AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 32 Monero

feat: zashi zkool sweep, and minor fixes (#2838)

Public commit record

What the developer wrote

Authored by cyan

80/100 · Strong
feat: zashi zkool sweep, and minor fixes (#2838)

feat: restore from keys zcash
fix: don't display empty keys
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit adds a feature to Cake Wallet that helps Zcash users recover funds that may be hidden on internal change addresses (a known issue with some wallets like Zashi). It also adds the ability to restore a Zcash wallet from a private key instead of only from a seed phrase, and makes several small UI and error-message improvements. There is no clear security vulnerability in the diff itself; the changes appear to be defensive/recovery functionality.

Recommended action

Review the zkool dependency for supply-chain trust and audit the Rust bridge code, since it handles seeds and private keys. Verify that the temporary sweep database is cleaned up and that the hardcoded password is only used for an ephemeral local cache. Confirm that exposing tsk/uvk/private keys in the UI is intentional and gated by existing authentication. No immediate patch is required for a vulnerability, but treat this as a high-touch crypto/key-management change.

Security signals we found

01

New external Rust dependency (zkool from https://github.com/hhanh00/zkool2) added to Zcash module

02

New wallet sweep logic creates a temporary database with a hardcoded password ('cw_zcash_migration')

03

Private key restore path added for Zcash with regex validation for secret-extended-key-main1 format

04

Additional Zcash sensitive keys (tsk, uvk, private spend/view keys) now displayed in UI

05

Null-safety fixes prevent crashes when seed is absent in Zcash t-address rotation

06

Build workflow adds NDK version symlink workaround (28.2.13676358 -> 25.1.8937393)

Risk score

Why this scored 32/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 4/15
Affected reach 6/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.