3

I'm using Truffle to develop an ERC721 smart contract.

Truffle expects HDWalletProvider to be installed so that Truffle can sign transactions for you, however this requires storing your mnemonic locally and importing it into Truffle's config file. Isn't that really insecure? I've seen approaches where it's kept in a .env file, however this still seems vulnerable.

What's considered best practice from a security P.O.V?

Would it be deploying via Remix and MetaMask, with MetaMask connected to a hardware wallet so that the wallet's mnemonic and private key are never stored?

Thanks!!

Improve this question

1 Answer 1

Reset to default
8

Best Approach

Deploy with any method you want (even a MNEMONIC stored in a .env file) then immediately transfer the ownership of the contracts to a Gnosis Safe multisig controlled by multiple signers. If you're using OpenZeppelin's Ownable.sol, you do this via transferOwnership.

2nd Best Approach

Use a hardware wallet like Ledger or Trezor, load your contracts in Remix and deploy with MetaMask.

Pro tip: connect to localhost so you don't have to copy-paste the contracts' source code.

Improve this answer
8

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.