What the developer wrote
Authored by Craig Raw
bind cormorant server to localhost only
What changed, and why it matters
This commit fixes a networking issue in Sparrow Wallet's built-in 'cormorant' Electrum server so it now listens only on the local computer (localhost) instead of on all network interfaces. Previously, the server could accept connections from other devices on the same network, which could let an attacker or another user on the network interact with the wallet's internal server without the user's knowledge.
Users running Sparrow Wallet with Cormorant/bitcoind should upgrade to a version containing this commit, especially when using the wallet on untrusted or shared networks. Review firewall rules and verify that no earlier release is exposing the Electrum port externally.
Security signals we found
Network binding narrowed from all interfaces to localhost only
Fixes potential exposure of internal Electrum server to LAN/Wi-Fi peers
Reduces risk of unauthorized RPC/wallet interaction from remote hosts on the same network
No authentication or encryption added; relies on network isolation
Evidence from the diff
The change modifies ElectrumServerRunnable.openServerSocket() to bind the ServerSocket to ElectrumServer.CORE_ELECTRUM_HOST (localhost/127.0.0.1) instead of using the default constructor new ServerSocket(0), which binds to all interfaces (0.0.0.0). This is a network-hardening fix that reduces the attack surface of the internal Electrum-compatible server used by the Cormorant bitcoind integration.
Changed components
src/main/java/com/sparrowwallet/sparrow/net/cormorant/electrum/ElectrumServerRunnable.javaCormorant Electrum server integrationSparrow Wallet local bitcoind connection modeInspect captured patch +3 / −1
diff --git a/src/main/java/com/sparrowwallet/sparrow/net/cormorant/electrum/ElectrumServerRunnable.java b/src/main/java/com/sparrowwallet/sparrow/net/cormorant/electrum/ElectrumServerRunnable.java
index dd041a6..0b63c79 100644
--- a/src/main/java/com/sparrowwallet/sparrow/net/cormorant/electrum/ElectrumServerRunnable.java
+++ b/src/main/java/com/sparrowwallet/sparrow/net/cormorant/electrum/ElectrumServerRunnable.java
@@ -1,10 +1,12 @@
package com.sparrowwallet.sparrow.net.cormorant.electrum;
+import com.sparrowwallet.sparrow.net.ElectrumServer;
import com.sparrowwallet.sparrow.net.cormorant.bitcoind.BitcoindClient;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.IOException;
+import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import java.util.concurrent.ExecutorService;
@@ -69,7 +71,7 @@ public class ElectrumServerRunnable implements Runnable {
private void openServerSocket() {
try {
- serverSocket = new ServerSocket(0);
+ serverSocket = new ServerSocket(0, 50, InetAddress.getByName(ElectrumServer.CORE_ELECTRUM_HOST));
} catch(IOException e) {
throw new RuntimeException("Cannot open electrum server port", e);
}
Why this scored 74/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.