Merge pull request #2669 from SatoshiPortal/security/audit-fixes-2026-08

fix: resolve 61 security audit findings, mitigate 7, document 5 upstream

Author: ethicnology

.github/actions/flutter-setup/action.yml

@@ -51,7 +51,28 @@ runs:
     - name: Install FVM
       shell: bash
       run: |
-        curl -fsSL https://fvm.app/install.sh | bash -s -- 4.1.2
+        case "$(uname -m)" in
+          x86_64) fvm_arch=x64 ;;
+          aarch64|arm64) fvm_arch=arm64 ;;
+          *) echo "Unsupported FVM architecture: $(uname -m)" >&2; exit 1 ;;
+        esac
+        archive="$RUNNER_TEMP/fvm-4.1.2-linux-${fvm_arch}.tar.gz"
+        curl --retry 5 --retry-all-errors -fL \
+          "https://github.com/conceptadev/fvm/releases/download/4.1.2/fvm-4.1.2-linux-${fvm_arch}.tar.gz" \
+          -o "$archive"
+        mkdir -p "$HOME/fvm/bin"
+        # Extract the whole tree, not just `fvm/fvm`: the two release archives
+        # have different layouts. x64 ships a self-contained binary, arm64 a
+        # launcher script that execs `src/dart` relative to its own directory —
+        # unpacking the launcher alone yields `exec: .../src/dart: not found`
+        # on every fvm invocation.
+        tar -xzf "$archive" -C "$HOME/fvm/bin" --strip-components=1
+        chmod +x "$HOME/fvm/bin/fvm"
+        if [ -f "$HOME/fvm/bin/src/dart" ]; then
+          chmod +x "$HOME/fvm/bin/src/dart"
+        fi
+        # Prove the launcher actually runs before anything depends on it.
+        "$HOME/fvm/bin/fvm" --version
         echo "$HOME/fvm/bin" >> $GITHUB_PATH
 
     - name: Check Flutter version

FEATURES.md

@@ -74,6 +74,7 @@ graph TB
     BUY --> EXCHANGE
     BUY --> RECEIVE
     BUY --> BULL_PAYJOIN
+    BUY --> TX_HISTORY
     COINS --> UTXO_MGMT
     COINS --> LABELS
     COINS --> WALLETS
@@ -94,6 +95,7 @@ graph TB
     SECRETS --> CORE
     SELL --> EXCHANGE
     SELL --> BULL_PAYJOIN
+    SELL --> TX_HISTORY
     SEND --> CONSOLIDATION
     SEND --> FEES
     SEND --> NETWORK

android/app/src/main/AndroidManifest.xml

@@ -76,12 +76,6 @@
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
-            <intent-filter>
-                <action android:name="android.intent.action.VIEW" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-                <data android:scheme="bitcoin" />
-            </intent-filter>
             <!-- USB device attached intent filter for BitBox02 -->
             <intent-filter>
                 <action

integration_test/bip85_derivation_test.dart

@@ -4,6 +4,7 @@ import 'package:bb_mobile/core/bip85/data/bip85_datasource.dart';
 import 'package:bb_mobile/core/bip85/data/bip85_repository.dart';
 import 'package:bb_mobile/core/bip85/domain/derive_next_bip85_mnemonic_from_default_wallet_usecase.dart';
 import 'package:bb_mobile/core/seed/data/repository/seed_repository.dart';
+import 'package:bb_mobile/core/settings/data/settings_repository.dart';
 import 'package:bb_mobile/core/storage/sqlite_database.dart';
 import 'package:bb_mobile/core/storage/tables/bip85_derivations_table.dart';
 import 'package:bb_mobile/core/utils/bip32_derivation.dart';
@@ -50,6 +51,7 @@ Future<void> main({bool isInitialized = false}) async {
     bip85Repository: bip85Repository,
     walletRepository: walletRepository,
     seedRepository: seedRepository,
+    settingsRepository: locator<SettingsRepository>(),
   );
 
   setUpAll(() async {

integration_test/payment_request_test.dart

@@ -46,20 +46,15 @@ Future<void> main({bool isInitialized = false}) async {
       expect(bip21.network, Network.bitcoinMainnet);
     });
 
