decred / dcraddrscanner Goto Github PK

Sometimes the app will panic and shut down when scanning a qr code. This is something that has started recently.

It looks as though scanning succeeds anyway when reopening the app.

No Idea of the cause or how to reproduce yet.

They should redirect to an address but seem to be broken atm.

This will require a special qr, but adding address batches is needed for ease of use. The data in the qr can be a simple array, i.e. [addr,addr,addr]. Upon scanning, if the first character is [ we can assume it is an array, if not a single address.

Unmined tickets will throw at the /tinfo enpoint and return invalid address which should not be the case. They should be marked unconfimed and perhaps have another status for tickets that are never mined.

This would be useful for ticket purchases.

I'm a PhD student interested in finding security vulnerabilities in open source projects.

We found a total of 7 warnings (indicating potential vulnerabilities) when running the CogniCrypt static analyzer (*) on dcraddrscanner (or its library dependencies). We documented each one of these issues in private gists for the sake of confidentiality (non-disclosure).

Can you please let us know whether we can share these gists with you? We are eager to evaluate the perception of developers (e.g. severity of these warnings) and improve dcraddrscanner's security, and the quality of the reports of static analysis tools.
(*) https://github.com/CROSSINGTUD/CryptoAnalysis

https://github.com/JoeGruffins/dcraddrscanner/blob/8ed4341c1d6e28df2928e3c5abf4e121eb364e39/app/src/main/java/com/joegruff/decredaddressscanner/types/Nets.kt#L49

After scanning an address, I had it added twice. This is the first time I have seen this and I was unable to reproduce, but there must be something, perhaps in the last fixup commit #12 .

QR Scanner fails without much notice as to why when you attempt to scan a Testnet address when configured for Mainnet addresses.

Perhaps the app should support adding any type of address regardless of what system, and just add a field to track what chain the address is from.

Use cfilters/SPV to discover address balance changes and other interesting events. See the proposal for the original discussion.

While it is a lot of work, I wonder if any of dcrandroid's approach can be reused? Afaik they embed a Go binary built from dcrlibwallet, which has everything for the SPV support and much more.

P.S. I didn't find an issue for this so creating one.

When using dcrdata, a user's ticket txid are used to query ticket statuses and could be used to link tickets to an ip address which could be a concern for the security conscious. Users should be shown an alert somewhere obvious when using dcrdata.

Our license isn't good enough for them.

Unexpected license tag "BlueOak-1.0.0"! Only use FSF or OSI approved tags from https://spdx.org/license-list

https://gitlab.com/fdroid/fdroiddata/-/merge_requests/8198

What should it be changed to?
https://spdx.org/license-list

Going to go with MIT because it sounds cool...

Sometimes ViewAddressFragment will freeze when resuming. It happens only rarely and only since updating to use api 30. Will update when more details are available.

App currently doesn't give a way to modify how often it checks for updated balances. Different users might have different needs. It'd also be nice to surface this so the user knows how soon to expect a notification after an address balance updates.

You can add Screenshots for F-Droid, too, if you want.
https://f-droid.org/en/docs/All_About_Descriptions_Graphics_and_Screenshots/
https://gitlab.com/snippets/1895688
That was simply information about what is still possible. You would then only have to enter the
screenshots in fastlane. This is just one way that you can also add screenshots to the app view
if you can. If you added screenshots (then F-Droid is happy) and if you can't add any -> then
you can close the issue because it was only an info. Thank you that your app is available in
fdroid. Very much for your attention.