avoid scanning for legacy addresses on bitbox02 with wallet discovery
What the developer wrote
Authored by Craig Raw
avoid scanning for legacy addresses on bitbox02 with wallet discovery
What changed, and why it matters
This commit changes Sparrow Wallet so that when it performs automatic wallet discovery with a BitBox02 hardware wallet, it no longer scans for old-style 'legacy' Bitcoin addresses (P2PKH). The change appears to be a compatibility or reliability fix for the BitBox02 device, not a security vulnerability patch. There is no evidence in the commit of an exploit, attacker, or disclosed security issue.
No immediate security action required. Users of BitBox02 with Sparrow Wallet should verify that wallet discovery still finds expected wallets; if legacy P2PKH funds were previously stored on BitBox02, they may need manual import. Review the drongo submodule update separately for any relevant changes.
Security signals we found
No security-relevant keywords in commit title or message
No CVE, advisory, or vulnerability description present
Change is a device-specific behavior adjustment, not a boundary check, auth, or crypto fix
Submodule update included but not diffed, limiting evidence
Evidence from the diff
The patch modifies DevicePane.java to remove ScriptType.P2PKH from the list of addressable script types when the connected device model is WalletModel.BITBOX_02 during wallet discovery. Previously, discovery iterated over all addressable script types for single-signature policies (which includes P2PKH, P2SH-P2WPKH, and P2WPKH). The change narrows BitBox02 discovery to non-legacy script types only. The ‘drongo’ submodule was also updated but its diff is not shown.
Changed components
src/main/java/com/sparrowwallet/sparrow/control/DevicePane.javadrongo (submodule, contents not shown)Inspect captured patch +6 / −2
diff --git a/src/main/java/com/sparrowwallet/sparrow/control/DevicePane.java b/src/main/java/com/sparrowwallet/sparrow/control/DevicePane.java
index 65a5569..e4137a9 100644
--- a/src/main/java/com/sparrowwallet/sparrow/control/DevicePane.java
+++ b/src/main/java/com/sparrowwallet/sparrow/control/DevicePane.java
@@ -926,7 +926,11 @@ public class DevicePane extends TitledDescriptionPane {
List<StandardAccount> discoveryAccounts = new ArrayList<>(Arrays.asList(StandardAccount.values()).subList(0, optRange.get() + 1));
Map<Hwi.WalletType, String> derivationPaths = new LinkedHashMap<>();
- for(ScriptType scriptType : ScriptType.getAddressableScriptTypes(PolicyType.SINGLE)) {
+ List<ScriptType> scriptTypes = new ArrayList<>(ScriptType.getAddressableScriptTypes(PolicyType.SINGLE));
+ if(device.getModel() == WalletModel.BITBOX_02) {
+ scriptTypes.remove(ScriptType.P2PKH);
+ }
+ for(ScriptType scriptType : scriptTypes) {
for(StandardAccount discoveryAccount : discoveryAccounts) {
derivationPaths.put(new Hwi.WalletType(scriptType, discoveryAccount), KeyDerivation.writePath(scriptType.getDefaultDerivation(discoveryAccount.getAccountNumber())));
}
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.