Private Keys Are Sent Directly to a Flux AI Server

[eljaladz]

Labels: security, bug, critical

Summary

There is a critical security vulnerability in the index.js script. It sends users' raw private keys directly to the fluxai-backend API. This exposes every user of this script to the immediate and total loss of all funds and assets associated with the provided private key.

Vulnerability Details & Impact

The fundamental rule of cryptocurrency is to never share your private key. This script breaks that rule by design.

The privateKey variable is placed directly into the 'x-wallet-address' header and transmitted over the network. Anyone with access to the receiving server (e.g., the service developers, or an attacker who has compromised the server) can steal these keys and drain the corresponding wallets.

This is not the standard or secure way to handle authentication in Web3. Secure applications prove ownership by asking the user to sign a message, not by asking for the private key itself.

Location of the Vulnerable Code

• File: index.js
• Function: getHeaders(privateKey)
• Line: The issue originates on line 73:

  //...
  'x-wallet-address': privateKey, // The raw private key is assigned here
  //...

• Execution: This insecure header is then used in the axios requests within the login (line 82) and generateImage (line 157) functions.

Proposed Immediate Fix (Client-Side)

The script should derive the public wallet address from the private key and send the address instead. This is a simple change using the ethers library.

1. Add ethers to the project:

npm install ethers

2. Modify the getHeaders function:

Current (Insecure) Code:

const getHeaders = (privateKey) => {
  // ...
  return {
    // ...
    'x-wallet-address': privateKey,
    // ...
  };
};

Suggested (Secure) Code:*

const { Wallet } = require('ethers'); // Add this to the top of the file

const getHeaders = (privateKey) => {
  // Create a wallet instance from the private key
  const wallet = new Wallet(privateKey);
  // Securely get the public address
  const address = wallet.address;

  const userAgent = new UserAgent();
  return {
    // ...
    // Send the public address, NOT the private key
    'x-wallet-address': address,
    // ...
  };
};