The 1.0.5 build 15 macOS test crashed with SIGSEGV in
WOWNERO_TransactionInfo_amount on the main thread, near the end of a
restore sync. TransactionHistory_refresh runs on a background isolate
under txHistoryMutex and frees the TransactionInfo objects it replaces;
getAllSubaddresses() and getTransaction() read those objects without
the mutex, so a read that overlaps a refresh dereferences freed memory.
The wallet cache had not been stored, so the next launch synced again.
Upstream fixed the same race for Monero in #3188 and in the v6.4.5
coin-control change; this ports both to cw_wownero. getAllSubaddresses()
and getTransaction() take the mutex and become async, which carries
through the subaddress list, its app proxy and the configure interface.
The subaddress list now fetches before clearing, so the observable list
is never empty while the fetch is pending, and addSubaddress and
setLabelSubaddress await the update before callers read the new address.
The coin-control change check compared a Transaction with 1 and was
always false; it now uses the transaction's direction, as Monero does.
The first notarized submission came back Invalid: xcodebuild build injects
com.apple.security.get-task-allow into the signature, which archive would
have stripped and which notarization and App Store review both reject.
build_signed.sh now passes CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO and
refuses an app still signed with it, before any upload.
notarytool exits 0 on Invalid, and the step learned the result only when
stapling failed with an unrelated-looking CloudKit error. It now reads the
status, and on anything but Accepted prints Apple's log and names the
submission.
torch_dart's prebuilt tarball stores the framework's Versions/Current,
top-level binary and Resources as copies of Versions/A, and codesign
refuses the result as an ambiguous bundle, failing the app's signature.
relink_framework.sh puts the three symlinks back, after checking that
every copy it replaces matches Versions/A byte for byte.
Gitea passes a dispatch boolean as a real false, so
`inputs.app_store_upload || 'true'` read it as true and a rebuild would
have re-uploaded a build number App Store Connect already holds. format()
keeps it as the string 'false'; a tag push still uploads.
The macOS lane has never gone green. It built with the project's Release
signing, which was still Cake's (automatic Apple Development, team
32J6BB6VUS), and failed at "No profiles for 'com.suchsoftware...'". Past
that it would have re-signed the finished app by hand, shipping
keychain-access-groups as a literal "$(AppIdentifierPrefix)" with no
profile to authorise it, and read notary secrets that do not exist.
Now, on the shape Vegan IQ proved for its store build:
- Runner's Release config signs manually under D8PL9F7X33 and takes its
profile name from HASH_BAGS_MACOS_PROFILE, so only the app carries one.
- scripts/macos/build_signed.sh decodes a profile, picks the keychain
identity it was issued for (check_macos_profile.py, from vegan-IQ),
and signs inside xcodebuild; it refuses an app whose entitlements keep
an unexpanded variable or that embeds no profile.
- developer-id lane: hardened runtime, notarize, staple, spctl assess,
zip to the release. app-store lane: productbuild with the installer
identity, pkgutil check, altool upload to App Store Connect.
- The first step refuses a selected lane missing any of its secrets and
names each one. The API key lives under the job's temp dir, not the
runner home.
Not run: no Developer ID or Mac App Store signing material is in the
repository's secrets yet, so the guard is the only part exercised.
v6.5.0 loads settings icons from assets/new-ui/*.svg.vec, which are
gitignored output of compile_graphics.sh. Every build workflow already
runs it; test.yml did not, so settings_page_test could not find
network_icons/wownero.svg.vec on a fresh checkout.
Catches up from the May 12 fork point (v6.1.2+23) through v6.5.0: 535
upstream commits, including the Monero silent-open fix, Monero on Trezor,
Ledger/Trezor BLE fixes, the new seed and history screens, quick Bitcoin
sync, git-pinned dependencies (pubspec_overrides.yaml), frozen Hive
adapters (*.part.dart), monero_c v0.18.4.6-RC2 and Flutter 3.41.9.
Merged with both sides normalized first (import rename, 100-column
format), which took the conflict count from 614 paths to 322. The
procedure is now scripts/upstream_sync.sh.
Kept from Hash Bags:
- WalletType enum order and Hive IDs. SQLite stores WalletType.index and
our order differs from upstream's; taking theirs would reread saved
wallets as other chains. Our frozen adapter keeps the shipped IDs.
- The 1.0.2 legacy PIN and wallet-password decode and self-heal.
- Removed chains (Solana, Tron, Zano, Zcash, Decred, Haven) and the new
Robinhood chain stay out; Cake Pay and non-Trocador swaps stay out.
