chore(release): bump version to 1.0.0

Fills in the CHANGELOG.md entry for the checkpoint-anchoring security fix, fuzzing infrastructure and its findings, OP_RETURN/coinbase-tag decoding, and localization fixes since 0.9.1 (see previous commits), and bumps <Version>/versionCode across the App and Android head csproj files ahead of the tag.
feat(wallet): decode OP_RETURN payloads and coinbase pool tags in tx details
2026-07-09 08:45:24 +02:00 · 2026-07-09 08:35:39 +02:00 · 2026-07-07 22:35:19 +02:00 · 2026-07-07 22:29:46 +02:00 · 2026-07-07 22:06:45 +02:00 · 2026-07-07 22:05:38 +02:00
55 changed files with 1261 additions and 170 deletions
@@ -93,3 +93,7 @@ settings.local.json
 # Local agent/tooling metadata
 .agents/
 .codex/
 # Fuzzing artifacts (tests/PalladiumWallet.Fuzz)
 findings/
 crash-*.bin
@@ -6,20 +6,22 @@ This file provides guidance to coding agents (OpenAI Codex and others following
 ## Role
-Operate as an **expert in cryptocurrencies and cryptography**: reason with the domain's rigor about UTXO consensus, HD key derivation (BIP32/39/SLIP-132), signature schemes and scripts (P2PKH/P2SH/P2WPKH, PSBT), address encoding (base58/bech32), Merkle/SPV proofs, and at-rest encryption. When a choice touches cryptographic correctness or fund safety, judge it through that lens and flag known risks and pitfalls (nonce reuse, missing validation, exposed keys/seed, wrong fee/coin-selection, unverified server responses). Explain trade-offs with technical precision; never take for granted what hasn't been verified.
+Operate as an **expert in cryptocurrencies and cryptography**: reason with domain rigor about UTXO consensus, HD key derivation (BIP32/39/SLIP-132), signature schemes and scripts (P2PKH/P2SH/P2WPKH, PSBT), address encoding (base58/bech32), Merkle/SPV proofs, and at-rest encryption. When a choice touches cryptographic correctness or fund safety, judge it through that lens and flag known risks (nonce reuse, missing validation, exposed keys/seed, wrong fee/coin-selection, unverified server responses). Explain trade-offs with technical precision; never take for granted what hasn't been verified.
 ## Language policy
 - **Conversation with the user**: Italian.
- **All code, comments, commit messages, and documentation files**: English only.
+- **Code, comments, commit messages, documentation files**: English only.
 ## How to assist
-On **every requested change**, before implementing, judge whether it makes sense and say so plainly: if a request is useful and consistent with the project, proceed; if it is useless, redundant, already covered elsewhere, or risks degrading the code, **say so** with a short rationale and propose the better alternative (or doing nothing). No automatic agreement — an honest opinion is worth more than blind execution.
+Before implementing any requested change, judge whether it makes sense and say so plainly. Useful and consistent with the project → proceed. Useless, redundant, already covered elsewhere, or likely to degrade the code → say so with a short rationale and propose the better alternative (or doing nothing). No automatic agreement — an honest opinion is worth more than blind execution.
 After implementing a **new feature**, propose the tests needed for proper coverage (unit tests for the new logic, edge cases, error paths; property-based tests where invariants apply; integration tests against `FakeElectrumServer` if network/SPV code is involved; a fuzz target if a new untrusted-input parser was added) — don't just write the feature and stop there.
 ## What it is
-SPV wallet (Sparrow-style) for the **Palladium (PLM)** cryptocurrency, a Bitcoin-derived UTXO chain. Targets desktop (Windows/Linux) and Android, from the same source. Lightning is excluded from the first release.
+SPV wallet (Sparrow-style) for the **Palladium (PLM)** cryptocurrency, a Bitcoin-derived UTXO chain. Targets desktop (Windows/Linux) and Android from the same source. Lightning is excluded from the first release.
 ## Stack and structure
@@ -34,33 +36,40 @@ src/Cli/          CLI on the same Core            tests/   xUnit
 docker/           reproducible release builds (build.sh + pinned Dockerfiles) → dist/
 ```
-The Avalonia UI lives **once** in `src/App` (a library); the two heads only carry the
+- The Avalonia UI lives **once** in `src/App` (a library); the two heads only carry the per-platform entry point and packages.
-per-platform entry point and packages. `MainView` (UserControl) is the shared root, hosted
+- `MainView` (UserControl) is the shared root, hosted by `MainWindow` on desktop and as the single-view root on Android.
-by `MainWindow` on desktop and as the single-view root on Android.
+- **Non-negotiable dependency rule:** `App`/`Cli` depend only on `Core`; the UI reaches network/cryptography only through the wallet domain, never directly. `Core` knows nothing about the UI.
 **Non-negotiable dependency rule:** `App`/`Cli` depend only on `Core`; the UI goes through the wallet domain, never directly through network or cryptography. `Core` knows nothing about the UI.
 ## Commands
-.NET 10 SDK lives in `~/.dotnet10`: in non-interactive shells, before any `dotnet` command run
+.NET 10 SDK lives in `~/.dotnet10` — in non-interactive shells, before any `dotnet` command run
 `export PATH="$HOME/.dotnet10:$PATH" DOTNET_ROOT="$HOME/.dotnet10"`.
- Build: `dotnet build`
+- **Build:** `dotnet build`
- Tests (headless, the primary verification layer): `dotnet test` — single: `dotnet test --filter "FullyQualifiedName~TestName"`; property-based tests (CsCheck, `PropertyTests.cs`) run in the same command and take ~30 s; coverage: `dotnet test tests/PalladiumWallet.Tests --collect:"XPlat Code Coverage"` (coverlet, Cobertura XML). The test tree mirrors `src/Core` (`Chain/ Crypto/ Net/ Spv/ Storage/ Wallet/`) — put new tests in the folder matching the code under test. Network/SPV code (`ElectrumClient`, `WalletSynchronizer`, `TransactionInspector`, TOFU pinning) is tested against the in-process fake ElectrumX server in `tests/PalladiumWallet.Tests/Net/FakeElectrumServer.cs` (loopback TCP + optional TLS, per-method handlers, call counters): extend that, don't mock the client — it isn't an interface, by design. Two `internal` test seams (visible via `InternalsVisibleTo`) sandbox the remaining externals: `UpdateChecker.CheckAsync` takes an optional `HttpMessageHandler` (never hit GitHub from a test), and `AppPaths.BootstrapDirOverride`/`PortableBaseOverride`/`DefaultRootOverride` redirect the machine-global path locations (tests touching them share the xUnit collection `"AppPaths"` because that state is static).
+- **Test** (headless, primary verification layer): `dotnet test`
- GUI hot reload: `dotnet watch --project src/App.Desktop` (on WSL2/WSLg the window shows on the Windows desktop, no graphics dependencies to install)
+  - Single test: `dotnet test --filter "FullyQualifiedName~TestName"`
- CLI: `dotnet run --project src/Cli -- <command>` (no args → usage)
+  - Property-based tests (CsCheck, `PropertyTests.cs`) run in the same command, ~30s
- **Release binaries (all 3 targets): `./docker/build.sh [windows|linux|android|all]`** — reproducible builds in Docker (toolchain pinned in `docker/Dockerfile.*`, no SDK needed on host), artifacts in `dist/`, version taken from the App csproj. See `docker/README.md`. Gotchas already encoded there: single-file desktop publishes need `-p:IncludeNativeLibrariesForSelfExtract=true` (without it Avalonia's native libs — Skia/HarfBuzz/ANGLE — stay outside the exe, which then silently fails to start); the android workload dictates the SDK API level (error XA5207 → bump `ANDROID_SDK_PLATFORM` in `Dockerfile.android`). Android release builds need a persistent signing keystore, generated once with `docker/keystore/generate-keystore.sh` (never committed — see `docker/keystore/README.md`): without it every build gets a different random signature and users must uninstall the old app to receive an update instead of updating in place.
+  - Coverage: `dotnet test tests/PalladiumWallet.Tests --collect:"XPlat Code Coverage"` (coverlet, Cobertura XML)
- Manual Windows publish: `dotnet publish src/App.Desktop -r win-x64 -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true --self-contained`
+  - Test tree mirrors `src/Core` (`Chain/ Crypto/ Net/ Spv/ Storage/ Wallet/`) — put new tests in the folder matching the code under test
- Manual Linux publish: same with `-r linux-x64` (single-file binary; AppImage via PupNet Deploy is a future step, no pupnet.conf yet)
+  - Network/SPV code (`ElectrumClient`, `WalletSynchronizer`, `TransactionInspector`, TOFU pinning): test against the in-process fake server `tests/PalladiumWallet.Tests/Net/FakeElectrumServer.cs` (loopback TCP + optional TLS, per-method handlers, call counters) — extend that, don't mock the client (it isn't an interface, by design)
  - Two `internal` test seams (via `InternalsVisibleTo`) sandbox the remaining externals: `UpdateChecker.CheckAsync` takes an optional `HttpMessageHandler` (never hit GitHub from a test); `AppPaths.BootstrapDirOverride`/`PortableBaseOverride`/`DefaultRootOverride` redirect the machine-global path locations (tests using them share xUnit collection `"AppPaths"` because that state is static)
 - **Fuzzing** (`tests/PalladiumWallet.Fuzz`, SharpFuzz): one target per untrusted-input parser (`header merkle slip132 bip39 address coinamount walletdoc encfile peers`), each encoding that parser's error contract — any other escaping exception is a finding
  - Seed corpus (incl. regression inputs for past findings) replays inside `dotnet test` via `FuzzCorpusTests`
  - Quick smoke without tooling: `dotnet run --project tests/PalladiumWallet.Fuzz -- <target> --random 50000`
  - Coverage-guided campaign: `tests/PalladiumWallet.Fuzz/fuzz.sh <target>` (needs afl++ + the SharpFuzz.CommandLine tool)
  - After fixing a finding: add the crashing input to `SeedCorpus` in the fuzz project's `Program.cs` and regenerate with `--make-seeds Corpus`
 - **GUI hot reload:** `dotnet watch --project src/App.Desktop` (on WSL2/WSLg the window shows on the Windows desktop, no graphics dependencies to install)
 - **CLI:** `dotnet run --project src/Cli -- <command>` (no args → usage)
 - **Release binaries (all 3 targets):** `./docker/build.sh [windows|linux|android|all]` — reproducible Docker builds (toolchain pinned in `docker/Dockerfile.*`, no SDK needed on host), artifacts in `dist/`, version taken from the App csproj (details in `docker/README.md`)
  - Single-file desktop publish needs `-p:IncludeNativeLibrariesForSelfExtract=true` or Avalonia's native libs (Skia/HarfBuzz/ANGLE) stay outside the exe and it silently fails to start
  - Android workload dictates the SDK API level — error XA5207 → bump `ANDROID_SDK_PLATFORM` in `Dockerfile.android`
  - Android release builds need a persistent signing keystore, generated once with `docker/keystore/generate-keystore.sh` (never commit it, see `docker/keystore/README.md`) — without it every build gets a random signature and users must uninstall to update instead of updating in place
 - **Manual publish:** `dotnet publish src/App.Desktop -r win-x64|linux-x64 -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true --self-contained` (AppImage via PupNet Deploy is a future step, no pupnet.conf yet)
-**Android (apk).** Needs the `android` workload (`dotnet workload install android`), a JDK
+**Android (apk):** needs the `android` workload (`dotnet workload install android`), a JDK (`JAVA_HOME`), and the Android SDK (`ANDROID_HOME`, or pass `-p:AndroidSdkDirectory=...`; a plain solution-level `dotnet build` needs it too).
-(`JAVA_HOME`), and the Android SDK. To provision the SDK once:
+- Provision once: `dotnet build src/App.Android -t:InstallAndroidDependencies -p:AndroidSdkDirectory=$HOME/android-sdk -p:AcceptAndroidSDKLicenses=true`
-`dotnet build src/App.Android -t:InstallAndroidDependencies -p:AndroidSdkDirectory=$HOME/android-sdk -p:AcceptAndroidSDKLicenses=true`.
+- Debug apk: `JAVA_HOME=<jdk> dotnet build src/App.Android -c Debug -t:SignAndroidPackage -p:AndroidSdkDirectory=$HOME/android-sdk` → `src/App.Android/bin/Debug/net10.0-android/*-Signed.apk`
-Then build a debug apk (output in `src/App.Android/bin/Debug/net10.0-android/*-Signed.apk`):
+- Head is an app, not a library (`<OutputType>Exe</OutputType>`); min SDK 23 (AndroidX requirement)
 `JAVA_HOME=<jdk> dotnet build src/App.Android -c Debug -t:SignAndroidPackage -p:AndroidSdkDirectory=$HOME/android-sdk`
 (set `ANDROID_HOME` to skip the `-p:AndroidSdkDirectory` flag). The head is an application,
 not a library, because it sets `<OutputType>Exe</OutputType>`; min SDK 23 (AndroidX requirement).
 Note: a plain `dotnet build` at the solution level needs the Android SDK path for the Android head.
 **CLI** (`src/Cli`): `create`/`restore`/`restore-xpub`/`info`; `sync`/`send`/`servers`/`reset-certs` (`--server host:port [--ssl]`); `newseed`/`addresses`. Default wallet file `~/.palladium-wallet/<network>/wallets/default.wallet.json` (`--file` to change it).
@@ -68,22 +77,28 @@ Note: a plain `dotnet build` at the solution level needs the Android SDK path fo
 - **Layers:** GUI → wallet domain → SPV/Sync → Network → Cryptography → Persistence; each layer depends only downward.
 - **Network profile:** all chain constants (address prefixes, BIP32 headers, bech32 HRP, genesis, ports, coin_type 746) **centralized in `Core/Chain`** (`ChainProfiles`/`PalladiumNetworks`), selectable per network (mainnet/testnet/regtest). No scattered magic numbers.
- **LWMA / skip PoW:** LWMA difficulty, 2-minute blocks; an SPV client cannot recompute it → `SkipPowValidation = true`, trust anchored to **hardcoded checkpoints**. Custom layer: NBitcoin assumes Bitcoin's retargeting.
+- **LWMA / skip PoW:** LWMA difficulty, 2-minute blocks; an SPV client cannot recompute it → `SkipPowValidation = true`, trust anchored to **hardcoded checkpoints**. This is a custom layer: NBitcoin assumes Bitcoin's retargeting.
