fix(contract_manager): mask private keys in deployment script logs #3105
+15
−3
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Apply private key masking to deployment script logging across 3 additional contract manager scripts. This extends the fix from PR #3078 to prevent private keys from being logged in plaintext during contract deployments.
Rationale
PR #3078 fixed private key logging in
deploy_evm_executor_contracts.ts
, but a comprehensive audit revealed 3 additional deployment scripts that log the entiredeploymentConfig
object containing private keys:deploy_evm_entropy_contracts.ts
deploy_evm_pricefeed_contracts.ts
deploy_evm_pulse_contracts.ts
These scripts could expose private keys in deployment logs, creating a security risk.
Changes
Each script now follows the identical pattern from PR #3078:
maskedDeploymentConfig
object that spreads the original configprivateKey
field with<REDACTED>
(orundefined
if no key exists)How has this been tested?
The changes are purely cosmetic (logging only) and don't modify any deployment functionality. Pre-commit hooks including linting and formatting passed successfully.
Review Checklist
Critical items for review:
Security consideration: This addresses the immediate issue of private key exposure in deployment logs, but reviewers may want to consider if there are other potential vectors for private key leakage not covered by this change.
Link to Devin run: https://app.devin.ai/sessions/b55e7883b27b47f6958a04f1886ff362
Requested by: aditya@dourolabs.xyz