Electric-Coin-Company / zcash-android-wallet-sdk

Native Android SDK for Zcash
MIT License
5 stars 9 forks source link

[SDK audit] Recommendation: Confirm that tracing is turned off for release builds #1466

Closed HonzaR closed 2 months ago

HonzaR commented 4 months ago

Is your feature request related to a problem? Please describe.

In backend-lib/src/main/rust/lib.rs there is code for enabling tracing of the Rust code:

Screenshot 2024-04-23 at 16 48 58

Describe the solution you'd like

Double-check that trace information is not generated and saved in release builds, since logs of tracing information could reveal details of private actions the user takes.

Alternatives you've considered

Additional context

We've already checked the production wallet build with the production SDK included, and it didn't reveal any tracing logs for create-new-wallet or restore-wallet-and-send use cases. See the attached logs below (the logs come from all device log tray filtered on zcash keyword):