 - **NBitcoin vs custom:** NBitcoin covers the custom network, BIP32/39, addresses, transactions, PSBT, signing, encoding, hashing — **do not reimplement these**. Hand-written custom code: JSON-RPC client for the indexing server (ElectrumX-like); SPV sync with Merkle verification; header/checkpoint validation; coin selection and fee policy; versioned encrypted JSON wallet file.
 - **PSBT-centric:** every signing flow goes through PSBT (offline/air-gapped/multisig/hardware).
 - **Ports:** 50001/50002 = indexing server (what the SPV wallet talks to), **not** the node's P2P port (2333).
 ## GUI conventions (`src/App`)
- **Shared `MainView` + heads:** the whole UI is a single `MainView` (UserControl), so it works both as a desktop window's content and as Android's single-view root. Top-level APIs (file/folder picker, clipboard) are reached via `TopLevel.GetTopLevel(this)` since a UserControl doesn't expose them. `MainWindowViewModel.IsDesktop` (from `OperatingSystem.IsAndroid()`) hides filesystem-only features (open-from-file; the data-location wizard step auto-skips on Android because the head sets `AppPaths.OverrideDataRoot`).
+- **Shared `MainView` + heads:** the whole UI is a single `MainView` (UserControl), working both as a desktop window's content and as Android's single-view root.
- **Single ViewModel** `MainWindowViewModel` (CommunityToolkit.Mvvm: `[ObservableProperty]`, `[RelayCommand]`); `Core` is driven directly from here. It is split into **partial classes by feature** (`MainWindowViewModel.Send.cs`, `.Receive.cs`, `.Sync.cs`, `.Settings.cs`, `.Wizard.cs`, `.Contacts.cs`, `.Update.cs`, …): new feature logic goes in the matching partial (or a new one), not in the main file.
+  - Top-level APIs (file/folder picker, clipboard) are reached via `TopLevel.GetTopLevel(this)` since a UserControl doesn't expose them.
- **In-app overlays, not OS windows:** details (address, transaction), settings, and help are full-screen `Border`s gated by an `IsXxxOpen` flag, not separate `Window`s — instant open/close, mobile-friendly, and popups/top-levels are slow on WSLg. Pattern: bool property + Open/Close commands + backdrop handler and Esc key in `MainView`'s code-behind; overlay close buttons bind via `$parent[UserControl]` (not `$parent[Window]`, absent on mobile). Heavy network work runs off the UI thread (`Task.Run`) so the overlay never freezes.
+  - `MainWindowViewModel.IsDesktop` (from `OperatingSystem.IsAndroid()`) hides filesystem-only features (open-from-file; the data-location wizard step auto-skips on Android because the head sets `AppPaths.OverrideDataRoot`).
 - **Single ViewModel** `MainWindowViewModel` (CommunityToolkit.Mvvm: `[ObservableProperty]`, `[RelayCommand]`); `Core` is driven directly from here.
  - Split into **partial classes by feature** (`MainWindowViewModel.Send.cs`, `.Receive.cs`, `.Sync.cs`, `.Settings.cs`, `.Wizard.cs`, `.Contacts.cs`, `.Update.cs`, …): new feature logic goes in the matching partial (or a new one), not in the main file.
 - **In-app overlays, not OS windows:** details (address, transaction), settings, and help are full-screen `Border`s gated by an `IsXxxOpen` flag, not separate `Window`s — instant open/close, mobile-friendly, and popups/top-levels are slow on WSLg.
  - Pattern: bool property + Open/Close commands + backdrop handler and Esc key in `MainView`'s code-behind; overlay close buttons bind via `$parent[UserControl]` (not `$parent[Window]`, absent on mobile).
  - Heavy network work runs off the UI thread (`Task.Run`) so the overlay never freezes.
 - **Localization:** `Localization/Loc.cs`, key→6 languages dictionary (it/en/es/fr/pt/de); in XAML `{Binding Loc[key]}`, in C# `Loc.Tr("key")`. On language change the `Loc` instance is replaced.
- **App version:** single source = `<Version>` in `src/App/PalladiumWallet.App.csproj`; read at runtime (`MainWindowViewModel.AppVersion`) and shown in the title. On startup `Core/Net/UpdateChecker.cs` compares it against the latest GitHub release and `MainWindowViewModel.Update.cs` prompts the user if newer.
+- **App version:** single source is `<Version>` in `src/App/PalladiumWallet.App.csproj`, read at runtime (`MainWindowViewModel.AppVersion`) and shown in the title. `Core/Net/UpdateChecker.cs` compares it against the latest GitHub release on startup; `MainWindowViewModel.Update.cs` prompts the user if newer.
 - **Storage paths:** `Core/Storage/AppPaths` resolves data locations; `AppPaths.OverrideDataRoot` (top priority) is the per-platform seam — the Android head sets it to the app sandbox (`Context.FilesDir`), desktop leaves it null.
 ## Working rules
 - **Cross-implementation tests:** compare addresses, txids, and PSBTs against a reference wallet (golden vectors). A different address or txid is a blocking bug.
- **Security:** seed and private keys never in plaintext on disk/logs/network; every server response validated with Merkle + checkpoints; watch-only truly read-only. `SECURITY.md` is the published threat model (SPV trust boundaries, encryption parameters, key handling): any change to crypto, SPV validation, or key/seed handling must keep it accurate in the same commit.
+- **Security:** seed and private keys never in plaintext on disk/logs/network; every server response validated with Merkle + checkpoints; watch-only truly read-only. `SECURITY.md` is the published threat model (SPV trust boundaries, encryption parameters, key handling) — any change to crypto, SPV validation, or key/seed handling must keep it accurate in the same commit.
- **Releases:** bump the version with `./update-version.sh` (interactive) — it updates `<Version>` in the App csproj (the single source), mirrors `ApplicationDisplayVersion` in the Android head, increments `ApplicationVersion` (Android versionCode, which **must strictly increase** every release or users can't update in place), and stubs a `CHANGELOG.md` entry. Fill in that entry before/with the tag — it's the technical record of what shipped, not optional bookkeeping — then commit and tag manually.
+- **Releases:** `./update-version.sh` (interactive) updates `<Version>` in the App csproj (single source), mirrors `ApplicationDisplayVersion` in the Android head, increments `ApplicationVersion` (Android versionCode, **must strictly increase** or users can't update in place), and stubs a `CHANGELOG.md` entry
  - Fill in the changelog entry before/with the tag — it's the technical record of what shipped, not optional bookkeeping — then commit and tag manually
@@ -5,6 +5,108 @@ Technical changelog for PalladiumWallet. Format loosely follows
 by subsystem rather than strictly by date, since `0.9.0` is the first
 release and covers the full history from the initial commit.
 ## [1.0.0] — 2026-07-09
 First stable release. Closes the last open security gap from 0.9.x (header
 trust was not actually anchored to any checkpoint), fixes several crash
 paths found by a new fuzzing harness, and adds OP_RETURN/coinbase-tag
 decoding to the transaction detail view.
 ### Security
 - `WalletSynchronizer.AnchorToCheckpointAsync`: header trust is now actually
  anchored to `ChainProfiles.Mainnet.Checkpoints` (24 real `[height, hash,
  bits]` checkpoints pulled from a fully-synced node, every 20,000 blocks
  plus one near tip). Previously the checkpoint array was empty and the
  methods meant to enforce it (`MatchesCheckpoint`/`IsValidChild`) were
  never called — on this LWMA chain, where PoW can't be recomputed
  client-side, a malicious or eclipsing server could hand back any
  internally-consistent header for a Merkle proof with nothing tying it to
  the real chain. For every header used in a Merkle proof, the intervening
  headers are now downloaded back to the nearest checkpoint and verified as
  an unbroken prev-hash chain terminating in that checkpoint's exact hash
  (memoized per sync session). Testnet/Regtest remain unanchored (no node
  available to source checkpoints from); a missing checkpoint is a no-op,
  not a failure.
 - New fuzzing harness (`tests/PalladiumWallet.Fuzz`, SharpFuzz-based): one
  target per untrusted-input parser (header, Merkle proof, peer list,
  wallet file, mnemonic/key/address/amount), each encoding that parser's
  documented error contract. Found and fixed:
  - `Bip39.TryParse` threw `NotSupportedException` on text resembling no
    wordlist instead of failing gracefully.
  - `ElectrumApi.ParsePeers` threw on any `server.peers.subscribe` response
    shape other than the expected `[ip, hostname, [features...]]`, and on a
    JSON string containing invalid UTF-8.
  - `EncryptedFile.Decrypt` let a tampered/corrupted wallet file escape as
    raw `JsonException`/`FormatException`/`ArgumentNullException` instead of
    the documented `WrongPasswordException`/`InvalidDataException`
    contract; worse, the PBKDF2 iteration count was read from the
    (attacker-controlled) container with no upper bound — a tampered file
    demanding e.g. 2³¹ iterations would hang the wallet on open. Iteration
    count is now clamped to 10,000,000.
  - `CertificatePinStore.Load`: a corrupted pin file blocked every SSL
    connection until manually deleted; now falls back to first-contact
    TOFU like `ServerRegistry` already did.
  - The seed corpus (incl. a regression input per fixed finding) replays
    inside `dotnet test` via `FuzzCorpusTests`, so a fix can't silently
    regress.
 - `SECURITY.md` corrected: PBKDF2 parameters (600,000 iterations / 16-byte
  salt, not the pre-hardening 100,000 / 32-byte), a stale file reference,
  and disclosure of the AI-assisted testing methodology used (adversarial
  fake-server simulation, property-based fuzzing, targeted security
  review) as a complement to, not a replacement for, independent review.
 ### Added
 - Transaction detail view now decodes OP_RETURN output payloads (UTF-8, or
  hex if the bytes aren't valid text — multiple OP_RETURN outputs in one tx
  are each decoded independently) and coinbase scriptSig pool tags (e.g.
  `/slush/`, extracted as printable-ASCII runs amid the binary BIP34
  height/extranonce). Both were previously dropped entirely — discarded
  once no destination address could be derived from the script.
 - Help overlay: "User guide" button next to "Report a bug", linking to
  `USERGUIDE.md` on GitHub.
 - `USERGUIDE.md`: full end-user reference for GUI and CLI (wizard flows,
  script types, fees, gap limit, TOFU cert pinning, CLI commands) with the
  exact numbers the software enforces.
 ### Fixed
 - Send/Donate/Sync/Wizard view models wrote status/error strings directly
  in Italian regardless of the active language; routed through `Loc` with
  the missing keys added. `CertificatePinMismatchException` no longer
  bakes an Italian message into `.Message` — it exposes `Host`/`Port` for
  the UI to translate.
 - CLI (`src/Cli/Program.cs`) printed all output in Italian regardless of
  the code/docs-are-English-only policy; translated every user-facing
  string and comment.
 ### Testing
 - Test suite expanded from 307 to 392 tests, closing coverage gaps in:
  checkpoint-anchoring (including the memoization and non-generic-retry
  branches), the PoW-checked branch of `BlockHeaderInfo.IsValidChild`
  (never run since every profile sets `SkipPowValidation`), all 8 BIP-39
  wordlist languages plus the empty-input guard, SLIP-132 rejection of
  malformed/corrupted keys, `TransactionFactory`'s standardness-policy
  rejection, `ImportedKeyAccount`'s fund-safety fallbacks,
  `WalletLoader`'s defensive branches for corrupted files,
  `PalladiumNetworks.For`/`INetworkSet`, `AppPaths`' full data-root
  precedence chain (via new internal override seams), `UpdateChecker`
  end-to-end via a stub-transport seam, and `ElectrumClient`'s
  multi-segment response dispatch.
 - OP_RETURN/coinbase-tag decoding covered: UTF-8 text, binary fallback to
  hex, multiple OP_RETURN outputs in one tx, pool-tag extraction, and the
  absence of false positives on standard outputs/inputs.
 ### Documentation
 - `AGENTS.md`/`CLAUDE.md` re-synced (had drifted) and reformatted from
  dense prose to scannable bullet lists; a stale `SECURITY.md` file
  reference fixed.
 - `README.md` test-coverage section and `SECURITY.md` updated to describe
  the checkpoint anchoring and fuzzing guarantees actually enforced now.
 ## [0.9.1] — 2026-07-02
 ### Testing
@@ -6,20 +6,22 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 ## Role
-Operate as an **expert in cryptocurrencies and cryptography**: reason with the domain's rigor about UTXO consensus, HD key derivation (BIP32/39/SLIP-132), signature schemes and scripts (P2PKH/P2SH/P2WPKH, PSBT), address encoding (base58/bech32), Merkle/SPV proofs, and at-rest encryption. When a choice touches cryptographic correctness or fund safety, judge it through that lens and flag known risks and pitfalls (nonce reuse, missing validation, exposed keys/seed, wrong fee/coin-selection, unverified server responses). Explain trade-offs with technical precision; never take for granted what hasn't been verified.
+Operate as an **expert in cryptocurrencies and cryptography**: reason with domain rigor about UTXO consensus, HD key derivation (BIP32/39/SLIP-132), signature schemes and scripts (P2PKH/P2SH/P2WPKH, PSBT), address encoding (base58/bech32), Merkle/SPV proofs, and at-rest encryption. When a choice touches cryptographic correctness or fund safety, judge it through that lens and flag known risks (nonce reuse, missing validation, exposed keys/seed, wrong fee/coin-selection, unverified server responses). Explain trade-offs with technical precision; never take for granted what hasn't been verified.
 ## Language policy
 - **Conversation with the user**: Italian.
- **All code, comments, commit messages, and documentation files**: English only.
+- **Code, comments, commit messages, documentation files**: English only.
 ## How to assist
-On **every requested change**, before implementing, judge whether it makes sense and say so plainly: if a request is useful and consistent with the project, proceed; if it is useless, redundant, already covered elsewhere, or risks degrading the code, **say so** with a short rationale and propose the better alternative (or doing nothing). No automatic agreement — an honest opinion is worth more than blind execution.
+Before implementing any requested change, judge whether it makes sense and say so plainly. Useful and consistent with the project → proceed. Useless, redundant, already covered elsewhere, or likely to degrade the code → say so with a short rationale and propose the better alternative (or doing nothing). No automatic agreement — an honest opinion is worth more than blind execution.
 After implementing a **new feature**, propose the tests needed for proper coverage (unit tests for the new logic, edge cases, error paths; property-based tests where invariants apply; integration tests against `FakeElectrumServer` if network/SPV code is involved; a fuzz target if a new untrusted-input parser was added) — don't just write the feature and stop there.
