fix: redact validator private keys from RPC - #1730
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/run-e2e default v0.5 all studio |
|
|
/run-e2e default v0.5 all studio |
|
/run-e2e |



What changed
SHOW_VALIDATOR_PRIVATE_KEYS_IN_RPC=trueWhy
Validator execution records include generated EOA keys used internally by Studio. Returning those values from public transaction RPC methods causes them to be mistaken for credentials that confer validator consensus authority.
Impact
Existing RPC callers no longer receive private-key fields unless the explicit opt-in configuration is enabled. Internal consensus and rollup signing behavior is unchanged.
Validation
pytest -q tests/unit/test_rpc_methods.py tests/unit/protocol_rpc/test_log_event_redaction.py(14 passed)git diff --checkpassed