verify the version check signature before assigning the current version
What the developer wrote
Authored by Craig Raw
verify the version check signature before assigning the current version
What changed, and why it matters
This commit fixes a logic bug in Sparrow Wallet's update checker. Previously, the app would accept and remember a new software version number from an online file before checking whether that file was properly signed. If an attacker could tamper with the version-check file, they could make the wallet believe a fake newer version existed, even though the signature check would later fail. The patch moves the signature verification earlier and adds null-safety checks, so only properly signed version information is trusted.
Review the drongo submodule diff for related security fixes, confirm signature verification uses a pinned, well-distributed public key, and ensure the version-check endpoint is fetched over authenticated TLS with certificate pinning if possible. Users should upgrade to a release containing this commit.
Security signals we found
TOCTOU-style trust ordering: version data accepted before cryptographic verification
Missing null checks on attacker-influenced network input (versionCheck fields)
Signature verification bypass could lead to false update notifications / downgrade or malware-distribution prompts
Submodule update (drongo) may include related cryptographic parsing changes
Evidence from the diff
VersionCheckService.createTask() originally assigned version = versionCheck.version before calling isNewer() and verifySignature(). The patch reorders the flow so verifySignature(versionCheck) runs first; only on success is version assigned and isNewer() evaluated. Additionally, verifySignature() now returns false immediately if versionCheck, versionCheck.version, or versionCheck.signatures is null, preventing NPEs. The drongo submodule bump likely contains related signature/serialization changes, but the exact diff is not supplied.
Changed components
src/main/java/com/sparrowwallet/sparrow/net/VersionCheckService.javadrongo submoduleInspect captured patch +11 / −4
### drongo
@@ -1 +1 @@
-Subproject commit 184fd4d755fab0dd542a0ab2b0de22eff48c1bbb
+Subproject commit fcda9f5fc485473bfe30c59bb835f6a70f5bbc81
### src/main/java/com/sparrowwallet/sparrow/net/VersionCheckService.java
@@ -30,9 +30,11 @@ protected Task<VersionUpdatedEvent> createTask() {
protected VersionUpdatedEvent call() {
try {
VersionCheck versionCheck = getVersionCheck();
- version = versionCheck.version;
- if(isNewer(versionCheck) && verifySignature(versionCheck)) {
- return new VersionUpdatedEvent(versionCheck.version);
+ if(verifySignature(versionCheck)) {
+ version = versionCheck.version;
+ if(isNewer(versionCheck)) {
+ return new VersionUpdatedEvent(versionCheck.version);
+ }
}
} catch(IOException e) {
log.error("Error retrieving version check file", e);
@@ -57,6 +59,11 @@ private VersionCheck getVersionCheck() throws IOException {
}
private boolean verifySignature(VersionCheck versionCheck) {
+ if(versionCheck == null || versionCheck.version == null || versionCheck.signatures == null) {
+ log.warn("Invalid version check file");
+ return false;
+ }
+
try {
for(String addressString : versionCheck.signatures.keySet()) {
if(!addressString.equals("1LiJx1HQ49L2LzhBwbgwXdHiGodvPg5YaV")) {Why this scored 65/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.