What the developer wrote
Authored by Sander van Grieken
qt: wizard: xpub can be None, fixes #10109
What changed, and why it matters
This is a small bug-fix in Electrum's Qt wallet setup wizard. The code previously tried to log a preview of an xpub (an extended public key used in Bitcoin wallets) even when the value was missing, which would crash the wizard with a Python error. The patch simply skips the log line when no xpub was retrieved. It does not appear to be a security vulnerability; it is a robustness fix for a user-facing crash.
No security action required. Treat as a normal stability fix. If backporting, include it with other UI hardening fixes, but it does not warrant an advisory or CVE.
Security signals we found
None-safety hardening in UI code
No attacker-controlled input introduced
No privilege or trust-boundary change
Crash-only failure mode (DoS of local wizard step, not network/service)
Evidence from the diff
In electrum/gui/qt/wizard/wallet.py, WCHWXPub’s xpub retrieval worker logged self.xpub[:10]…self.xpub[-5:] unconditionally. If retrieval failed or returned None, slicing None raises TypeError, crashing the wizard component. The patch wraps the debug log in ‘if self.xpub:’, preventing the exception. No cryptographic, trust-boundary, or input-validation changes are present.
Changed components
electrum/gui/qt/wizard/wallet.pyWCHWXPub wizard componentInspect captured patch +2 / −1
diff --git a/electrum/gui/qt/wizard/wallet.py b/electrum/gui/qt/wizard/wallet.py
index 9ca2810..fd12408 100644
--- a/electrum/gui/qt/wizard/wallet.py
+++ b/electrum/gui/qt/wizard/wallet.py
@@ -1425,7 +1425,8 @@ class WCHWXPub(WalletWizardComponent, Logger):
except Exception as e:
self.error = repr(e) # TODO: handle user interaction exceptions (e.g. invalid pin) more gracefully
self.logger.exception(repr(e))
- self.logger.debug(f'Done retrieve xpub: {self.xpub[:10]}...{self.xpub[-5:]}')
+ if self.xpub:
+ self.logger.debug(f'Done retrieve xpub: {self.xpub[:10]}...{self.xpub[-5:]}')
self.busy = False
self.validate()
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.