Description
The entire AutoPilot automation system relies on a single AUTOPILOT_SECRET_KEY (the engine hot-wallet) stored as a plain environment variable. This keypair signs ALL vault creation transactions and ALL deposit transactions. If leaked via a misconfigured render.yaml, log aggregation, or a server breach, an attacker gains full control over every user's vault.
Expected Behavior
The engine private key should be stored in a secrets manager (AWS Secrets Manager, HashiCorp Vault, or HSM). Ideally, vault operations should require multi-sig or use the Soroban contract as a trustless escrow.
Impact
High - Single point of failure for all user funds under automation.
Description
The entire AutoPilot automation system relies on a single AUTOPILOT_SECRET_KEY (the engine hot-wallet) stored as a plain environment variable. This keypair signs ALL vault creation transactions and ALL deposit transactions. If leaked via a misconfigured render.yaml, log aggregation, or a server breach, an attacker gains full control over every user's vault.
Expected Behavior
The engine private key should be stored in a secrets manager (AWS Secrets Manager, HashiCorp Vault, or HSM). Ideally, vault operations should require multi-sig or use the Soroban contract as a trustless escrow.
Impact
High - Single point of failure for all user funds under automation.