DigiByte Wallet v4.0.59
August 26, 2026
This release covers the work since v4.0.46. The headline is about DigiAssets, and it came out of a real forgery.
A DigiAsset’s name, image and description live in a file the person minting it writes. The wallet used to read the creator’s address out of that same file and show it to you under the heading “Issuer Address”. That is the one field a forger most wants a wallet to repeat: copy someone’s asset, mint it again, write the original artist’s address into the file, and the borrowed credit arrives attached to the artwork. Showing it made the forgery more convincing than it would have been alone.
The wallet now shows only what the blockchain proves — the address that actually paid for the asset’s creation. That cannot be copied, because it is a payment somebody genuinely made. Where it cannot be established, the wallet now shows nothing at all rather than guessing. A confirmed forgery on the DigiStamp marketplace is included in our test suite so this cannot quietly come back.
A second check catches the same trick from the other side. A copied asset gets a new ID but reuses the original’s artwork file, so if you hold two assets whose artwork file is identical, both now say so and point you at the verified creator. The wallet does not tell you which one is genuine — it cannot know that — it tells you what it saw and leaves the judgement to you.
Assets improved elsewhere too. Assets whose creator never published a name are now labelled as artifacts and counted rather than silently ignored. Artwork that was showing “metadata offline” now resolves: the cause was our own limit on how far back the wallet would trace an asset’s history, not the servers being down. A completed send can no longer be mistaken for an invitation to send again.
The DigiStamp marketplace is now inside the wallet, with Digi-ID sign-in that works without leaving the app.
Security had a full pass — the first structured one in 52 releases, and there is now a check that stops us going that long again. Release builds are obfuscated. Known vulnerabilities in our dependencies are checked on every single build rather than at review time, because a new one can appear without anybody touching the code. Leftover code from the original wallet this project was forked from has been removed rather than left sitting unused. A Digi-ID sign-in code and a wallet address that could each reach the device log no longer do.
Seven security findings were raised in that pass. Five are fixed here, one was accepted as harmless after review, and one was withdrawn: we measured it and the evidence contradicted what we had written down. The full record, including that retraction, is published in the repository.