Root + Impact

Description

The script programmatically accesses a sensitive private key stored in the system's environment variables.

There are three primary ways this leads to theft:

1. Shell History: If the key is set via export PRIVATE_KEY=..., it is saved in plaintext in ~/.bash_history or ~/.zsh_history.

2. Version Control Leakage: If the key is stored in a .env file and that file is accidentally committed to a public repository (e.g., forgetting to update .gitignore), bots will scrape and drain the wallet instantly.

3. Process Inspection: Environment variables can sometimes be read by other processes running on the same machine, increasing the attack surface for malware.

Risk

Likelihood: Medium

• Common "copy-paste" deployment commands often lead to keys being left in terminal history.

• Accidental .env uploads are one of the most frequent causes of lost funds in web3 development.

Impact: Critical

• Total loss of all assets held by the deployer address.

• Immediate compromise of the TreasureHunt contract's admin privileges.

Proof of Concept

1. Developer runs export PRIVATE_KEY=0x123... in their terminal.

2. Developer runs the forge script.

3. An attacker gains access to the machine (or a public repo where the history was leaked) and runs cat ~/.bash_history.

4. The attacker finds the export command, imports the key, and drains the account.

Recommended Mitigation

Use Foundry Keystores instead of environment variables. Keystores store the key in an encrypted file on your disk that requires a password to unlock during the broadcast phase.

Update the script to remove the envUint requirement: