accounts/keystore: clear decrypted key after use#33090 (#1790)

wit765 · web-flow · commit ea179d287cd9 · 2025-11-24T10:55:09.000+05:30
diff --git a/accounts/keystore/keystore.go b/accounts/keystore/keystore.go
@@ -417,6 +417,7 @@ func (ks *KeyStore) Export(a accounts.Account, passphrase, newPassphrase string)
 	if err != nil {
 		return nil, err
 	}
+	defer zeroKey(key.PrivateKey)
 	var N, P int
 	if store, ok := ks.storage.(*keyStorePassphrase); ok {
 		N, P = store.scryptN, store.scryptP
@@ -476,6 +477,7 @@ func (ks *KeyStore) Update(a accounts.Account, passphrase, newPassphrase string)
 	if err != nil {
 		return err
 	}
+	defer zeroKey(key.PrivateKey)
 	return ks.storage.StoreKey(a.URL.Path, key, newPassphrase)
 }
 

Original file line number	Diff line number	Diff line change
`@@ -417,6 +417,7 @@ func (ks *KeyStore) Export(a accounts.Account, passphrase, newPassphrase string)`
`417`	`417`	`if err != nil {`
`418`	`418`	`return nil, err`
`419`	`419`	`}`
	`420`	`+ defer zeroKey(key.PrivateKey)`
`420`	`421`	`var N, P int`
`421`	`422`	`if store, ok := ks.storage.(*keyStorePassphrase); ok {`
`422`	`423`	`N, P = store.scryptN, store.scryptP`
`@@ -476,6 +477,7 @@ func (ks *KeyStore) Update(a accounts.Account, passphrase, newPassphrase string)`
`476`	`477`	`if err != nil {`
`477`	`478`	`return err`
`478`	`479`	`}`
	`480`	`+ defer zeroKey(key.PrivateKey)`
`479`	`481`	`return ks.storage.StoreKey(a.URL.Path, key, newPassphrase)`
`480`	`482`	`}`
`481`	`483`