release the reference to the derived encryption key when clearing a loaded wallet
What the developer wrote
Authored by Craig Raw
release the reference to the derived encryption key when clearing a loaded wallet
What changed, and why it matters
This commit fixes a cleanup step in Sparrow Wallet. When a wallet is unloaded, the code now explicitly drops its reference to the derived encryption key, which may help the Java garbage collector reclaim the key material sooner and reduces the window in which a sensitive key could linger in memory. The change is defensive and small, but it does not by itself prove an exploitable vulnerability.
Treat as a minor hardening improvement. Review whether ECKey or the underlying library supports secure zeroization of key bytes, and verify that no other components retain a reference to the same encryptionKey after clear() is called. Consider adding explicit key destruction if available.
Security signals we found
Sensitive key material retained longer than necessary
Defensive cleanup of cryptographic key reference
No explicit zeroization of underlying key bytes
Field mutability increased to allow reference release
Evidence from the diff
In WalletAndKey.java, the encryptionKey field was changed from final to non-final so that the clear() method can set it to null. This releases the strong reference to the ECKey object when the wallet is cleared. In Java, clearing references can speed up garbage collection of sensitive objects, but it does not guarantee immediate erasure from memory (the JVM and GC may still retain the object or copies). The patch is partial: it does not zero the underlying key bytes, and other references to the same ECKey may still exist elsewhere in the application.
Changed components
src/main/java/com/sparrowwallet/sparrow/io/WalletAndKey.javaInspect captured patch +2 / −1
### src/main/java/com/sparrowwallet/sparrow/io/WalletAndKey.java
@@ -7,7 +7,7 @@
public class WalletAndKey implements Comparable<WalletAndKey> {
private final Wallet wallet;
- private final ECKey encryptionKey;
+ private ECKey encryptionKey;
private final Key key;
private final Map<WalletAndKey, Storage> childWallets;
@@ -38,6 +38,7 @@ public void clear() {
if(key != null) {
key.clear();
}
+ encryptionKey = null;
}
@OverrideWhy this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.