delete solana sync keys when removing the wallet
What the developer wrote
Authored by Omar
delete solana sync keys when removing the wallet
What changed, and why it matters
This commit fixes a cleanup issue in Cake Wallet's Solana support. When a user deleted a Solana wallet, the app left behind leftover 'last synced signature' data stored on the device. This patch now deletes those leftover records when the wallet is removed. It is a privacy/data-hygiene fix rather than a remote hack vulnerability.
Treat as a low-severity privacy fix. Verify no other wallet types leave similar sync metadata behind, and consider a broader audit of local storage cleanup during wallet deletion. No urgent user action is required.
Security signals we found
Incomplete data deletion on wallet removal
Local storage cleanup of per-wallet sync metadata
Privacy/data-retention hygiene issue
Evidence from the diff
In cw_solana/lib/solana_wallet_service.dart the wallet-removal method now instantiates SharedPreferences and removes every key matching ‘solana_last_synced_signature_${wallet}_*’. Previously these per-wallet sync-state keys persisted after WalletInfo.delete(), meaning stale Solana transaction-sync metadata remained on the device after a wallet was removed. The change is local cleanup only; no network, cryptographic, or access-control flaw is visible in the diff.
Changed components
cw_solana/lib/solana_wallet_service.dartSolana wallet removal flowSharedPreferences local storage keysInspect captured patch +6 / −0
diff --git a/cw_solana/lib/solana_wallet_service.dart b/cw_solana/lib/solana_wallet_service.dart
index e374c932..1ed55c41 100644
--- a/cw_solana/lib/solana_wallet_service.dart
+++ b/cw_solana/lib/solana_wallet_service.dart
@@ -13,6 +13,7 @@ import 'package:cw_core/wallet_type.dart';
import 'package:cw_solana/solana_mnemonics.dart';
import 'package:cw_solana/solana_wallet.dart';
import 'package:cw_solana/solana_wallet_creation_credentials.dart';
+import 'package:shared_preferences/shared_preferences.dart';
class SolanaWalletService extends WalletService<
SolanaNewWalletCredentials,
@@ -96,6 +97,11 @@ class SolanaWalletService extends WalletService<
throw Exception('Wallet not found');
}
await WalletInfo.delete(walletInfo);
+ final prefs = await SharedPreferences.getInstance();
+ for (final key in prefs.getKeys().where(
+ (k) => k.startsWith('solana_last_synced_signature_${wallet}_'))) {
+ await prefs.remove(key);
+ }
}
@override
Why this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.