What the developer wrote
Authored by Craig Raw
improve loaded psbt verification
What changed, and why it matters
This commit changes how Sparrow Wallet checks the silent payment addresses inside a loaded PSBT (a partially signed Bitcoin transaction). Previously, the wallet extracted and trusted the silent payment addresses directly from the PSBT file itself. Now it passes the PSBT to a wallet method that performs verification before returning the addresses. The change suggests the previous code may have accepted unverified or spoofed silent payment addresses from an external PSBT, which could lead to sending funds to an attacker's address, but the diff alone does not show what the new verification actually does or whether any bug was exploitable in practice.
Review the implementation of `wallet.verifySilentPaymentOutputs(psbt)` in the same or a related commit to determine what validation is now performed (e.g., proof of ownership, output script matching, BIP-352 rules). Users who load PSBTs from untrusted sources should upgrade once a release containing this commit is available. If this change fixes a security issue, request that the project publish a security advisory or changelog note explaining the risk.
Security signals we found
Moved silent payment address extraction from controller to wallet-side verification method
Removed direct trust of PSBT-supplied silent payment address and address-script mapping
Commit title explicitly describes the change as improving verification
No explicit security disclosure, CVE, or researcher attribution in commit or supplied references
Evidence from the diff
HeadersController’s PSBT loading logic previously built a pending map by iterating PSBT outputs and reading psbtOutput.getSilentPaymentAddress() and psbtOutput.getScript().getToAddress() without any wallet-side validation. It then compared those addresses against the wallet’s stored silent payment addresses and added missing ones. The patch replaces that inline extraction with wallet.verifySilentPaymentOutputs(psbt), which returns a verified map. The controller now uses that verified result. The diff removes 14 lines and adds 3, but the implementation of verifySilentPaymentOutputs is not shown. The change is consistent with hardening silent payment address handling against a malicious or malformed PSBT, but the exact vulnerability, attack scenario, and verification rules are not present in the supplied materials.
Changed components
Sparrow Wallet desktop applicationHeadersController PSBT loading flowSilent payment address handling in PSBT outputsWallet silent payment address storage/verificationInspect captured patch +3 / −14
diff --git a/src/main/java/com/sparrowwallet/sparrow/transaction/HeadersController.java b/src/main/java/com/sparrowwallet/sparrow/transaction/HeadersController.java
index 7e458a2..28c8b83 100644
--- a/src/main/java/com/sparrowwallet/sparrow/transaction/HeadersController.java
+++ b/src/main/java/com/sparrowwallet/sparrow/transaction/HeadersController.java
@@ -1455,21 +1455,10 @@ public class HeadersController extends TransactionFormController implements Init
return;
}
- Map<Address, SilentPaymentAddress> pending = new LinkedHashMap<>();
- for(PSBTOutput psbtOutput : psbt.getPsbtOutputs()) {
- SilentPaymentAddress spAddress = psbtOutput.getSilentPaymentAddress();
- if(spAddress != null) {
- Script script = psbtOutput.getScript();
- Address address = script == null ? null : script.getToAddress();
- if(address == null) {
- return;
- }
- pending.put(address, spAddress);
- }
- }
+ Map<Address, SilentPaymentAddress> verified = wallet.verifySilentPaymentOutputs(psbt);
boolean changed = false;
- for(Map.Entry<Address, SilentPaymentAddress> entry : pending.entrySet()) {
+ for(Map.Entry<Address, SilentPaymentAddress> entry : verified.entrySet()) {
if(!entry.getValue().equals(wallet.getSilentPaymentAddress(entry.getKey()))) {
wallet.addSilentPaymentAddress(entry.getKey(), entry.getValue());
changed = true;
Why this scored 40/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.