 ## What it is
-SPV wallet (Sparrow-style) for the **Palladium (PLM)** cryptocurrency, a Bitcoin-derived UTXO chain. Targets desktop (Windows/Linux) and Android, from the same source. Lightning is excluded from the first release.
+SPV wallet (Sparrow-style) for the **Palladium (PLM)** cryptocurrency, a Bitcoin-derived UTXO chain. Targets desktop (Windows/Linux) and Android from the same source. Lightning is excluded from the first release.
 ## Stack and structure
@@ -34,33 +36,40 @@ src/Cli/          CLI on the same Core            tests/   xUnit
 docker/           reproducible release builds (build.sh + pinned Dockerfiles) → dist/
 ```
-The Avalonia UI lives **once** in `src/App` (a library); the two heads only carry the
+- The Avalonia UI lives **once** in `src/App` (a library); the two heads only carry the per-platform entry point and packages.
-per-platform entry point and packages. `MainView` (UserControl) is the shared root, hosted
+- `MainView` (UserControl) is the shared root, hosted by `MainWindow` on desktop and as the single-view root on Android.
-by `MainWindow` on desktop and as the single-view root on Android.
+- **Non-negotiable dependency rule:** `App`/`Cli` depend only on `Core`; the UI reaches network/cryptography only through the wallet domain, never directly. `Core` knows nothing about the UI.
 **Non-negotiable dependency rule:** `App`/`Cli` depend only on `Core`; the UI goes through the wallet domain, never directly through network or cryptography. `Core` knows nothing about the UI.
 ## Commands
-.NET 10 SDK lives in `~/.dotnet10`: in non-interactive shells, before any `dotnet` command run
+.NET 10 SDK lives in `~/.dotnet10` — in non-interactive shells, before any `dotnet` command run
 `export PATH="$HOME/.dotnet10:$PATH" DOTNET_ROOT="$HOME/.dotnet10"`.
- Build: `dotnet build`
+- **Build:** `dotnet build`
- Tests (headless, the primary verification layer): `dotnet test` — single: `dotnet test --filter "FullyQualifiedName~TestName"`; property-based tests (CsCheck, `PropertyTests.cs`) run in the same command and take ~30 s; coverage: `dotnet test tests/PalladiumWallet.Tests --collect:"XPlat Code Coverage"` (coverlet, Cobertura XML). The test tree mirrors `src/Core` (`Chain/ Crypto/ Net/ Spv/ Storage/ Wallet/`) — put new tests in the folder matching the code under test. Network/SPV code (`ElectrumClient`, `WalletSynchronizer`, `TransactionInspector`, TOFU pinning) is tested against the in-process fake ElectrumX server in `tests/PalladiumWallet.Tests/Net/FakeElectrumServer.cs` (loopback TCP + optional TLS, per-method handlers, call counters): extend that, don't mock the client — it isn't an interface, by design. Two `internal` test seams (visible via `InternalsVisibleTo`) sandbox the remaining externals: `UpdateChecker.CheckAsync` takes an optional `HttpMessageHandler` (never hit GitHub from a test), and `AppPaths.BootstrapDirOverride`/`PortableBaseOverride`/`DefaultRootOverride` redirect the machine-global path locations (tests touching them share the xUnit collection `"AppPaths"` because that state is static).
+- **Test** (headless, primary verification layer): `dotnet test`
- GUI hot reload: `dotnet watch --project src/App.Desktop` (on WSL2/WSLg the window shows on the Windows desktop, no graphics dependencies to install)
+  - Single test: `dotnet test --filter "FullyQualifiedName~TestName"`
- CLI: `dotnet run --project src/Cli -- <command>` (no args → usage)
+  - Property-based tests (CsCheck, `PropertyTests.cs`) run in the same command, ~30s
- **Release binaries (all 3 targets): `./docker/build.sh [windows|linux|android|all]`** — reproducible builds in Docker (toolchain pinned in `docker/Dockerfile.*`, no SDK needed on host), artifacts in `dist/`, version taken from the App csproj. See `docker/README.md`. Gotchas already encoded there: single-file desktop publishes need `-p:IncludeNativeLibrariesForSelfExtract=true` (without it Avalonia's native libs — Skia/HarfBuzz/ANGLE — stay outside the exe, which then silently fails to start); the android workload dictates the SDK API level (error XA5207 → bump `ANDROID_SDK_PLATFORM` in `Dockerfile.android`). Android release builds need a persistent signing keystore, generated once with `docker/keystore/generate-keystore.sh` (never committed — see `docker/keystore/README.md`): without it every build gets a different random signature and users must uninstall the old app to receive an update instead of updating in place.
+  - Coverage: `dotnet test tests/PalladiumWallet.Tests --collect:"XPlat Code Coverage"` (coverlet, Cobertura XML)
- Manual Windows publish: `dotnet publish src/App.Desktop -r win-x64 -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true --self-contained`
+  - Test tree mirrors `src/Core` (`Chain/ Crypto/ Net/ Spv/ Storage/ Wallet/`) — put new tests in the folder matching the code under test
- Manual Linux publish: same with `-r linux-x64` (single-file binary; AppImage via PupNet Deploy is a future step, no pupnet.conf yet)
+  - Network/SPV code (`ElectrumClient`, `WalletSynchronizer`, `TransactionInspector`, TOFU pinning): test against the in-process fake server `tests/PalladiumWallet.Tests/Net/FakeElectrumServer.cs` (loopback TCP + optional TLS, per-method handlers, call counters) — extend that, don't mock the client (it isn't an interface, by design)
  - Two `internal` test seams (via `InternalsVisibleTo`) sandbox the remaining externals: `UpdateChecker.CheckAsync` takes an optional `HttpMessageHandler` (never hit GitHub from a test); `AppPaths.BootstrapDirOverride`/`PortableBaseOverride`/`DefaultRootOverride` redirect the machine-global path locations (tests using them share xUnit collection `"AppPaths"` because that state is static)
 - **Fuzzing** (`tests/PalladiumWallet.Fuzz`, SharpFuzz): one target per untrusted-input parser (`header merkle slip132 bip39 address coinamount walletdoc encfile peers`), each encoding that parser's error contract — any other escaping exception is a finding
  - Seed corpus (incl. regression inputs for past findings) replays inside `dotnet test` via `FuzzCorpusTests`
  - Quick smoke without tooling: `dotnet run --project tests/PalladiumWallet.Fuzz -- <target> --random 50000`
  - Coverage-guided campaign: `tests/PalladiumWallet.Fuzz/fuzz.sh <target>` (needs afl++ + the SharpFuzz.CommandLine tool)
  - After fixing a finding: add the crashing input to `SeedCorpus` in the fuzz project's `Program.cs` and regenerate with `--make-seeds Corpus`
 - **GUI hot reload:** `dotnet watch --project src/App.Desktop` (on WSL2/WSLg the window shows on the Windows desktop, no graphics dependencies to install)
 - **CLI:** `dotnet run --project src/Cli -- <command>` (no args → usage)
 - **Release binaries (all 3 targets):** `./docker/build.sh [windows|linux|android|all]` — reproducible Docker builds (toolchain pinned in `docker/Dockerfile.*`, no SDK needed on host), artifacts in `dist/`, version taken from the App csproj (details in `docker/README.md`)
  - Single-file desktop publish needs `-p:IncludeNativeLibrariesForSelfExtract=true` or Avalonia's native libs (Skia/HarfBuzz/ANGLE) stay outside the exe and it silently fails to start
  - Android workload dictates the SDK API level — error XA5207 → bump `ANDROID_SDK_PLATFORM` in `Dockerfile.android`
  - Android release builds need a persistent signing keystore, generated once with `docker/keystore/generate-keystore.sh` (never commit it, see `docker/keystore/README.md`) — without it every build gets a random signature and users must uninstall to update instead of updating in place
 - **Manual publish:** `dotnet publish src/App.Desktop -r win-x64|linux-x64 -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true --self-contained` (AppImage via PupNet Deploy is a future step, no pupnet.conf yet)
-**Android (apk).** Needs the `android` workload (`dotnet workload install android`), a JDK
+**Android (apk):** needs the `android` workload (`dotnet workload install android`), a JDK (`JAVA_HOME`), and the Android SDK (`ANDROID_HOME`, or pass `-p:AndroidSdkDirectory=...`; a plain solution-level `dotnet build` needs it too).
-(`JAVA_HOME`), and the Android SDK. To provision the SDK once:
+- Provision once: `dotnet build src/App.Android -t:InstallAndroidDependencies -p:AndroidSdkDirectory=$HOME/android-sdk -p:AcceptAndroidSDKLicenses=true`
-`dotnet build src/App.Android -t:InstallAndroidDependencies -p:AndroidSdkDirectory=$HOME/android-sdk -p:AcceptAndroidSDKLicenses=true`.
+- Debug apk: `JAVA_HOME=<jdk> dotnet build src/App.Android -c Debug -t:SignAndroidPackage -p:AndroidSdkDirectory=$HOME/android-sdk` → `src/App.Android/bin/Debug/net10.0-android/*-Signed.apk`
-Then build a debug apk (output in `src/App.Android/bin/Debug/net10.0-android/*-Signed.apk`):
+- Head is an app, not a library (`<OutputType>Exe</OutputType>`); min SDK 23 (AndroidX requirement)
 `JAVA_HOME=<jdk> dotnet build src/App.Android -c Debug -t:SignAndroidPackage -p:AndroidSdkDirectory=$HOME/android-sdk`
 (set `ANDROID_HOME` to skip the `-p:AndroidSdkDirectory` flag). The head is an application,
 not a library, because it sets `<OutputType>Exe</OutputType>`; min SDK 23 (AndroidX requirement).
 Note: a plain `dotnet build` at the solution level needs the Android SDK path for the Android head.
 **CLI** (`src/Cli`): `create`/`restore`/`restore-xpub`/`info`; `sync`/`send`/`servers`/`reset-certs` (`--server host:port [--ssl]`); `newseed`/`addresses`. Default wallet file `~/.palladium-wallet/<network>/wallets/default.wallet.json` (`--file` to change it).
@@ -68,22 +77,28 @@ Note: a plain `dotnet build` at the solution level needs the Android SDK path fo
 - **Layers:** GUI → wallet domain → SPV/Sync → Network → Cryptography → Persistence; each layer depends only downward.
 - **Network profile:** all chain constants (address prefixes, BIP32 headers, bech32 HRP, genesis, ports, coin_type 746) **centralized in `Core/Chain`** (`ChainProfiles`/`PalladiumNetworks`), selectable per network (mainnet/testnet/regtest). No scattered magic numbers.
- **LWMA / skip PoW:** LWMA difficulty, 2-minute blocks; an SPV client cannot recompute it → `SkipPowValidation = true`, trust anchored to **hardcoded checkpoints**. Custom layer: NBitcoin assumes Bitcoin's retargeting.
+- **LWMA / skip PoW:** LWMA difficulty, 2-minute blocks; an SPV client cannot recompute it → `SkipPowValidation = true`, trust anchored to **hardcoded checkpoints**. This is a custom layer: NBitcoin assumes Bitcoin's retargeting.
 - **NBitcoin vs custom:** NBitcoin covers the custom network, BIP32/39, addresses, transactions, PSBT, signing, encoding, hashing — **do not reimplement these**. Hand-written custom code: JSON-RPC client for the indexing server (ElectrumX-like); SPV sync with Merkle verification; header/checkpoint validation; coin selection and fee policy; versioned encrypted JSON wallet file.
 - **PSBT-centric:** every signing flow goes through PSBT (offline/air-gapped/multisig/hardware).
 - **Ports:** 50001/50002 = indexing server (what the SPV wallet talks to), **not** the node's P2P port (2333).
 ## GUI conventions (`src/App`)
- **Shared `MainView` + heads:** the whole UI is a single `MainView` (UserControl), so it works both as a desktop window's content and as Android's single-view root. Top-level APIs (file/folder picker, clipboard) are reached via `TopLevel.GetTopLevel(this)` since a UserControl doesn't expose them. `MainWindowViewModel.IsDesktop` (from `OperatingSystem.IsAndroid()`) hides filesystem-only features (open-from-file; the data-location wizard step auto-skips on Android because the head sets `AppPaths.OverrideDataRoot`).
+- **Shared `MainView` + heads:** the whole UI is a single `MainView` (UserControl), working both as a desktop window's content and as Android's single-view root.
- **Single ViewModel** `MainWindowViewModel` (CommunityToolkit.Mvvm: `[ObservableProperty]`, `[RelayCommand]`); `Core` is driven directly from here. It is split into **partial classes by feature** (`MainWindowViewModel.Send.cs`, `.Receive.cs`, `.Sync.cs`, `.Settings.cs`, `.Wizard.cs`, `.Contacts.cs`, `.Update.cs`, …): new feature logic goes in the matching partial (or a new one), not in the main file.
+  - Top-level APIs (file/folder picker, clipboard) are reached via `TopLevel.GetTopLevel(this)` since a UserControl doesn't expose them.
- **In-app overlays, not OS windows:** details (address, transaction), settings, and help are full-screen `Border`s gated by an `IsXxxOpen` flag, not separate `Window`s — instant open/close, mobile-friendly, and popups/top-levels are slow on WSLg. Pattern: bool property + Open/Close commands + backdrop handler and Esc key in `MainView`'s code-behind; overlay close buttons bind via `$parent[UserControl]` (not `$parent[Window]`, absent on mobile). Heavy network work runs off the UI thread (`Task.Run`) so the overlay never freezes.
+  - `MainWindowViewModel.IsDesktop` (from `OperatingSystem.IsAndroid()`) hides filesystem-only features (open-from-file; the data-location wizard step auto-skips on Android because the head sets `AppPaths.OverrideDataRoot`).
 - **Single ViewModel** `MainWindowViewModel` (CommunityToolkit.Mvvm: `[ObservableProperty]`, `[RelayCommand]`); `Core` is driven directly from here.
  - Split into **partial classes by feature** (`MainWindowViewModel.Send.cs`, `.Receive.cs`, `.Sync.cs`, `.Settings.cs`, `.Wizard.cs`, `.Contacts.cs`, `.Update.cs`, …): new feature logic goes in the matching partial (or a new one), not in the main file.
 - **In-app overlays, not OS windows:** details (address, transaction), settings, and help are full-screen `Border`s gated by an `IsXxxOpen` flag, not separate `Window`s — instant open/close, mobile-friendly, and popups/top-levels are slow on WSLg.
  - Pattern: bool property + Open/Close commands + backdrop handler and Esc key in `MainView`'s code-behind; overlay close buttons bind via `$parent[UserControl]` (not `$parent[Window]`, absent on mobile).
