Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 18bf15005d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
spoon_toolkits/crypto/evm/signers.py
Outdated
| ) | ||
| else: | ||
| logger.debug("Using plaintext private_key parameter") | ||
| key = private_key |
There was a problem hiding this comment.
If the caller supplies an encrypted private_key parameter and decryption succeeds, key is set from the vault, but it is then unconditionally overwritten with the original (still-encrypted) private_key. That means LocalSigner will receive the encrypted ENC:v2... string and fail to decode or sign. This breaks local signing whenever users pass encrypted keys via the parameter even with a valid SPOON_MASTER_PWD.
Useful? React with 👍 / 👎.
spoon_toolkits/crypto/evm/signers.py
Outdated
| key = _get_private_key_from_vault() | ||
| else: | ||
| logger.debug(f"Using plaintext {ENV_PRIVATE_KEY} from environment") | ||
| key = env_key |
There was a problem hiding this comment.
When ENV_PRIVATE_KEY is encrypted, _get_private_key_from_vault() returns the decrypted key, but the following unconditional assignment key = env_key overwrites it with the encrypted string. In that case local signing will attempt to use the encrypted value and fail. This breaks any setup that relies on the auto-decrypt path for environment keys.
Useful? React with 👍 / 👎.
2 participants
Integrate existing SignerManager into SolanaTransferTool and SolanaSwapTool
Enable secure remote signing via Turnkey API for Solana transactions
Maintain backward compatibility with local private key signing