CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 38 Monero

v6.0.2 Release candidate (#3080)

CWdb00a021 View source ↗
Public commit record

What the developer wrote

Authored by Omar Hatem

76/100 · Adequate
v6.0.2 Release candidate (#3080)

* v6.0.2 Release candidate

* v6.0.2 Release candidate

* move btc ln up in the currency picker

* disable bsc for swapsxyz

* minor [skip ci]

* hide dex/rate selection on swap screen

* temp fix for evm tokens swaps icons until hive migration is done

* minor [skip ci]

* disable force dex providers for existing users and let them pick it from settings preference

* Show bitcoin address types in swap picker (#3096)

* Show bitcoin address types in swap picker

* remove wrong conversion to bolt11 [skip ci]

* feat: add Lightning invoice resolution and address normalization

* automatically select contact wallet address based on the selected swap currency (whether it's bitcoin or lightning)

* minor [skip ci]

* default to bolt11 invoice for lightning swaps

---------

Co-authored-by: Konstantin Ullrich <konstantinullrich12@gmail.com>

---------

Co-authored-by: Konstantin Ullrich <konstantinullrich12@gmail.com>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This is a routine mobile app release candidate (version 6.0.2) for Cake Wallet/Monero.com. The visible changes are mostly user-facing polish: updated changelogs, moving Bitcoin Lightning higher in currency lists, disabling a swap provider for certain tokens, hiding some swap options, and improving how Lightning addresses/invoices are resolved and displayed. There is no explicit security fix described by the vendor, and nothing in the diff clearly points to a vulnerability being patched.

Recommended action

Treat as a normal release-candidate review. The Lightning invoice service is new network-facing code handling user input; it should be reviewed for URL validation, TLS certificate pinning, and robust handling of malicious LNURL responses. Verify that address normalization cannot be abused to redirect swaps to attacker-controlled invoices. No urgent security action is indicated by the commit itself.

Security signals we found

01

New network service resolves arbitrary user-supplied Lightning addresses (user@domain) via HTTPS LNURL callback

02

Exchange provider now converts Lightning addresses to Bolt11 invoices before passing to backend

03

Lightning wallet address initialization now falls back to cached address on error

04

Settings migration resets user preference for forced DEX providers

05

No vendor-described security fix or CVE reference present

Risk score

Why this scored 38/100

Our methodology →
Potential impact 8/30
Exploitability 7/25
Stealth signal 6/15
Affected reach 9/15
Confidence 5/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Cake Wallet / Monero.com

Related watches

Informational 15 AI analysisMessage 80 · Strong
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

fix: add new images and fix integration tests (#3679)

This commit is a routine product update for the Cake Wallet app. It swaps in new Robinhood-themed icons and card backgrounds, adjusts a color gradient, adds Robinhood to integration-test wallet lists, fixes a QR-code image reference to poi…

ad93901aby David Adegoke+216−3417 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 76 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

Add Robinhood Chain (#3398)

This commit adds support for a new blockchain, "Robinhood Chain" (chain ID 4663), to the Cake Wallet app. It is a large feature patch that wires the new chain into wallet creation, sending, receiving, exchange providers, transaction histor…

New EVM chain integration with custom transaction signing path (RobinhoodClient forces gasPrice instead of EIP-1559)New third-party RPC endpoints added to default node list (PublicNode, NOWNodes, Robinhood, Alchemy)New API secret (ALCHEMY_API_KEY) written into generated secrets file in CI workflows
046e57c5by David Adegoke+1214−159143 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 65 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

chore: migrate to hosted scalable CI (#3620)

This commit is an infrastructure change: Cake Wallet moved its automated build system from GitHub's standard runners to a third-party hosted service ('puzl-ubuntu-latest') and split the build into many smaller parallel jobs. It also adds a…

Third-party CI runner label `puzl-ubuntu-latest` replaces GitHub-managed `ubuntu-24.04`Committed RSA private key and self-signed certificate (`scripts/android/dev-test-key.pem`, `scripts/android/dev-test-key.crt`) used only for debug/CI keystoresCI jobs now log in to GHCR using `secrets.GITHUB_TOKEN` and run Docker with broad socket permissions (`sudo chmod 666 /var/run/docker.sock`)
77e4b946by cyan+1306−23423 files
No security note in commit
Open full analysis →Source commit ↗