AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 37 Bitcoin

omit a paynym contact whose payment code does not parse rather than keeping it with a null code or failing the whole paynym response

Public commit record

What the developer wrote

Authored by Craig Raw

50/100 · Thin
omit a paynym contact whose payment code does not parse rather than keeping it with a null code or failing the whole paynym response
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
The short version

What changed, and why it matters

This commit fixes a bug in Sparrow Wallet's PayNym (BIP47 reusable payment code) contact handling. Previously, if a single contact in your PayNym following/followers list had a malformed payment code, the app either kept a broken contact with a null payment code or could fail the entire PayNym response. Now it simply skips that bad contact and keeps the rest. This is a robustness fix that prevents crashes or broken contact lists, but it is not a direct theft-of-funds vulnerability.

Recommended action

Review the drongo submodule diff (9a8c659b49b6cb3010855b74a37e66e076521490) to confirm the PaymentCode parsing exception behavior and ensure no other callers rely on the old null-payment-code behavior. Consider whether silently omitting contacts could hide attacker-controlled deletions; logging remains present.

Security signals we found

01

Null payment code previously stored in contact object

02

Potential NullPointerException or downstream dereference of null PaymentCode in contact lists/search

03

Whole PayNym response could fail on one malformed contact

04

Defense-in-depth input validation for BIP47 payment codes

05

Unit test added for malformed/corrupted payment codes

Risk score

Why this scored 37/100

Our methodology →
Potential impact 8/30
Exploitability 6/25
Stealth signal 5/15
Affected reach 7/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.