java-topology/whitepaper/outreach/cake_wallet-0001.md

Cake Wallet — CWE-407 Disclosure Brief (cake_wallet-0001)

2026-04-14 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Cake Wallet's exchange view model. The token injection methods (_injectUserEthTokensIntoCurrencyLists, _injectUserSplTokensIntoCurrencyLists, _injectUserTronTokensIntoCurrencyLists) use .any() with a linear scan over receiveCurrencies/depositCurrencies for each user token. Fires during exchange screen initialization.

The Defect

cake_wallet-0001 (PATCHED — HIGH): lib/view_model/exchange/exchange_view_model.dart:1643

// In _injectUserEthTokensIntoCurrencyLists() — fires per user token:
for (final token in tokens) {
  if (!_listContainsToken(receiveCurrencies, token)) toAddReceive.add(token);
  if (!_listContainsToken(depositCurrencies, token)) toAddDeposit.add(token);
}
// _listContainsToken scans receiveCurrencies with .any() — O(R) per token

For each user token, the code scans both receiveCurrencies and depositCurrencies lists using .any() with contract address comparison. With T user tokens and R/D existing currencies, total cost per injection method = O(T × (R + D)). The same pattern repeats for ETH, SPL, and Tron tokens.

Complexity Proof

At T=200 user tokens, R=500 receive currencies:

• Defective: 200 × 500 × 2 = 200,000 address comparisons (per chain)
• Fixed: 200 × 2 = 400 set lookups (per chain)
• ~500× op reduction. Fires three times (ETH, SPL, Tron) during exchange init.

Impact

Cake Wallet serves cryptocurrency users managing token portfolios. Users with many custom ERC-20, SPL, or TRC-20 tokens experience slow exchange screen loading as each token triggers a linear scan of the currency lists. DeFi-active users with hundreds of tokens across multiple chains feel this most acutely.

The Fix

Build Set<String> of existing contract/mint addresses before the loop:

// Before
for (final token in tokens) {
  if (!_listContainsToken(receiveCurrencies, token)) toAddReceive.add(token);
}

// After
// CWE-407 fix: Set for O(1) address lookup instead of O(R) linear scan.
final receiveAddrs = receiveCurrencies.whereType<Erc20Token>()
    .map((t) => t.contractAddress.toLowerCase()).toSet();
for (final token in tokens) {
  final addr = token.contractAddress.toLowerCase();
  if (!receiveAddrs.contains(addr)) toAddReceive.add(token);
}

Patch

Fix available: defects/cake_wallet-0001/patch/cake_wallet-0001.patch

Single-file patch on exchange_view_model.dart. Adds pre-built address sets for all three token injection methods (ETH, SPL, Tron). Replaces _listContainsToken/_listContainsSplToken/_listContainsTronToken calls with set lookups.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (cake-tech/cake_wallet).
2. Assess severity — fires during exchange screen initialization, scales with token count.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the Cake Wallet team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.