2

So, I'll immediately preface this question with a statement:

You should never share your private key or mnemonic phrase with anyone for any reason. This gives that person full access to your wallet, all of your tokens, etc. Do NOT share your private keys!

I will now follow this up with a contradiction and a rare use-case where this doesn't apply. Let me explain.

I've developed an application (local CLI-based app) that performs buy/sell limit orders on various assets in realtime. Essentially a "sniper" for executing orders immediately. You set parameters for a listing that meets your requirements, and if it does, it scoops it up immediately.

So here comes the issue: for myself, I am perfectly comfortable using my own private key on an application I've written by myself. But I plan on distributing this to a few friends, closed source (obfuscated node.js app). This is an issue because as an end-user, I'd want to know where my private key is going, along with this, is storing the passphrase or mnemonic in a YAML file the best way to go? I think not.

Essentially, I have two issues:

  1. How could I somewhat prove that these keys are not being sent to a server somewhere (yes, users could use a request sniffing application, but they aren't all technically savvy)
  2. What is the best practice for storing these keys? I was thinking potentially a one-time input that gets encrypted to some hash that I then un-hash in my application. It's a bit of a facade but definitely prevents any random person being able to open the file and see the key in plaintext.

I will also once again reiterate, this solution is gross, I don't want to be doing this, but unfortunately it's the only way. I don't want to use a browser with a Metamask provider because I want this to be fully automated, and so do my users.

1

You could use a proxy signer that uses a Vault or HSM to sign the transactions. See Ethsigner for instance. It makes the setup a bit more complex but what you want to do is not really possible without some isolation of the keys and signing process at a network level and with some encryption over the secrets. No honest answer will give you a safe way to distribute an obfuscated software while ensuring your users key are safe on computer directly connected to the internet. This is the whole purpose of hardware wallets. Now even with a proxy signer you still provide a way for a hacker to sign with your keys. But you reduce the risk of them to acces the keys. Even yourself won't be able to access the private keys. Also if you need your friends to trust your code not to do things with their money, you can still open source it and let them run it from source. It still requires that they can read code. But trust is one of these things that requires effort from both parts to exist. Last advise: make them use a separate wallet where they only put a small portion of their funds to interact with your software. Then they won't fear that you empty all their coins.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.