  - Heavy network work runs off the UI thread (`Task.Run`) so the overlay never freezes.
 - **Localization:** `Localization/Loc.cs`, key→6 languages dictionary (it/en/es/fr/pt/de); in XAML `{Binding Loc[key]}`, in C# `Loc.Tr("key")`. On language change the `Loc` instance is replaced.
- **App version:** single source = `<Version>` in `src/App/PalladiumWallet.App.csproj`; read at runtime (`MainWindowViewModel.AppVersion`) and shown in the title. On startup `Core/Net/UpdateChecker.cs` compares it against the latest GitHub release and `MainWindowViewModel.Update.cs` prompts the user if newer.
+- **App version:** single source is `<Version>` in `src/App/PalladiumWallet.App.csproj`, read at runtime (`MainWindowViewModel.AppVersion`) and shown in the title. `Core/Net/UpdateChecker.cs` compares it against the latest GitHub release on startup; `MainWindowViewModel.Update.cs` prompts the user if newer.
 - **Storage paths:** `Core/Storage/AppPaths` resolves data locations; `AppPaths.OverrideDataRoot` (top priority) is the per-platform seam — the Android head sets it to the app sandbox (`Context.FilesDir`), desktop leaves it null.
 ## Working rules
 - **Cross-implementation tests:** compare addresses, txids, and PSBTs against a reference wallet (golden vectors). A different address or txid is a blocking bug.
- **Security:** seed and private keys never in plaintext on disk/logs/network; every server response validated with Merkle + checkpoints; watch-only truly read-only. `SECURITY.md` is the published threat model (SPV trust boundaries, encryption parameters, key handling): any change to crypto, SPV validation, or key/seed handling must keep it accurate in the same commit.
+- **Security:** seed and private keys never in plaintext on disk/logs/network; every server response validated with Merkle + checkpoints; watch-only truly read-only. `SECURITY.md` is the published threat model (SPV trust boundaries, encryption parameters, key handling) — any change to crypto, SPV validation, or key/seed handling must keep it accurate in the same commit.
- **Releases:** bump the version with `./update-version.sh` (interactive) — it updates `<Version>` in the App csproj (the single source), mirrors `ApplicationDisplayVersion` in the Android head, increments `ApplicationVersion` (Android versionCode, which **must strictly increase** every release or users can't update in place), and stubs a `CHANGELOG.md` entry. Fill in that entry before/with the tag — it's the technical record of what shipped, not optional bookkeeping — then commit and tag manually.
+- **Releases:** `./update-version.sh` (interactive) updates `<Version>` in the App csproj (single source), mirrors `ApplicationDisplayVersion` in the Android head, increments `ApplicationVersion` (Android versionCode, **must strictly increase** or users can't update in place), and stubs a `CHANGELOG.md` entry
  - Fill in the changelog entry before/with the tag — it's the technical record of what shipped, not optional bookkeeping — then commit and tag manually
@@ -1,64 +1,134 @@
-
+
-Microsoft Visual Studio Solution File, Format Version 12.00
+Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 17
+# Visual Studio Version 17
-VisualStudioVersion = 17.0.31903.59
+VisualStudioVersion = 17.0.31903.59
-MinimumVisualStudioVersion = 10.0.40219.1
+MinimumVisualStudioVersion = 10.0.40219.1
-Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{84E60614-5042-48EC-B349-290FB0CA7BA8}"
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{84E60614-5042-48EC-B349-290FB0CA7BA8}"
-EndProject
+EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.Core", "src\Core\PalladiumWallet.Core.csproj", "{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.Core", "src\Core\PalladiumWallet.Core.csproj", "{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}"
-EndProject
+EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.App", "src\App\PalladiumWallet.App.csproj", "{13EE9780-5810-4229-BFCF-6003172534DD}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.App", "src\App\PalladiumWallet.App.csproj", "{13EE9780-5810-4229-BFCF-6003172534DD}"
-EndProject
+EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.Cli", "src\Cli\PalladiumWallet.Cli.csproj", "{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.Cli", "src\Cli\PalladiumWallet.Cli.csproj", "{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}"
-EndProject
+EndProject
-Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{FDF1822C-58D6-4B35-93EA-6A85E1292933}"
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{FDF1822C-58D6-4B35-93EA-6A85E1292933}"
-EndProject
+EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.Tests", "tests\PalladiumWallet.Tests\PalladiumWallet.Tests.csproj", "{C7E79E8E-B1DE-4053-9FB4-853814766CE0}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.Tests", "tests\PalladiumWallet.Tests\PalladiumWallet.Tests.csproj", "{C7E79E8E-B1DE-4053-9FB4-853814766CE0}"
-EndProject
+EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.App.Desktop", "src\App.Desktop\PalladiumWallet.App.Desktop.csproj", "{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.App.Desktop", "src\App.Desktop\PalladiumWallet.App.Desktop.csproj", "{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}"
-EndProject
+EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.App.Android", "src\App.Android\PalladiumWallet.App.Android.csproj", "{BCC5BE4A-B909-4043-B0FB-B5A839349578}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.App.Android", "src\App.Android\PalladiumWallet.App.Android.csproj", "{BCC5BE4A-B909-4043-B0FB-B5A839349578}"
-EndProject
+EndProject
-Global
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PalladiumWallet.Fuzz", "tests\PalladiumWallet.Fuzz\PalladiumWallet.Fuzz.csproj", "{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}"
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+EndProject
-		Debug|Any CPU = Debug|Any CPU
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Core", "Core", "{BF9B33E3-314A-3621-C1F0-AFD074692421}"
-		Release|Any CPU = Release|Any CPU
+EndProject
-	EndGlobalSection
+Global
-	GlobalSection(SolutionProperties) = preSolution
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		HideSolutionNode = FALSE
+		Debug|Any CPU = Debug|Any CPU
-	EndGlobalSection
+		Debug|x64 = Debug|x64
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		Debug|x86 = Debug|x86
-		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
-		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		Release|x64 = Release|x64
-		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		Release|x86 = Release|x86
-		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
-		{13EE9780-5810-4229-BFCF-6003172534DD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{13EE9780-5810-4229-BFCF-6003172534DD}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{13EE9780-5810-4229-BFCF-6003172534DD}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{13EE9780-5810-4229-BFCF-6003172534DD}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Debug|x64.Build.0 = Debug|Any CPU
-		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Debug|x86.Build.0 = Debug|Any CPU
-		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Release|Any CPU.Build.0 = Release|Any CPU
-		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Release|x64.ActiveCfg = Release|Any CPU
-		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Release|x64.Build.0 = Release|Any CPU
-		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Release|x86.ActiveCfg = Release|Any CPU
-		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978}.Release|x86.Build.0 = Release|Any CPU
-		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Release|Any CPU.Build.0 = Release|Any CPU
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Debug|x64.Build.0 = Debug|Any CPU
-		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Debug|x86.Build.0 = Debug|Any CPU
-		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Release|Any CPU.Build.0 = Release|Any CPU
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Release|Any CPU.ActiveCfg = Release|Any CPU
-	EndGlobalSection
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Release|Any CPU.Build.0 = Release|Any CPU
-	GlobalSection(NestedProjects) = preSolution
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Release|x64.ActiveCfg = Release|Any CPU
-		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Release|x64.Build.0 = Release|Any CPU
-		{13EE9780-5810-4229-BFCF-6003172534DD} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Release|x86.ActiveCfg = Release|Any CPU
-		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
+		{13EE9780-5810-4229-BFCF-6003172534DD}.Release|x86.Build.0 = Release|Any CPU
-		{C7E79E8E-B1DE-4053-9FB4-853814766CE0} = {FDF1822C-58D6-4B35-93EA-6A85E1292933}
+		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
+		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{BCC5BE4A-B909-4043-B0FB-B5A839349578} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
+		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Debug|x64.ActiveCfg = Debug|Any CPU
-	EndGlobalSection
+		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Debug|x64.Build.0 = Debug|Any CPU
-EndGlobal
+		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Debug|x86.ActiveCfg = Debug|Any CPU
 		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Debug|x86.Build.0 = Debug|Any CPU
 		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Release|Any CPU.Build.0 = Release|Any CPU
 		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Release|x64.ActiveCfg = Release|Any CPU
 		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Release|x64.Build.0 = Release|Any CPU
 		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Release|x86.ActiveCfg = Release|Any CPU
 		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416}.Release|x86.Build.0 = Release|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Debug|x64.ActiveCfg = Debug|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Debug|x64.Build.0 = Debug|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Debug|x86.ActiveCfg = Debug|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Debug|x86.Build.0 = Debug|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Release|Any CPU.Build.0 = Release|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Release|x64.ActiveCfg = Release|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Release|x64.Build.0 = Release|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Release|x86.ActiveCfg = Release|Any CPU
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0}.Release|x86.Build.0 = Release|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Debug|x64.ActiveCfg = Debug|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Debug|x64.Build.0 = Debug|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Debug|x86.ActiveCfg = Debug|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Debug|x86.Build.0 = Debug|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Release|Any CPU.Build.0 = Release|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Release|x64.ActiveCfg = Release|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Release|x64.Build.0 = Release|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Release|x86.ActiveCfg = Release|Any CPU
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7}.Release|x86.Build.0 = Release|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Debug|x64.ActiveCfg = Debug|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Debug|x64.Build.0 = Debug|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Debug|x86.ActiveCfg = Debug|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Debug|x86.Build.0 = Debug|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Release|Any CPU.Build.0 = Release|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Release|x64.ActiveCfg = Release|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Release|x64.Build.0 = Release|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Release|x86.ActiveCfg = Release|Any CPU
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578}.Release|x86.Build.0 = Release|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Debug|x64.ActiveCfg = Debug|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Debug|x64.Build.0 = Debug|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Debug|x86.ActiveCfg = Debug|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Debug|x86.Build.0 = Debug|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Release|Any CPU.Build.0 = Release|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Release|x64.ActiveCfg = Release|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Release|x64.Build.0 = Release|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Release|x86.ActiveCfg = Release|Any CPU
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
 	EndGlobalSection
 	GlobalSection(NestedProjects) = preSolution
 		{A7D0EF95-B206-4646-99DD-1D2BBB7AF978} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
 		{13EE9780-5810-4229-BFCF-6003172534DD} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
 		{D1AE035A-6DAC-46F4-90FB-F1AE2A79D416} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
 		{C7E79E8E-B1DE-4053-9FB4-853814766CE0} = {FDF1822C-58D6-4B35-93EA-6A85E1292933}
 		{A5D1DD48-7485-43F0-BFE3-2F645EC4D1E7} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
 		{BCC5BE4A-B909-4043-B0FB-B5A839349578} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
 		{BC5932E5-E6F7-42A2-AC39-697C9A737A3C} = {FDF1822C-58D6-4B35-93EA-6A85E1292933}
 		{BF9B33E3-314A-3621-C1F0-AFD074692421} = {84E60614-5042-48EC-B349-290FB0CA7BA8}
 	EndGlobalSection
 EndGlobal
@@ -168,6 +168,18 @@ framing, retries, TLS pinning included — without any external dependency.
 The suite also includes **property-based tests** ([CsCheck](https://github.com/AnthonyLloyd/CsCheck)) in `tests/PalladiumWallet.Tests/PropertyTests.cs`. These generate hundreds of random inputs per test and verify invariants that must hold universally — no crash on arbitrary strings, encrypt/decrypt roundtrip for any plaintext and password, SLIP-132 key roundtrip for every script kind and network, every leaf in a randomly-built Merkle tree verifies against its root. They run automatically with `dotnet test` and take ~30 s.
 ### Fuzzing
 `tests/PalladiumWallet.Fuzz` fuzzes every parser that consumes untrusted input
 (server-supplied headers/proofs/peer lists, wallet files, user-pasted
 keys/mnemonics/addresses/amounts) via [SharpFuzz](https://github.com/Metalnem/sharpfuzz):
 each target enforces the parser's documented error contract, so any other
 exception escaping is a finding. The seed corpus — including a regression input
 for every crash found so far — replays automatically inside `dotnet test`;
 coverage-guided campaigns run separately with afl++ (`tests/PalladiumWallet.Fuzz/fuzz.sh`),
 and a built-in random-mutation mode (`dotnet run -- <target> --random N`) needs
 no external tooling. See `tests/PalladiumWallet.Fuzz/README.md`.
