3

I'm about to deploy a small Dapp to Mainnet using infura. Built using express + truffle.

I'm curious to hear how people are storing their mnemonic value when deploying to mainnet using truffle + Infura.

All examples I've found thus far store the mnemonic value as plaintext inside truffle.js.. which seems to me like a giant red flag.

According to http://truffleframework.com/tutorials/using-infura-custom-provider :

Warning: In production, we highly recommend storing the mnemonic in another (secret) file, to reduce the risk of the mnemonic becoming known. If someone knows your mnemonic, they have all of your addresses and private keys!

I'm curious to hear how people are setting up this mnemonic secret file ? Are you just restricting perms to the mnemonic file to +r inside express (or whatever..)? Or are you encrypting the mnemonic file on the fs and then decrypting it inside express? The latter feels safer.

Perhaps someone has an example of a solution they have come up with.. ?

|improve this question
3

Using dotenv you can hide your private keys. This is a pretty good tutorial, where they explain it in more detail:

http://www.masonforest.com/blockchain/ethereum/2017/11/13/how-to-deploy-an-erc20-token-in-20-minutes.html

|improve this answer
  • 2
    Please refrain from posting links(they might not always work) and instead highlight the relevant text in your posts. – Vignesh Karthikeyan May 29 '18 at 15:40
  • Amazing! Thank you. I feel this should be in the truffle documentation. Given that many devs are new to this space, it's very easy to overlook something that might then have serious repercussions if deployed to mainnet. – hellohihihi May 29 '18 at 23:55
  • @hellohihihi totally agree! – Gabor Soter Jun 3 '18 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.