Skip to content

fix(wallet): zero sensitive PIN and secret-key form state after use #915

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
llinsss merged 3 commits into from
Aug 31, 2026
Merged

fix(wallet): zero sensitive PIN and secret-key form state after use #915

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e81d8d1
fix(wallet): zero sensitive PIN and secret-key form state after use
Alu-card19 Aug 25, 2026
e929288
Merge branch 'main' into fix/856-zero-wallet-secret-state
Clinton6801 Aug 29, 2026
092ff55
Merge branch 'main' into fix/856-zero-wallet-secret-state
llinsss Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 26 additions & 1 deletion src/components/Wallet/MultiSigSetup.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,14 @@ export default function MultiSigSetup({
const [showSetupConfirm, setShowSetupConfirm] = useState(false);
const [showRemoveConfirm, setShowRemoveConfirm] = useState<string | null>(null);

// Cleanup sensitive state on unmount
useEffect(() => {
return () => {
setPin('');
setRemovePin('');
};
}, []);

if (!wallet) {
return (
<div className="text-center py-12 text-gray-400">Select a wallet to configure multi-sig.</div>
Expand Down Expand Up @@ -127,9 +135,11 @@ export default function MultiSigSetup({
highThreshold,
});
setResult(res);
// Zero sensitive state immediately after success
setPin('');
} catch {
// error shown via hook
// error shown via hook, also zero sensitive state on failure
setPin('');
}
}

Expand All @@ -144,9 +154,12 @@ export default function MultiSigSetup({
onClearError();
try {
await onRemoveSigner(removePin, signerKey);
// Zero sensitive state immediately after success
setRemovePin('');
setRemovingKey(null);
} catch {
// error shown via hook, also zero sensitive state on failure
setRemovePin('');
setRemovingKey(null);
}
}
Expand Down Expand Up @@ -226,7 +239,13 @@ export default function MultiSigSetup({
type="password"
value={removePin}
onChange={(e) => setRemovePin(e.target.value)}
onCopy={(e) => e.preventDefault()}
onCut={(e) => e.preventDefault()}
onPaste={(e) => e.preventDefault()}
placeholder="Your wallet PIN…"
autoComplete="off"
autoCorrect="off"
spellCheck={false}
className="flex-1 px-3 py-1.5 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-500"
/>
</div>
Expand Down Expand Up @@ -385,7 +404,13 @@ export default function MultiSigSetup({
type={showPin ? 'text' : 'password'}
value={pin}
onChange={(e) => setPin(e.target.value)}
onCopy={(e) => e.preventDefault()}
onCut={(e) => e.preventDefault()}
onPaste={(e) => e.preventDefault()}
placeholder="Enter PIN to sign setup transaction…"
autoComplete="off"
autoCorrect="off"
spellCheck={false}
className="w-full px-3 py-2 pr-10 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-500"
/>
<button
Expand Down
Loading