cake_wallet 5-MOAD scan: 3 CWE-407 defects + 1 CWE-312 defect

MOAD-0001 (CWE-407):
- cake_wallet-0001: exchange_view_model token injection List.any() O(T*L), 275x
- cake_wallet-0002: currency_pairs_utils/pairs_utils List.contains() O(ALL*N), 139x
- cake_wallet-0003: monero/wownero _usedAddresses List.contains() O(S*U), 275x

MOAD-0004 (CWE-312):
- cake_wallet-0004: zcash_taddress_rotation prints wallet seeds to verbose log

MOAD-0002: NOTED (SettingsStore 2228 lines, DI 1765 lines, global currentWallet)
MOAD-0003: CLEAN (no Zone.current / zone-scoped wallet identity)
MOAD-0005: CLEAN (Dart single-threaded, no concurrent cache races)

8/8 unit tests PASS

defects/cake_wallet-0002/test/test_cake_wallet_0002.dart

@@ -0,0 +1,78 @@
+/// Unit test for cake_wallet-0002: currency_pairs_utils / pairs_utils
+/// List.contains() O(ALL * N) for filtering notSupported currencies.
+
+int opsDefect = 0;
+int opsFix = 0;
+
+class FakeCurrency {
+  final int raw;
+  FakeCurrency(this.raw);
+  @override
+  bool operator ==(Object other) => other is FakeCurrency && other.raw == raw;
+  @override
+  int get hashCode => raw.hashCode;
+}
+
+void main() {
+  // CryptoCurrency.all has ~278 entries; notSupported varies by provider
+  final allCurrencies = List.generate(278, (i) => FakeCurrency(i));
+
+  // DFX has ~270 not-supported (only 7 supported)
+  final notSupported = List.generate(270, (i) => FakeCurrency(i + 8));
+
+  // --- Defect: List.contains per element ---
+  opsDefect = 0;
+  final resultDefect = allCurrencies.where((crypto) {
+    for (final ns in notSupported) {
+      opsDefect++;
+      if (ns == crypto) return false;
+    }
+    return true;
+  }).toList();
+
+  // --- Fix: Set.contains per element ---
+  opsFix = 0;
+  final notSupportedSet = notSupported.toSet();
+  final resultFix = allCurrencies.where((crypto) {
+    opsFix++;
+    return !notSupportedSet.contains(crypto);
+  }).toList();
+
+  assert(resultDefect.length == resultFix.length,
+      'FAIL: results differ (${resultDefect.length} vs ${resultFix.length})');
+
+  final ratio = opsDefect / opsFix;
+  print('ALL=278 notSupported=270: defect=$opsDefect fix=$opsFix ratio=${ratio.toStringAsFixed(1)}x '
+      '${ratio > 2 ? "PASS" : "FAIL"}');
+  assert(ratio > 2, 'FAIL: expected speedup, got ${ratio}x');
+
+  // Also test the supportedPairs pattern (Cartesian product)
+  // With 278 all and 100 not-supported:
+  final notSupported2 = List.generate(100, (i) => FakeCurrency(i));
+  opsDefect = 0;
+  opsFix = 0;
+
+  // Defect
+  final supported1 = allCurrencies.where((e) {
+    for (final ns in notSupported2) {
+      opsDefect++;
+      if (ns == e) return false;
+    }
+    return true;
+  }).toList();
+
+  // Fix
+  final ns2Set = notSupported2.toSet();
+  final supported2 = allCurrencies.where((e) {
+    opsFix++;
+    return !ns2Set.contains(e);
+  }).toList();
+
+  assert(supported1.length == supported2.length);
+  final ratio2 = opsDefect / opsFix;
+  print('ALL=278 notSupported=100: defect=$opsDefect fix=$opsFix ratio=${ratio2.toStringAsFixed(1)}x '
+      '${ratio2 > 2 ? "PASS" : "FAIL"}');
+  assert(ratio2 > 2);
+
+  print('cake_wallet-0002: ALL PASS');
+}

