set isChange=false for ProReg recipient
What the developer wrote
Authored by levoncrypto
set isChange=false for ProReg recipient
What changed, and why it matters
This commit changes a single flag in the Firo cryptocurrency wallet code. When creating a special 'ProReg' transaction used for masternode registration, the wallet now marks a small recipient output as 'not change' rather than 'change.' In many wallet designs, change outputs are handled differently from payment outputs—potentially affecting how fees are calculated, how the output is selected in future spending, or how the transaction is displayed to the user. The change is too small and context-free to conclude it fixes a serious vulnerability, but it is a plausible correctness or security-related fix for a coin-specific transaction type.
Review the ProReg transaction construction logic end-to-end to confirm that marking this output as non-change matches Firo's protocol expectations. Check whether any related outputs (e.g., collateral, operator reward) are also misclassified. Add a regression test and a code comment explaining why this output must not be treated as change. If this change was motivated by a bug report or security finding, disclose that context.
Security signals we found
Transaction output misclassification (change vs payment)
Firo-specific masternode/ProReg transaction logic
Single-line behavioral change with no explanatory security context
Potential UTXO accounting or fee-calculation side effects
Evidence from the diff
In lib/wallets/wallet/impl/firo_wallet.dart, the ProReg (pro registration) transaction builder sets isChange: true on an output paying the ownerAddress the dustLimit amount. The patch flips this to isChange: false. ProReg transactions are part of Firo’s masternode / LelantusSpark / deterministic masternode registration flow. Mis-labeling a non-change output as change can cause the wallet to treat a registration collateral/output incorrectly: it may skip it in UTXO selection, apply change-specific fee or privacy logic, or record the wrong address metadata. The patch is a one-line correctness fix, but the diff alone does not reveal whether this is a functional bug, a privacy leak, or a security flaw.
Changed components
lib/wallets/wallet/impl/firo_wallet.dartFiro ProReg transaction constructionFiro masternode registration output handlingInspect captured patch +1 / −1
diff --git a/lib/wallets/wallet/impl/firo_wallet.dart b/lib/wallets/wallet/impl/firo_wallet.dart
index 901f695..af94ad1 100644
--- a/lib/wallets/wallet/impl/firo_wallet.dart
+++ b/lib/wallets/wallet/impl/firo_wallet.dart
@@ -1158,7 +1158,7 @@ class FiroWallet<T extends ElectrumXCurrencyInterface> extends Bip39HDWallet<T>
address: ownerAddress.value,
addressType: AddressType.p2pkh,
amount: cryptoCurrency.dustLimit,
- isChange: true,
+ isChange: false,
),
],
);
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.