ERC 2335 - Encrypting Private Keys

While taking the @cyfrin_Updraft course, I came across ERC 2335, I realized the dire implication of hardcoding private keys onto the project repo and then pushing to GitHub.

So many developers forget to remove their private keys and it was a menace and a big issue until the ERC 2335 was introduced.

So what is the ERC 2335?

ERC-2335 emerged as a crucial response to a persistent and dangerous problem in blockchain development: the accidental exposure of private keys in public repositories and production environments.

Before its standardization, developers frequently made the costly mistake of hardcoding private keys directly in their source code or configuration files, which would then be inadvertently pushed to GitHub or deployed to production servers.

These exposures often resulted in the immediate theft of funds and compromise of smart contracts, as malicious actors continuously scan public repositories for exposed keys.

The standard introduces a structured approach to private key encryption, specifically designed to make it harder for developers to accidentally commit sensitive key material.

It provides a robust encryption framework that separates the storage of encrypted keys from application code while maintaining interoperability across different platforms and tools.

By enforcing a clear distinction between encrypted key storage and application logic, ERC-2335 helps development teams implement secure key management practices from the start of their projects.

One of the most significant aspects of ERC-2335 is its emphasis on secure local storage and encryption of private keys, rather than relying on environment variables or configuration files that might accidentally be included in version control.

This approach directly addresses the common pitfall of developers using plaintext private keys during development and forgetting to remove them before pushing code to public repositories.

How does it work

To follow this next part, fork the )

If you encounter any issues during the installation please drop a comment or use AI to resolve them.

Once you are done you should be able to see the following cast, anvil, forge and chisel

Next copy the scofield contract we forked from GitHub into our src and delete whatever you see inside. Make sure to save with the .sol format.

Spin up your terminal and type anvil to create a local EVM account which would give us access to accounts and private keys.

Here we set our private key to hide_my_key and set a password so we we run

forge script script/Deployscofield.s.sol --rpc-url HTTP://127.0.0.1:8545 --broadcast --account hide_my_key --sender 0x15d34aaf54267db7d7c367839aaf71a00a2c6a65 

Here we are prompted for the password we set for our private key

Voila.

We have learnt a valuable lesson and that is we don't have to use our private key in our development stage going forward.

If you have any recommendations or you feel I forgot something please drop a comment below.

You can read more about ERC 2335 here.