Skip to content

fix(cli): incorrect/unnecessary passphrase assumptions#224

Open
0xferrous wants to merge 1 commit into
open-wallet-standard:mainfrom
0xferrous:fix/wallet-import-create
Open

fix(cli): incorrect/unnecessary passphrase assumptions#224
0xferrous wants to merge 1 commit into
open-wallet-standard:mainfrom
0xferrous:fix/wallet-import-create

Conversation

@0xferrous
Copy link
Copy Markdown

@0xferrous 0xferrous commented May 13, 2026

What

Don't make empty passphrase assumptions in wallet create/import/export/decrypt.

Why

read_passphrase currently:

  1. tries to read passphrase from env vars OWS_PASSPHRASE, LWS_PASSPRASE.
  2. checks if it is an interactive terminal, if it is, it prompts the user for passphrase
  3. if it is not an interactive terminal, it assumes passphrase to be "".

Given this, there is no need for us to assume:

  1. Empty passphrases for ows wallet import, ows wallet create. This assumption creates poor security for human users.
  2. Empty passphrase while decrypting the signing key, this assumption causes 2x the time for all wallets encrypted without "", even in cases when OWS_PASSPHRASE was explicitly set.

Closes #

Testing

  • cargo test --workspace passes
  • cargo clippy --workspace -- -D warnings is clean
  • npm test passes (if Node bindings changed)
  • Tested manually with ows CLI

Notes

Anything reviewers should know.

@0xferrous 0xferrous requested a review from njdawn as a code owner May 13, 2026 07:54
@vercel
Copy link
Copy Markdown

vercel Bot commented May 13, 2026

@0xferrous is attempting to deploy a commit to the MoonPay Team on Vercel.

A member of the Team first needs to authorize it.

@0xferrous 0xferrous force-pushed the fix/wallet-import-create branch from 952723d to c8b2182 Compare May 13, 2026 08:08
@0xferrous 0xferrous changed the title fix(cli): wallet import/create assuming empty passphrases fix(cli): incorrect/unnecessary passphrase assumptions May 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant