add warning when entering outdated slip132 values into a watch-only wallet of a different script type
What the developer wrote
Authored by Craig Raw
add warning when entering outdated slip132 values into a watch-only wallet of a different script type
What changed, and why it matters
This commit adds a warning message in Sparrow Wallet when a user pastes an older-style extended public key (SLIP132 format) into a watch-only wallet that uses a different Bitcoin address type. It does not change wallet logic or fix a vulnerability; it only alerts the user to a possible mismatch so they can correct it. The change is defensive UX, not a security patch.
No urgent action needed; treat as routine UX improvement. Users creating watch-only wallets should still verify the chosen script type matches their xpub to avoid address derivation mismatches.
Security signals we found
Adds user-facing warning for xpub/wallet script-type mismatch
No cryptographic or access-control changes
No input validation hardening beyond dialog
Watch-only context limits key exposure
Evidence from the diff
KeystoreController.java now checks, after setting an xpub on a SW_WATCH keystore, whether the parsed extended key header’s default ScriptType differs from both the network default and the wallet’s current ScriptType. If so, it shows a warning dialog naming the entered key type, the wallet’s script type, and suggesting the matching script type. This is purely informational UI code.
Changed components
src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.javaInspect captured patch +9 / −0
diff --git a/src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.java b/src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.java
index 4d712c4..3b547a6 100644
--- a/src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.java
+++ b/src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.java
@@ -3,6 +3,7 @@ package com.sparrowwallet.sparrow.wallet;
import com.google.common.eventbus.Subscribe;
import com.sparrowwallet.drongo.*;
import com.sparrowwallet.drongo.policy.PolicyType;
+import com.sparrowwallet.drongo.protocol.ScriptType;
import com.sparrowwallet.drongo.wallet.*;
import com.sparrowwallet.sparrow.AppServices;
import com.sparrowwallet.sparrow.EventManager;
@@ -194,6 +195,14 @@ public class KeystoreController extends WalletFormController implements Initiali
if(!extendedKey.equals(keystore.getExtendedPublicKey()) && extendedKey.getKey().isPubKeyOnly()) {
keystore.setExtendedPublicKey(extendedKey);
EventManager.get().post(new SettingsChangedEvent(walletForm.getWallet(), SettingsChangedEvent.Type.KEYSTORE_XPUB));
+
+ ExtendedKey.Header header = ExtendedKey.Header.fromExtendedKey(newValue);
+ ExtendedKey.Header defaultHeader = Network.get().getXpubHeader();
+ ScriptType scriptType = walletForm.getWallet().getScriptType();
+ if(keystore.getSource() == KeystoreSource.SW_WATCH && header.getDefaultScriptType() != defaultHeader.getDefaultScriptType() && scriptType != header.getDefaultScriptType()) {
+ AppServices.showWarningDialog("Script type mismatch", "You have entered a " + header.getDisplayName() + " into a " + scriptType.getDescription() + " wallet. " +
+ "Consider changing the script type to " + header.getDefaultScriptType().getDescription() + " to match the default value for a " + header.getDisplayName() + ".");
+ }
}
} else {
xpub.setContextMenu(null);
Why this scored 30/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.