Skip to content

Load multisig RPC configuration from environment - F-ssv-dkg-009 - #238

Open
julienharbulot wants to merge 3 commits into
mainfrom
F-ssv-dkg-009
Open

Load multisig RPC configuration from environment - F-ssv-dkg-009#238
julienharbulot wants to merge 3 commits into
mainfrom
F-ssv-dkg-009

Conversation

@julienharbulot

Copy link
Copy Markdown
Contributor

Ticket

F-ssv-dkg-009

This fixes a security finding in ssv-dkg where an Alchemy Sepolia API key was hardcoded in integration_test/multisig_test.go and the Gnosis multisig example scripts under utils/gnosis_multisig_examples.

Changes

  • Replaced the hardcoded Ethereum RPC URL in the multisig integration tests with ETH_RPC_URL and skip the RPC-dependent tests when it is not set.
  • Replaced the hardcoded RPC URL in the Gnosis multisig example scripts with runtime environment variable loading.
  • Updated the example READMEs to document the env-based secret flow.
  • Expanded .gitignore to ignore *.env files.

Validation

  • GOPROXY=https://proxy.golang.org,direct go test -timeout=3600s ./integration_test/... -run 'Test(ReshareBulkJSONPArsing|ResignBulkJSONPArsing|VerifyMultisigSignedOnChain2of3|VerifyMultisigSignedOnChain|VerifyMultisigSignedOffChain|VerifyEOASigned)$'
  • GOPROXY=https://proxy.golang.org,direct go tool golangci-lint run -v ./integration_test/...

Fixes - Fixes ssvlabs/ssv-node-board#623

@julienharbulot julienharbulot self-assigned this Apr 23, 2026
@julienharbulot
julienharbulot enabled auto-merge (squash) April 23, 2026 12:21
nkryuchkov
nkryuchkov previously approved these changes Apr 23, 2026
Comment thread integration_test/multisig_test.go
Comment thread .gitignore
ljuba-ssv
ljuba-ssv previously approved these changes Apr 24, 2026
ljuba-ssv
ljuba-ssv previously approved these changes Apr 29, 2026
nkryuchkov
nkryuchkov previously approved these changes Apr 29, 2026
@momosh-ssv
momosh-ssv self-requested a review April 30, 2026 07:45
Comment thread integration_test/multisig_test.go
Comment thread utils/gnosis_multisig_examples/validate/index.ts
Comment thread utils/gnosis_multisig_examples/safe_off_chain/README.md
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants