What the developer wrote
Authored by julian
disable redundant call to init()
What changed, and why it matters
A developer commented out a redundant call to wallet.init() in the wallet view screen. The change is described as cleanup because the initialization is already performed earlier when entering a wallet. There is no direct evidence in the commit that this fixes a security vulnerability.
Treat as a routine code-quality change unless further review shows the redundant init() caused observable security side effects. If the project has a bug bounty or security process, consider asking the maintainer whether this change was security-motivated and request a CVE only if concrete impact is confirmed.
Security signals we found
Wallet initialization lifecycle change
SparkInterface view key access immediately after removed init() call
Evidence from the diff
In lib/pages/wallet_view/wallet_view.dart, the line await wallet.init(); was commented out with a note that it is redundant because init() is already invoked when entering a wallet. The surrounding code still reads wallet.viewKeyHex afterward. The diff alone does not show a security bug; it shows a minor lifecycle/initialization cleanup. Without additional context, we cannot determine whether the redundant init() caused any concrete security issue such as key re-derivation, state corruption, or information leakage.
Changed components
lib/pages/wallet_view/wallet_view.dartSparkInterface wallet initializationInspect captured patch +3 / −1
diff --git a/lib/pages/wallet_view/wallet_view.dart b/lib/pages/wallet_view/wallet_view.dart
index 0e2bd23..e7c8ea1 100644
--- a/lib/pages/wallet_view/wallet_view.dart
+++ b/lib/pages/wallet_view/wallet_view.dart
@@ -432,7 +432,9 @@ class _WalletViewState extends ConsumerState<WalletView> {
);
final wallet = ref.read(pWallets).getWallet(walletId) as SparkInterface;
- await wallet.init();
+ // this should not be needed here as its already called when entering a
+ // wallet
+ // await wallet.init();
final sparkViewKeyHex = wallet.viewKeyHex;
if (context.mounted) {
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.