correct an amount or fee entry that parses as zero when only part of it validates
What the developer wrote
Authored by Craig Raw
correct an amount or fee entry that parses as zero when only part of it validates
What changed, and why it matters
This commit fixes a bug in Sparrow Wallet's text input handling for Bitcoin amounts and transaction fees. Previously, if a user typed something like '0abc', the wallet would partially match only the '0' and treat the amount as zero, silently dropping the invalid trailing characters. This could let a user accidentally (or be tricked into) entering an amount that the wallet interprets as zero when they intended something else. The fix now only keeps a zero value if the entire typed text is a valid amount, not just a partial match.
Treat as a low-to-moderate UI correctness fix. Review whether the zero-amount early-return path is necessary at all, and add regression tests for inputs like '0abc', '0.0.0', and locale-specific separators. Consider whether downstream transaction construction treats a zero amount/fee as a no-op or as a valid value, and ensure the UI blocks submission of invalid/partially parsed amounts.
Security signals we found
UI input sanitization bug: partial regex match accepted as valid zero amount
Potential for user-induced zero-value transactions or fees
No explicit security framing in commit message or diff
Evidence from the diff
CoinTextFormatter.java validates user-entered amount/fee text with a regex. Before this patch, matcher.matches() was called inline inside the failure branch, and the zero-short-circuit check (value.doubleValue() == 0.0 && “0”.equals(correct)) did not know whether the original text fully matched the coin validation regex. Consequently, an input such as ‘0
Changed components
src/main/java/com/sparrowwallet/sparrow/control/CoinTextFormatter.javaAmount/fee text fields in Sparrow Wallet UIInspect captured patch +4 / −2
### src/main/java/com/sparrowwallet/sparrow/control/CoinTextFormatter.java
@@ -52,7 +52,8 @@ public Change apply(Change change) {
}
Matcher matcher = coinValidation.matcher(noFractionCommaText);
- if(!matcher.matches()) {
+ boolean validAmount = matcher.matches();
+ if(!validAmount) {
matcher.reset();
if(matcher.find()) {
noFractionCommaText = matcher.group();
@@ -90,7 +91,8 @@ public Change apply(Change change) {
return change;
}
- if(value.doubleValue() == 0.0 && "0".equals(correct)) {
+ //A zero value is left as entered so the fractional part can still be typed out, but only where the entire text is a valid amount
+ if(validAmount && value.doubleValue() == 0.0 && "0".equals(correct)) {
return change;
}
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.