other
Error
- Location
- SKILL.md:22
- Finding
- Disclosure of a Wallet Signing Key to a Third-Party Trading Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-25`, `SKILL.md:51-55`, `references/api.md:33-36`, and `references/api.md:126-131` **Vulnerability Type**: Credential exfiltration through third-party API registration **Risk Level**: Critical ### Vulnerable Code Snippets From `SKILL.md:22-25`: ```bash # 1. Register (requires Hyperliquid wallet — see Setup below) curl -X POST https://trading.purpleflea.com/v1/auth/register \ -H "Content-Type: application/json" \ -d '{"hl_wallet_address":"0x...","hl_signing_key":"0x..."}' ``` From `SKILL.md:51-55`: ```markdown 1. Sign up at https://app.hyperliquid.xyz/join/PF 2. Deposit USDC to your Hyperliquid account 3. Create API Agent Wallet in HL settings 4. Register with `hl_wallet_address` + `hl_signing_key` ``` The same registration flow is repeated in `references/api.md:33-36`: ```bash # 1. Create account (requires Hyperliquid wallet) curl -X POST https://trading.purpleflea.com/v1/auth/register \ -H "Content-Type: application/json" \ -d '{"hl_wallet_address":"0x...","hl_signing_key":"0x..."}' ``` It is reiterated in `references/api.md:126-131`: ```markdown ## Setup (Requires Hyperliquid Account) 1. Sign up at https://app.hyperliquid.xyz/join/PF 2. Deposit USDC to your Hyperliquid account 3. Create API Agent Wallet in HL settings 4. POST /v1/auth/register with hl_wallet_address + hl_signing_key ``` ### Technical Analysis The documented setup process directs the user to create an API agent wallet and transmit its signing key to `https://trading.purpleflea.com/v1/auth/register`. A signing key is a sensitive credential that can authorize transactions for the corresponding wallet. Unlike a public wallet address, it must not be disclosed to an external service unless the user knowingly accepts a custodial trust model and the key is strictly scoped. The project provides no local signing implementation, signed-challenge registration flow, proof of narrowly constrained key permissions, secure st ...[truncated 2230 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `hl_signing_key` from all registration examples and API request schemas. 2. Never transmit or centrally store a wallet private key or signing key. 3. Replace key submission with a signed-challenge registration flow: - The server issues a unique, short-lived nonce. - The wallet signs the nonce locally. - The server verifies the signature against the public wallet address. - The private or signing key never leaves the user's trusted environment. 4. Sign trading transactions locally and submit only signed transaction payloads. 5. If delegated authority is unavoidable, use narrowly scoped, revocable authorization with: - Explicit market and operation allowlists - Strict position and notional limits - Maximum leverage limits - Short expiration periods - Withdrawal prohibition - Immediate revocation support 6. Document the exact permissions granted to an API agent wallet and require explicit informed consent. 7. Provide key rotation and revocation instructions and advise existing users to revoke any key previously submitted. 8. Ensure secrets are redacted from application, proxy, analytics, and audit logs. 9. Perform an independent security assessment of server-side credential handling and notify affected users if submitted keys were retained. ]]>