forge script call traces should not print private key.

[robinsdan]

Component

Forge

Have you ensured that all of these are up to date?

• Foundry
• Foundryup

What version of Foundry are you on?

forge 0.2.0 (24abca6 2024-01-16T07:35:41.234348345Z)

What command(s) is the bug in?

forge script

Operating System

None

Describe the bug

The call traces will print the private key param of VM::startBroadcast and VM::broadcast. It may lead to users inadvertently leaking sensitive information.

        vm.startBroadcast(uint256(vm.envBytes32("MAINNET_KEY")));
        // ... 
        vm.stopBroadcast();

[mattsse]

good point, @DaniPopes can we redact the envBytes32 call as well?
I assume this is mostly used for reading pk

[zerosnacks]

Please correct me if I'm wrong but I suspect there is a logical error in:

foundry/crates/evm/traces/src/decoder/mod.rs

Line 368 in 8885e97

if !func.inputs.is_empty() && func.inputs[0].ty != "uint256" {

This should be func.inputs[0].ty == "uint256"

Currently both envUint (shown in https://book.getfoundry.sh/cheatcodes/start-broadcast#examples) and envBytes32 print the private key.

Redacting the envUint and envBytes32 directly (as was done for addr: #6698) doesn't seem necessary because it is handled here (<env var value>):

https://github.com/foundry-rs/foundry/blob/master/crates/evm/traces/src/decoder/mod.rs#L462C20-L462C27

Note that there is possibly the same logical error here:

foundry/crates/evm/traces/src/decoder/mod.rs

Line 378 in 8885e97

if !decoded.is_empty() && func.inputs[0].ty != "uint256" {

[mattsse]

nice find! this makes sense

do you want to submit a fix + test?

[zerosnacks]

nice find! this makes sense

do you want to submit a fix + test?

Sure! Feel free to assign this to me