Encrypt private keys at rest using Alloy's built-in keystore methods by smypmsa · Pull Request #19 · Polymarket/polymarket-cli

smypmsa · 2026-02-25T10:51:37Z

Closes #18

Encrypt private keys at rest using Alloy's built-in keystore methods

Problem

Private keys are stored as plaintext in ~/.config/polymarket/config.json. Any process running as the user can read the file and steal funds.

Solution

Encrypt private keys using LocalSigner::encrypt_keystore / decrypt_keystore from Alloy (already a dependency — enabled the signer-keystore feature). Uses AES-128-CTR + scrypt, the same format as MetaMask, Geth, and Foundry. The only new crate is rpassword for hidden terminal input.

What changed for users

Command	Before	After
`wallet create`	Saved plaintext key to `config.json`	Prompts for password (+ confirmation), saves encrypted `keystore.json`
`wallet import`	Same	Same
`wallet show` / `wallet address`	Read plaintext key from config	Prompts for password to decrypt keystore
`wallet reset`	Deleted `config.json`	Deletes both `config.json` and `keystore.json`
`setup` wizard	Same as `wallet create`	Same as `wallet create`
Any key-using command (`order`, `approve`, `ctf split`, …)	Read plaintext key from config	Prompts for password. 3 retries on wrong password.
`wallet export` (new)	—	Decrypts keystore, prints private key to stdout

New env var: POLYMARKET_PASSWORD — supplies the password non-interactively (for scripts/CI).

File layout after:

~/.config/polymarket/
  config.json    # { "chain_id": 137, "signature_type": "proxy" }  — no private key
  keystore.json  # encrypted (AES-128-CTR + scrypt)

Migration

On first use after upgrade, if config.json contains a plaintext private_key and no keystore.json exists, the CLI prompts for a password, encrypts the key into keystore.json, and strips private_key from config.json. The original command continues without a second password prompt.

Key resolution priority (unchanged, pre-existing)

--private-key CLI flag — plaintext, no password
POLYMARKET_PRIVATE_KEY env var — plaintext, no password
keystore.json — encrypted, password required

Note: --private-key is a pre-existing flag, not introduced here. It's less secure than the keystore — the key is visible in shell history and /proc/<pid>/cmdline. Prefer the keystore for everyday use; the flag and env var are escape hatches for CI or advanced users.

Dependencies

Crate	Version	Status	Purpose
`alloy`	1.6.3	existing — added `signer-keystore` feature	`LocalSigner::encrypt_keystore` / `decrypt_keystore`
`rand`	0.8	existing	RNG for keystore encryption
`rpassword`	7	new	Hidden password terminal input

Manual testing

All commands use POLYMARKET_PASSWORD to avoid interactive prompts. Drop it to test the interactive flow.

1. Create, inspect, show, export

polymarket wallet reset --force
POLYMARKET_PASSWORD=test123 polymarket wallet create

cat ~/.config/polymarket/config.json    # no private_key field
cat ~/.config/polymarket/keystore.json  # encrypted blob
ls -la ~/.config/polymarket/            # files 0600, dir 0700

POLYMARKET_PASSWORD=test123 polymarket wallet show
POLYMARKET_PASSWORD=test123 polymarket wallet address
POLYMARKET_PASSWORD=test123 polymarket wallet export   # prints 0x-prefixed key

2. Wrong password

POLYMARKET_PASSWORD=wrong polymarket wallet export
# Wrong password. Try again. (1/3)
# Wrong password. Try again. (2/3)
# Error: Wrong password          (exit code 1)

3. JSON output

POLYMARKET_PASSWORD=test123 polymarket wallet show -o json
POLYMARKET_PASSWORD=test123 polymarket wallet export -o json

4. Import and round-trip

polymarket wallet reset --force
POLYMARKET_PASSWORD=test123 polymarket wallet import 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80
POLYMARKET_PASSWORD=test123 polymarket wallet export
# should print 0xac0974...

5. --private-key flag bypasses password

polymarket wallet address --private-key 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80
# prints address, no password prompt

6. Auto-migration from plaintext

polymarket wallet reset --force
mkdir -p ~/.config/polymarket
cat > ~/.config/polymarket/config.json << 'EOF'
{
  "private_key": "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80",
  "chain_id": 137,
  "signature_type": "proxy"
}
EOF

POLYMARKET_PASSWORD=migrate123 polymarket wallet address
# Your wallet key is stored in plaintext. Encrypting it now...
# Wallet key encrypted successfully.
# 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266

cat ~/.config/polymarket/config.json             # private_key gone
POLYMARKET_PASSWORD=migrate123 polymarket wallet export  # prints original key

7. Reset

polymarket wallet reset --force
ls ~/.config/polymarket/   # No such file or directory

Note

High Risk
High risk because it changes wallet key storage and resolution paths, introducing encryption/decryption, password prompting, and migration logic that can block key access or cause data-loss if mis-handled. It also adds a new export path that prints decrypted keys to stdout, which is security-sensitive.

Overview
Moves wallet private keys from plaintext config to an encrypted keystore. wallet create/import and the setup wizard now prompt for a password (with confirmation) and write keystore.json, while config.json is rewritten to only contain non-sensitive settings.

Key resolution for all signer/provider creation is updated to support auto-migration of existing plaintext configs (encrypt on first use) and to prompt/retry for keystore passwords (with optional POLYMARKET_PASSWORD for non-interactive use). Adds a new wallet export subcommand to decrypt the keystore and print the private key, and updates reset/overwrite checks and tests accordingly.

^{Written by Cursor Bugbot for commit d9ba215. This will update automatically on new commits. Configure here.}

…thods Private keys were stored as plaintext in config.json. Now encrypted using LocalSigner::encrypt_keystore (AES-128-CTR + scrypt) via Alloy's signer-keystore feature. No new crypto crates added. - Password-protected keystore.json replaces plaintext key in config.json - New wallet export command to decrypt and print key for backup - Auto-migration from plaintext config on first use after upgrade - POLYMARKET_PASSWORD env var for non-interactive use (scripts/CI) - 3-retry on wrong password, hidden terminal input via rpassword Closes Polymarket#18 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/auth.rs

src/commands/wallet.rs

src/commands/setup.rs

- Move CLI flag and env var checks before migration block in resolve_key_string so --private-key is never overridden by migration - Add Keystore variant to KeySource so wallet show reports "encrypted keystore" instead of "config file" - Setup wizard now checks keystore_exists() and decrypts to detect existing wallet, preventing silent overwrite of keystore.json Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/commands/setup.rs

Keep the source from resolve_key() instead of re-deriving it from keystore_exists() heuristic. Correctly shows "POLYMARKET_PRIVATE_KEY env var" when the key came from the env var. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/config.rs

Wrap all password and private key strings in secrecy::SecretString to zeroize memory on drop and prevent accidental Debug/Display leaks. Requires explicit .expose_secret() for access, making secret usage auditable across the codebase. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

smypmsa · 2026-03-02T07:47:37Z

@chaz-polymarket

src/commands/wallet.rs

The merge with main left references to the removed `normalize_key` function and didn't account for `load_config()` signature change from `Option<Config>` to `Result<Option<Config>>`. - Replace undefined `normalized` with hex derivation from signer bytes - Update all `load_config()` callers for new Result-wrapped return type - Fix `&OutputFormat` vs `OutputFormat` mismatches at call sites - Add missing `std::fmt::Write` imports for hex formatting Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

src/commands/wallet.rs

The bytes-to-hex conversion was copy-pasted in 5 places across wallet.rs, setup.rs, and config.rs. Extract into a single config::key_bytes_to_hex() function. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

smypmsa force-pushed the feat/encrypted-key-storage branch from 811d02f to 05a728c Compare February 25, 2026 10:53

cursor bot reviewed Feb 25, 2026

View reviewed changes

src/auth.rs Outdated Show resolved Hide resolved

src/commands/wallet.rs Outdated Show resolved Hide resolved

src/commands/setup.rs Show resolved Hide resolved

cursor bot reviewed Feb 25, 2026

View reviewed changes

src/commands/setup.rs Outdated Show resolved Hide resolved

chaz-polymarket reviewed Feb 25, 2026

View reviewed changes

src/config.rs Outdated Show resolved Hide resolved

smypmsa requested a review from chaz-polymarket February 25, 2026 20:17

mvanhorn mentioned this pull request Mar 10, 2026

feat: encrypt private keys at rest using keystore #44

Open

9 tasks

Merge branch 'main' into feat/encrypted-key-storage

facd249

smypmsa mentioned this pull request Mar 11, 2026

Private keys stored as plaintext in config file #18

Open

cursor bot reviewed Mar 11, 2026

View reviewed changes

src/commands/wallet.rs Outdated Show resolved Hide resolved

cursor bot reviewed Mar 11, 2026

View reviewed changes

src/commands/wallet.rs Outdated Show resolved Hide resolved

refactor: extract key_bytes_to_hex helper to deduplicate hex conversion

d9ba215

The bytes-to-hex conversion was copy-pasted in 5 places across wallet.rs, setup.rs, and config.rs. Extract into a single config::key_bytes_to_hex() function. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Encrypt private keys at rest using Alloy's built-in keystore methods#19

Encrypt private keys at rest using Alloy's built-in keystore methods#19
smypmsa wants to merge 7 commits intoPolymarket:mainfrom
smypmsa:feat/encrypted-key-storage

smypmsa commented Feb 25, 2026 •

edited by cursor bot

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smypmsa commented Mar 2, 2026

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

smypmsa commented Feb 25, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Encrypt private keys at rest using Alloy's built-in keystore methods

Problem

Solution

What changed for users

Migration

Key resolution priority (unchanged, pre-existing)

Dependencies

Manual testing

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smypmsa commented Mar 2, 2026

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

smypmsa commented Feb 25, 2026 •

edited by cursor bot

Loading