What changed, and why it matters
This commit is a routine code cleanup to support a new Bitcoin standard (BIP375). It simply moves the definition of a default placeholder fingerprint for watch-only wallets from one class (KeystoreController) to another (KeyDerivation), and updates all references. There is no security bug being fixed here.
No security action required. Treat as a normal feature/refactor commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change refactors DEFAULT_WATCH_ONLY_FINGERPRINT from KeystoreController into KeyDerivation, updating all call sites. It also adds a clarifying comment about PSBTv0 as the internal representation. The submodule ‘drongo’ is updated, likely to add BIP375 support. No cryptographic, input validation, or access-control changes are present.
Changed components
AppController.javaQRScanDialog.javaDescriptor.javaKeystoreImportDialog.javaWatchOnlyDialog.javaKeystoreController.javadrongo submoduleInspect captured patch +7 / −11
diff --git a/src/main/java/com/sparrowwallet/sparrow/AppController.java b/src/main/java/com/sparrowwallet/sparrow/AppController.java
index 659685c..eccfb4a 100644
--- a/src/main/java/com/sparrowwallet/sparrow/AppController.java
+++ b/src/main/java/com/sparrowwallet/sparrow/AppController.java
@@ -1911,7 +1911,7 @@ public class AppController implements Initializable {
}
private void addTransactionTab(String name, File file, PSBT psbt) {
- //Convert to PSBTv0 first
+ //Convert to PSBTv0 first as the consistent internal representation
if(psbt.getVersion() != null && psbt.getVersion() >= 2) {
psbt.convertVersion(0);
}
diff --git a/src/main/java/com/sparrowwallet/sparrow/control/QRScanDialog.java b/src/main/java/com/sparrowwallet/sparrow/control/QRScanDialog.java
index ec6a92c..4f4e290 100644
--- a/src/main/java/com/sparrowwallet/sparrow/control/QRScanDialog.java
+++ b/src/main/java/com/sparrowwallet/sparrow/control/QRScanDialog.java
@@ -656,7 +656,7 @@ public class QRScanDialog extends Dialog<QRScanDialog.Result> {
List<ChildNumber> path = cryptoKeypath.getComponents().stream().map(comp -> (IndexPathComponent)comp)
.map(comp -> new ChildNumber(comp.getIndex(), comp.isHardened())).collect(Collectors.toList());
- String fingerprint = cryptoKeypath.getSourceFingerprint() == null ? KeystoreController.DEFAULT_WATCH_ONLY_FINGERPRINT : Utils.bytesToHex(cryptoKeypath.getSourceFingerprint());
+ String fingerprint = cryptoKeypath.getSourceFingerprint() == null ? KeyDerivation.DEFAULT_WATCH_ONLY_FINGERPRINT : Utils.bytesToHex(cryptoKeypath.getSourceFingerprint());
return new KeyDerivation(fingerprint, KeyDerivation.writePath(path));
}
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/Descriptor.java b/src/main/java/com/sparrowwallet/sparrow/io/Descriptor.java
index e836ab2..d3caae6 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/Descriptor.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/Descriptor.java
@@ -140,7 +140,7 @@ public class Descriptor implements WalletImport, WalletExport {
private static Wallet ensureKeyDerivations(Wallet wallet) {
for(Keystore keystore : wallet.getKeystores()) {
if(keystore.getKeyDerivation().getMasterFingerprint() == null || keystore.getKeyDerivation().getDerivationPath() == null) {
- keystore.setKeyDerivation(new KeyDerivation(KeystoreController.DEFAULT_WATCH_ONLY_FINGERPRINT, wallet.getScriptType().getDefaultDerivationPath()));
