* fix android CI
* feat: add anypay core models, parser and routing engine
* feat: add anypay resolver, anypay service and wallet switch service
* refactor: route the send page payment flow through anypay service
* fix: show message when there's no swap providers for a pair and reset the trade guard on dismissal
* refactor: merge the swap from network and send to network decision pages together and clean up anypay widgets
* feat: reapply deep links to a currently open send flow and register the solana scheme
* feat: add support for zcash address detection to anypay and other minor fixes
* refactor: remove trailing icon
* feat: hide swap flow for sp and mweb addresses
* feat: enhance zcash address detection and deeplink handling
* fix: pin bitcoin_base
* refactor: Move the anypay decision navigation out of the send page and address minor review comments
* refactor: Move the anypay decision navigation out of the send page and address minor review comments
* feat: handle exception in switch service and mvoe balance compute to call site
* refactor: combine anypay entry points to one and extract selected mode widget
* fix: tx priority for doge
* chore: add dogecoin to isElectrumWallet util
* fix: annoying mobx error
---------
Co-authored-by: Czarek Nakamoto <cyjan@mrcyjanek.net>
generated/i18n.dart and several .g.dart parts are untracked generation
outputs too; without them a fresh checkout analyzes with thousands of
undefined_identifier errors. Run model_generator.sh and
generate_localization exactly as the build lanes do.
pubspec.yaml, the cw_* dependency wiring, wallet_types.g.dart, and the
.secrets.g.dart files are generated and untracked, so the workflow's
bare pub get failed on every push since the workflow landed. Mirror the
build lanes: description -> generate_pubspec -> coin configure ->
generate_new_secrets (empty defaults), then analyze and test. This also
makes the CI resolve identical to release builds, so descriptor drift
like the cake_backup ref conflict fails here in minutes instead of at
release-build time.
* fix android CI
* feat: add anypay core models, parser and routing engine
* feat: add anypay resolver, anypay service and wallet switch service
* refactor: route the send page payment flow through anypay service
* fix: show message when there's no swap providers for a pair and reset the trade guard on dismissal
* refactor: merge the swap from network and send to network decision pages together and clean up anypay widgets
* feat: reapply deep links to a currently open send flow and register the solana scheme
* feat: add support for zcash address detection to anypay and other minor fixes
* refactor: remove trailing icon
* feat: hide swap flow for sp and mweb addresses
* feat: enhance zcash address detection and deeplink handling
* fix: pin bitcoin_base
* refactor: Move the anypay decision navigation out of the send page and address minor review comments
* refactor: Move the anypay decision navigation out of the send page and address minor review comments
* feat: handle exception in switch service and mvoe balance compute to call site
* refactor: combine anypay entry points to one and extract selected mode widget
---------
Co-authored-by: Czarek Nakamoto <cyjan@mrcyjanek.net>
* fix android CI
* feat: Migrate EVM, Sol and Tron tokens to SQL
* handle rename edgecase
* refactor: enhance token migration logic and improve database handling
* Randomize coin selection with single random draw
The greedy selection walked the unspent pool in a predictable order (address generation order, then per-address server order), a fingerprint an analyst can exploit. Shuffle the pool before the accumulate-until-covered loop so the input set is chosen non-deterministically (single random draw). MWEB coins are still kept last.
Branch-and-bound (changeless exact match) is a larger follow-up.
* Add BnB + SRD coin selection primitives
Pure, wallet-independent coin selector: branch-and-bound for an exact
changeless match within the cost-of-change window, single-random-draw
fallback (shuffled, injectable RNG) when no exact match exists, and
selectCoins tying them together over effective values.
This is the basis for replacing the greedy accumulation in _createUTXOS
so sends produce no change when possible and a non-deterministic
selection otherwise. Validated with dart test (9 cases); wiring into
_createUTXOS is a separate step.
* Use BnB changeless matching in coin selection
Before the shuffled greedy walk, run branch-and-bound over effective
values (value minus per-input fee cost) looking for an input set whose
excess over amount plus fee stays below dust. When found, order those
inputs first and cap the walk at their count: the caller then computes
a change below dust, drops the change output, and absorbs the residue
into the fee, producing a changeless transaction with no residual
change fingerprint.
When no match exists, selection falls back to the shuffled pool, which
the greedy walk turns into a single random draw. BnB is skipped for
sendAll, forced input counts and pools holding MWEB coins.
changelessMatch filters non-positive effective values and maps indices
back to the original pool.
* Cover changeless fee bounds and BnB termination
Assert the end-to-end arithmetic the wallet performs around a
branch-and-bound match: with the 68/34/10 vBytes model, the leftover
the caller absorbs into the fee is never negative (no re-selection
loop) and never exceeds the dust limit (bounded fee overpay).
Also pin termination: a large pool with no possible match returns null
through the maxTries cap instead of exploring the full search tree.
* Use a secure RNG for coin selection randomness
The selection shuffle and the single-random-draw fallback exist to be
unpredictable, so seed them from Random.secure() instead of the default
PRNG, matching what Core and bdk use for coin selection. Pool sizes are
small, so the cost is negligible. Tests keep injecting a seeded Random
for determinism.
