Lesson 9: Securely Use Private Key from Keystore in Solidity test File during vm.broadCast(deployerKey)

[a1111198]

I am looking for a way to securely use a private key from keystore instead of pasting it directly in plain text in .env File.

I am talking about this

deployerKey: vm.envUint("PRIVATE_KEY")
vm.startBroadcast(deployerKey);

like we did here:

 forge script script/DeployRaffle.s.sol --rpc-url $SEPOLIA_RPC_URL --account account1 --password $DKP --broadcast --verify --etherscan-api-key $ETHERSCAN_API_KEY -vvvv

[EngrPips]

Hello @a1111198, I am unsure how to do this right now, but if you find a way, I would be glad to hear it. However, if you want to test a contract on a real test net, why not deploy it to the test net and test it if forking the test net wouldn't be enough.

[a1111198]

@EngrPips sure I will update you If I get it.

[EngrPips]

I am honestly looking forward to it.

[heheboii11]

Hey @a1111198 you can just use
cast wallet import --interactive privatekey1
you can use any name in the place of privatekey1, Hope this helps you.

[EngrPips]

Interesting. This would work fine for running a test that requires vm.startBroadcast(), right?

[heheboii11]

In test you just create a random address and prank it with the user right ?, Ig there is no need of using this method

[EngrPips]

They said they explicitly need to use this method, but I am unsure why.

[heheboii11]

Ig while using private key in vm.startBroadcast(privatekey) we cannot use the encrypted key as I have mentioned above but we can use the private key while deploying scripts instead of storing it in .env file. There might be a way to use vm.startBroadcast(privatekey) by decrypting it the script, but i am unsure of it

[Ikpong-Joseph]

I was able to find a way around this and deployer to Sepolia. Had to refactor .env, HelperConfig.s.sol and DeployDSC.s.sol

.env

Store the path to your encrypted key in your .env as such
ETH_KEYSTORE_ACCOUNT=~/.foundry/keystores/defiProtocol2.json
To find the path to your encrypted key, run cd .foundry/keystores/ in your home directory. Once in ls to view encrypted keys. Concatenate it like for ETH_KEYSTORE_ACCOUNT and add a .json

HelperConfig.s.sol

contract HelperConfig is Script {
    NetworkConfig public activeNetworkConfig;
    NetworkConfigSepolia public activeNetworkConfigSepolia; // 1

    /*SNIPPED*/

    struct NetworkConfig {/*Specifically for Anvil*/
        address wethUsdPriceFeed;
        address wbtcUsdPriceFeed;
        address weth;
        address wbtc;
        uint256 deployerKey;
    }

    struct NetworkConfigSepolia { /*Specifically for Sepolia*/
        address wethUsdPriceFeed;
        address wbtcUsdPriceFeed;
        address weth;
        address wbtc;
@>    string deployerKey;
    }

   /*SNIPPED*/

    constructor() {
        if (block.chainid == 11155111) {
@>          activeNetworkConfigSepolia = getSepoliaEthConfig();
        } else {
            activeNetworkConfig = getOrCreateAnvilEthConfig();
        }
    }

    function getSepoliaEthConfig() public view returns (NetworkConfigSepolia memory sepoliaNetworkConfig) {
@>      sepoliaNetworkConfig = NetworkConfigSepolia ({
            wethUsdPriceFeed: 0x694AA1769357215DE4FAC081bf1f309aDC325306, // ETH / USD https://docs.chain.link/data-feeds/price-feeds/addresses?network=ethereum&page=1
            wbtcUsdPriceFeed: 0x1b44F3514812d835EB1BDB0acB33d3fA3351Ee43, // BTC / USD https://docs.chain.link/data-feeds/price-feeds/addresses?network=ethereum&page=1
            weth: 0xdd13E55209Fd76AfE204dBda4007C227904f0a81,
            wbtc: 0x8f3Cf7ad23Cd3CaDbD9735AFf958023239c6A063, // Collateral token address gotten from?
@>      deployerKey: vm.envString("ETH_KEYSTORE_ACCOUNT") // Reads encrypted SEPOLIA_PRIVATE_KEY path from .env file. **PRIVATE STUFF!**

        });
    }

DeployDSC.s.sol

function run() external returns (DecentralisedStableCoin, DSCEngine, HelperConfig) {
        HelperConfig helperConfig = new HelperConfig(); // This comes with our mocks!

@>    (address wethUsdPriceFeedSepolia, address wbtcUsdPriceFeedSepolia, address wethSepolia, address wbtcSepolia, /*uint256*/string memory deployerKeySepolia) =
            helperConfig.activeNetworkConfigSepolia(); // For Sepolia
        (address wethUsdPriceFeed, address wbtcUsdPriceFeed, address weth, address wbtc, uint256 deployerKey) =
            helperConfig.activeNetworkConfig(); // For Anvil
        tokenAddresses = [weth, wbtc]; //setting token[] for dscEngine constructor
        priceFeedAddresses = [wethUsdPriceFeed, wbtcUsdPriceFeed]; //setting priceFeedAddress[] for dscEngine constructor sequentially for each corresponding token in tokenAddresses[]

@>     vm.startBroadcast();
        // Powering up each of the contracts
        DecentralisedStableCoin dsc = new DecentralisedStableCoin();
        DSCEngine dscEngine = new DSCEngine(tokenAddresses, priceFeedAddresses, address(dsc));
        dsc.transferOwnership(address(dscEngine));
        vm.stopBroadcast();
        return (dsc, dscEngine, helperConfig);
    }

/*SNIPPED*/ means every other aspect of code remains same.

Deploy with forge script script/DeployDSC.s.sol:DeployDSC --fork-url $SEPOLIA --account defiProtocol2 --sender <public-key-of-encrypted-private-key> --broadcast
Forked test with forge test -f <rpc-url args>

Hope this helps.

[EngrPips]

Hello @Ikpong-Joseph, This seems interesting but I think the private key is always encrypted in the file where it is stored, does it automatically get decrypted whenever we read the file?

[Ikpong-Joseph]

When deploying, you'll be asked for the password with which you encrypted the key. I believe it gets decrypted then, but that's behind the scenes and doesn't expose the private key.

[EngrPips]

Yeah, I know that happens behind the scene but i am wondering if reading the path where our encrypted private key is stored will return the encrypted private key or will decrypt it before returning it to us.

[Ikpong-Joseph]

It won't return the private key. If there's an error, say you didn't add the `--sender <account-name>` flag while deploying, it returns the public key associated with it.

…

On Sat, 22 Jun 2024, 07:31 EngrPips, ***@***.***> wrote: Yeah, I know that happens behind the scene but i am wondering if reading the path where our encrypted private key is stored will return the encrypted private key or will decrypt it before returning it to us. — Reply to this email directly, view it on GitHub <#1805 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BD7GOMEWBS5NRHD7S5DZRZDZIUK2TAVCNFSM6AAAAABI6W7WL2VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TQNBVGM4TE> . You are receiving this because you were mentioned.Message ID: <Cyfrin/foundry-full-course-f23/repo-discussions/1805/comments/9845392@ github.com>

[EngrPips]

Hmmmm 🤔. I am just trying to understand if reading the path where our private key is encrypted to would return an encrypted private key or a decrypted private key