Skip to content

v4.0.59

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 10:33
· 61 commits to develop since this release
v4.0.59
db3102a

Covers the work since v4.0.46. The headline is about DigiAssets, and it came out of a real forgery.

Who created an asset is now proved, not claimed

A DigiAsset's name, image and description live in a file the person minting it writes. The wallet used to read the creator's address out of that same file and show it under the heading "Issuer Address".

That is the one field a forger most wants a wallet to repeat back: copy someone's asset, mint it again, write the original artist's address into the file, and the borrowed credit arrives attached to the artwork. Displaying it made the forgery more convincing than it would have been alone.

The wallet now shows only what the chain proves — the address that actually paid for the asset's creation. That cannot be copied, because it is a payment somebody genuinely made. Where it cannot be established, the wallet shows nothing rather than guessing. A confirmed forgery on the DigiStamp marketplace is pinned in the test suite so this cannot quietly return.

A second check catches the same trick from the other side. A copy gets a new asset ID but reuses the original's artwork file, so if you hold two assets whose artwork file is identical, both now say so and point you at the verified creator. The wallet does not claim to know which is genuine — it reports what it saw and leaves the judgement to you.

Also in assets

  • Assets whose creator never published a name are labelled as artifacts and counted, instead of silently ignored.
  • Artwork stuck on "metadata offline" resolves. The cause was our own limit on how far back the wallet would trace an asset's history — not the servers being down.
  • A completed send can no longer be mistaken for an invitation to send again.
  • The DigiStamp marketplace is now inside the wallet, with Digi-ID sign-in that works without leaving the app.

Security

The first structured pass in 52 releases, plus a check that stops us going that long again.

  • Release builds are obfuscated.
  • Dependency vulnerabilities are checked on every build rather than at review time — a new one can appear without anybody touching the code.
  • Leftover code from the wallet this project was forked from is removed rather than left sitting unused.
  • A Digi-ID sign-in code and a wallet address that could each reach the device log no longer do.

Seven findings were raised. Five are fixed here, one was accepted as harmless after review, and one was withdrawn — we measured it and the evidence contradicted what we had written down. The full record, retraction included, is in security/AUDIT-LOG.md.

Upgrade note

This release migrates the local asset database to clear previously stored creator claims. Downgrading to an earlier version afterwards is not supported.

Full notes: https://digiscope.me/wallet/releases/4.0.59

SHA-256: d11ceb901ca726f77f202914d42c2827c3f7acd6e2d2e0092d745d9ae9ae38d3

Download from digiscope.me/downloads/ or install the APK below. Requires Android 8.0+.

Source: https://github.com/JohnnyLawDGB/digibytewallet-android

Assets 3
Loading