pump-security

Security Practices — Cryptographic Safety, Memory Zeroization & Hardened I/O

Defense-in-depth security across Rust, TypeScript, and Bash: key handling, memory zeroization, secure file I/O, input validation, privilege management, and dependency auditing.

Memory Zeroization

Rust

use zeroize::Zeroize;

struct SecureBytes(Vec<u8>);

impl Drop for SecureBytes {
    fn drop(&mut self) {
        self.0.zeroize();
    }
}

TypeScript

try {
    // ... use secretKey
} finally {
    secretKey.fill(0);
    // Best-effort: GC may have copied the buffer
}

Shell

shred -u "$keypair_file" 2>/dev/null || rm -P "$keypair_file"

RNG Quality

Language	Source	Verification
Rust	OsRng	Verify via solana-sdk internals
TypeScript	crypto.getRandomValues	Node.js built-in CSPRNG
Shell	solana-keygen	Delegates to Rust OsRng

Keypair Integrity Verification

1. Re-derive public key from secret key
2. Compare derived key with stored public key
3. Sign a test message with the keypair
4. Verify the signature with the public key
5. Validate Base58 encoding roundtrip

Secure File I/O

• Set permissions to 0o600 before writing content (race-free on Unix)
• Use O_CREAT | O_EXCL to prevent overwrites
• Write to temp file + atomic rename for crash safety
• Never write secret keys to stdout unless explicitly requested

Input Validation

Input	Validation
Base58 address	Regex: ^[1-9A-HJ-NP-Za-km-z]{32,44}$
File paths	Reject .., prevent traversal
Tool inputs	Zod schemas in MCP server
Shell arguments	Quoted variables, no eval

Security Checklist Summary (60+ items)

Key categories:

• Cryptographic library allowlist
• Memory zeroization in all code paths
• File permission enforcement
• Input validation and sanitization
• Error message information leakage prevention
• Dependency auditing (cargo audit, npm audit)
• No network calls during key generation
• Secret key never in logs, error messages, or telemetry