Skip to content

fix: redact validator private keys from RPC - #1730

Merged
MuncleUscles merged 1 commit into
v0.121from
codex/redact-validator-private-keys-v0121
Aug 15, 2026
Merged

fix: redact validator private keys from RPC#1730
MuncleUscles merged 1 commit into
v0.121from
codex/redact-validator-private-keys-v0121

Conversation

@MuncleUscles

@MuncleUscles MuncleUscles commented Aug 14, 2026

Copy link
Copy Markdown
Member

What changed

  • recursively remove private-key fields from public transaction RPC payloads by default
  • keep stored/internal receipt data intact for Studio rollup-event signing
  • allow local inspection with SHOW_VALIDATOR_PRIVATE_KEYS_IN_RPC=true
  • cover transaction, Studio transaction, address history, block, and status-update responses

Why

Validator execution records include generated EOA keys used internally by Studio. Returning those values from public transaction RPC methods causes them to be mistaken for credentials that confer validator consensus authority.

Impact

Existing RPC callers no longer receive private-key fields unless the explicit opt-in configuration is enabled. Internal consensus and rollup signing behavior is unchanged.

Validation

  • pytest -q tests/unit/test_rpc_methods.py tests/unit/protocol_rpc/test_log_event_redaction.py (14 passed)
  • Black check passed
  • git diff --check passed
  • plain full E2E matrix passed

@coderabbitai

coderabbitai Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 236ba9c8-312b-4472-a26d-d1f2e2f72439

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Copy link
Copy Markdown
Member Author

/run-e2e default v0.5 all studio

@sonarqubecloud

Copy link
Copy Markdown

@MuncleUscles
MuncleUscles marked this pull request as ready for review August 14, 2026 21:17

Copy link
Copy Markdown
Member Author

/run-e2e default v0.5 all studio

Copy link
Copy Markdown
Member Author

/run-e2e

@MuncleUscles
MuncleUscles merged commit e77363f into v0.121 Aug 15, 2026
21 of 22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant