[Bug] Private Keys Leak to logs and insecure memory

[0xAlcibiades]

Component

Other (please provide more details)

What version of Alloy are you on?

0.5.4

Operating System

None

Describe the bug

For the local signer alloy does not use the secrets crate or other solution to protect keys, alloy should by default use secure secrets management, or implement a SecureLocalSigner if the concern here is compatibility with no_std.

[mattsse]

could you please provide more specifics, which type leaks to debug?

[0xAlcibiades]

could you please provide more specifics, which type leaks to debug?

So the issue is that the scalar underlying SecretKey isn't actually protected using the secrets crate here, i.e. the underlying scalar is accessible generally both in memory and to be logged out.

This would affect shared tenant systems where the memory could be inspected, and distributed tracing types of scenarios

This is actually an issue with the implementation of the underlying ECDSA library used in alloy, but the information can be protected as such:

https://github.com/warlock-labs/sylow/blob/main/src/secrets.rs

h/t to @trbritt

[mattsse]

Secretkey does not log internals

impl<C> Debug for SecretKey<C>
where
    C: Curve,
{
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.debug_struct(core::any::type_name::<Self>())
            .finish_non_exhaustive()
    }
}