From 8dffc2dbe0d54e29d888f139c7cb649898972709 Mon Sep 17 00:00:00 2001
From: mertcano <35747700+mertcano@users.noreply.github.com>
Date: Sat, 29 Aug 2026 22:47:29 +0300
Subject: [PATCH] fix(core): remove tracked BlockCypher API token from
 integration tests

### Description
This PR addresses a high-severity secrets management vulnerability within the `core` repository. It removes a hardcoded BlockCypher API credential from tracked test files, eliminating unnecessary disclosure and the risk of unauthorized external API usage.

### Key Changes
* **Secrets Management (`lib/bitcoin_burner_test.go`):**
  - Replaced the directly committed BlockCypher token with an environment variable lookup (`os.Getenv("BLOCKCYPHER_API_KEY")`)[cite: 43].
  - Implemented a fail-safe fallback that cleanly skips the external integration test (`t.Skip`) if the `BLOCKCYPHER_API_KEY` is not provided at runtime, ensuring the test suite does not fail locally for contributors lacking external credentials[cite: 43].
  - Updated all `BlockCypherCheckBitcoinDoubleSpend` assertions to pass the dynamically loaded `blockCypherAPIKey` instead of a static string[cite: 43].

### Validation & Testing
* **Reviewer Action Required:** The previously committed BlockCypher API token remains in the Git history and must be revoked or rotated by the repository owners. To execute `TestCheckDoubleSpend` locally, maintainers must now explicitly provide a valid `BLOCKCYPHER_API_KEY` in their testing environment[cite: 43].
---
 lib/bitcoin_burner_test.go | 155 +++++++++++++++++++------------------
 1 file changed, 79 insertions(+), 76 deletions(-)

diff --git a/lib/bitcoin_burner_test.go b/lib/bitcoin_burner_test.go
index ff99f8f60..119339b50 100644
--- a/lib/bitcoin_burner_test.go
+++ b/lib/bitcoin_burner_test.go
@@ -1,84 +1,87 @@
-package lib
-
+package lib
+
 import (
+	"os"
+	"testing"
+
 	"github.com/btcsuite/btcd/chaincfg/chainhash"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"testing"
 )
-
-var (
-	BlockCypherTestAPIKey = "3aaa4e1c99164e8ba9ade1a605a150c0"
-)
-
+
 func TestCheckDoubleSpend(t *testing.T) {
-	// Set up a blockchain
-	assert := assert.New(t)
-	require := require.New(t)
-	_, _ = assert, require
-
-	// Mainnet checks
-	{
-		params := &DeSoMainnetParams
-
-		// This txn is not a double-spend
-		{
-			hash, err := chainhash.NewHashFromStr("4d02fa8bed28405dd0f8eabbcd5a1ead6018ee7d260d026bb9ba99eb90f7389b")
-			require.NoError(err)
-			isDoubleSpend, err := BlockCypherCheckBitcoinDoubleSpend(hash, BlockCypherTestAPIKey, params)
-			require.NoError(err)
-			require.False(isDoubleSpend)
-		}
-		{
-			hash, err := chainhash.NewHashFromStr("60bbed01b7d6adfe1482161092894943e4ddff9cc9c9ed398df295cfcfde2d9e")
-			require.NoError(err)
-			isDoubleSpend, err := BlockCypherCheckBitcoinDoubleSpend(hash, BlockCypherTestAPIKey, params)
-			require.NoError(err)
-			require.True(isDoubleSpend)
-		}
-	}
-
-	{
-		// Testnet checks
-		params := &DeSoTestnetParams
-
-		// This txn is not a double-spend
-		{
-			hash, err := chainhash.NewHashFromStr("141efaf43d716166792dec365b5b598a0ad9920baf52446675840c4b3ea2e4e1")
-			require.NoError(err)
-			isDoubleSpend, err := BlockCypherCheckBitcoinDoubleSpend(hash, BlockCypherTestAPIKey, params)
-			require.NoError(err)
-			require.False(isDoubleSpend)
-		}
-		{
-			hash, err := chainhash.NewHashFromStr("60bbed01b7d6adfe1482161092894943e4ddff9cc9c9ed398df295cfcfde2d9e")
-			require.NoError(err)
-			isDoubleSpend, err := BlockCypherCheckBitcoinDoubleSpend(hash, BlockCypherTestAPIKey, params)
-			require.NoError(err)
-			require.True(isDoubleSpend)
-		}
+	blockCypherAPIKey := os.Getenv("BLOCKCYPHER_API_KEY")
+	if blockCypherAPIKey == "" {
+		t.Skip("BLOCKCYPHER_API_KEY is not set; skipping the external BlockCypher integration test")
 	}
-}
 
