Best security practices for contract deployment?

Question

I'm using Truffle to develop an ERC721 smart contract.

Truffle expects HDWalletProvider to be installed so that Truffle can sign transactions for you, however this requires storing your mnemonic locally and importing it into Truffle's config file. Isn't that really insecure? I've seen approaches where it's kept in a .env file, however this still seems vulnerable.

What's considered best practice from a security P.O.V?

Would it be deploying via Remix and MetaMask, with MetaMask connected to a hardware wallet so that the wallet's mnemonic and private key are never stored?

Thanks!!

Answer 1

Best Approach

Deploy with any method you want (even a MNEMONIC stored in a .env file) then immediately transfer the ownership of the contracts to a Gnosis Safe multisig controlled by multiple signers. If you're using OpenZeppelin's Ownable.sol, you do this via transferOwnership.

2nd Best Approach

Use a hardware wallet like Ledger or Trezor, load your contracts in Remix and deploy with MetaMask.

Pro tip: connect to localhost so you don't have to copy-paste the contracts' source code.