 ---
 ## Building
@@ -55,8 +55,9 @@ It cannot (given correct Merkle verification):
 ## Encryption at rest
 - Algorithm: AES-256-GCM
- Key derivation: PBKDF2-HMAC-SHA512, 600 000 iterations, 16-byte random salt (fresh salt and nonce on every save; the iteration count is stored in the file container, so future increases remain backward-compatible)
+- Key derivation: PBKDF2-HMAC-SHA512, 600 000 iterations, 16-byte random salt (fresh salt and nonce on every save; the iteration count is stored in the file container, so future increases remain backward-compatible — bounded at 10 000 000 on read, since the count is attacker-controlled in a tampered file and an absurd value would hang the wallet at open)
 - Authentication: GCM tag (16 bytes) — any tampering is detected before decryption
 - A malformed container (broken JSON, missing fields, bad base64, wrong nonce/tag size) always fails with a typed `InvalidDataException`, never a raw parser exception — the decrypt path is fuzz-tested (`tests/PalladiumWallet.Fuzz`)
 - The user can explicitly opt out of encryption (UI shows a warning); the `WalletStore.Save` API accepts `null` password only when the caller has confirmed user intent
 ---
@@ -8,8 +8,8 @@
    <Nullable>enable</Nullable>
    <ApplicationId>io.github.davide3011.palladiumwallet</ApplicationId>
    <!-- ApplicationVersion = versionCode (intero), ApplicationDisplayVersion = versionName -->
-    <ApplicationVersion>2</ApplicationVersion>
+    <ApplicationVersion>3</ApplicationVersion>
-    <ApplicationDisplayVersion>0.9.1</ApplicationDisplayVersion>
+    <ApplicationDisplayVersion>1.0.0</ApplicationDisplayVersion>
    <AndroidPackageFormat>apk</AndroidPackageFormat>
    <!-- Includi le assembly .NET DENTRO l'apk: senza, in Debug si usa il Fast
         Deployment (assembly spinte via adb da `dotnet run`) e un apk installato
@@ -63,6 +63,7 @@ public sealed class Loc
        ["help.tab.info"]         = ["Info",                                                               "Info",                         "Info",                                 "Info",                                     "Info",                                     "Info"],
        ["help.tab.donate"]       = ["Dona",                                                               "Donate",                       "Donar",                                "Faire un don",                             "Doar",                                     "Spenden"],
        ["help.bug.report"]       = ["Segnala un bug",                                                     "Report a bug",                 "Informar un error",                    "Signaler un bug",                          "Reportar um bug",                          "Fehler melden"],
        ["help.user.guide"]       = ["Guida utente",                                                       "User guide",                   "Guía del usuario",                     "Guide utilisateur",                        "Guia do usuário",                          "Benutzerhandbuch"],
        ["update.title"]          = ["Aggiornamento disponibile",                                          "Update available",             "Actualización disponible",             "Mise à jour disponible",                   "Atualização disponível",                   "Update verfügbar"],
        ["update.message"]        = ["È disponibile una nuova versione:",                                  "A new version is available:",  "Hay una nueva versión disponible:",    "Une nouvelle version est disponible :",    "Uma nova versão está disponível:",         "Eine neue Version ist verfügbar:"],
        ["update.download"]       = ["Scarica",                                                            "Download",                     "Descargar",                            "Télécharger",                              "Baixar",                                   "Herunterladen"],
@@ -6,7 +6,7 @@
    <TargetFramework>net10.0</TargetFramework>
    <!-- Versione dell'applicazione: unico punto da modificare. Compare nel
         titolo della finestra ed è incisa nei binari pubblicati. -->
-    <Version>0.9.1</Version>
+    <Version>1.0.0</Version>
    <Nullable>enable</Nullable>
    <AvaloniaUseCompiledBindingsByDefault>true</AvaloniaUseCompiledBindingsByDefault>
  </PropertyGroup>
@@ -64,13 +64,17 @@ public sealed class TransactionDetailsViewModel
        RbfText = loc[d.RbfSignaled ? "tx.yes" : "tx.no"];
        Inputs = new ObservableCollection<TxIoRow>(d.Inputs.Select((i, n) => new TxIoRow(
            i.IsCoinbase ? loc["tx.coinbase"] : $"{i.PrevTxid}:{i.PrevIndex}",
-            i.IsCoinbase ? loc["tx.coinbase.newcoins"] : i.Address ?? "—",
+            i.IsCoinbase
                ? i.CoinbaseTag is { Length: > 0 } tag
                    ? $"{loc["tx.coinbase.newcoins"]} — {tag}"
                    : loc["tx.coinbase.newcoins"]
                : i.Address ?? "—",
            i.AmountSats is { } a ? CoinAmount.FormatIn(a, unit) : "—",
            i.IsMine)));
        Outputs = new ObservableCollection<TxIoRow>(d.Outputs.Select(o => new TxIoRow(
            $"#{o.Index}",
-            o.Address ?? $"({o.ScriptType})",
+            o.Address ?? (o.OpReturnText is { Length: > 0 } msg ? $"OP_RETURN: {msg}" : $"({o.ScriptType})"),
            CoinAmount.FormatIn(o.AmountSats, unit),
            o.IsMine)));
    }
@@ -1563,9 +1563,14 @@
                                                   Foreground="{DynamicResource TextSecondaryBrush}"/>
                                    </StackPanel>
                                    <TextBlock Text="{Binding Loc[help.info]}" TextWrapping="Wrap"/>
-                                    <Button Content="{Binding Loc[help.bug.report]}"
+                                    <StackPanel Orientation="Horizontal" Spacing="8">
-                                            Click="OnOpenBugReportClick"
+                                        <Button Content="{Binding Loc[help.bug.report]}"
-                                            HorizontalAlignment="Left"/>
+                                                Click="OnOpenBugReportClick"
                                                HorizontalAlignment="Left"/>
                                        <Button Content="{Binding Loc[help.user.guide]}"
                                                Click="OnOpenUserGuideClick"
                                                HorizontalAlignment="Left"/>
                                    </StackPanel>
                                    <Border BorderBrush="{DynamicResource BorderSubtleBrush}"
                                            BorderThickness="0,1,0,0" Margin="0,4,0,0"/>
                                    <StackPanel Spacing="4">
@@ -144,6 +144,14 @@ public partial class MainView : UserControl
            await launcher.LaunchUriAsync(new Uri(issueUrl));
    }
    private async void OnOpenUserGuideClick(object? sender, RoutedEventArgs e)
    {
        const string userGuideUrl = "https://github.com/davide3011/PalladiumWallet/blob/main/USERGUIDE.md";
        var launcher = TopLevel.GetTopLevel(this)?.Launcher;
        if (launcher is not null)
            await launcher.LaunchUriAsync(new Uri(userGuideUrl));
    }
    private async void OnOpenReleasePageClick(object? sender, RoutedEventArgs e)
    {
        if (DataContext is not MainWindowViewModel vm || string.IsNullOrEmpty(vm.UpdateReleaseUrl)) return;
@@ -58,28 +58,45 @@ public static class Bip39
        // ideographic spaces — the text must not be altered further (§4.1).
        text = text.Trim();
-        IEnumerable<Wordlist> candidates = language is not null
+        Wordlist wordlist;
-            ? [ToWordlist(language.Value)]
+        if (language is not null)
-            : [Wordlist.AutoDetect(text)];
+        {
-
+            wordlist = ToWordlist(language.Value);
-        foreach (var wordlist in candidates)
+        }
        else
        {
            try
            {
-                var parsed = new Mnemonic(text, wordlist);
+                wordlist = Wordlist.AutoDetect(text);
                // The constructor does NOT verify the checksum — explicit check is mandatory.
                if (parsed.IsValidChecksum && parsed.Words.Length is 12 or 15 or 18 or 21 or 24)
                {
                    mnemonic = parsed;
                    return true;
                }
            }
-            catch (FormatException)
+            catch (NotSupportedException)
            {
-                // Words outside the wordlist or invalid count — try the next candidate.
+                // AutoDetect lands on NBitcoin's internal "Unknown" language for
                // text resembling no wordlist and throws instead of returning a
                // default (found by fuzzing) — not a valid mnemonic, plain and simple.
                return false;
            }
        }
        try
        {
            var parsed = new Mnemonic(text, wordlist);
            // The constructor does NOT verify the checksum — explicit check is mandatory.
            if (parsed.IsValidChecksum && parsed.Words.Length is 12 or 15 or 18 or 21 or 24)
            {
                mnemonic = parsed;
                return true;
            }
        }
        catch (FormatException)
        {
            // Words outside the wordlist or invalid count.
        }
        catch (NotSupportedException)
        {
            // Defensive: same NBitcoin failure mode surfacing from the constructor.
        }
        return false;
    }
@@ -124,17 +124,22 @@ public static class ElectrumApi
    /// Parses the server.peers.subscribe response: a list of
    /// [ip, hostname, ["v1.4.2", "pN", "tPORT", "sPORT", ...]];
    /// "t"/"s" without a number = network default port (resolved by the caller).
    /// The response is untrusted server data: any unexpected shape (non-array,
    /// wrong element types) is skipped, never thrown on.
    /// </summary>
    public static IReadOnlyList<PeerInfo> ParsePeers(JsonElement response)
    {
        var peers = new List<PeerInfo>();
        if (response.ValueKind != JsonValueKind.Array)
            return peers;
        foreach (var entry in response.EnumerateArray())
        {
-            if (entry.ValueKind != JsonValueKind.Array || entry.GetArrayLength() < 3)
+            if (entry.ValueKind != JsonValueKind.Array || entry.GetArrayLength() < 3
                || entry[2].ValueKind != JsonValueKind.Array)
                continue;
-            var host = entry[1].GetString();
+            var host = AsString(entry[1]);
            if (string.IsNullOrWhiteSpace(host))
-                host = entry[0].GetString();
+                host = AsString(entry[0]);
            if (string.IsNullOrWhiteSpace(host))
                continue;
@@ -142,7 +147,7 @@ public static class ElectrumApi
            string? version = null;
            foreach (var feature in entry[2].EnumerateArray())
            {
-                var f = feature.GetString();
+                var f = AsString(feature);
                if (string.IsNullOrEmpty(f))
                    continue;
                switch (f[0])
@@ -157,4 +162,21 @@ public static class ElectrumApi
        }
        return peers;
    }
    private static string? AsString(JsonElement element)
    {
        if (element.ValueKind != JsonValueKind.String)
            return null;
        try
        {
            return element.GetString();
        }
        catch (InvalidOperationException)
        {
            // Syntactically valid JSON string that cannot be transcoded to UTF-16
            // (invalid UTF-8 bytes / lone surrogates) — untrusted server data,
            // treat as absent (found by fuzzing).
            return null;
        }
    }
 }
@@ -13,6 +13,10 @@ public static class EncryptedFile
 {
    private const string Format = "plm-wallet-aesgcm-v1";
    private const int DefaultIterations = 600_000;
    // Upper bound on the iteration count read from the container: the value is
    // attacker-controlled in a tampered file, and an absurd count would hang the
    // wallet at open (PBKDF2 DoS). Leaves ample room for future increases.
    private const int MaxIterations = 10_000_000;
    private const int SaltSize = 16;
    private const int NonceSize = 12;
    private const int TagSize = 16;
@@ -62,23 +66,51 @@ public static class EncryptedFile
            Convert.ToBase64String(tag), Convert.ToBase64String(cipher)));
    }
-    /// <summary>Throws <see cref="WrongPasswordException"/> if the password is wrong or the file is tampered with.</summary>
+    /// <summary>
    /// Throws <see cref="WrongPasswordException"/> if the password is wrong or the
    /// ciphertext is tampered with, <see cref="InvalidDataException"/> for any
    /// malformed container (broken JSON, missing fields, bad base64, wrong
    /// nonce/tag size, out-of-range iteration count) — never a raw parsing exception.
    /// </summary>
    public static string Decrypt(string fileContent, string password)
    {
-        var container = JsonSerializer.Deserialize<Container>(fileContent)
+        Container? container;
-            ?? throw new InvalidDataException("Contenitore cifrato non valido.");
+        try
        {
            container = JsonSerializer.Deserialize<Container>(fileContent);
        }
        catch (JsonException)
        {
            throw new InvalidDataException("Invalid encrypted container.");
        }
        if (container is null)
            throw new InvalidDataException("Invalid encrypted container.");
        if (container.Format != Format)
-            throw new InvalidDataException($"Formato sconosciuto: {container.Format}");
+            throw new InvalidDataException($"Unknown container format: {container.Format}");
        if (container.Iterations is <= 0 or > MaxIterations)
            throw new InvalidDataException($"Iteration count out of range: {container.Iterations}");
-        var key = DeriveKey(password, Convert.FromBase64String(container.Salt), container.Iterations);
+        byte[] salt, nonce, tag, cipher;
-        var cipher = Convert.FromBase64String(container.Data);
+        try
        {
            salt   = Convert.FromBase64String(container.Salt);
            nonce  = Convert.FromBase64String(container.Nonce);
            tag    = Convert.FromBase64String(container.Tag);
            cipher = Convert.FromBase64String(container.Data);
        }
        catch (Exception ex) when (ex is FormatException or ArgumentNullException)
        {
            throw new InvalidDataException("Invalid encrypted container.");
        }
        if (nonce.Length != NonceSize || tag.Length != TagSize)
            throw new InvalidDataException("Invalid encrypted container.");
        var key = DeriveKey(password, salt, container.Iterations);
        var plain = new byte[cipher.Length];
        try
        {
            using var aes = new AesGcm(key, TagSize);
-            aes.Decrypt(
+            aes.Decrypt(nonce, cipher, tag, plain);
                Convert.FromBase64String(container.Nonce), cipher,
                Convert.FromBase64String(container.Tag), plain);
        }
        catch (AuthenticationTagMismatchException)
        {
@@ -5,12 +5,18 @@ using PalladiumWallet.Core.Spv;
 namespace PalladiumWallet.Core.Wallet;
 /// <summary>An input of a transaction, with the spent output resolved from the server.</summary>
 /// <param name="CoinbaseTag">
 /// Printable ASCII runs (e.g. pool tags like "/slush/") extracted from the coinbase
 /// scriptSig; null for non-coinbase inputs or if no printable text was found.
 /// </param>
 public sealed record TxInputInfo(
-    string PrevTxid, uint PrevIndex, long? AmountSats, string? Address, bool IsMine, bool IsCoinbase);
+    string PrevTxid, uint PrevIndex, long? AmountSats, string? Address, bool IsMine, bool IsCoinbase,
    string? CoinbaseTag = null);
 /// <summary>An output of a transaction.</summary>
 /// <param name="OpReturnText">Decoded OP_RETURN payload (UTF-8, or hex if not valid text); null otherwise.</param>
 public sealed record TxOutputInfo(
-    uint Index, long AmountSats, string? Address, string ScriptType, bool IsMine);
+    uint Index, long AmountSats, string? Address, string ScriptType, string? OpReturnText, bool IsMine);
 /// <summary>
 /// Complete transaction data assembled by querying the server: the raw transaction
@@ -105,8 +111,9 @@ public static class TransactionInspector
        {
            var o = tx.Outputs[i];
            var addr = AddrOf(o.ScriptPubKey);
            var opReturn = addr is null ? OpReturnTextOf(o.ScriptPubKey) : null;
            outputs.Add(new TxOutputInfo(
-                (uint)i, o.Value.Satoshi, addr, ScriptType(o.ScriptPubKey),
+                (uint)i, o.Value.Satoshi, addr, ScriptType(o.ScriptPubKey), opReturn,
                addr is not null && ownedAddresses.Contains(addr)));
        }
@@ -134,7 +141,7 @@ public static class TransactionInspector
        {
            if (tx.IsCoinBase)
            {
-                inputs.Add(new TxInputInfo("", inp.PrevOut.N, null, null, false, true));
+                inputs.Add(new TxInputInfo("", inp.PrevOut.N, null, null, false, true, CoinbaseTagOf(inp.ScriptSig.ToBytes())));
                continue;
            }
@@ -189,4 +196,48 @@ public static class TransactionInspector
        }
        catch { return "—"; }
    }
    /// <summary>Decodes an OP_RETURN output's pushed data as UTF-8 text, falling back to hex if it isn't valid text.</summary>
    private static string? OpReturnTextOf(Script script)
    {
        if (!script.IsUnspendable) return null;
        try
        {
            var data = script.ToOps().Skip(1)
                .Where(op => op.PushData is { Length: > 0 })
                .SelectMany(op => op.PushData)
                .ToArray();
            return data.Length == 0 ? null : DecodeUtf8OrHex(data);
        }
        catch { return null; }
    }
    private static string DecodeUtf8OrHex(byte[] data)
    {
        var text = System.Text.Encoding.UTF8.GetString(data);
        var looksLikeText = !text.Contains('�') && text.All(c => !char.IsControl(c) || c is '\n' or '\r' or '\t');
        return looksLikeText ? text : "0x" + Convert.ToHexString(data);
    }
    /// <summary>
    /// Extracts printable-ASCII runs (≥4 chars) from a coinbase scriptSig, e.g. pool
    /// tags like "/slush/" embedded among the binary BIP34 height and extranonce.