-// Comment this in to test the RBF checker. We comment it out for now since the transactions
-// used within it go stale and return different values after being mined.
-//
-//func TestCheckRBF(t *testing.T) {
-//
-//	// Set up a blockchain
-//	assert := assert.New(t)
-//	require := require.New(t)
-//	_, _ = assert, require
-//
-//	{
-//		isRBF, err := BlockonomicsCheckRBF("625ae824aaa832731fbd124d10e54e7e976083ef91da81f51f80838f0e442df6")
-//		require.NoError(err)
-//		require.True(isRBF)
-//	}
-//
-//	{
-//		isRBF, err := BlockonomicsCheckRBF("42239441b091f78185ee398cdbdc4f9710ccf2c309175b5f47cd189429f7552b")
-//		require.NoError(err)
-//		require.False(isRBF)
-//	}
-//}
+	// Set up a blockchain
+	assert := assert.New(t)
+	require := require.New(t)
+	_, _ = assert, require
+
+	// Mainnet checks
+	{
+		params := &DeSoMainnetParams
+
+		// This txn is not a double-spend
+		{
+			hash, err := chainhash.NewHashFromStr("4d02fa8bed28405dd0f8eabbcd5a1ead6018ee7d260d026bb9ba99eb90f7389b")
+			require.NoError(err)
+			isDoubleSpend, err := BlockCypherCheckBitcoinDoubleSpend(hash, blockCypherAPIKey, params)
+			require.NoError(err)
+			require.False(isDoubleSpend)
+		}
+		{
+			hash, err := chainhash.NewHashFromStr("60bbed01b7d6adfe1482161092894943e4ddff9cc9c9ed398df295cfcfde2d9e")
+			require.NoError(err)
+			isDoubleSpend, err := BlockCypherCheckBitcoinDoubleSpend(hash, blockCypherAPIKey, params)
+			require.NoError(err)
+			require.True(isDoubleSpend)
+		}
+	}
+
+	{
+		// Testnet checks
+		params := &DeSoTestnetParams
+
+		// This txn is not a double-spend
+		{
+			hash, err := chainhash.NewHashFromStr("141efaf43d716166792dec365b5b598a0ad9920baf52446675840c4b3ea2e4e1")
+			require.NoError(err)
+			isDoubleSpend, err := BlockCypherCheckBitcoinDoubleSpend(hash, blockCypherAPIKey, params)
+			require.NoError(err)
+			require.False(isDoubleSpend)
+		}
+		{
+			hash, err := chainhash.NewHashFromStr("60bbed01b7d6adfe1482161092894943e4ddff9cc9c9ed398df295cfcfde2d9e")
+			require.NoError(err)
+			isDoubleSpend, err := BlockCypherCheckBitcoinDoubleSpend(hash, blockCypherAPIKey, params)
+			require.NoError(err)
+			require.True(isDoubleSpend)
+		}
+	}
+}
+
+// Comment this in to test the RBF checker. We comment it out for now since the transactions
+// used within it go stale and return different values after being mined.
+//
+//func TestCheckRBF(t *testing.T) {
+//
+//	// Set up a blockchain
+//	assert := assert.New(t)
+//	require := require.New(t)
+//	_, _ = assert, require
+//
+//	{
+//		isRBF, err := BlockonomicsCheckRBF("625ae824aaa832731fbd124d10e54e7e976083ef91da81f51f80838f0e442df6")
+//		require.NoError(err)
+//		require.True(isRBF)
+//	}
+//
+//	{
+//		isRBF, err := BlockonomicsCheckRBF("42239441b091f78185ee398cdbdc4f9710ccf2c309175b5f47cd189429f7552b")
+//		require.NoError(err)
+//		require.False(isRBF)
+//	}
+//}