What changed, and why it matters
This commit adds a standard extension point (a 'hook') to the right-click menu of the UTXO list in Electrum's Qt wallet interface. It lets third-party plugins add their own menu items when a user right-clicks on unspent transaction outputs. The change itself is a neutral feature addition; it does not contain any vulnerability or unsafe behavior.
No action required. Review any plugins that register the 'qt_utxo_menu' hook separately if they are installed or distributed.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff imports run_hook from electrum.plugin and invokes the ‘qt_utxo_menu’ hook inside create_menu(), passing the QMenu, selected coins, and wallet. This is a normal plugin API extension. There is no bug, missing validation, or security-relevant change in the commit itself. Any security implications would depend entirely on what a future plugin registers for this hook, which is outside the scope of this commit.
Changed components
electrum/gui/qt/utxo_list.pyInspect captured patch +2 / −0
diff --git a/electrum/gui/qt/utxo_list.py b/electrum/gui/qt/utxo_list.py
index c2db82f..94f8fe0 100644
--- a/electrum/gui/qt/utxo_list.py
+++ b/electrum/gui/qt/utxo_list.py
@@ -36,6 +36,7 @@ from electrum.bitcoin import is_address
from electrum.transaction import PartialTxInput, PartialTxOutput
from electrum.lnutil import MIN_FUNDING_SAT
from electrum.util import profiler
+from electrum.plugin import run_hook
from .util import ColorScheme, MONOSPACE_FONT
from .my_treeview import MyTreeView, MySortModel
@@ -367,6 +368,7 @@ class UTXOList(MyTreeView):
act = menu_freeze.addAction(_("Unfreeze Addresses"), lambda: self.main_window.set_frozen_state_of_addresses(addrs, False))
act.setToolTip(MSG_FREEZE_ADDRESS)
+ run_hook('qt_utxo_menu', menu, coins, self.wallet)
menu.exec(self.viewport().mapToGlobal(position))
def get_filter_data_from_coordinate(self, row, col):
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.