* Randomize RBF and payjoin input candidate order
Two secondary paths still consumed unspentCoins in wallet scan order
(address generation order, then per-address age), the same predictable
order removed from the main selection path:
- replaceByFee walked the unused-UTXO list in scan order when the fee
bump needed extra inputs
- the payjoin receiver handed input candidates to the payjoin library
in scan order, letting ties inside its selection mirror that order
Shuffle both with a secure RNG so no input-selection path exposes the
wallet's address or coin age ordering.
* ci: skip Linux PR build on forks (no secrets access)
* Account for script-type sizes in changeless matching
* Keep coin selection order stable within a transaction build
* Set anti-fee-sniping locktime on bitcoin sends
Current tip (exact-tip) via shared helper, wired into normal sends (path A) and payjoin/PSBT (path B). 0 when unsynced. Converges with the exact-tip cluster (payjoin-cli, ldk-node, Bull Bitcoin) and skips the ~10% backdate.
* Update cw_bitcoin/lib/locktime.dart
Co-authored-by: Konstantin Ullrich <konstantinullrich12@gmail.com>
* Update cw_bitcoin/lib/locktime.dart
Co-authored-by: Konstantin Ullrich <konstantinullrich12@gmail.com>
* Update cw_bitcoin/lib/locktime.dart [skip ci]
---------
Co-authored-by: Konstantin Ullrich <konstantinullrich12@gmail.com>
Co-authored-by: Omar Hatem <omarh.ismail1@gmail.com>
Pub requires identical git descriptors across the graph: the root's
pinned SHAs (pubspec_base) conflicted with cw_core's ref:main /
unpinned declarations, failing CI's pub resolve after the configure
step regenerates pubspec.yaml. Local resolution had masked it because
the untracked working-tree pubspec.yaml predated the pins. Pins now
identical everywhere (audit script confirms no remaining multi-ref git
deps); sibling lockfiles re-locked.
User report 05ebf86e: monero?.getCurrentAccount on a Wownero wallet. The
null-aware operator guards plugin presence, not wallet type, so the
Monero bridge always ran and CWMonero's cast threw before the ?? chain
could reach the wownero branch. Dispatch by wallet.type instead. Swept
lib for the same anti-pattern: account_customizer already dispatches
(fixed 2026-08-07) and the settings_store call sites take no wallet
argument; this was the last live instance.
* fix: sanitize Electrum fee estimates
* chore: drop test changes from this PR
Removes the test additions/modifications introduced by this branch so the
test design is left to the maintainers. Production code is unchanged.
* fix: validate EVM restore mnemonics
* chore: drop test changes from this PR
Removes the test additions/modifications introduced by this branch so the
test design is left to the maintainers. Production code is unchanged.
Server-side forex (ECB daily reference rates) shipped in
hash-wallet-prices; the wallet needed no code change. Comment updated so
the file stops claiming USD-only.
- Wownero default becomes node.wownero.org:443 (SSL, ours) instead of a
third-party plaintext host
- Arbitrum's default was arbitrum.nownodes.io, which requires an API key
we don't ship (nowNodesApiKey is empty) — every fresh install had a dead
default RPC; now arbitrum-one-rpc.publicnode.com
- remove the other NOWNodes entries from node lists and the EVM chain
registry for the same reason; historical migration maps keep their
entries so old users still get migrated off
Deposit side: natives of shipped chains (WOW, XMR, BTC, BCH, DOGE, XNO,
ETH, ETH-Base, ETH-Arb, BNB, POL) plus major stables (USDT/USDC variants,
DAI). Receive side: same minus BNB (inherited upstream restriction) plus
LTC as a receive-only target. ZEC, DASH, SOL, AVAX, Zano, Haven, ADA,
EOS, XLM, XRP, TRX, TON and the rest disappear from the swap UI; their
CryptoCurrency entries stay defined because the raw ids back Hive-stored
trade history.
The 10 language wordlists were byte-identical between cw_monero and
cw_wownero (16,291 duplicated lines). A single copy now lives in
cw_core/lib/mnemonics/, and the configure.dart code-gen templates import
from there.
- Cake Pay: 36 files (~5.3k LOC) plus DI registrations, routes, and UI
branches (feature was hard-disabled and unreachable)
- unreachable buy providers: robinhood, dfx, onramper, meld, kryptonim
(~1.7k LOC); MoonPay untouched
- exchange providers that only existed as commented-out wiring:
changenow, sideshift, chainflip, exolix, swaptrade, letsexchange,
stealthex, xoswap, swapsxyz, thorchain, simpleswap (~5.2k LOC);
Trocador untouched; ExchangeProviderDescription values and Hive
adapters kept so stored trades and orders still deserialize
- di.dart setup() split from one 1,452-line function into 10 sequential
chunk functions; registration execution order verified identical
before and after (251 register calls)
Address-field input no longer leaves the device except toward
infrastructure implied by the typed name itself:
- remove Twitter, Mastodon, Nostr, Yat, Unstoppable Domains, FIO,
ThorChain-name, zcash.me, and Zano alias lookups (Nostr and FIO ran
with no setting gate at all; Zano is not even a supported chain)
- keep OpenAlias, BIP-353, .well-known, LNURL, and ENS, each toggleable
in Settings -> Domain lookups
- BTC fee/block/restore-height queries move from mempool.cakewallet.com
to public mempool.space (also fixes two /api/v1 paths that 404 on
standard mempool deployments)
- PRIVACY.md updated to disclose the remaining flows (mempool.space,
name lookups, opt-in silent payments and payjoin); issue templates and
the translation prompt de-Caked
Robert Malikowski