-    test(
-      'HTTPS URL with percent-encoded LNAddress in lightning param',
-      () async {
-        const input =
-            'https://admin.bullbitcoin.com/abc'
-            '?lightning=ishi%40walletofsatoshi.com&label=pleasefundme';
-        final result = await PaymentRequest.parse(input);
-        expect(result, isA<LnAddressPaymentRequest>());
-        expect(
-          (result as LnAddressPaymentRequest).address,
-          'ishi@walletofsatoshi.com',
-        );
-      },
-    );
+    test('HTTPS URL with a percent-encoded LNAddress is rejected', () async {
+      const input =
+          'https://admin.bullbitcoin.com/abc'
+          '?lightning=ishi%40walletofsatoshi.com&label=pleasefundme';
+      expect(
+        () => PaymentRequest.parse(input),
+        throwsA('Invalid payment request'),
+      );
+    });
   });
 
   group('Liquid address confidentiality (security audit)', () {

ios/Runner/AppDelegate.swift

@@ -9,6 +9,7 @@ import workmanager_apple
     didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?
   ) -> Bool {
     GeneratedPluginRegistrant.register(with: self)
+    excludeSensitiveFilesFromBackup()
 
     // workmanager_apple spawns a separate FlutterEngine per background task
     // (see BackgroundWorker.swift in workmanager_apple). Plugins registered
@@ -23,23 +24,22 @@ import workmanager_apple
       GeneratedPluginRegistrant.register(with: registry)
     }
 
-    WorkmanagerPlugin.registerPeriodicTask(
-      withIdentifier: "com.bullbitcoin.mobile.bitcoin-sync-id",
-      frequency: NSNumber(value: 20 * 60)
-    )
-    WorkmanagerPlugin.registerPeriodicTask(
-      withIdentifier: "com.bullbitcoin.mobile.liquid-sync-id",
-      frequency: NSNumber(value: 20 * 60)
-    )
-    WorkmanagerPlugin.registerPeriodicTask(
-      withIdentifier: "com.bullbitcoin.mobile.swaps-sync-id",
-      frequency: NSNumber(value: 20 * 60)
-    )
-    WorkmanagerPlugin.registerPeriodicTask(
-      withIdentifier: "com.bullbitcoin.mobile.logs-prune-id",
-      frequency: NSNumber(value: 20 * 60)
-    )
-    
     return super.application(application, didFinishLaunchingWithOptions: launchOptions)
   }
+
+  private func excludeSensitiveFilesFromBackup() {
+    let fileManager = FileManager.default
+    guard let documentsDirectory = fileManager.urls(for: .documentDirectory, in: .userDomainMask).first else {
+      return
+    }
+
+    // Wallet, payjoin, wallet-engine, and TSV log data all live below Documents.
+    // Excluding the directory also covers wallet directories created after startup.
+    var documentsURL = documentsDirectory
+    var resourceValues = URLResourceValues()
+    resourceValues.isExcludedFromBackup = true
+    // `setResourceValues` is `mutating`, so it needs a `var` receiver.
+    // URLResourceValues.isExcludedFromBackup sets NSURLIsExcludedFromBackupKey.
+    try? documentsURL.setResourceValues(resourceValues)
+  }
 }

lib/core/bbqr/bbqr.dart

@@ -44,19 +44,25 @@ class Bbqr {
       }
     } else {
       final scannedOptions = BbqrOptions.decode(payload);
-      if (options != null && scannedOptions.total != options!.total) {
-        // reset another state.bbqr
-        // and expect the next scan to be a new BBQR
-        parts.clear();
-        return (null, this);
+      if (options != null &&
+          (scannedOptions.total != options!.total ||
+              scannedOptions.encoding != options!.encoding ||
+              scannedOptions.type != options!.type)) {
+        _reset();
       }
 
       options = scannedOptions;
       parts[options!.share] = payload;
 
       if (options!.total == parts.length) {
         final bbqrParts = parts.values.toList();
-        final bbqrJoiner = await bbqr.Joined.tryFromParts(parts: bbqrParts);
+        late final bbqr.Joined bbqrJoiner;
+        try {
+          bbqrJoiner = await bbqr.Joined.tryFromParts(parts: bbqrParts);
+        } catch (_) {
+          _reset();
+          throw FailedToParseBbqr();
+        }
 
         try {
           final tx = await BitcoinTx.fromBytes(bbqrJoiner.data);
@@ -79,13 +85,19 @@ class Bbqr {
           );
         } catch (_) {}
 
