Do i need Electrum’s latest version

[dufresne]

I turned one of my old mobile phones into an airgapped device a few years ago and installed Electrum. I know it might not be the best setup and i would probably be safer if i did this on a PC, but this is what is, or was available to me and i did it this way.

I have the phone in airplane mode, i don’t use bluetooth or Wifi on the device, and other than the fact that mobile devices can’t be airgapped by design, i think i am comfortable with my setup.

But i am worried about a few things and i really need your recommendations. My cold storage is at version 4.0.9.

• What is the security risk in using such an older version?
• Do i need to update my Electrum to a newer version to feel safer?
• Can i just continue using this older version without any risks?
• Now this is the most important question: if i must update Electrum to the newest version, what is the safest way to do it offline, without my keys touching the internet?
• My mobile phone is also a really old phone, does that even make me less secure?

[OmegaStarScream]

All of the changes can be found here: https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES

The version you're using was released in December 2020. I don't believe there are any serious vulnarabilities but it's probably a good idea to update, it's been 6 years after all.

For updating the wallet, I guess the proper way to do it would be to download it from another device (your computer for example) and then (after verifying it) transferring the .apk using a USB cable, microSD, etc. Just make sure you have your seedphrase with you before installing the new wallet.

As for your device being old, and given that it's offline, I would imagine that you have missed few security updates from your manufacturer, but I wouldn't be too paranoid about it.

If your concern is about the newest update (4.8.1) then using an older version is not that much of a problem. From my understanding, this is about submarine swaps which were only introduced in Android at 4.1.0

https://x.com/ElectrumWallet/status/2087808003663687759

[dufresne]

If your concern is about the newest update (4.8.1) then using an older version is not that much of a problem.

No, that is not my concern. This is just something i have been thinking about for a while now, and a bit worried if i am doing everything right by having a really older version as my cold wallet. I have Electrum up-to-date in my watch-only/spending wallet, so i see all of the added features and minor fixes, but they are not really necessary in a cold wallet.

The version you're using was released in December 2020. I don't believe there are any serious vulnarabilities

So in other words, as long as there were no serious vulnerabilities found in that version of Electrum, that had to be patched up in subsequent versions, it is safe to use it and there can be no surprises sometime in the future? Forgive my paranoia, based on my financial level, i have a lot of money in the wallet.

For updating the wallet, I guess the proper way to do it would be to download it from another device (your computer for example) and then (after verifying it) transferring the .apk using a USB cable, microSD, etc. Just make sure you have your seedphrase with you before installing the new wallet.

I think i’d go with this. As long as i download the right Electrum and confirm my backup, i believe i should be fine.

[nc50lc]

So in other words, as long as there were no serious vulnerabilities found in that version of Electrum, that had to be patched up in subsequent versions, it is safe to use it and there can be no surprises sometime in the future?

For that, bookmark their Github Repo's security tab for the disclosed security patches and the affected versions.
You can open each entry to see the affected versions and when it's fixed.
Here: github.com/spesmilo/electrum/security

To summarize; only 1 out of those 5 is active in your cold-storage Electrum version but it's not directly affected since it's for malicious BIP70 invoice which is a problem only if your watch-only wallet is also outdated.
Since you've updated you online Electrum, the setup should be fine.