defects/cake_wallet-0003/patch/cake_wallet-0003.patch

@@ -0,0 +1,50 @@
+--- a/cw_monero/lib/monero_subaddress_list.dart
++++ b/cw_monero/lib/monero_subaddress_list.dart
+@@ -16,7 +16,7 @@ abstract class MoneroSubaddressListBase with Store {
+         _isUpdating = false,
+         subaddresses = ObservableList<Subaddress>();
+
+-  final List<String> _usedAddresses = [];
++  final Set<String> _usedAddresses = {};
+
+   @observable
+   ObservableList<Subaddress> subaddresses;
+@@ -96,10 +96,8 @@ abstract class MoneroSubaddressListBase with Store {
+   Future<void> updateWithAutoGenerate({
+     required int accountIndex,
+     required String defaultLabel,
+     required List<String> usedAddresses,
+   }) async {
+-    _usedAddresses.addAll(usedAddresses);
+-    final _all = _usedAddresses.toSet().toList();
+-    _usedAddresses.clear();
+-    _usedAddresses.addAll(_all);
++    _usedAddresses.addAll(usedAddresses); // Set auto-deduplicates
+     if (_isUpdating) {
+       return;
+     }
+--- a/cw_wownero/lib/wownero_subaddress_list.dart
++++ b/cw_wownero/lib/wownero_subaddress_list.dart
+@@ -16,7 +16,7 @@ abstract class WowneroSubaddressListBase with Store {
+         _isUpdating = false,
+         subaddresses = ObservableList<Subaddress>();
+
+-  final List<String> _usedAddresses = [];
++  final Set<String> _usedAddresses = {};
+
+   @observable
+   ObservableList<Subaddress> subaddresses;
+@@ -104,10 +104,8 @@ abstract class WowneroSubaddressListBase with Store {
+   Future<void> updateWithAutoGenerate({
+     required int accountIndex,
+     required String defaultLabel,
+     required List<String> usedAddresses,
+   }) async {
+-    _usedAddresses.addAll(usedAddresses);
+-    final _all = _usedAddresses.toSet().toList();
+-    _usedAddresses.clear();
+-    _usedAddresses.addAll(_all);
++    _usedAddresses.addAll(usedAddresses); // Set auto-deduplicates
+     if (_isUpdating) {
+       return;
+     }

defects/cake_wallet-0003/test/test_cake_wallet_0003.dart

@@ -0,0 +1,68 @@
+/// Unit test for cake_wallet-0003: monero/wownero _usedAddresses
+/// List<String>.contains() O(S*U) in _newSubaddress filtering.
+
+int opsDefect = 0;
+int opsFix = 0;
+
+void main() {
+  // Monero wallets can accumulate hundreds of used addresses
+  final sizes = [
+    [50, 100],   // 50 subaddresses, 100 used addresses
+    [200, 500],  // heavy usage
+  ];
+
+  for (final pair in sizes) {
+    final S = pair[0]; // subaddresses to filter
+    final U = pair[1]; // used addresses
+
+    final allAddresses = List.generate(S, (i) => 'addr_$i');
+    final usedList = List.generate(U, (i) => 'addr_${i * 2}'); // even indices are "used"
+
+    // --- Defect: List.contains per subaddress ---
+    opsDefect = 0;
+    final unusedDefect = allAddresses.where((addr) {
+      for (final used in usedList) {
+        opsDefect++;
+        if (used == addr) return false;
+      }
+      return true;
+    }).toList();
+
+    // --- Fix: Set.contains per subaddress ---
+    opsFix = 0;
+    final usedSet = usedList.toSet();
+    final unusedFix = allAddresses.where((addr) {
+      opsFix++;
+      return !usedSet.contains(addr);
+    }).toList();
+
+    assert(unusedDefect.length == unusedFix.length,
+        'FAIL: results differ (${unusedDefect.length} vs ${unusedFix.length})');
+
+    final ratio = opsDefect / opsFix;
+    print('S=$S U=$U: defect=$opsDefect fix=$opsFix ratio=${ratio.toStringAsFixed(1)}x '
+        '${ratio > 2 ? "PASS" : "FAIL"}');
+    assert(ratio > 2);
+  }
+
+  // Also verify the dedup pattern: addAll + toSet + clear + addAll vs just Set.addAll
+  final existing = ['a', 'b', 'c'];
+  final incoming = ['b', 'c', 'd', 'e'];
+
+  // Defect: List with manual dedup
+  final listResult = <String>[];
+  listResult.addAll(existing);
+  listResult.addAll(incoming);
+  final deduped = listResult.toSet().toList();
+
+  // Fix: Set with addAll
+  final setResult = <String>{};
+  setResult.addAll(existing);
+  setResult.addAll(incoming);
+
+  assert(deduped.toSet().length == setResult.length,
+      'FAIL: dedup results differ');
+  print('Dedup correctness: PASS (${setResult.length} unique)');
+
+  print('cake_wallet-0003: ALL PASS');
+}

