qml: strip whitespace from message before signing, as in qt gui
What the developer wrote
Authored by Ferdinando Ametrano
qml: strip whitespace from message before signing, as in qt gui
The qt gui strips leading/trailing whitespace from the message (and
address) both when signing and when verifying (see #4327). The qml gui
already strips in verifyMessage (qedaemon.py), but not in signMessage:
a message with leading/trailing whitespace signed in the qml gui would
produce a signature that fails verification even in the same dialog.
Strip in signMessage too, replicating the qt gui behaviour.
related: https://github.com/spesmilo/electrum/issues/4327
related: https://github.com/btclib-org/btclib/issues/200
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
What changed, and why it matters
This commit fixes a minor consistency bug in Electrum's newer QML (mobile-style) user interface. When signing a message, the app now removes accidental spaces at the start or end of the message and address, just like the older desktop Qt interface already did. Without this fix, a message signed in the QML interface could fail verification because of stray whitespace. It is a usability/reliability fix, not a serious security vulnerability.
No urgent action needed. Treat as a normal bugfix/UX consistency patch. Users relying on message signing in the QML GUI should update to a release containing this commit to avoid verification failures caused by whitespace.
Security signals we found
Behavioral inconsistency between GUI implementations could cause user confusion or failed verification
No cryptographic weakness introduced; change is input normalization
No memory-unsafe code, no privilege changes, no network changes
Evidence from the diff
The patch adds address.strip() and message.strip() at the start of QEWallet.signMessage in electrum/gui/qml/qewallet.py. The Qt GUI already strips whitespace in both signMessage and verifyMessage, and the QML verifyMessage already stripped input, so a message with leading/trailing whitespace signed in QML would produce a signature that failed verification in the same QML dialog. The change aligns behavior across GUIs and prevents user-induced signature/verification mismatches.
Changed components
electrum/gui/qml/qewallet.pyQML GUI message signing flowInspect captured patch +3 / −0
diff --git a/electrum/gui/qml/qewallet.py b/electrum/gui/qml/qewallet.py
index 6b0cc9e..3302f6f 100644
--- a/electrum/gui/qml/qewallet.py
+++ b/electrum/gui/qml/qewallet.py
@@ -846,6 +846,9 @@ class QEWallet(AuthMixin, QObject, QtEventListener):
@pyqtSlot(str, str)
@auth_protect(message=_("Sign message?"))
def signMessage(self, address, message):
+ # strip, as in qt gui and in qml verifyMessage (see #4327)
+ address = address.strip()
+ message = message.strip()
sig = self.wallet.sign_message(address, message, self.password)
result = base64.b64encode(sig).decode('ascii')
self.messageSigned.emit(result)
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.