    /// </summary>
    private static string? CoinbaseTagOf(byte[] scriptSig)
    {
        var runs = new List<string>();
        var run = new System.Text.StringBuilder();
        void Flush()
        {
            if (run.Length >= 4) runs.Add(run.ToString());
            run.Clear();
        }
        foreach (var b in scriptSig)
        {
            if (b is >= 0x20 and <= 0x7E) run.Append((char)b);
            else Flush();
        }
        Flush();
        return runs.Count == 0 ? null : string.Join(" ", runs);
    }
 }
@@ -0,0 +1 @@
 plm1qdq3gu2zvg9lyr8gxd6yln4wavc5tlp8prmvfay
@@ -0,0 +1 @@
 hello world
@@ -0,0 +1 @@
 PB6q3PB6q3PB6q3PB6q3PB6q3PB6q3PB6q
@@ -0,0 +1 @@
 abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
@@ -0,0 +1 @@
 Ã¡bÊco Ã¡baco0Ã¡bacoÃ¡bÊ
@@ -0,0 +1 @@
 ábaco ábaco ábaco
@@ -0,0 +1 @@
 0,001
@@ -0,0 +1 @@
 79228162514264337593543950335
@@ -0,0 +1 @@
 1.50000000
@@ -0,0 +1 @@
 {"Format":"plm-wallet-aesgcm-v1","Iterations":2,"Salt":"AAAAAAAAAAAAAAAAAAAAAA==","Nonce":"AAAAAAAAAAAAAAAA","Tag":"AAAAAAAAAAAAAAAAAAAAAA==","Data":"AAAA"}
@@ -0,0 +1 @@
 hello
@@ -0,0 +1 @@
 {"Format":"other","Iterations":2,"Salt":"","Nonce":"","Tag":"","Data":""}
@@ -0,0 +1 @@
 0100000000000000000000000000000000000000000000000000000000000000000000003ba3edfd7a7b12b27ac72c3e67768f617fc81bc3888a51323a9fb8aa4b1e5e4a29ab5f49ffff001d1dac2b7c
@@ -0,0 +1 @@
 [[1,2,3],{"a":1},"x",[["h","n",[42,"t"]]]]
@@ -0,0 +1 @@
 [["1.2.3.4","peer.example",["v1.4.2","p10","t50001","‡50002"]]]
@@ -0,0 +1 @@
 [["1.2.3.4","peer.example",["v1.4.2","p10","t50001","s50002"]]]
@@ -0,0 +1 @@
 not-a-key
@@ -0,0 +1 @@
 xpub661MyMwAqRbcF
@@ -0,0 +1 @@
 zpub6rFR7y4Q2AijBEqTUquhVz398htDFrtymD9xYYfG1m4wAcvPhXNfE3EfH1r1ADqtfSdVCToUG868RvUUkgDKf31mGDtKsAYz2oz2AGutZYs
@@ -0,0 +1 @@
 {"Version":99}
@@ -0,0 +1 @@
 {"Version":1,"Network":"mainnet","ScriptKind":"NativeSegwit"}
@@ -0,0 +1 @@
 hello
@@ -0,0 +1,141 @@
 using System.Text;
 using System.Text.Json;
 using NBitcoin;
 using PalladiumWallet.Core.Chain;
 using PalladiumWallet.Core.Crypto;
 using PalladiumWallet.Core.Net;
 using PalladiumWallet.Core.Spv;
 using PalladiumWallet.Core.Storage;
 using PalladiumWallet.Core.Wallet;
 namespace PalladiumWallet.Fuzz;
 /// <summary>
 /// Fuzz targets over the parsers that consume untrusted input (server responses,
 /// wallet files, user-pasted keys/addresses/amounts). Each target enforces the
 /// parser's error contract: the exception types documented as its failure mode
 /// are swallowed, anything else escapes and is reported as a crash by the fuzzer.
 /// </summary>
 public static class FuzzTargets
 {
    public static readonly IReadOnlyDictionary<string, Action<byte[]>> All =
        new Dictionary<string, Action<byte[]>>
        {
            ["header"] = Header,
            ["merkle"] = Merkle,
            ["slip132"] = Slip132Keys,
            ["bip39"] = Bip39Mnemonic,
            ["address"] = Address,
            ["coinamount"] = CoinAmountParse,
            ["walletdoc"] = WalletDoc,
            ["encfile"] = EncFile,
            ["peers"] = Peers,
        };
    /// <summary>Runs one input through a named target (used by replay and the regression test).</summary>
    public static void Run(string target, byte[] data) => All[target](data);
    private static string Utf8(byte[] data) => Encoding.UTF8.GetString(data);
    // 80-byte block headers arrive from the server both as raw bytes and as hex.
    // Contract: exactly 80 bytes never throws; any other length is ArgumentException;
    // the hex overload may also reject non-hex text with FormatException.
    private static void Header(byte[] data)
    {
        try { BlockHeaderInfo.Parse(data); }
        catch (ArgumentException) when (data.Length != BlockHeaderInfo.Size) { }
        try { BlockHeaderInfo.Parse(Utf8(data)); }
        catch (FormatException) { }
        catch (ArgumentException) { }
    }
    // Merkle proof verification runs on server-supplied txid/pos/branch.
    // Contract: never throws, for any position (including negative) and branch.
    private static void Merkle(byte[] data)
    {
        if (data.Length < 68)
            return;
        var txid = new uint256(data.AsSpan(0, 32));
        var position = BitConverter.ToInt32(data, 32);
        var root = new uint256(data.AsSpan(36, 32));
        var branch = new List<uint256>();
        for (var offset = 68; offset + 32 <= data.Length; offset += 32)
            branch.Add(new uint256(data.AsSpan(offset, 32)));
        MerkleProof.Verify(txid, position, branch, root);
    }
    // SLIP-132 extended keys are pasted by the user on import.
    // Contract: the Try* pair never throws, on any profile.
    private static void Slip132Keys(byte[] data)
    {
        var text = Utf8(data);
        foreach (var profile in new[] { ChainProfiles.Mainnet, ChainProfiles.Testnet, ChainProfiles.Regtest })
        {
            Slip132.TryDecodePublic(text, profile, out _, out _);
            Slip132.TryDecodePrivate(text, profile, out _, out _);
        }
    }
    // Mnemonics are pasted by the user on restore. Contract: TryParse never throws,
    // with auto-detected and explicit wordlist language alike.
    private static void Bip39Mnemonic(byte[] data)
    {
        var text = Utf8(data);
        Bip39.TryParse(text, out _);
        if (data.Length > 0)
            Bip39.TryParse(text, out _, (MnemonicLanguage)(data[0] % 8));
    }
    // Recipient addresses are pasted by the user (or scanned from a QR).
    // Contract: NBitcoin rejects anything invalid with FormatException.
    private static void Address(byte[] data)
    {
        try { BitcoinAddress.Create(Utf8(data), PalladiumNetworks.Mainnet); }
        catch (FormatException) { }
    }
    // Amounts are typed by the user in the currently selected unit.
    // Contract: TryParse* never throws for any of the official units.
    private static void CoinAmountParse(byte[] data)
    {
        var text = Utf8(data);
        foreach (var unit in CoinAmount.Units)
            CoinAmount.TryParseIn(text, unit, out _);
        CoinAmount.TryParseCoins(text, out _);
    }
    // The plaintext wallet document is read from disk at every open.
    // Contract: malformed JSON or schema is JsonException/InvalidDataException.
    private static void WalletDoc(byte[] data)
    {
        try { WalletDocument.FromJson(Utf8(data)); }
        catch (JsonException) { }
        catch (InvalidDataException) { }
    }
    // The encrypted container wraps the document on disk; a tampered file must
    // fail with the two typed exceptions, never a raw parser error, and
    // IsEncrypted (the format sniffer) must never throw at all.
    private static void EncFile(byte[] data)
    {
        var text = Utf8(data);
        EncryptedFile.IsEncrypted(text);
        try { EncryptedFile.Decrypt(text, "fuzz-password"); }
        catch (WrongPasswordException) { }
        catch (InvalidDataException) { }
    }
    // server.peers.subscribe responses are attacker-controlled JSON.
    // Contract: any well-formed JSON of any shape parses to a (possibly empty)
    // peer list without throwing.
    private static void Peers(byte[] data)
    {
        JsonDocument doc;
        try { doc = JsonDocument.Parse(data); }
        catch (JsonException) { return; }
        using (doc)
            ElectrumApi.ParsePeers(doc.RootElement);
    }
 }
@@ -0,0 +1,24 @@
 <Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net10.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <IsPackable>false</IsPackable>
    <!-- Fuzzing wants stable, non-inlined instrumentation points. -->
    <TieredCompilation>false</TieredCompilation>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="SharpFuzz" Version="2.3.0" />
    <ProjectReference Include="..\..\src\Core\PalladiumWallet.Core.csproj" />
  </ItemGroup>
  <ItemGroup>
    <!-- Seed corpus travels next to the binary so replay and the regression
         test in PalladiumWallet.Tests can find it via AppContext.BaseDirectory. -->
    <None Include="Corpus\**\*" CopyToOutputDirectory="PreserveNewest" />
  </ItemGroup>
 </Project>
@@ -0,0 +1,215 @@
 using System.Text;
 using PalladiumWallet.Fuzz;
 // Fuzzing entry point. One binary, one target per process (fuzzers want a
 // single deterministic execution path). Modes:
 //
 //   <target> --afl                 run under afl-fuzz (instrumented Core, see fuzz.sh)
 //   <target> --libfuzzer           run under libfuzzer-dotnet
 //   <target> --random N [seed]     built-in dumb fuzzer: N corpus mutations (no tooling needed)
 //   <target> <file|dir> ...        replay saved inputs (used by the regression test / triage)
 //   --make-seeds <dir>             regenerate the seed corpus
 //
 // A "crash" is any exception escaping the target: each target already swallows
 // the exception types that are part of the parser's documented contract.
 if (args.Length >= 2 && args[0] == "--make-seeds")
 {
    SeedCorpus.WriteAll(args[1]);
    Console.WriteLine($"Seed corpus written to {args[1]}");
    return 0;
 }
 if (args.Length < 2 || !FuzzTargets.All.TryGetValue(args[0], out var target))
 {
    Console.Error.WriteLine("Usage: PalladiumWallet.Fuzz <target> --afl | --libfuzzer | --random N [seed] | <file|dir>...");
    Console.Error.WriteLine("       PalladiumWallet.Fuzz --make-seeds <dir>");
    Console.Error.WriteLine($"Targets: {string.Join(' ', FuzzTargets.All.Keys)}");
    return 2;
 }
 switch (args[1])
 {
    case "--afl":
        SharpFuzz.Fuzzer.Run(stream =>
        {
            using var ms = new MemoryStream();
            stream.CopyTo(ms);
            target(ms.ToArray());
        });
        return 0;
    case "--libfuzzer":
        SharpFuzz.Fuzzer.LibFuzzer.Run(span => target(span.ToArray()));
        return 0;
    case "--random":
    {
        var iterations = args.Length > 2 ? int.Parse(args[2]) : 100_000;
        var seed = args.Length > 3 ? ulong.Parse(args[3]) : 0xF022_5EEDUL;
        return RandomFuzz.Run(args[0], target, iterations, seed);
    }
    default:
    {
        var failures = 0;
        foreach (var path in args[1..])
        foreach (var file in Directory.Exists(path)
            ? Directory.EnumerateFiles(path).OrderBy(f => f, StringComparer.Ordinal)
            : (IEnumerable<string>)[path])
        {
            var data = File.ReadAllBytes(file);
            try
            {
                target(data);
            }
            catch (Exception ex)
            {
                failures++;
                Console.Error.WriteLine($"CRASH {args[0]} on {file}:");
                Console.Error.WriteLine(ex);
            }
        }
        return failures == 0 ? 0 : 1;
    }
 }
 /// <summary>
 /// Minimal corpus-mutation fuzzer for smoke runs and CI: not coverage-guided,
 /// but catches shallow contract violations without afl++/libFuzzer installed.
 /// Deterministic for a given seed; on crash it saves the input for replay.
 /// </summary>
 internal static class RandomFuzz
 {
    public static int Run(string name, Action<byte[]> target, int iterations, ulong seed)
    {
        var corpus = SeedCorpus.For(name);
        var rng = seed;
        ulong Next() { rng ^= rng << 13; rng ^= rng >> 7; rng ^= rng << 17; return rng; }
        for (var i = 0; i < iterations; i++)
        {
            var data = (byte[])corpus[(int)(Next() % (ulong)corpus.Count)].Clone();
            var mutations = 1 + (int)(Next() % 8);
            for (var m = 0; m < mutations && data.Length > 0; m++)
                switch (Next() % 4)
                {
                    case 0: data[Next() % (ulong)data.Length] = (byte)Next(); break;
                    case 1: data[Next() % (ulong)data.Length] ^= (byte)(1 << (int)(Next() % 8)); break;
                    case 2: Array.Resize(ref data, (int)(Next() % 512) + 1); break;
                    case 3: data = [.. data, .. data[..(int)(Next() % (ulong)data.Length)]]; break;
                }
            try
            {
                target(data);
            }
            catch (Exception ex)
            {
                var crashFile = $"crash-{name}-{i}.bin";
                File.WriteAllBytes(crashFile, data);
                Console.Error.WriteLine(
                    $"CRASH {name} at iteration {i}: {ex.GetType().Name}: {ex.Message} (input saved to {crashFile})");
                return 1;
            }
        }
        Console.WriteLine($"{name}: {iterations} random mutations, no contract violations");
        return 0;
    }
 }
 /// <summary>
 /// Seed inputs per target: small valid (or near-valid) examples that give the
 /// mutation engines a meaningful starting shape. Regenerate with --make-seeds.
