-
Notifications
You must be signed in to change notification settings - Fork 237
fix: multiple node issues #766
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
65d7109
a5be057
32caaf3
720ed80
ff17c94
03aa877
0f3b501
ef2c2d6
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -16,7 +16,7 @@ const palmNetworkOptions: EvmNetworkOptions = { | |
| isTestNetwork: false, | ||
| currencyName: 'PALM', | ||
| currencyNameLong: 'PALM', | ||
| node: 'https://palm-mainnet.public.blastapi.io', | ||
| node: 'https://palm-mainnet.infura.io/v3/3a961d6501e54add9a41aa53f15de99b', | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chainSecurity concern: Infura API key hardcoded in source code. The Infura API key
Consider moving RPC endpoints with API keys to a secure configuration management system or using environment variables that are injected at build time. Run the following script to check if other network files also hardcode API keys in their RPC endpoints: 🏁 Script executed: #!/bin/bash
# Description: Check if other network files contain hardcoded API keys in RPC URLs
# Search for common API key patterns in network configuration files
rg -n -C 2 'node:.*\.(infura\.io|alchemy\.com|quicknode\.com).*[a-f0-9]{32}' packages/extension/src/providers/ethereum/networks/Length of output: 473 Length of output: 509 🏁 Script executed: #!/bin/bash
# Check if the codebase uses environment variables or config management for RPC endpoints
rg -n "process\.env|import.*config|require.*config" packages/extension/src/providers/ethereum/networks/ -C 2 | head -50Length of output: 0 🏁 Script executed: #!/bin/bash
# Check the .env or environment configuration files in the repository root
fd -e env -o -e example '\.(env|config)' | head -20Length of output: 116 🏁 Script executed: #!/bin/bash
# Check if there are any comments or documentation about RPC endpoint management
rg -n "RPC|endpoint|api.?key" packages/extension/src/providers/ethereum/networks/ -C 1 | head -50Length of output: 556 Length of output: 5307 🏁 Script executed: #!/bin/bash
# Examine a few other network files to see how they configure RPC endpoints
# Get first 3 network files (excluding index)
files=$(fd . 'packages/extension/src/providers/ethereum/networks/' -e ts | grep -v index.ts | head -3)
for file in $files; do
echo "=== $file ==="
rg -n "node:" "$file" -A 0 -B 0
echo ""
doneLength of output: 347 🏁 Script executed: #!/bin/bash
# Search entire codebase for environment variable patterns related to RPC or endpoints
rg -n "process\.env.*RPC|process\.env.*NODE|RPC_URL|NODE_URL" packages/extension/ | head -20Length of output: 174 🏁 Script executed: #!/bin/bash
# Check if .env files exist in the root or extension directories
find packages/extension -name ".env*" -o -name "*.env" 2>/dev/null | head -10Length of output: 31 🏁 Script executed: #!/bin/bash
# Examine the palm.ts file context to see if there's any configuration pattern
cat packages/extension/src/providers/ethereum/networks/palm.tsLength of output: 1062 Length of output: 41 🏁 Script executed: #!/bin/bash
# Comprehensive search: show ALL node: definitions across all network files to ensure no missed API keys
rg -n "node:" packages/extension/src/providers/ethereum/networks/ --type tsLength of output: 7885 🏁 Script executed: #!/bin/bash
# Check if there's any documentation or comments about RPC endpoint management in the root README or docs
find . -maxdepth 2 -name "README*" -o -name "SECURITY*" 2>/dev/null | xargs grep -l "RPC\|API.key\|endpoint" 2>/dev/null | head -5Length of output: 0 🏁 Script executed: #!/bin/bash
# Search for any comments mentioning API key, security, or hardcoded in the networks directory
rg -n "API.?key|hardcod|secret|credential" packages/extension/src/providers/ethereum/networks/ -iLength of output: 0 Security concern: Infura API key hardcoded in source code remains critical. The verification confirms that
All other 80+ networks use public endpoints without credentials, demonstrating that environment-based or build-time configuration is feasible. Move this key to environment variables injected at build time or use a secure credential management system. 🤖 Prompt for AI Agents |
||
| icon, | ||
| coingeckoID: 'palm-ai', | ||
| activityHandler: wrapActivityHandler(() => Promise.resolve([])), | ||
|
|
||
This file was deleted.
This file was deleted.
Uh oh!
There was an error while loading. Please reload this page.