do not import wallet descriptors on a cormorant started to test a server connection
What the developer wrote
Authored by Craig Raw
do not import wallet descriptors on a cormorant started to test a server connection
What changed, and why it matters
This commit fixes a logic bug in Sparrow Wallet's Cormorant feature. Previously, when Cormorant was started only to test a connection to a Bitcoin server (not to actually manage wallets), it could still try to check or import wallet descriptors. The fix adds a guard so that wallet import checks are skipped when Cormorant is in 'test server connection' mode. This prevents unintended wallet operations and reduces the risk of exposing wallet information or causing errors during a simple connection test.
Review whether other wallet-related Cormorant methods (e.g., importWallet, getWalletInfo, rescan, etc.) also need similar useWallets guards. Verify that connection-test mode cannot trigger descriptor imports, rescans, or private key handling elsewhere. Consider adding unit tests for Cormorant startup modes to ensure wallet operations are gated correctly.
Security signals we found
Missing authorization/state guard: wallet import logic reachable in non-wallet mode
Unintended RPC side effects during connection test mode
Potential wallet descriptor exposure or import against wrong server context
Defensive hardening: early return on invalid operational state
Evidence from the diff
In Cormorant.java, a new early-return guard was added to checkWalletImport(Wallet): if useWallets is false, the method logs a warning and returns false immediately. This prevents wallet descriptor import checks from running when Cormorant was started in a mode intended only to test server connectivity. Without this guard, the code could attempt wallet-related RPC calls or descriptor imports against a bitcoind instance even though no wallet management was intended, potentially causing side effects, errors, or unintended wallet state changes.
Changed components
src/main/java/com/sparrowwallet/sparrow/net/cormorant/Cormorant.javaCormorant Bitcoin Core integration layerWallet import/descriptor synchronization pathInspect captured patch +5 / −0
### src/main/java/com/sparrowwallet/sparrow/net/cormorant/Cormorant.java
@@ -68,6 +68,11 @@ public Server start() throws CormorantBitcoindException {
}
public boolean checkWalletImport(Wallet wallet) {
+ if(!useWallets) {
+ log.warn("Attempting to check if " + wallet.getMasterName() + " is imported, but Cormorant was started to test a server connection");
+ return false;
+ }
+
if(bitcoindClient == null) {
log.warn("Attempting to check if " + wallet.getMasterName() + " is imported, but Cormorant is not started");
return false;Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.