AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 46 Bitcoin

apply the wallet lock to label import, sweep and show paynym, and to password prompts and unlocks completing after the wallet was locked

Public commit record

What the developer wrote

Authored by Craig Raw

50/100 · Thin
apply the wallet lock to label import, sweep and show paynym, and to password prompts and unlocks completing after the wallet was locked
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
The short version

What changed, and why it matters

This commit fixes a timing issue in the Sparrow Bitcoin wallet where a user could still perform sensitive actions on a wallet that had been locked while a password prompt or background unlock was in progress. The patch makes sure that if a wallet is locked before the password is entered or the unlock finishes, the action is cancelled or blocked. It also disables certain wallet features (label import, sweeping private keys, and showing a PayNym) when the wallet is locked. This is a defensive hardening fix rather than a remote-exploitable vulnerability.

Recommended action

Treat as a security hardening fix and include in the next release. Users who share a machine or leave Sparrow open should continue to lock wallets when unattended. No immediate emergency response is indicated because exploitation requires local access and a specific user-interaction timing window.

Security signals we found

01

TOCTOU (time-of-check/time-of-use) race between wallet lock state and password-prompt/unlock completion

02

Missing authorization check on sensitive wallet operations (sweep private key, label import, show PayNym)

03

UI control state not synchronized with wallet lock state

04

Local-only attack surface; no network or cryptographic primitive change

Risk score

Why this scored 46/100

Our methodology →
Potential impact 12/30
Exploitability 8/25
Stealth signal 7/15
Affected reach 8/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.