From 1e5954b3accefc39cb96b37e1c14b00e6b1ea367 Mon Sep 17 00:00:00 2001 From: baku-ccron Date: Sat, 22 Aug 2026 08:11:56 +0000 Subject: [PATCH] Read the deployment key instead of writing it into the command MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The documented invocation prefixed `DEPLOYMENT_KEY=0x...` to the command, which puts a private key with real money behind it into the shell's history file, where it outlives the run and the terminal. This is the only place in the repo that documents a key on a command line at all — the deploy reaches its key through a workflow secret — so it was also the only place that could teach the habit. `read -rs` takes the key off the terminal without echoing it and without a history entry carrying its value. Same variable, same script, nothing about the mechanism changes. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 7 ++++++- script/CreditHyperCore.sol | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a22a237..eea268a 100644 --- a/README.md +++ b/README.md @@ -422,10 +422,15 @@ it. The deployer already holds HYPE, because that is what it pays gas in, so it credits itself: ```sh -HYPERCORE_CREDIT_WEI=10000000000000000 DEPLOYMENT_KEY=0x... \ +read -rs DEPLOYMENT_KEY && export DEPLOYMENT_KEY +HYPERCORE_CREDIT_WEI=10000000000000000 \ nix develop -c forge script script/CreditHyperCore.sol:CreditHyperCore --legacy ``` +The key is read rather than written into the command, because a +`DEPLOYMENT_KEY=0x...` prefix is a private key in the shell's history file, +where it outlives the run and the terminal both. + Run exactly that first, without `--broadcast`: it is a dry run against a fork of HyperEVM that executes every guard and the transfer itself and sends nothing, so anything the real run would refuse is refused there for free. Add `--broadcast` diff --git a/script/CreditHyperCore.sol b/script/CreditHyperCore.sol index 9566085..e85890f 100644 --- a/script/CreditHyperCore.sol +++ b/script/CreditHyperCore.sol @@ -34,10 +34,15 @@ import {LibHyperCore} from "../src/lib/LibHyperCore.sol"; /// It is run by hand instead: /// /// ```sh -/// HYPERCORE_CREDIT_WEI=10000000000000000 DEPLOYMENT_KEY=0x... \ +/// read -rs DEPLOYMENT_KEY && export DEPLOYMENT_KEY +/// HYPERCORE_CREDIT_WEI=10000000000000000 \ /// forge script script/CreditHyperCore.sol:CreditHyperCore --legacy /// ``` /// +/// The key is read rather than written into the command: a +/// `DEPLOYMENT_KEY=0x...` prefix leaves a private key in the shell's history +/// file, where it outlives both the run and the terminal. +/// /// Without `--broadcast` that is a dry run against a fork of HyperEVM, which /// executes every guard and the transfer itself and sends nothing. Do that /// first: it is the same code path, so anything it refuses is something the