- Default nodes (node.wownero.org, sethforprivacy, Blockstream, bysh.me),
converted to upstream's isDefault node-list key; Wownero is back in the
node reset list.
- Privacy: address resolvers limited to domain-anchored sources again;
prices.neroswap.com for fiat; upstream's charts tab, which reads
prices.cakewallet.com, sits behind FeatureFlag.isChartsEnabled = false.
- Lightning stays behind FeatureFlag.isLightningEnabled, including
upstream's new post-seed Lightning username step.
- Our icon pipeline, branding and bundle identifiers.
Twelve new upstream widget tests are skipped: test and code are unchanged
from v6.5.0 apart from renames (not rerun on a pristine upstream checkout;
upstream's top_bar_test does not compile against its own TopBar).
flutter analyze lib: 0 errors; flutter test: 345 passed, 12 skipped;
flutter build bundle compiles. Built with Flutter 3.41.9.
TradeIsCreating was only set deep inside createTrade's provider loop,
after several awaits, so the swap button stayed tappable while the
first call was still running and every extra tap started another
trade. createTrade also had no in-progress check of its own.
Now createTrade returns early if a trade is already being created,
sets TradeIsCreating synchronously before the first await, and resets
the state in a finally block so the button is usable again after
success, failure or an unexpected exception. The
ConcurrentModificationError retry now awaits the inner call instead of
re-entering createTrade, so it is not blocked by the new guard.
Claude-Session: https://claude.ai/code/session_016HdqYnWEiqnBvmvqCBQgjE
Co-authored-by: Claude <noreply@anthropic.com>
The "View in Block Explorer" link on the Unspent coins details screen
pointed Litecoin UTXOs at litecoin.earlyordies.com, which no longer
shows transaction info. Use the same Blockchair URL the transaction
details screen uses for Litecoin.
Claude-Session: https://claude.ai/code/session_01G9ovgVGLzHmQ1a1rE1tDgK
Co-authored-by: Claude <noreply@anthropic.com>
* Fix compile_graphics.sh flattening subfolder SVGs into parent dirs
vector_graphics_compiler's --input-dir lists recursively and writes each
file to out-dir/<basename>.vec, so the run for res/pictures also compiled
every subfolder SVG into assets/new-ui and same-named files (payjoin.svg,
info.svg, lightning.svg) overwrote the root ones nondeterministically.
Compile only each directory's own SVGs via a temp copy.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01StzwoeTrDpPZxw5ERPaynT
* Remove explanatory comment per review
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YB4vJJnUcdupSKFD9nYpK7
---------
Co-authored-by: Claude <noreply@anthropic.com>
* bump: monero_c to v0.18.5.3
* revert deprecated seeds table
* update monero_c
* update monero_c
* update monero_c
* v6.5.0 Release candidate
Things to test:
- Robinhood (new evm wallet)
- Monero update (test monero in general)
- Restore from backup that is created in previous versions
- Charts
- Bitcoin accounts (please also test that ltc, bch, doge are working fine without issues)
- quick bitcoin sync (also verify other wallets above are working fine)
* v6.5.0 Release candidate
Things to test:
- Robinhood (new evm wallet)
- Monero update (test monero in general)
- Restore from backup that is created in previous versions
- Charts
- Bitcoin accounts (please also test that ltc, bch, doge are working fine without issues)
- quick bitcoin sync (also verify other wallets above are working fine)
* bump: monero
fix: ci
* fix monero.com build
* disable exolix [skip ci]
---------
Co-authored-by: Czarek Nakamoto <cyjan@mrcyjanek.net>
Tapping Show QR on the wallet keys/seed page wrapped the navigation in
BrightnessUtil.changeBrightnessForFunction, which set the display to
full brightness and only reset it if the route returned normally,
leaving brightness stuck at max in some dismiss paths. Show the seed QR
at the user's normal brightness instead.
