Bitcoin privacy wallet Sparrow Wallet has released version 2.5.4. Developer Craig Raw stated to Decrypt that most of the fixes in this update come from a AI auxiliary code review, with a focus on identifying potential vulnerabilities and reducing the wallet's reliance on external services.
Post-Coldcard event inspection speedup
Raw indicates that one of the backgrounds for this round of review is the code vulnerability incident with Coldcard seeds that occurred in July. This vulnerability once gave attackers the opportunity to reconstruct private keys without having access to physical devices. Coldcard manufacturers previously stated that attackers might have taken advantage of AI to discover this flaw.
He also mentioned that another reason for driving this review is that the new generation of AI tools are now capable of searching for potential vulnerabilities in large codebases. Raw did not disclose which specific models were used in Sparrow, but indicated that most of the fixes in this release came from that round of reviews.
Transaction verification becomes a key focus of the update.
According to the official update records, version 2.5.4 has added several security checks related to transaction confirmation, mainly aimed at reducing the wallet's single-point dependence on external blockchain data services.
- Verify whether the transactions returned by the Electrum server are consistent with the requests.
- Cryptographic proof that a transaction has been written to a Bitcoin block
- Verify the latest block on the chain before displaying transaction confirmation.
Enhanced protection synchronization between hardware wallets and Tor
The new version also strengthens the security requirements for BitBox02. Sparrow now requires that the device firmware be at least version 9.4.0, and enables anti-klepto protection to prevent the secret leakage of private key information during the signing process.
In addition to BitBox02, the update also involves Ledger, Trezor, Keycard, multi-signature wallets, wallet import, and some signature Bitcoin transaction functions. At the same time, Sparrow also performed masking on the Bitcoin Core credentials and other sensitive information in the debug logs, and restricted access to the wallet and backup directories. When using Tor, it also addressed the local DNS leakage issue.
Raw indicates that this review did not identify any issues that would pose a direct risk to users' funds, nor is there evidence that these issues have been exploited. However, he still recommends that users install this update. On a broader scale, AI is being used by more Bitcoin developers to scan for potential vulnerabilities in wallets, payment protocols, and code repositories.
