ElectrumSVP 0.2.0 Stable Release Fixes Plaintext BIP39 Seed Storage Issue

Wallet Infrastructure Watch / Applications

In Brief

ElectrumSVP has released version 0.2.0 as its new official desktop-wallet release, two days after publishing the 0.2.0-beta.1 testing build.

The final release carries forward the beta’s broader work on blockchain-header verification, BREAD transaction evidence, fee handling, UTXO control and desktop compatibility, but adds an important security correction not disclosed in the beta release notes: BIP39 mnemonic words could be written in plaintext into wallet metadata.

Version 0.2.0 removes that storage behavior and migrates affected wallet data to remove the plaintext mnemonic. ElectrumSVP warns that if a mnemonic may have been exposed before upgrading, users should treat it as compromised and move funds to a newly created wallet using a new seed.

News Report

ElectrumSVP 0.2.0 has moved the independently maintained desktop BSV wallet from its September 15 beta into a new official release while correcting a seed-storage issue discovered in the preceding implementation.

The GitHub release, published September 17, identifies v0.2.0 as the project’s first stable release and provides downloadable builds for Linux, macOS and Windows, with SHA256 checksums and GPG signatures.

BSV TIMES covered the 0.2.0-beta.1 release on September 15 after it introduced substantial work across blockchain-header integrity, BREAD verification, transaction fees, UTXO control, account handling and platform compatibility.

Most of those changes carry directly into the official build.

The more consequential new development is in seed handling.

Plaintext Mnemonic Storage Removed

ElectrumSVP says the previous implementation could cause BIP39 mnemonic words to be stored in plaintext as part of wallet metadata.

The underlying source changes show how that occurred.

During BIP39 account creation, the preceding code retained the newly created seed phrase in a bip39_words field associated with the keystore. When the keystore’s derivation information was serialized, that field could also be written into the wallet data.

Version 0.2.0 removes both steps.

Newly created wallets no longer attach the plaintext mnemonic to that metadata field, while the keystore serialization code no longer writes bip39_words into its derivation data.

The release also says existing affected wallets are migrated so that previously stored plaintext mnemonic data is removed.

That migration addresses the stored copy going forward, but it cannot determine whether an earlier copy of a wallet file or its metadata was previously accessed.

For that reason, the developer gives a stronger warning than simply advising users to upgrade: if a wallet’s mnemonic was exposed before the update, the mnemonic should be regarded as compromised and funds should be moved to a newly created wallet with a new seed.

The release does not state that seed phrases were transmitted to an external service or automatically exposed over the network. The issue concerns plaintext storage within wallet data, meaning the practical exposure depends on whether somebody or something obtained access to that data.

Nevertheless, a recovery phrase is the root credential for a self-custodial wallet. Keeping an additional plaintext copy inside wallet metadata defeats an important separation between encrypted wallet access and the recovery secret itself.

Official Release Follows the Beta

The stable release otherwise retains the substantial changes introduced in 0.2.0-beta.1.

Those include stronger blockchain-header integrity checking and recovery, expanded BREAD verification, improved handling of transaction proofs, revised fee calculation, broader UTXO and coin-control functions, multiple-account support, fixes for Windows QR scanning, improved Python 3.10 compatibility and corrections for newer Linux environments.

There are also several changes made between the beta and the final release.

On Windows, BREAD export now uses the application’s correct Merkle-cache location rather than a hard-coded path.

The Max payment function has also been adjusted so that when a user has explicitly selected UTXOs through Spend From, calculating the maximum payment respects that selection rather than discarding it and reverting to all available spendable outputs.

The release additionally updates ElectrumSVP’s own release-checking information so that version 0.2.0 becomes the current official build.

From Testing Build to User Release

The transition matters more than a routine removal of a beta label.

The September 15 build was explicitly presented as test software and carried a warning not to use it for significant funds. Version 0.2.0 is now presented by the project as its official release.

At the same time, the discovery of the mnemonic-storage issue during that short testing period illustrates why the distinction between beta and stable wallet software matters.

The beta exposed the broader changes to testing.

Before those changes became the official release, one particularly sensitive behavior involving the wallet’s ultimate recovery credential was identified and removed.

BSV TIMES Read

The most important part of ElectrumSVP 0.2.0 is therefore not that a beta version became stable after two days.

It is what changed during those two days.

A wallet can have sophisticated transaction verification, independent proof handling and detailed UTXO controls while still being undermined by a much simpler problem at the key-management boundary.

A BIP39 recovery phrase is different from ordinary wallet metadata. Possession of it can reproduce control of the wallet independently of the application that created it.

That makes minimizing where the phrase exists at all an important security principle.

The correction also reinforces a useful distinction in wallet infrastructure: verification security and key security are separate problems.

ElectrumSVP’s recent development has concentrated heavily on allowing the wallet to verify more transaction evidence locally through headers and BREAD.

Version 0.2.0 shows that the other boundary remains just as important: the wallet must also protect the secret from which that control ultimately derives.

The broader 0.2.0 work remains significant, but the newly disclosed seed-storage correction is the reason today’s final release deserves separate attention from the beta BSV TIMES covered on September 15.