Claude-Session: https://claude.ai/code/session_01ADigRvS6eGMkm1YGRJusys
Co-authored-by: Claude <noreply@anthropic.com>
* Charts: detect missing older cached prices in _firstUnavailablePrice
Only the newest cached point was checked, so after loading a short range
(e.g. 30D or 1H) a longer range (1Y/ALL or 1D) skipped the API fetch and
showed only the shorter range's data. Now walk the cached points aligned
to the requested precision from the range start and return the first
missing slot (before the oldest point, in a gap, or after the newest),
tolerating a single missing slot. The existing newest-point check is kept.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHSNx4epaJ8hpwuFvWjTmy
* Charts: drop comment and logging, use explicit type in _firstUnavailablePrice
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHSNx4epaJ8hpwuFvWjTmy
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix android CI
* feat: Add Robinhood Chain, all major flows done. minor issue now is our providers don't support it yet as its still pretty early, two weeks from launch
* feat: Add Robinhood Chain, all major flows done. minor issue now is our providers don't support it yet as its still pretty early, two weeks from launch
* Cleanup
* auto-reformat
* fix ui issue and contact listing for tokens
* fix: missing icons and crash for fee priority in settings
* chore: cleanup
* fixes from feedbacks
* fix: review issues and sync to latest dev
feat: switch history api to etherscan, add history toggle to privacy settings, exclude robETH from exchange pickers, skip tokens discovery for chains that moralis hasn't indexed, add tests
* fix: address Robinhood review comments
* fix: show Solana token icons in history
* fix: address review comments and default Robinhood to PublicNode
* fix: revert filter and refuse unmapped networks in provider
---------
Co-authored-by: Robert Malikowski <malikowskirobert@gmail.com>
Flutter writes app-release.{apk,aab} for every build, so each release's
artifact unzips to the same filename. A stale 1.0.3 app-release.aab in
Downloads was uploaded to the 1.0.4 Play release and refused for reusing
versionCode 13. Copy the outputs to hash-bags-<version>-build<N>.* from
pubspec_description.yaml and upload those, refusing if the version line
does not parse.
The first macOS run died after 88 seconds on `cd scripts/monero_c: No such file
or directory`. That was the cheap failure. The workflow had been written fresh
rather than ported, and behind that missing clone it had also skipped the step
that pins the crypto salts. Had it got further it would have shipped a build
that mints random salts, which is the 2026-08-29 corrupted-seeds incident on a
new platform: wallets created on it would not decrypt after the next upgrade.
So the prerequisites are now ported step for step from build-linux.yml, the
desktop build known to pass: torch_dart, reown_flutter, bitbox (the Apple
variant, without the gomobile Android bindings), prepare_moneroc.sh, configure,
secrets generation, salt pinning with the same refusal, Trocador injection,
codegen, localization, and compile_graphics.sh. curl for wget and BSD sed's
-i.bak form, because the runner is a Mac.
Two more things the fresh version got wrong, found while porting:
configure was run without sourcing app_env.sh, and app_config.sh writes
CFBundleName, the bundle id and the version into Info.plist from variables only
app_env.sh sets. The app would have shipped with an empty name. The step now
prints the three values it wrote.
And app_env.sh hardcoded 1.0.0 (1) on macOS, 6.1.0 (79) on Linux and 1.9.0 (29)
in the fish variant, the last two being Cake Wallet's own version numbers. On
macOS PlistBuddy writes that into the bundle, so every macOS build would have
called itself 1.0.0. Linux only escaped because its substitution looks for a
version: 0.0.0 placeholder that pubspec_description.yaml does not contain. All
three now derive from pubspec_description.yaml the way Android already does, and
the two sh variants resolve to 1.0.4 (14). The fish one is unverified: fish is
not installed here and CI does not use it.
Separately, four workflows verified their secret injection by grepping
lib/.secrets.g.dart into the log, which prints the values. Android's printed the
Trocador, WalletConnect, MoonPay and exchange-helper keys. Gitea likely masks
registered secrets, but masking is a best-effort layer and values never belong
in output. Each now reports every key's name and length and nothing else.
Windows is not in this commit. Its run refused correctly, on the guard added in
c11c79b0c: the runner has Flutter 3.38.5, not the pinned 3.32.0. That is fixed on
the runner, not in the workflow.
* Add onionbalance Tor frontends to default node lists
Update the primary Monero and Zcash onion nodes to the new
load-balanced onionbalance frontends, add missing Cake Wallet Tor
nodes for Bitcoin and Litecoin, and use the mempool onion frontend
for Bitcoin fee fetching when Tor is enabled. All Cake Tor nodes are
marked isOfficial so they get the official-node badge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Remove per-instance Zcash Tor #2 node, superseded by onionbalance frontend
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1.0.3 reached both stores carrying Cake Wallet's app icon on the About screen,
Cake's wordmark on the receive QR page, and Cake's release notes in What's New.
All three were compiled or read from files the August de-cake pass never
touched. This is the release that fixes them.
Build 14: Play wants a higher versionCode and App Store Connect wants a higher
build than 13, and both read this one file.
LN receive remapped btcln to BTC, so the default "sats (LN)" display mode never applied and the amount field stayed in BTC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Konstantin Ullrich <konstantin@cakewallet.com>
jwinterm