defects/cake_wallet-0004/patch/cake_wallet-0004.patch

@@ -0,0 +1,27 @@
+--- a/cw_zcash/lib/src/zcash_taddress_rotation.dart
++++ b/cw_zcash/lib/src/zcash_taddress_rotation.dart
+@@ -261,7 +261,7 @@ class ZcashTAddressRotation {
+         final id = await ZcashWalletService.runInDbMutex(
+           () => WarpApi.newAccount(coin, name, seed, rotationAccounts[raKeys[i]]!.length),
+         );
+-        printV("new id: $id / $seed");
++        printV("new id: $id / <seed redacted>");
+         printV("${rotationAccounts[raKeys[i]]}");
+         printV(raKeys[i]);
+         rotationAccounts[raKeys[i]]!.forEach((final a) {
+@@ -415,7 +415,7 @@ class ZcashTAddressRotation {
+     for (int i = 0; i < acc.length; i++) {
+       final b = WarpApi.getBackup(coin, acc[i].id);
+-      printV("$i. ${b.seed?.split(" ").last}, ${b.index}, ${WarpApi.getTAddr(coin, acc[i].id)}");
++      printV("$i. <seed redacted>, ${b.index}, ${WarpApi.getTAddr(coin, acc[i].id)}");
+     }
+     return acc.map((final a) => WarpApi.getTAddr(coin, a.id)).toList();
+   }
+@@ -438,7 +438,7 @@ class ZcashTAddressRotation {
+     for (int i = 0; i < acc.length; i++) {
+       final b = WarpApi.getBackup(coin, acc[i].id);
+-      printV("$i. ${b.seed?.split(" ").last}, ${b.index}, ${WarpApi.getTAddr(coin, acc[i].id)}");
++      printV("$i. <seed redacted>, ${b.index}, ${WarpApi.getTAddr(coin, acc[i].id)}");
+     }
+     return acc.map((final a) => WarpApi.getTAddr(coin, a.id)).toList();
+   }

defects/cake_wallet-0004/test/test_cake_wallet_0004.dart

@@ -0,0 +1,47 @@
+/// Unit test for cake_wallet-0004: MOAD-0004 Logged Secret (CWE-312)
+/// zcash_taddress_rotation.dart prints wallet seeds to verbose output.
+///
+/// Verifies that the patched log messages do not contain seed material.
+
+void main() {
+  // Simulate the three defect sites
+  final seed = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
+
+  // --- Defect: original log patterns ---
+  final defectLog1 = 'new id: 42 / $seed';
+  final defectLog2 = '0. ${seed.split(" ").last}, 3, t1abc123';
+  final defectLog3 = '1. ${seed.split(" ").last}, 5, t1def456';
+
+  assert(defectLog1.contains(seed), 'Defect log 1 should contain seed');
+  assert(defectLog2.contains('about'), 'Defect log 2 should contain last seed word');
+  assert(defectLog3.contains('about'), 'Defect log 3 should contain last seed word');
+
+  // --- Fix: redacted log patterns ---
+  final fixLog1 = 'new id: 42 / <seed redacted>';
+  final fixLog2 = '0. <seed redacted>, 3, t1abc123';
+  final fixLog3 = '1. <seed redacted>, 5, t1def456';
+
+  assert(!fixLog1.contains(seed), 'Fixed log 1 should NOT contain seed');
+  assert(!fixLog1.contains('abandon'), 'Fixed log 1 should NOT contain any seed words');
+  assert(!fixLog2.contains('about'), 'Fixed log 2 should NOT contain last seed word');
+  assert(!fixLog3.contains('about'), 'Fixed log 3 should NOT contain last seed word');
+
+  // Verify the redacted strings are present
+  assert(fixLog1.contains('<seed redacted>'), 'Fixed log 1 should contain redaction marker');
+  assert(fixLog2.contains('<seed redacted>'), 'Fixed log 2 should contain redaction marker');
+
+  print('Site 1 (line 264): PASS - seed no longer logged');
+  print('Site 2 (line 418): PASS - seed word no longer logged');
+  print('Site 3 (line 441): PASS - seed word no longer logged');
+
+  // Also check the zano password logging defect
+  final password = 'MyP@ssw0rd!';
+  String shorten(String s) => s.length > 10 ? '${s.substring(0, 4)}...${s.substring(s.length - 4)}' : s;
+  final zanoLog = 'create_wallet path /wallets/test password ${shorten(password)}';
+  // Even shortened, first 4 + last 4 chars of password leak
+  assert(zanoLog.contains('MyP@'), 'Zano log leaks first 4 chars of password');
+  assert(zanoLog.contains('0rd!'), 'Zano log leaks last 4 chars of password');
+  print('Zano password partial leak: CONFIRMED (not patched in this defect, noted for follow-up)');
+
+  print('cake_wallet-0004: ALL PASS');
+}