add any missing key path information to psbts once signing wallet is chosen
What the developer wrote
Authored by Craig Raw
add any missing key path information to psbts once signing wallet is chosen
What changed, and why it matters
This commit changes Sparrow Wallet so that, when a user chooses a wallet to sign a Bitcoin transaction (PSBT), the app automatically fills in any missing key-path details needed for signing. The change is small and appears to be a usability/fix improvement rather than a clear security patch. There is no vendor statement or external reference saying this fixes a vulnerability, so we cannot confidently label it as a security fix.
Treat as a routine functional improvement unless further vendor or researcher information emerges. Review the corresponding drongo submodule commit to confirm whether any related cryptographic or key-handling changes were made. If this change was prompted by a reported security issue, request the vendor to publish an advisory or CVE.
Security signals we found
Missing key-path data in a PSBT can cause signers to fail or prompt the user in ways that may lead to unsafe workarounds.
The patch adds key-path information only after the signing wallet has been explicitly chosen by the user, which limits scope.
No explicit security wording, CVE, advisory, or researcher attribution is present in the commit or supplied references.
Evidence from the diff
In HeadersController.java, inside the PSBT signing flow, after making the sign button visible the code now calls event.getPsbt().addKeyPathInformation(event.getSigningWallet()). This populates BIP32 key derivation paths in the PSBT for inputs/outputs associated with the chosen signing wallet. A submodule reference to drongo was also updated, but the actual diff inside the submodule is not shown. The change ensures the PSBT contains the key origin info the hardware signer or local signer needs, which can prevent signing failures when the PSBT was created without full derivation data.
Changed components
Sparrow Wallet desktop applicationHeadersController signing UI flowdrongo wallet library (submodule update, exact changes not shown)Inspect captured patch +2 / −1
diff --git a/src/main/java/com/sparrowwallet/sparrow/transaction/HeadersController.java b/src/main/java/com/sparrowwallet/sparrow/transaction/HeadersController.java
index 678bf29..d7d3e8e 100644
--- a/src/main/java/com/sparrowwallet/sparrow/transaction/HeadersController.java
+++ b/src/main/java/com/sparrowwallet/sparrow/transaction/HeadersController.java
@@ -1625,6 +1625,7 @@ public class HeadersController extends TransactionFormController implements Init
broadcastButtonBox.setVisible(true);
} else {
signButtonBox.setVisible(true);
+ event.getPsbt().addKeyPathInformation(event.getSigningWallet());
}
}
}
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.