* feat: harden spam detection for solana and evm
* fix: guard scam/impersonator tokens from auto-enabling on EVM and Solana
* feat: enhance token property validation for scam detection
The dependency_override pinned ledger_usb_plus to
konstantinullrich/ledger-usb-plus@dad482c847..., a commit that was force-pushed
away and no longer exists — so 'flutter pub get' fails ('bad object') on any
cold runner (the Android/Linux containers). It passed on iOS only because the
Mac-mini runner had a warm pub cache. cake-tech's ledger-flutter-plus fork
depends on the published ledger_usb_plus ^1.0.4, so pin the override to that.
tool/generate_new_secrets.dart imports app packages (encrypt/convert/intl).
pubspec_gen.sh runs `flutter pub get` without set -e, so a silent hiccup there
surfaced downstream as 'Couldn't resolve the package encrypt' at secrets-gen.
Run `flutter pub get` explicitly (set -e) right before the tool on Android +
Linux, matching what the iOS flow effectively guarantees. The build container
already pins Flutter 3.32.0, so this resolves cleanly.
Build 7 is already on TestFlight. Both iOS (CFBundleVersion) and Android
(versionCode) source the build number from pubspec_description.yaml at build
time (scripts/{ios,android}/app_env.sh), so this single bump moves both to 8.
Chainflip added Tron support with asset ids trx.tron and usdt.tron.
Enable both for swaps in the Chainflip provider.
Tron needs explicit handling because Chainflip's network slug is
'tron', while Cake uses the 'TRX' tag (and null for native TRX), so
the generic title.tag normalization can't produce the right ids:
- _supported: add trx, usdttrc20
- _normalizeCurrency: map trx -> trx.tron, usdttrc20 -> usdt.tron
- _normalizeNetworkName: TRON -> Tron (status lookup in findTradeById)
- _toCurrency: reverse-map trx.tron/usdt.tron for trade resolution
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* if input transactions are not all fetched correctly or had a failure, still parse the transaction correctly instead of skipping it
* handle nullable tx fee
* show warning for BTC txs with missing inputs
---------
Co-authored-by: Serhii <17529954+serhii-bor@users.noreply.github.com>
getAvailableBuyProviderTypes() now returns [moonpay] only when moonPayApiKey is
non-empty, so MoonPay's Buy button appears only in builds where the CI secret is
present (and the exchange-helper signer is live). Both build workflows now inject
MOONPAY_API_KEY -> moonPayApiKey and EXCHANGE_HELPER_API_KEY -> exchangeHelperApiKey
alongside Trocador + WalletConnect. moonPaySecretKey is server-side and never injected.
Both build workflows now set walletConnectProjectId in lib/.secrets.g.dart from
the WALLETCONNECT_PROJECT_ID secret (alongside the Trocador keys), so
WalletConnect pairing works in signed builds. Add WALLETCONNECT_PROJECT_ID
(your reown Wallet projectId) to the CI secrets before building.
