prevent tweakless address nodes in sp wallets
What the developer wrote
Authored by Craig Raw
prevent tweakless address nodes in sp wallets
What changed, and why it matters
This commit changes how Sparrow Wallet creates address nodes when scanning silent payments. Previously, the wallet would fill a range of address indexes up to a target and then mark the matching one as a 'silent payment tweak' address. The new code adds a dedicated method that creates only the single silent-payment child node with its tweak value already set. The change appears intended to prevent silent-payment addresses from being created without their associated tweak data, which could otherwise lead to incorrect or missing balance tracking in single-sig (sp) wallets.
Review the new addSilentPaymentChild implementation in the 'drongo' dependency to confirm it atomically creates the node with the tweak and prevents duplicate or tweakless entries. Test silent payment scanning on single-sig wallets to ensure no funds are missed and that existing non-silent-payment address chains remain unaffected. Consider whether the old fillToIndex path could have left tweakless nodes in persisted wallet state and whether migration or rescan is needed.
Security signals we found
Silent payment tweak data is now bound at node creation rather than applied afterwards
Batch address derivation replaced with targeted single-node creation for silent payment matches
Removal logic narrowed from all created nodes to only the newly added silent-payment child
Commit title explicitly frames the change as preventing 'tweakless address nodes' in silent payment wallets
Evidence from the diff
The patch replaces a call to purposeNode.fillToIndex(wallet, newIndex) followed by addressNode.setSilentPaymentTweak(match.tweak()) with a new purposeNode.addSilentPaymentChild(wallet, newIndex, match.tweak()) call. The old approach created a batch of child nodes up to the target index and then retroactively tagged the matched node with the silent-payment tweak. The new approach creates only the specific child and embeds the tweak at creation time. If the address derived from that node already exists in the wallet’s known address map, the node is removed and the match is discarded. The commit title ‘prevent tweakless address nodes in sp wallets’ indicates the goal is to avoid silent-payment address nodes that lack the required tweak, which in single-sig silent payment wallets could cause the wallet to miss or misattribute funds.
Changed components
src/main/java/com/sparrowwallet/sparrow/net/ElectrumServer.javaSilent payment scanning/address derivationSingle-sig (sp) wallet address node managementInspect captured patch +6 / −5
diff --git a/src/main/java/com/sparrowwallet/sparrow/net/ElectrumServer.java b/src/main/java/com/sparrowwallet/sparrow/net/ElectrumServer.java
index bbf698e..a379fbc 100644
--- a/src/main/java/com/sparrowwallet/sparrow/net/ElectrumServer.java
+++ b/src/main/java/com/sparrowwallet/sparrow/net/ElectrumServer.java
@@ -1566,12 +1566,13 @@ public class ElectrumServer {
private WalletNode createNodeForMatch(Wallet wallet, SilentPaymentScanMatch match, Map<Address, WalletNode> walletAddresses, KeyPurpose purpose, int newIndex) {
WalletNode purposeNode = wallet.getNode(purpose);
- Set<WalletNode> created = purposeNode.fillToIndex(wallet, newIndex);
- WalletNode addressNode = created.stream().filter(n -> n.getIndex() == newIndex).findFirst().orElseThrow(() -> new IllegalStateException("fillToIndex did not create node at index " + newIndex));
- addressNode.setSilentPaymentTweak(match.tweak());
+ WalletNode addressNode = purposeNode.addSilentPaymentChild(wallet, newIndex, match.tweak());
+ if(addressNode == null) {
+ throw new IllegalStateException("Silent payment child already exists at index " + newIndex);
+ }
if(walletAddresses.containsKey(wallet.getAddress(addressNode))) {
- purposeNode.getChildren().removeAll(created);
+ purposeNode.getChildren().remove(addressNode);
return null;
}
Why this scored 54/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.