Audit : Secret keys are stored in memory

TalaoDAO / AltMe

Talao / Altme wallet : Open source Self Sovereign Identity wallet. Multi ecosystem support : EBSI conformant. ARF EUDI wallet implementation, DIIP and more.

https://talao.io

Apache License 2.0

47 stars 14 forks source link

Audit : Secret keys are stored in memory #1397

Closed ThierryThevenet closed 3 months ago

ThierryThevenet commented 1 year ago

we need to keep theh secret key in secure storage

hawkbee1 commented 1 year ago

@hawkbee1 : Asking more information from audit company.

hawkbee1 commented 1 year ago

every wallet has "wallet state" where all crypto accounts with secret keys are stored /TalaoDAO/AltMe/lib/wallet/model/crypto_account_data.dart, class CryptoAccountData, L:13, L:23, secretKey field
this state updates every time when new account is created /TalaoDAO/AltMe/lib/wallet/cubit/wallet_cubit.dart, createBlockchainAccount, L:305