 /// </summary>
 internal static class SeedCorpus
 {
    private static readonly Dictionary<string, (string Name, byte[] Data)[]> Seeds = new()
    {
        ["header"] =
        [
            ("genesis", Convert.FromHexString(
                "0100000000000000000000000000000000000000000000000000000000000000000000003ba3edfd7a7b12b27ac72c3e67768f617fc81bc3888a51323a9fb8aa4b1e5e4a29ab5f49ffff001d1dac2b7c")),
            ("genesis-hex", Encoding.UTF8.GetBytes(
                "0100000000000000000000000000000000000000000000000000000000000000000000003ba3edfd7a7b12b27ac72c3e67768f617fc81bc3888a51323a9fb8aa4b1e5e4a29ab5f49ffff001d1dac2b7c")),
            ("short", [0x01, 0x00, 0x00, 0x00]),
        ],
        ["merkle"] =
        [
            ("one-level", [.. new byte[32], .. BitConverter.GetBytes(1), .. new byte[32], .. Enumerable.Repeat((byte)0xAA, 32)]),
            ("no-branch", [.. Enumerable.Repeat((byte)0x11, 32), .. BitConverter.GetBytes(0), .. Enumerable.Repeat((byte)0x11, 32)]),
        ],
        ["slip132"] =
        [
            ("zpub", Encoding.UTF8.GetBytes(
                "zpub6rFR7y4Q2AijBEqTUquhVz398htDFrtymD9xYYfG1m4wAcvPhXNfE3EfH1r1ADqtfSdVCToUG868RvUUkgDKf31mGDtKsAYz2oz2AGutZYs")),
            ("xpub-prefix", Encoding.UTF8.GetBytes("xpub661MyMwAqRbcF")),
            ("garbage", Encoding.UTF8.GetBytes("not-a-key")),
        ],
        ["bip39"] =
        [
            ("english-12", Encoding.UTF8.GetBytes(
                "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about")),
            ("spanish-word", Encoding.UTF8.GetBytes("ábaco ábaco ábaco")),
            ("empty", []),
            // Regression: NBitcoin AutoDetect → "Unknown" language → NotSupportedException
            // escaped TryParse (fixed by catching it).
            ("regression-notsupported", Convert.FromHexString(
                "c3a162ca636f20c3a16261636f30c3a16261636fc3a162ca")),
        ],
        ["address"] =
        [
            ("bech32", Encoding.UTF8.GetBytes("plm1qdq3gu2zvg9lyr8gxd6yln4wavc5tlp8prmvfay")),
            ("legacy-ish", Encoding.UTF8.GetBytes("PB6q3PB6q3PB6q3PB6q3PB6q3PB6q3PB6q")),
            ("garbage", Encoding.UTF8.GetBytes("hello world")),
        ],
        ["coinamount"] =
        [
            ("plain", Encoding.UTF8.GetBytes("1.50000000")),
            ("comma", Encoding.UTF8.GetBytes("0,001")),
            ("huge", Encoding.UTF8.GetBytes("79228162514264337593543950335")),
        ],
        ["walletdoc"] =
        [
            ("minimal", Encoding.UTF8.GetBytes(
                """{"Version":1,"Network":"mainnet","ScriptKind":"NativeSegwit"}""")),
            ("bad-version", Encoding.UTF8.GetBytes("""{"Version":99}""")),
            ("not-json", Encoding.UTF8.GetBytes("hello")),
        ],
        ["encfile"] =
        [
            // Well-formed container with a tiny iteration count so every replay and
            // mutated descendant skips the full PBKDF2 cost (decryption then fails
            // with the typed WrongPasswordException — exactly the contract under test).
            ("container", Encoding.UTF8.GetBytes(
                """{"Format":"plm-wallet-aesgcm-v1","Iterations":2,"Salt":"AAAAAAAAAAAAAAAAAAAAAA==","Nonce":"AAAAAAAAAAAAAAAA","Tag":"AAAAAAAAAAAAAAAAAAAAAA==","Data":"AAAA"}""")),
            ("wrong-format", Encoding.UTF8.GetBytes(
                """{"Format":"other","Iterations":2,"Salt":"","Nonce":"","Tag":"","Data":""}""")),
            ("not-json", Encoding.UTF8.GetBytes("hello")),
        ],
        ["peers"] =
        [
            ("typical", Encoding.UTF8.GetBytes(
                """[["1.2.3.4","peer.example",["v1.4.2","p10","t50001","s50002"]]]""")),
            ("odd-shapes", Encoding.UTF8.GetBytes("""[[1,2,3],{"a":1},"x",[["h","n",[42,"t"]]]]""")),
            // Regression: raw invalid-UTF-8 byte inside a JSON string parses but cannot
            // be transcoded by GetString() → InvalidOperationException (fixed in AsString).
            ("regression-bad-utf8", Convert.FromHexString(
                "5b5b22312e322e332e34222c22706565722e6578616d706c65222c5b2276312e342e32222c22703130222c227435303030" +
                "31222c22873530303032225d5d5d")),
        ],
    };
    public static IReadOnlyList<byte[]> For(string target) =>
        Seeds[target].Select(s => s.Data).ToList();
    public static void WriteAll(string root)
    {
        foreach (var (target, seeds) in Seeds)
        {
            var dir = Path.Combine(root, target);
            Directory.CreateDirectory(dir);
            foreach (var (name, data) in seeds)
                File.WriteAllBytes(Path.Combine(dir, name + ".bin"), data);
        }
    }
 }
@@ -0,0 +1,66 @@
 # Fuzzing
 Fuzz targets over every parser that consumes **untrusted input**: server
 responses (block headers, Merkle proofs, peer lists), wallet files (plaintext
 document and encrypted container), and user-pasted text (mnemonics, SLIP-132
 keys, addresses, amounts).
 Each target encodes the parser's **error contract**: the exception types
 documented as its failure mode are swallowed, anything else escaping is a
 finding. Targets: `header` `merkle` `slip132` `bip39` `address` `coinamount`
 `walletdoc` `encfile` `peers` (see `FuzzTargets.cs` for each contract).
 ## Three ways to run
 **1. Corpus replay — automatic.** The seed corpus (including regression inputs
 for every crash found so far) replays through all targets on every
 `dotnet test` run via `FuzzCorpusTests`, so fixed findings cannot come back.
 **2. Built-in random smoke — no tooling.** Not coverage-guided, but catches
 shallow contract violations in seconds:
 ```bash
 dotnet run -- bip39 --random 50000        # target, iterations [, seed]
 ```
 **3. Coverage-guided campaign — afl++.** The real thing; run it before a
 release or after touching any parser:
 ```bash
 apt install afl++
 dotnet tool install --global SharpFuzz.CommandLine
 ./fuzz.sh header              # one target per campaign
 ./fuzz.sh peers -V 3600       # extra args go to afl-fuzz
 ```
 `fuzz.sh` builds Release, instruments `PalladiumWallet.Core.dll` (and NBitcoin)
 with SharpFuzz, and launches afl-fuzz with the target's seed corpus. Findings
 land in `findings/<target>/crashes/`.
 ## Triage workflow
 ```bash
 dotnet run -- <target> findings/<target>/crashes/<file>   # replay: full stack trace
 ```
 Fix the parser (typed exception or graceful rejection — see the hardening
 commits for `Bip39.TryParse`, `ElectrumApi.ParsePeers`, `EncryptedFile.Decrypt`
 as examples), then add the input to `SeedCorpus` in `Program.cs` as a
 `regression-*` seed and regenerate with `dotnet run -- --make-seeds Corpus`.
 ## Findings so far
 The first smoke run found two real bugs, both reachable from untrusted input:
 - `Bip39.TryParse` crashed with `NotSupportedException` on restore text
  resembling no wordlist (NBitcoin's `Wordlist.AutoDetect` throws for its
  internal "Unknown" language).
 - `ElectrumApi.ParsePeers` crashed with `InvalidOperationException` on a peer
  list containing a JSON string with invalid UTF-8 bytes (parses fine,
  fails at `GetString()` transcoding) — attacker-controlled server data.
 Plus two hardening changes made so the `encfile`/`peers` contracts could be
 strict at all: `EncryptedFile.Decrypt` maps every malformed-container failure
 to `InvalidDataException` and bounds the PBKDF2 iteration count (a tampered
 file could previously demand 2^31 iterations, hanging the wallet at open), and
 `ParsePeers` tolerates any JSON shape.
@@ -0,0 +1,38 @@
 #!/usr/bin/env bash
 # Coverage-guided fuzzing with afl++ + SharpFuzz.
 #
 # One-time setup:
 #   apt install afl++                                (or build from source)
 #   dotnet tool install --global SharpFuzz.CommandLine
 #
 # Usage:
 #   ./fuzz.sh <target> [afl-fuzz args...]
 #   ./fuzz.sh header
 #   ./fuzz.sh peers -V 3600          # time-limited campaign (seconds)
 #
 # Targets: header merkle slip132 bip39 address coinamount walletdoc encfile peers
 #
 # Findings land in findings/<target>/crashes/: replay one with
 #   dotnet run -- <target> findings/<target>/crashes/<file>
 # then add it to the seed corpus in Program.cs as a regression input.
 set -euo pipefail
 cd "$(dirname "$0")"
 TARGET="${1:?usage: ./fuzz.sh <target> [afl-fuzz args...]}"
 shift || true
 command -v afl-fuzz >/dev/null || { echo "afl-fuzz not found: apt install afl++"; exit 1; }
 command -v sharpfuzz >/dev/null || { echo "sharpfuzz not found: dotnet tool install --global SharpFuzz.CommandLine"; exit 1; }
 dotnet build -c Release
 BIN="bin/Release/net10.0"
 # Instrument the assemblies under test (idempotent: SharpFuzz skips already-
 # instrumented DLLs). Core is the real target; NBitcoin gives the fuzzer
 # visibility into the library our parsers delegate to.
 sharpfuzz "$BIN/PalladiumWallet.Core.dll"
 sharpfuzz "$BIN/NBitcoin.dll" || true
 mkdir -p "findings/$TARGET"
 afl-fuzz -i "Corpus/$TARGET" -o "findings/$TARGET" -t 5000 "$@" \
    -- dotnet "$BIN/PalladiumWallet.Fuzz.dll" "$TARGET" --afl
@@ -126,4 +126,15 @@ public class Bip39Tests
        Assert.Throws<ArgumentOutOfRangeException>(
            () => Bip39.Generate(MnemonicLength.Twelve, (MnemonicLanguage)99));
    }
    [Fact]
    public void Testo_che_non_somiglia_a_nessuna_wordlist_viene_rifiutato_senza_eccezioni()
    {
        // NBitcoin's Wordlist.AutoDetect throws NotSupportedException("Unknown")
        // for text resembling no wordlist instead of failing gracefully (found by
        // fuzzing): TryParse must swallow it and return false — this string reaches
        // TryParse straight from the user's restore input.
        Assert.False(Bip39.TryParse("ábÊco ábaco0ábaco ábÊ", out var mnemonic));
        Assert.Null(mnemonic);
    }
 }
@@ -0,0 +1,36 @@
 using PalladiumWallet.Fuzz;
 namespace PalladiumWallet.Tests;
 /// <summary>
 /// Replays the fuzzing seed corpus (tests/PalladiumWallet.Fuzz/Corpus, copied
 /// next to the test binary) through every fuzz target on each test run: the
 /// corpus includes the regression inputs for crashes found by past campaigns,
 /// so a fixed contract violation can never silently come back. The real
 /// coverage-guided campaigns run separately via tests/PalladiumWallet.Fuzz/fuzz.sh.
 /// </summary>
 public class FuzzCorpusTests
 {
    public static TheoryData<string> Targets()
    {
        var data = new TheoryData<string>();
        foreach (var name in FuzzTargets.All.Keys)
            data.Add(name);
        return data;
    }
    [Theory]
    [MemberData(nameof(Targets))]
    public void Il_corpus_del_target_rispetta_il_contratto_del_parser(string target)
    {
        var dir = Path.Combine(AppContext.BaseDirectory, "Corpus", target);
        Assert.True(Directory.Exists(dir), $"seed corpus missing for '{target}' at {dir}");
        foreach (var file in Directory.EnumerateFiles(dir))
        {
            // Any escaping exception is a contract violation: the target itself
            // swallows the exception types documented as the parser's failure mode.
            FuzzTargets.Run(target, File.ReadAllBytes(file));
        }
    }
 }
@@ -27,6 +27,35 @@ public class PeerParsingTests
        Assert.Equal(new PeerInfo("nodo.esempio.org", 0, null, "1.4"), peers[1]);
        Assert.Equal(new PeerInfo("solo-ssl.esempio.org", null, 50002, "1.4"), peers[2]);
    }
    [Theory]
    [InlineData("""{"not":"an array"}""")]
    [InlineData(""" "just a string" """)]
    [InlineData("42")]
    [InlineData("""[[1,2,3]]""")]                       // numeric ip/hostname
    [InlineData("""[["h","n",42]]""")]                  // features not an array
    [InlineData("""[["h","n",[42,{"x":1},null]]]""")]   // non-string features
    public void Una_risposta_peers_di_forma_inattesa_produce_una_lista_vuota(string json)
    {
        // The response is untrusted server data: any shape must degrade to an
        // empty list, never throw (found by fuzzing).
