cake_wallet icon indicating copy to clipboard operation
cake_wallet copied to clipboard
verified publisher icon cake-tech

Missing network check for silent payments

Open cygnet3 opened this issue 6 months ago • 1 comments

Describe the bug I got a message from a user that tried sending funds from Cake Wallet to Dana and didn't see their funds arrive. Dana wallet currently uses Regtest, so this action should have been impossible. After testing it out myself, it looks like Cake doesn't do network verification, because it allowed me to send to a Regtest address as well.

To Reproduce NOTE: THIS WILL BURN FUNDS

  1. Receive some funds on Cake wallet
  2. Go to 'Send' tab
  3. Paste in an address of a different network type, e.g. the regtest address sprt1qqtprfuwwx33sxkre9mwwglhsyjsp5nnck4jutmxxqdkctatjqe5e6qupf52f6ryvzqgtnuhqj7t0tfhafute0vyf7axxsakyrejcgz7p5gzqlp30
  4. Fill in other send details like amount and fee
  5. Click 'Send'
  6. Confirm send

Expected behavior On attempting to send, Cake should fail with an error message informing the user that this address is invalid (wrong network).

Screenshots IMG_20250605_093050.jpg

Platform:

  • OS: Android 15, GrapheneOS
  • Device: Google Pixel 8a
  • Cake Wallet Version: 5.0.1

Additional context I haven't tested this with testnet addresses. This problem may be unique to regtest.

cygnet3 avatar Jun 05 '25 07:06 cygnet3

Thank you for the report!

Investigating as we speak, and plan to push a hot-fix for this or at the very least include it in the next major release.

sethforprivacy avatar Jun 05 '25 13:06 sethforprivacy