Skip to content

Bug: BTCPayServer.Plugins does not clear nsec from database when you remove Ark wallet #20

@steepdawn974

Description

@steepdawn974

Description:

When you Set up an Ark wallet on BTCPayServer, your nsec is

  1. stored in clear text in the backend database
  2. is not removed, even when you Remove the Ark wallet via the UI

Version: Plugin 1.0.17.0

Steps to reproduce:

  • Install plugin and Set up Arkade > enter nsec
  • Connect to postgres. SELECT * FROM "BTCPayServer.Plugins.Ark"."Wallets" returns plain text nsec
  • In BTcPay, go to Arkade > Clear Wallet > Confirm
  • Back to postgres. SELECT * FROM "BTCPayServer.Plugins.Ark"."Wallets" still returns plain text nsec - even though it should have been purged.

Expected behaviour

  • nsec should be stored salted/hashed, not in plain text. Server operator who hosts Stores for other users ("Uncle Jim") could steal their funds
  • Clearing the Arkade wallet from the UI should remove the database record

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions