btcutil: zero range-check scalar before returning from DecodeWIF
What the developer wrote
Authored by Lrifton92
btcutil: zero range-check scalar before returning from DecodeWIF
Wipe the secp256k1 scalar used for the [1, N-1] range validation as
soon as DecodeWIF returns, so the decoded private key value does not
linger in this local after use. Addresses review feedback on #2545.
What changed, and why it matters
This commit adds a cleanup step in the function that decodes Bitcoin private keys from Wallet Import Format (WIF). It ensures a temporary mathematical value used to check the key is valid gets wiped from memory right after use, so the private key value does not linger in that temporary variable. This is a defensive memory-hygiene improvement rather than a fix for an active remote attack.
Adopt the patch as a hardening measure. Reviewers should verify that Zero() is called on all paths, including error returns, and consider whether other temporary scalars or big integers in the codebase need similar cleanup.
Security signals we found
Sensitive-data lingering in local variable after use
Defensive memory wipe added for private-key material
No change to cryptographic validation or control flow
Addresses prior review feedback, not an independent vulnerability report
Evidence from the diff
In btcutil/wif.go, DecodeWIF now calls defer keyScalar.Zero() immediately after declaring the keyScalar ModNScalar used for the [1, N-1] range check. The scalar is populated via SetByteSlice from the decoded private key bytes. Previously, after the check, keyScalar could retain the private key value until garbage collection or stack reuse. The patch zeroes it as soon as the function returns, reducing the window in which sensitive key material lingers in a local variable. It does not change validation logic or error behavior.
Changed components
btcutil/wif.goDecodeWIF functionbtcec.ModNScalarInspect captured patch +1 / −0
diff --git a/btcutil/wif.go b/btcutil/wif.go
index c8aab1b..36600bd 100644
--- a/btcutil/wif.go
+++ b/btcutil/wif.go
@@ -127,6 +127,7 @@ func DecodeWIF(wif string) (*WIF, error) {
// the one actually encoded in the WIF (or the all-zero key) without
// reporting an error.
var keyScalar btcec.ModNScalar
+ defer keyScalar.Zero()
if overflow := keyScalar.SetByteSlice(privKeyBytes); overflow ||
keyScalar.IsZero() {
Why this scored 30/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.