compare silent payment scan addresses when considering wallet address changes
What changed, and why it matters
This commit fixes a logic gap in Sparrow Wallet's settings form. When a user changes wallet settings, the app checks whether the wallet's receiving addresses would change, so it can warn or take appropriate action. The check already compared regular extended public keys, but it forgot to compare 'silent payment scan addresses'—a newer Bitcoin privacy feature. Without this comparison, changing the silent-payment scan key might not be detected as an address change, potentially causing the wallet to show stale or incorrect addresses without warning.
Review whether any other silent-payment-related fields (e.g., spend key, label) are also omitted from change detection. Verify that the settings dialog now correctly prompts for wallet refresh or rescan when the silent-payment scan address changes. Consider adding regression tests for silent-payment key rotation in the settings form.
Security signals we found
Missing comparison of cryptographic key material in wallet-change detection
Silent payment scan key change not treated as address-changing event
Potential UI/state inconsistency when silent payment settings are modified
Evidence from the diff
In SettingsWalletForm.java, the isAddressChange() method now also compares WalletKeystore.getSilentPaymentScanAddress() between the original and changed wallet. Previously it only compared extended public keys. Silent Payments (BIP 352) use a separate scan key to detect outputs; if this key changed, the method would incorrectly report no address change, which could affect address derivation tracking, wallet refresh behavior, or UI warnings in the settings dialog.
Changed components
src/main/java/com/sparrowwallet/sparrow/wallet/SettingsWalletForm.javaWallet settings change-detection logicSilent Payments (BIP 352) scan address handlingInspect captured patch +4 / −0
### src/main/java/com/sparrowwallet/sparrow/wallet/SettingsWalletForm.java
@@ -197,6 +197,10 @@ private boolean isAddressChange(Wallet original, Wallet changed) {
if(!Objects.equals(originalKeystore.getExtendedPublicKey(), changedKeystore.getExtendedPublicKey())) {
return true;
}
+
+ if(!Objects.equals(originalKeystore.getSilentPaymentScanAddress(), changedKeystore.getSilentPaymentScanAddress())) {
+ return true;
+ }
}
return false;Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.