+ keystore.setKeyDerivation(new KeyDerivation(KeyDerivation.DEFAULT_WATCH_ONLY_FINGERPRINT, wallet.getScriptType().getDefaultDerivationPath()));
}
}
diff --git a/src/main/java/com/sparrowwallet/sparrow/keystoreimport/KeystoreImportDialog.java b/src/main/java/com/sparrowwallet/sparrow/keystoreimport/KeystoreImportDialog.java
index c02c415..14c322f 100644
--- a/src/main/java/com/sparrowwallet/sparrow/keystoreimport/KeystoreImportDialog.java
+++ b/src/main/java/com/sparrowwallet/sparrow/keystoreimport/KeystoreImportDialog.java
@@ -82,7 +82,7 @@ public class KeystoreImportDialog extends Dialog<Keystore> {
keystore.setLabel(existingLabel);
keystore.setSource(KeystoreSource.SW_WATCH);
keystore.setWalletModel(WalletModel.SPARROW);
- keystore.setKeyDerivation(new KeyDerivation(KeystoreController.DEFAULT_WATCH_ONLY_FINGERPRINT, scriptType.getDefaultDerivationPath()));
+ keystore.setKeyDerivation(new KeyDerivation(KeyDerivation.DEFAULT_WATCH_ONLY_FINGERPRINT, scriptType.getDefaultDerivationPath()));
return keystore;
}
diff --git a/src/main/java/com/sparrowwallet/sparrow/terminal/wallet/WatchOnlyDialog.java b/src/main/java/com/sparrowwallet/sparrow/terminal/wallet/WatchOnlyDialog.java
index 655858e..b698027 100644
--- a/src/main/java/com/sparrowwallet/sparrow/terminal/wallet/WatchOnlyDialog.java
+++ b/src/main/java/com/sparrowwallet/sparrow/terminal/wallet/WatchOnlyDialog.java
@@ -20,8 +20,6 @@ import org.slf4j.LoggerFactory;
import java.util.*;
-import static com.sparrowwallet.sparrow.wallet.KeystoreController.DEFAULT_WATCH_ONLY_FINGERPRINT;
-
public class WatchOnlyDialog extends NewWalletDialog {
private static final Logger log = LoggerFactory.getLogger(WatchOnlyDialog.class);
@@ -126,7 +124,7 @@ public class WatchOnlyDialog extends NewWalletDialog {
Keystore keystore = new Keystore();
keystore.setSource(KeystoreSource.SW_WATCH);
keystore.setWalletModel(WalletModel.SPARROW);
- keystore.setKeyDerivation(new KeyDerivation(DEFAULT_WATCH_ONLY_FINGERPRINT, scriptType.getDefaultDerivationPath()));
+ keystore.setKeyDerivation(new KeyDerivation(KeyDerivation.DEFAULT_WATCH_ONLY_FINGERPRINT, scriptType.getDefaultDerivationPath()));
keystore.setExtendedPublicKey(xpub);
wallet.makeLabelsUnique(keystore);
wallet.getKeystores().add(keystore);
diff --git a/src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.java b/src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.java
index fb56d11..4d712c4 100644
--- a/src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.java
+++ b/src/main/java/com/sparrowwallet/sparrow/wallet/KeystoreController.java
@@ -44,8 +44,6 @@ import static com.sparrowwallet.sparrow.io.CardApi.isReaderAvailable;
public class KeystoreController extends WalletFormController implements Initializable {
private static final Logger log = LoggerFactory.getLogger(KeystoreController.class);
- public static final String DEFAULT_WATCH_ONLY_FINGERPRINT = "00000000";
-
private Keystore keystore;
@FXML
@@ -252,7 +250,7 @@ public class KeystoreController extends WalletFormController implements Initiali
if(keystoreSource != KeystoreSource.SW_WATCH) {
launchImportDialog(keystoreSource);
} else {
- fingerprint.setText(DEFAULT_WATCH_ONLY_FINGERPRINT);
+ fingerprint.setText(KeyDerivation.DEFAULT_WATCH_ONLY_FINGERPRINT);
derivation.setText(getWalletForm().getWallet().getScriptType().getDefaultDerivationPath());
selectSourcePane.setVisible(false);
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.