search

AlexanderBuzz / xrpl-php

A PHP library to interact with the XRP Ledger (XRPL) blockchain
ISC License
5 stars 3 forks source link

Wallet secrets and seeds exposed #1

Closed juliangums closed 2 years ago

juliangums commented 2 years ago

@AlexanderBuzz I came across your project when looking for an XRPL PHP SDK. I went through your code and saw this: https://github.com/AlexanderBuzz/xrpl-php/blob/081904370e48be5761ae553c08175e62f9c75391/src/Wallet/Wallet.php#L28-L32

You might want to stick this in an .env file and use a different wallet going forward. This one is now compromised.

AlexanderBuzz commented 2 years ago

This is standard test data from the documentation, no secretes here :)

juliangums commented 2 years ago

@AlexanderBuzz not sure what docs you're referring to. One can steal 22 XRP from it and issue more VRB and VSD token with the above info. If that's not an issue, ok. But thought I'd let you know.

AlexanderBuzz commented 2 years ago

@juliangums In the JavaScript documentation there is under Section 3) Generate Wallet the following example:

const test_wallet = xrpl.Wallet.fromSeed("sn3nxiW7v8KXzPzAqzyHXbSSKNuN9")

Thats what is in the hardcoded example, all the other stuff is derived from this.