other
Error
- Location
SKILL.md:96- Finding
Solana Wallet Private Keys Transmitted to Remote Services
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:96-109;references/marketplace.md:25-38;references/atp-protocol.md:5-17, 45-57
Vulnerability Type: Sensitive credential disclosure to remote services
Risk Level: CriticalVulnerable Code
SKILL.md:96-109python ### 3. Token Launch (Solana) ```python payload = { "name": "My Agent Token", "description": "Agent description", "ticker": "MAG", "private_key": "[1,2,3,...]" # Solana wallet private key } response = requests.post( "https://swarms.world/api/token/launch", headers={"Authorization": "Bearer API_KEY", "Content-Type": "application/json"}, json=payload ) # Returns: token_address, pool_address, listing_url # Cost: ~0.04 SOLtext `references/marketplace.md:25-38` ```markdown ## Token Launch API **POST** `https://swarms.world/api/token/launch` Creates agent listing + launches Solana token in single request. ### Required Fields | Field | Type | Description | |-------|------|-------------| | `name` | string | Agent display name (min 2 chars) | | `description` | string | Agent description | | `ticker` | string | Token symbol (1-10 chars, letters+numbers) | | `private_key` | string | Solana wallet key (JSON array, base64, or base58) |references/atp-protocol.md:5-17markdown ## Components 1. **Settlement Service (Facilitator)** — handles usage parsing, payment calculation, blockchain transactions - URL: `https://facilitator.swarms.world` 2. **Middleware** — FastAPI middleware intercepting API responses, encrypting until payment confirmed 3. **Client** — user-facing client for ATP-protected endpoints ## Request Flow 1. Client sends request with wallet private key in header 2. Endpoint processes, returns response with usage data 3. Middleware encrypts response, sends payment request 4. Settlement service calculates cost, creates split transacti ...[truncated 2745 chars]- Remediation
View remediation
Remediation Suggestions
- Remove all API fields and HTTP headers that accept raw wallet private keys.
- Construct transactions on the service, return unsigned transaction data, and require the user to sign locally.
- Submit only signed transaction bytes or signatures to the remote service.
- Integrate established Solana wallet adapters or hardware-wallet approval flows.
- Ensure the remote service cannot substitute transaction contents after user review.
- Display transaction recipients, amounts, fees, and instructions before requesting a signature.
- Until the protocol is redesigned, explicitly warn users not to use funded or primary wallets and require isolated, low-balance wallets.
- Redact wallet credentials from request logs, traces, exception reports, analytics, and monitoring systems.
- Rotate any key that has previously been supplied to these endpoints and transfer remaining assets to a newly generated wallet.