Skip to content

Secure pubKey cleanup in BIP32 child key derivation #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Corey-Code merged 2 commits into from
Feb 3, 2026
Merged

Secure pubKey cleanup in BIP32 child key derivation #54

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
79dd1a0
Initial plan
Copilot Feb 3, 2026
cb7079f
fix: add cleanup for pubKey in deriveChild to prevent memory leak
Copilot Feb 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion src/lib/crypto/bitcoin.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,6 +268,7 @@ function deriveChild(
): { key: Uint8Array; chainCode: Uint8Array } {
const data = new Uint8Array(37);
const intermediates: Uint8Array[] = [];
let pubKey: Uint8Array | null = null;

try {
if (hardened) {
Expand All @@ -279,7 +280,7 @@ function deriveChild(
data.set(indexBytes, 33);
} else {
// Normal derivation: public key || index
const pubKey = secp256k1.getPublicKey(parentKey, true);
pubKey = secp256k1.getPublicKey(parentKey, true);
data.set(pubKey, 0);
const indexBytes = new Uint8Array(4);
new DataView(indexBytes.buffer).setUint32(0, index, false);
Expand Down Expand Up @@ -307,6 +308,9 @@ function deriveChild(
} finally {
// Zero out intermediate data
secureZero(data);
if (pubKey !== null) {
secureZero(pubKey);
}
for (const arr of intermediates) {
secureZero(arr);
}
Expand Down