domain list, but nothing that clearly creates a new exploitable security flaw based on the supplied materials.

Recommended action

Treat this as a routine feature addition. Reviewers should verify that the new ArbitrumClient correctly validates Etherscan API responses, that the default node list uses reputable endpoints, and that the shared EVM fee-estimation refactor does not regress fee behavior for Ethereum/Polygon/Base. No immediate security patch is indicated by the supplied materials.

Security signals we found

01

New EVM chain integration using existing shared EVM code paths

02

Hard-coded dependency on Etherscan v2 API for transaction history (same pattern as other EVM chains)

03

Default Arbitrum RPC nodes added to assets/arbitrum_node_list.yml

04

No explicit security fix, vulnerability disclosure, or CVE reference in commit or supplied materials

Risk score

Why this scored 34/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 10/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Cake Wallet / Monero.com

Related watches

Informational 15 AI analysisMessage 80 · Strong
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

fix: add new images and fix integration tests (#3679)

This commit is a routine product update for the Cake Wallet app. It swaps in new Robinhood-themed icons and card backgrounds, adjusts a color gradient, adds Robinhood to integration-test wallet lists, fixes a QR-code image reference to poi…

ad93901aby David Adegoke+216−3417 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 76 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

Add Robinhood Chain (#3398)

This commit adds support for a new blockchain, "Robinhood Chain" (chain ID 4663), to the Cake Wallet app. It is a large feature patch that wires the new chain into wallet creation, sending, receiving, exchange providers, transaction histor…

New EVM chain integration with custom transaction signing path (RobinhoodClient forces gasPrice instead of EIP-1559)New third-party RPC endpoints added to default node list (PublicNode, NOWNodes, Robinhood, Alchemy)New API secret (ALCHEMY_API_KEY) written into generated secrets file in CI workflows
046e57c5by David Adegoke+1214−159143 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 65 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

chore: migrate to hosted scalable CI (#3620)

This commit is an infrastructure change: Cake Wallet moved its automated build system from GitHub's standard runners to a third-party hosted service ('puzl-ubuntu-latest') and split the build into many smaller parallel jobs. It also adds a…

Third-party CI runner label `puzl-ubuntu-latest` replaces GitHub-managed `ubuntu-24.04`Committed RSA private key and self-signed certificate (`scripts/android/dev-test-key.pem`, `scripts/android/dev-test-key.crt`) used only for debug/CI keystoresCI jobs now log in to GHCR using `secrets.GITHUB_TOKEN` and run Docker with broad socket permissions (`sudo chmod 666 /var/run/docker.sock`)
77e4b946by cyan+1306−23423 files
No security note in commit
Open full analysis →Source commit ↗