From e09cc5dff3bf1fd722f49c6570f44f118837e992 Mon Sep 17 00:00:00 2001 From: Jonathan Tzeng Date: Tue, 9 Jun 2026 22:24:49 -0700 Subject: [PATCH] Remove SideShift privateKey from env config The SideShift affiliate account was compromised. SideShift confirmed the swap integration works identically without the privateKey, so stop validating and injecting it (it was sent as the x-sideshift-secret header). Account rotation to a new affiliateId is handled operationally. --- CHANGELOG.md | 1 + src/envConfig.ts | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a93be492443..28895c1ff51 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,7 @@ - added: Logbox disable option to env.json - added: Reverse-resolve recipient addresses to ENS / Unstoppable Domains / ZNS names in the send flow, address modal, and transaction history. +- removed: SideShift `privateKey` from env config; the swap integration no longer sends the affiliate secret header. ## 4.49.0 (staging) diff --git a/src/envConfig.ts b/src/envConfig.ts index 149d1383f28..c255bda10f2 100644 --- a/src/envConfig.ts +++ b/src/envConfig.ts @@ -385,8 +385,7 @@ export const asEnvConfig = asObject({ SEPOLIA_INIT: asCorePluginInit(asEvmApiKeys), SIDESHIFT_INIT: asCorePluginInit( asObject({ - affiliateId: asOptional(asString, ''), - privateKey: asOptional(asString) + affiliateId: asOptional(asString, '') }).withRest ), SOLANA_INIT: asCorePluginInit(