        Assert.Empty(ElectrumApi.ParsePeers(JsonDocument.Parse(json).RootElement));
    }
    [Fact]
    public void Una_stringa_json_con_utf8_invalido_viene_ignorata_senza_eccezioni()
    {
        // Raw 0x87 inside a JSON string: JsonDocument.Parse accepts the bytes but
        // GetString() cannot transcode them to UTF-16 (found by fuzzing). The
        // whole entry degrades to "no usable host/feature", not an exception.
        var bytes = "[[\"1.2.3.4\",\"#\",[\"v1\",\"t#\"]]]"u8.ToArray();
        var hostIdx = Array.IndexOf(bytes, (byte)'#');
        bytes[hostIdx] = 0x87;
        bytes[Array.LastIndexOf(bytes, (byte)'#')] = 0x87;
        using var doc = JsonDocument.Parse(bytes);
        Assert.Empty(ElectrumApi.ParsePeers(doc.RootElement));
    }
 }
 public class ServerRegistryTests
@@ -21,8 +21,9 @@
    <Using Include="Xunit" />
  </ItemGroup>
-  <ItemGroup>
+  <ItemGroup>
-    <ProjectReference Include="..\..\src\Core\PalladiumWallet.Core.csproj" />
+    <ProjectReference Include="..\..\src\Core\PalladiumWallet.Core.csproj" />
    <ProjectReference Include="..\PalladiumWallet.Fuzz\PalladiumWallet.Fuzz.csproj" />
  </ItemGroup>
 </Project>
@@ -57,6 +57,22 @@ public class StorageTests
        Assert.NotEqual(c1, c2);
    }
    [Theory]
    [InlineData("not json at all")]                                     // broken JSON
    [InlineData("null")]                                                // JSON null
    [InlineData("""{"Format":"plm-wallet-aesgcm-v1"}""")]               // missing fields → null strings
    [InlineData("""{"Format":"plm-wallet-aesgcm-v1","Iterations":600000,"Salt":"$$$","Nonce":"AAAAAAAAAAAAAAAA","Tag":"AAAAAAAAAAAAAAAAAAAAAA==","Data":""}""")] // bad base64
    [InlineData("""{"Format":"plm-wallet-aesgcm-v1","Iterations":600000,"Salt":"AA==","Nonce":"AA==","Tag":"AAAAAAAAAAAAAAAAAAAAAA==","Data":""}""")] // wrong nonce size
    [InlineData("""{"Format":"plm-wallet-aesgcm-v1","Iterations":0,"Salt":"AA==","Nonce":"AAAAAAAAAAAAAAAA","Tag":"AAAAAAAAAAAAAAAAAAAAAA==","Data":""}""")] // iterations 0
    [InlineData("""{"Format":"plm-wallet-aesgcm-v1","Iterations":2147483647,"Salt":"AA==","Nonce":"AAAAAAAAAAAAAAAA","Tag":"AAAAAAAAAAAAAAAAAAAAAA==","Data":""}""")] // PBKDF2 DoS
    public void Un_contenitore_malformato_produce_sempre_InvalidDataException(string container)
    {
        // A tampered/corrupted file must map to the two typed exceptions, never to a
        // raw JsonException/FormatException/ArgumentNullException (found by fuzzing);
        // the absurd iteration count would otherwise hang the wallet at open.
        Assert.Throws<InvalidDataException>(() => EncryptedFile.Decrypt(container, "pass"));
    }
    [Fact]
    public void Ogni_encrypt_produce_salt_diverso()
    {
@@ -195,6 +195,139 @@ public class TransactionInspectorTests
        Assert.Equal(0, server.CallCount("blockchain.block.header"));
    }
    [Fact]
    public async Task Un_output_OP_RETURN_con_testo_UTF8_viene_decodificato()
    {
        var account = Account();
        var tx = Net.CreateTransaction();
        tx.Inputs.Add(new TxIn(new OutPoint(uint256.One, 0)));
        tx.Outputs.Add(Money.Satoshis(1_000_000), account.GetReceiveAddress(0));
        tx.Outputs.Add(Money.Zero, TxNullDataTemplate.Instance.GenerateScriptPubKey("hello palladium"u8.ToArray()));
        var (server, client) = await StartAsync(tx);
        await using var _ = server; await using var __ = client;
        var details = await TransactionInspector.FetchAsync(
            client, Net, tx.GetHash().ToString(), tipHeight: 200, height: 101,
            Owned(account), netSats: 1_000_000, verified: true);
        var opReturn = Assert.Single(details.Outputs, o => o.Index == 1);
        Assert.Null(opReturn.Address);
        Assert.Equal("hello palladium", opReturn.OpReturnText);
    }
    [Fact]
    public async Task Un_output_OP_RETURN_con_dati_binari_ricade_su_hex()
    {
        var account = Account();
        byte[] data = [0x00, 0x01, 0xFF, 0xFE, 0x02];
        var tx = Net.CreateTransaction();
        tx.Inputs.Add(new TxIn(new OutPoint(uint256.One, 0)));
        tx.Outputs.Add(Money.Satoshis(1_000_000), account.GetReceiveAddress(0));
        tx.Outputs.Add(Money.Zero, TxNullDataTemplate.Instance.GenerateScriptPubKey(data));
        var (server, client) = await StartAsync(tx);
        await using var _ = server; await using var __ = client;
        var details = await TransactionInspector.FetchAsync(
            client, Net, tx.GetHash().ToString(), tipHeight: 200, height: 101,
            Owned(account), netSats: 1_000_000, verified: true);
        var opReturn = Assert.Single(details.Outputs, o => o.Index == 1);
        Assert.Equal("0x" + Convert.ToHexString(data), opReturn.OpReturnText);
    }
    [Fact]
    public async Task Piu_output_OP_RETURN_nella_stessa_tx_sono_decodificati_singolarmente()
    {
        var account = Account();
        var tx = Net.CreateTransaction();
        tx.Inputs.Add(new TxIn(new OutPoint(uint256.One, 0)));
        tx.Outputs.Add(Money.Satoshis(1_000_000), account.GetReceiveAddress(0));
        tx.Outputs.Add(Money.Zero, TxNullDataTemplate.Instance.GenerateScriptPubKey("first"u8.ToArray()));
        tx.Outputs.Add(Money.Zero, TxNullDataTemplate.Instance.GenerateScriptPubKey("second"u8.ToArray()));
        var (server, client) = await StartAsync(tx);
        await using var _ = server; await using var __ = client;
        var details = await TransactionInspector.FetchAsync(
            client, Net, tx.GetHash().ToString(), tipHeight: 200, height: 101,
            Owned(account), netSats: 1_000_000, verified: true);
        Assert.Equal("first", details.Outputs.Single(o => o.Index == 1).OpReturnText);
        Assert.Equal("second", details.Outputs.Single(o => o.Index == 2).OpReturnText);
    }
    [Fact]
    public async Task Un_output_normale_non_ha_testo_OP_RETURN()
    {
        var (funding, spend, _, account) = SpendPair();
        var (server, client) = await StartAsync(funding, spend);
        await using var _ = server; await using var __ = client;
        var details = await TransactionInspector.FetchAsync(
            client, Net, spend.GetHash().ToString(), tipHeight: 200, height: 101,
            Owned(account), netSats: -610_000, verified: true);
        Assert.All(details.Outputs, o => Assert.Null(o.OpReturnText));
    }
    [Fact]
    public async Task Il_tag_pool_nello_scriptSig_della_coinbase_viene_estratto()
    {
        var account = Account();
        var coinbase = Net.CreateTransaction();
        // BIP34 height push (binary) followed by a pool tag (printable ASCII).
        var scriptSig = new Script(Op.GetPushOp(190), Op.GetPushOp("/slush/"u8.ToArray()));
        coinbase.Inputs.Add(new TxIn(new OutPoint(uint256.Zero, 0xffffffff), scriptSig));
        coinbase.Outputs.Add(Money.Satoshis(5_000_000_000), account.GetReceiveAddress(0));
        var (server, client) = await StartAsync(coinbase);
        await using var _ = server; await using var __ = client;
        var details = await TransactionInspector.FetchAsync(
            client, Net, coinbase.GetHash().ToString(), tipHeight: 200, height: 190,
            Owned(account), netSats: 5_000_000_000, verified: true);
        var input = Assert.Single(details.Inputs);
        Assert.True(input.IsCoinbase);
        Assert.Contains("/slush/", input.CoinbaseTag);
    }
    [Fact]
    public async Task Uno_scriptSig_coinbase_senza_testo_stampabile_non_produce_tag()
    {
        var account = Account();
        var coinbase = Net.CreateTransaction();
        var scriptSig = new Script(Op.GetPushOp([0x00, 0x01, 0x02]));
        coinbase.Inputs.Add(new TxIn(new OutPoint(uint256.Zero, 0xffffffff), scriptSig));
        coinbase.Outputs.Add(Money.Satoshis(5_000_000_000), account.GetReceiveAddress(0));
        var (server, client) = await StartAsync(coinbase);
        await using var _ = server; await using var __ = client;
        var details = await TransactionInspector.FetchAsync(
            client, Net, coinbase.GetHash().ToString(), tipHeight: 200, height: 190,
            Owned(account), netSats: 5_000_000_000, verified: true);
        var input = Assert.Single(details.Inputs);
        Assert.Null(input.CoinbaseTag);
    }
    [Fact]
    public async Task Un_input_normale_non_ha_tag_coinbase()
    {
        var (funding, spend, _, account) = SpendPair();
        var (server, client) = await StartAsync(funding, spend);
        await using var _ = server; await using var __ = client;
        var details = await TransactionInspector.FetchAsync(
            client, Net, spend.GetHash().ToString(), tipHeight: 200, height: 101,
            Owned(account), netSats: -610_000, verified: true);
        Assert.All(details.Inputs, i => Assert.Null(i.CoinbaseTag));
    }
    [Fact]
    public async Task La_cache_delle_tx_evita_le_richieste_al_server()
    {
Author	SHA1	Message	Date
davide	9971e29b81	chore(release): bump version to 1.0.0 Fills in the CHANGELOG.md entry for the checkpoint-anchoring security fix, fuzzing infrastructure and its findings, OP_RETURN/coinbase-tag decoding, and localization fixes since 0.9.1 (see previous commits), and bumps <Version>/versionCode across the App and Android head csproj files ahead of the tag.	2026-07-09 08:45:24 +02:00
davide	077835a30b	feat(wallet): decode OP_RETURN payloads and coinbase pool tags in tx details Transaction detail view silently dropped OP_RETURN messages and coinbase scriptSig text (e.g. pool tags), since TransactionInspector discarded scriptPubKey/scriptSig bytes once no destination address could be derived. Each output/input is decoded independently, so multiple OP_RETURN outputs in one tx are all shown.	2026-07-09 08:35:39 +02:00
davide	663460d62e	feat(ui): add user guide button to help overlay Adds a "User guide" button next to "Report a bug" in the Help > Info tab, linking to USERGUIDE.md on GitHub via the same Launcher pattern used for bug reports and release pages.	2026-07-07 22:35:19 +02:00
davide	be818a50a8	docs: tighten CLAUDE.md/AGENTS.md formatting for scannability Convert dense prose paragraphs to bullet lists (Commands, Architecture, GUI conventions, Working rules) and trim redundant wording; no content removed. Both files kept in sync per the header sync rule.	2026-07-07 22:29:46 +02:00
davide	6f4ae679e5	docs: document fuzzing infrastructure and its security guarantees Sync AGENTS.md/CLAUDE.md with the fuzzing workflow, add a README section pointing to tests/PalladiumWallet.Fuzz, and record in SECURITY.md the two guarantees the fuzz suite enforces: a bounded PBKDF2 iteration count on read and a typed InvalidDataException for any malformed encrypted container.	2026-07-07 22:06:45 +02:00
davide	cdede17683	feat(fuzz): add SharpFuzz-based fuzzing for untrusted-input parsers New tests/PalladiumWallet.Fuzz project: one target per parser that consumes untrusted input (block headers, Merkle proofs, peer lists, wallet files, user-pasted mnemonics/keys/addresses/amounts), each encoding the parser's documented error contract - any exception beyond that contract is a finding, reported as a crash. Three ways to run: the seed corpus (with regression inputs for every crash found so far, including the two fixed in prior commits) replays automatically inside dotnet test via FuzzCorpusTests, so a fixed contract violation can't silently return; a built-in random-mutation mode needs no external tooling (dotnet run -- <target> --random N); and fuzz.sh drives real coverage-guided campaigns via afl++ + SharpFuzz instrumentation for pre-release or post-parser-change runs.	2026-07-07 22:05:38 +02:00
davide	a264669151	fix(storage): EncryptedFile.Decrypt must reject malformed containers cleanly A tampered or corrupted wallet file could reach Decrypt with broken JSON, missing fields, invalid base64, or a wrong nonce/tag size, all of which previously escaped as raw JsonException/FormatException/ ArgumentNullException instead of the documented WrongPasswordException/ InvalidDataException contract. Worse, the iteration count is read straight from the (attacker-controlled) container with no upper bound: a tampered file demanding e.g. 2^31 PBKDF2 iterations would hang the wallet at open - a DoS via a file the user merely tries to open. Now every malformed shape maps to InvalidDataException and the iteration count is clamped to a sane maximum (10,000,000, well above the current 600,000 default).	2026-07-07 22:05:08 +02:00
davide	d9c75eaec2	fix(net): ParsePeers must tolerate any JSON shape from the server server.peers.subscribe is attacker-controlled data: ParsePeers assumed the standard [ip, hostname, [features...]] shape and threw on anything else (non-array response, wrong element types), and GetString() on a JSON string containing invalid UTF-8 bytes threw InvalidOperationException instead of failing to parse — both found by fuzzing. Any unexpected shape or unparseable string now degrades to "no usable data" instead of propagating an exception into the sync/discovery path.	2026-07-07 21:52:00 +02:00
davide	c868c17505	fix(crypto): Bip39.TryParse must not throw on unrecognisable text Wordlist.AutoDetect lands on NBitcoin's internal "Unknown" language for text resembling no wordlist and throws NotSupportedException instead of failing gracefully — found by fuzzing the restore-mnemonic input. TryParse now treats that (and the same failure mode from the Mnemonic constructor) as "not a valid mnemonic", consistent with every other rejection path.	2026-07-07 21:51:31 +02:00
		`@@ -0,0 +1 @@`
							`plm1qdq3gu2zvg9lyr8gxd6yln4wavc5tlp8prmvfay`
		`@@ -0,0 +1 @@`
							`abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about`
		`@@ -0,0 +1 @@`
							`{"Format":"plm-wallet-aesgcm-v1","Iterations":2,"Salt":"AAAAAAAAAAAAAAAAAAAAAA==","Nonce":"AAAAAAAAAAAAAAAA","Tag":"AAAAAAAAAAAAAAAAAAAAAA==","Data":"AAAA"}`
		`@@ -0,0 +1 @@`
							`{"Format":"other","Iterations":2,"Salt":"","Nonce":"","Tag":"","Data":""}`
		`@@ -0,0 +1 @@`
							`0100000000000000000000000000000000000000000000000000000000000000000000003ba3edfd7a7b12b27ac72c3e67768f617fc81bc3888a51323a9fb8aa4b1e5e4a29ab5f49ffff001d1dac2b7c`
		`@@ -0,0 +1 @@`
							`[["1.2.3.4","peer.example",["v1.4.2","p10","t50001","‡50002"]]]`
		`@@ -0,0 +1 @@`
							`zpub6rFR7y4Q2AijBEqTUquhVz398htDFrtymD9xYYfG1m4wAcvPhXNfE3EfH1r1ADqtfSdVCToUG868RvUUkgDKf31mGDtKsAYz2oz2AGutZYs`
		`@@ -0,0 +1 @@`
							`{"Version":1,"Network":"mainnet","ScriptKind":"NativeSegwit"}`