hack in USDT TRX warning

Stack Wallet/Stack Wallet

4c173f6c View source ↗

Public commit record

What the developer wrote

Authored by julian

18/100 · Opaque

hack in USDT TRX warning

✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body! Contains work-in-progress language! Opaque security-relevant change

The short version

What changed, and why it matters

This commit adds on-screen warnings telling users to send only USDT (TRC20) to a displayed address and not to send plain TRX. It is a user-interface safety hint, not a code change that fixes a software vulnerability. There is no evidence in the commit of an exploit, bug, or security flaw being patched.

Recommended action

No security action required. Treat as a routine UX improvement. If reviewing broader payment safety, consider validating the selected token network at the transaction construction layer in addition to displaying warnings.

Security signals we found

UI warning added to reduce user error when sending USDT vs TRX

No cryptographic, network, or authorization code changed

No vulnerability, bugfix, or exploit mitigation present in diff

Technical analysis

Evidence from the diff

The patch inserts conditional UI widgets into two ShopInBit payment views. When the selected/payment method is USDT, a warning container is rendered below the QR code/address stating: ‘IMPORTANT: Only send USDT (TRX20) to this address, not TRX’. It imports rounded_container.dart and uses existing theme warning colors. No logic, validation, address generation, or transaction handling code is modified.

Changed components

lib/pages/shopinbit/shopinbit_car_research_payment_view.dartlib/pages/shopinbit/shopinbit_payment_view.dart

Inspect captured patch +41 / −0

diff --git a/lib/pages/shopinbit/shopinbit_car_research_payment_view.dart b/lib/pages/shopinbit/shopinbit_car_research_payment_view.dart
index 55a94c1..a1f4a5c 100644
--- a/lib/pages/shopinbit/shopinbit_car_research_payment_view.dart
+++ b/lib/pages/shopinbit/shopinbit_car_research_payment_view.dart
@@ -22,6 +22,7 @@ import '../../widgets/desktop/secondary_button.dart';
 import '../../widgets/dialogs/s_dialog.dart';
 import '../../widgets/icon_widgets/copy_icon.dart';
 import '../../widgets/qr.dart';
+import '../../widgets/rounded_container.dart';
 import '../../widgets/rounded_white_container.dart';
 import '../../widgets/stack_dialog.dart';
 import '../more_view/services_view.dart';
@@ -613,6 +614,26 @@ class _ShopInBitCarResearchPaymentViewState
               ),
             ),
           ),
+        if (_currentAddress.isNotEmpty && _methods[_selectedMethod] == "USDT")
+          SizedBox(height: isDesktop ? 24 : 16),
+        if (_currentAddress.isNotEmpty && _methods[_selectedMethod] == "USDT")
+          RoundedContainer(
+            color: Theme.of(
+              context,
+            ).extension<StackColors>()!.warningBackground,
+            child: Center(
+              child: Text(
+                "IMPORTANT: Only send USDT (TRX20) to this address, not TRX",
+                style: (isDesktop
+                    ? STextStyles.desktopTextExtraExtraSmall(context)
+                    : STextStyles.itemSubtitle12(context).copyWith(
+                        color: Theme.of(
+                          context,
+                        ).extension<StackColors>()!.warningForeground,
+                      )),
+              ),
+            ),
+          ),
         SizedBox(height: isDesktop ? 16 : 12),
         if (_currentAddress.isNotEmpty)
           GestureDetector(
diff --git a/lib/pages/shopinbit/shopinbit_payment_view.dart b/lib/pages/shopinbit/shopinbit_payment_view.dart
index d298842..18b6b89 100644
--- a/lib/pages/shopinbit/shopinbit_payment_view.dart
+++ b/lib/pages/shopinbit/shopinbit_payment_view.dart
@@ -28,6 +28,7 @@ import '../../widgets/dialogs/s_dialog.dart';
 import '../../widgets/dialogs/simple_mobile_dialog.dart';
 import '../../widgets/icon_widgets/copy_icon.dart';
 import '../../widgets/qr.dart';
+import '../../widgets/rounded_container.dart';
 import '../../widgets/rounded_white_container.dart';
 import '../../widgets/stack_dialog.dart';
 import '../more_view/services_view.dart';
@@ -744,6 +745,25 @@ class _UnownedCoinPaymentDialog extends StatelessWidget {
         Center(
           child: QR(data: address, size: isDesktop ? 200 : 180),
         ),
+        if (ticker == "USDT") SizedBox(height: isDesktop ? 24 : 16),
+        if (ticker == "USDT")
+          RoundedContainer(
+            color: Theme.of(
+              context,
+            ).extension<StackColors>()!.warningBackground,
+            child: Center(
+              child: Text(
+                "IMPORTANT: Only send USDT (TRX20) to this address, not TRX",
+                style: (isDesktop
+                    ? STextStyles.desktopTextExtraExtraSmall(context)
+                    : STextStyles.itemSubtitle12(context).copyWith(
+                        color: Theme.of(
+                          context,
+                        ).extension<StackColors>()!.warningForeground,
+                      )),
+              ),
+            ),
+          ),
         const SizedBox(height: 16),
         GestureDetector(
           onTap: () async {

Risk score

Why this scored 17/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 5/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 17/100

Community notes

Related watches

Merge pull request #1450 from Ez3kiel-dev/fix/xelis-integration

Merge branch 'staging' into fix/xelis-integration

Merge pull request #1361 from cypherstack/fix/305-multiline-transaction-notes