+        _reset();
         throw FailedToParseBbqr();
       } else {
         return (null, this);
       }
     }
   }
 
+  void _reset() {
+    parts.clear();
+    options = null;
+  }
+
   static Future<List<String>> splitPsbt(String psbt) async {
     try {
       // check if the PSBT is valid, will throw if not

lib/core/bbqr/bbqr_options.dart

@@ -23,12 +23,16 @@ class BbqrOptions {
   }
 
   factory BbqrOptions.decode(String code) {
-    if (code.length < 6) throw "Encoded string is too short";
+    if (code.length < 8) throw "Encoded string is too short";
     if (code.substring(0, 2) != "B\$") throw "Invalid header: expected 'B\$'";
 
     final totalQRCodes = int.parse(code.substring(4, 6), radix: 36);
     final sequenceNumber = int.parse(code.substring(6, 8), radix: 36);
 
+    if (totalQRCodes < 1 || sequenceNumber >= totalQRCodes) {
+      throw "Invalid BBQR sequence";
+    }
+
     return BbqrOptions(
       encoding: code[2],
       type: code[3],

lib/core/bip85/bip85_locator.dart

@@ -6,6 +6,7 @@ import 'package:bb_mobile/core/bip85/domain/derive_next_bip85_hex_from_default_w
 import 'package:bb_mobile/core/bip85/domain/derive_next_bip85_mnemonic_from_default_wallet_usecase.dart';
 import 'package:bb_mobile/core/bip85/domain/revoke_bip85_derivation_usecase.dart';
 import 'package:bb_mobile/core/seed/data/repository/seed_repository.dart';
+import 'package:bb_mobile/core/settings/data/settings_repository.dart';
 import 'package:bb_mobile/core/storage/sqlite_database.dart';
 import 'package:bb_mobile/core/wallet/data/repositories/wallet_repository.dart';
 import 'package:get_it/get_it.dart';
@@ -29,6 +30,7 @@ class Bip85DerivationsLocator {
         bip85Repository: locator<Bip85Repository>(),
         walletRepository: locator<WalletRepository>(),
         seedRepository: locator<SeedRepository>(),
+        settingsRepository: locator<SettingsRepository>(),
       ),
     );
 
@@ -37,6 +39,7 @@ class Bip85DerivationsLocator {
         bip85Repository: locator<Bip85Repository>(),
         walletRepository: locator<WalletRepository>(),
         seedRepository: locator<SeedRepository>(),
+        settingsRepository: locator<SettingsRepository>(),
       ),
     );
 

lib/core/bip85/domain/derive_next_bip85_hex_from_default_wallet_usecase.dart

@@ -7,16 +7,19 @@ import 'package:bb_mobile/core/utils/logger.dart';
 import 'package:bb_mobile/core/utils/result.dart';
 import 'package:bb_mobile/core/wallet/data/repositories/wallet_repository.dart';
 import 'package:meta/meta.dart';
+import 'package:bb_mobile/core/settings/data/settings_repository.dart';
 
 class DeriveNextBip85HexFromDefaultWalletUsecase {
   final Bip85Repository _bip85Repository;
   final WalletRepository _walletRepository;
   final SeedRepository _seedRepository;
+  final SettingsRepository _settingsRepository;
 
   DeriveNextBip85HexFromDefaultWalletUsecase({
     required this._bip85Repository,
     required this._walletRepository,
     required this._seedRepository,
+    required this._settingsRepository,
   });
 
   @useResult
@@ -25,9 +28,13 @@ class DeriveNextBip85HexFromDefaultWalletUsecase {
     String? alias,
   }) async {
     try {
+      // Derive from the default wallet of the environment the app is actually
+      // running in: a hardcoded mainnet lookup finds no wallet on testnet.
+      final settings = await _settingsRepository.fetch();
       final wallets = await _walletRepository.getWallets(
         onlyDefaults: true,
         onlyBitcoin: true,
+        environment: settings.environment,
       );
       if (wallets.isEmpty) return const Err(Bip85NoDefaultWalletFailure());
       final defaultWallet = wallets.first;