Repository navigation
Conversation
eef8df5 to
a8b36bd
Compare
fix: warnings on malicious inputs chore: bump flutter to 3.41.2 fix: ios builds on linux, android builds on mac chore: bump sdk chore: bump monero_c chore: bump all pubspec.yaml fix: LTC mweb, use passphrase
a8b36bd to
d2d2b12
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 5 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d2d2b12. Configure here.
| else | ||
| curl -L "$release_url" > "$ARG_LOCATION/${asset_basename/${ARG_COIN}_${ARG_TRIPLET}_/}" | ||
| unxz -f "$ARG_LOCATION/${asset_basename/${ARG_COIN}_${ARG_TRIPLET}_/}" | ||
| cp "$release" "$ARG_LOCATION/$asset_basename" |
There was a problem hiding this comment.
Android prebuild library name mismatch
High Severity
The release-bundle path copies Android artifacts as libmonero_wallet2_api_c.so, but the app and the source-build path still use libmonero_libwallet2_api_c.so. iOS is renamed to the expected monero_libwallet2_api_c.* name; Android is not. Using libs_android_download then leaves a native library the FFI will not load.
Reviewed by Cursor Bugbot for commit d2d2b12. Configure here.
| zkool: | ||
| git: | ||
| url: https://github.com/cake-tech/zkool2 | ||
| ref: 36e72b530c274c4a54a6127aadb94886e84d67bf |
There was a problem hiding this comment.
Unused zkool dependency added
Medium Severity
zkool is added as a direct dependency but is never imported or referenced. It still pulls a large tree (rive, flutter_inappwebview, file_picker, riverpod, and others) into the lockfile and the macOS plugin registrant, increasing app size and build surface for no feature in this change.
Reviewed by Cursor Bugbot for commit d2d2b12. Configure here.
| zkool: | ||
| git: | ||
| url: https://github.com/cake-tech/zkool2 | ||
| ref: 36e72b530c274c4a54a6127aadb94886e84d67bf |
There was a problem hiding this comment.
New dependency fetches prebuilt binaries
Medium Severity
Adding zkool pulls rive_common (and related native plugins) that download prebuilt .so/.dylib artifacts at build time instead of compiling them from source. That violates the project's no-prebuilds dependency rule.
Triggered by team rule: No prebuilds
Reviewed by Cursor Bugbot for commit d2d2b12. Configure here.
| final raw = input[0x03]; // SIGHASH_TYPE | ||
| if (raw != null && raw.length == 4) { | ||
| final type = ByteData.sublistView(raw).getUint32(0, Endian.little); | ||
| if (type != 0x01) sighashes.add(type); // anything but SIGHASH_ALL |
There was a problem hiding this comment.
Default sighash treated as unsafe
Medium Severity
_inspect flags every sighash other than 0x01 (SIGHASH_ALL), including 0x00 (SIGHASH_DEFAULT). For Taproot, SIGHASH_DEFAULT commits to all inputs and outputs the same way SIGHASH_ALL does, so the new warning text that the signature may not commit to the shown outputs is wrong.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit d2d2b12. Configure here.
| if [[ ! -d "${BUILD_DIR}/impls" ]]; | ||
| then | ||
| checkout_moneroc "${BUILD_DIR}" | ||
| fi |
There was a problem hiding this comment.
Prebuild cache breaks source builds
Medium Severity
Prebuild now does a shallow checkout_moneroc into .cache/monero_c/${ARG_TAG} with no submodules or patches. The source-build path treats that same directory as a complete cache and skips git clone, submodule init, and apply_patches.sh. A later libs_*_build after a download therefore compiles an incomplete tree.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit d2d2b12. Configure here.
|
will be included in zcash PR |
fix: warnings on malicious inputs
chore: bump flutter to 3.41.2
fix: ios builds on linux, android builds on mac
chore: bump sdk
chore: bump monero_c
chore: bump all pubspec.yaml
fix: LTC mweb, use passphrase
Note
Medium Risk
Changes affect offline transaction confirmation and signing paths (PSBT parsing warnings, LTC MWEB passphrase derivation) alongside large dependency and native-library upgrades that could alter build or signing behavior.
Overview
This PR upgrades the Flutter/SDK and native build stack (FVM 3.41.9, Gradle/AGP,
monero_ccommit + separateMONERO_C_PREBUILD_TAG, richerbuild_moneroc.shwithrelease-bundle.zipand commit checkout) and relaxes Makefile host checks so Android/iOS native libs can be built cross-platform. Monero is wired via a cached path dependency; zkool and a forked bdk-flutter are added with a broad pub refresh.Signing safety: a new
psbtConfirmationWarningshelper inspects PSBTs (v0/v2) and surfaces yellow warnings on the confirm sheet when fees cannot be independently verified (witness-only inputs) or when inputs use non-standard sighash types (e.g.SIGHASH_NONE). Bitcoin and Litecoin PSBT flows pass these warnings intoUnconfirmedTransactionView.Litecoin: MWEB HD derivation now uses the wallet passphrase (matching segwit derivation). Debug: an in-app Coin tests screen runs restore/sign fixtures for BTC, LTC, and XMR.
Reviewed by Cursor Bugbot for commit d2d2b12. Bugbot is set up for automated code reviews on this repo. Configure here.