qml: QERequestDetails process request update via event loop. This allows backend to process all callbacks before we start querying the payment database
What the developer wrote
Authored by Sander van Grieken
qml: QERequestDetails process request update via event loop.
This allows backend to process all callbacks before we start querying the payment database
should fix #10116
What changed, and why it matters
This commit changes how the Electrum mobile/QML wallet listens for payment request status updates. It switches from a direct callback to one processed through the Qt event loop, so the backend can finish its own bookkeeping before the user interface reads the payment database. The stated goal is to fix a reported bug (#10116), likely a race condition where the UI shows stale or inconsistent payment state. There is no direct evidence in the commit that this is a security vulnerability, but race conditions between payment status and database queries can in principle lead to incorrect UI state or user decisions.
Treat as a bug-fix commit with possible security-adjacent side effects. Review issue #10116 and any linked discussion to determine whether the race condition could be exploited to mislead a user about payment status. If the issue describes user-visible inconsistency only, no immediate security response is needed; if it describes a way to double-spend, spoof payment confirmation, or bypass merchant checks, escalate for security analysis. Consider adding regression tests for the event ordering.
Security signals we found
Race condition in payment request status handling
UI/backend synchronization change
Fixes referenced issue #10116 (contents not supplied)
Evidence from the diff
In electrum/gui/qml/qerequestdetails.py the decorator on on_event_request_status is changed from @event_listener to @qt_event_listener. The imported symbol is updated accordingly. The difference between the two decorators is that qt_event_listener schedules handling on the Qt event loop (via a queued signal or similar mechanism), while event_listener runs synchronously in the event emitter’s thread. The commit message says this lets the backend process all callbacks before the QML frontend queries the payment database, which is intended to fix issue #10116. The diff itself is a two-line change and does not include tests, root-cause analysis, or disclosure text.
Changed components
electrum/gui/qml/qerequestdetails.pyQML GUI payment request details viewInspect captured patch +2 / −2
diff --git a/electrum/gui/qml/qerequestdetails.py b/electrum/gui/qml/qerequestdetails.py
index 288ef16..d79997c 100644
--- a/electrum/gui/qml/qerequestdetails.py
+++ b/electrum/gui/qml/qerequestdetails.py
@@ -16,7 +16,7 @@ from electrum.network import Network
from .qewallet import QEWallet
from .qetypes import QEAmount
-from .util import QtEventListener, event_listener, status_update_timer_interval
+from .util import QtEventListener, qt_event_listener, status_update_timer_interval
class QERequestDetails(QObject, QtEventListener):
@@ -65,7 +65,7 @@ class QERequestDetails(QObject, QtEventListener):
self._timer.stop()
self._timer = None
- @event_listener
+ @qt_event_listener
def on_event_request_status(self, wallet, key, status):
if wallet == self._wallet.wallet and key == self._key:
self._logger.debug('request status %d for key %s' % (status, key))
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.