lambdaclass / lambdaclass/eth-agent

Add security considerations document

Open
#30 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

documentation security
Dominant language
TypeScript
Stars
10
Forks
1
PR merge metrics
No merged PRs in 30d

Description

Problem

A library handling keys and transactions should have explicit security documentation.

Recommendation

Create docs/security.md covering:

Key Management
  • Never log private keys
  • Use environment variables, not hardcoded
  • Consider hardware wallets for production
RPC Security
  • Don't use public RPCs for mainnet (rate limits, privacy)
  • Use authenticated endpoints
  • Consider running own node
Limit Configuration
  • Start with conservative limits
  • Adjust based on use case
  • Monitor spending patterns
Smart Account Security
  • Session key permissions
  • Paymaster trust assumptions
Common Pitfalls
  • ENS caching considerations
  • Nonce management with concurrent txs
  • Stablecoin depeg scenarios

Priority

Documentation - Security

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the recommendations in the issue and create docs/security.md with sections for key management, RPC security, limit configuration, smart account security, and common pitfalls. Done means each listed security concern is documented clearly for users of the library; no tests are mentioned.

Written by the indexing model from the issue text.

Assessment

Domain
blockchain, documentation, security
Issue type
Documentation
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.