description: "A recent $152K hack happened because of a Hardhat test key left in production for 14 months. Here's how I built a tool to make sure this never happens again."
Picture this: It's Friday afternoon. You're deploying a smart contract. You copy-paste a private key from the Hardhat docs because "it's just for testing, I'll change it later."
Spoiler alert: You won't.
And neither did the developers who recently lost $152,000 because a well-known Hardhat test key (Account #0) was left in a production whitelist for 14 months.
Yep. Fourteen. Months.
As a security enthusiast, reading about preventable hacks makes my blood pressure spike. So, instead of just tweeting about it, I decided to do what developers do best: I wrote code to fix it.
Enter slither-cex-detector v0.2.0.
🤦♂️ The Problem: "It's Just a Test Key"
We've all been there. Hardhat's default accounts are incredibly convenient. They are in every tutorial, every StackOverflow answer, and every local dev environment.
The problem? They are public knowledge. If you hardcode them into a smart contract and deploy to mainnet, anyone can monitor the blockchain, see that address, and drain the contract faster than you can say "reentrancy guard".
Static analysis tools like Slither are amazing, but out of the box, they don't specifically hunt for this very specific, yet catastrophic, anti-pattern.
So, I built a custom detector to catch it.
🛠️ Under the Hood (Conceptually)
I didn't want to overcomplicate things. I extended Slither's native AbstractDetector class to do one simple job: scan state variables and function nodes for known Hardhat default addresses and private keys.
If it finds a match, it immediately flags it as a High-impact vulnerability, stopping the deployment before it ever hits the mainnet. No complex AST parsing nightmares, just a straightforward, highly effective pattern match.
🚨 The Anti-Patterns We All Know (But Sometimes Forget)
Instead of showing you the code, let's talk about the patterns this detector actively hunts down:
- ❌ The "Please Hack Me" Approach: Hardcoding
0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266(Hardhat Account #0) as an admin, owner, or whitelisted address in the contract state. - ❌ The "Trust Me Bro" CEX Interface: Storing plaintext API keys or secrets as public string variables.
- ❌ The Missing Bouncer: External functions that trigger withdrawals or trades without any cryptographic signature verification (
ecrecover).
✅ The "Sleep Well at Night" Approach: Using securely injected environment variables, multisig wallets, proper constructor initialization that explicitly rejects known test addresses, and encrypted off-chain credential management.
🚀 How to Use It (in 30 seconds)
I packaged this into a clean Python module. You don't need to write custom scripts anymore; it integrates natively with the Slither CLI.
1. Clone & Install:
git clone https://github.com/rdin777/slither-cex-detector.git
cd slither-cex-detector
pip install -e .
- Run the detector on your project:
slither . --detect cex-interface-security,hardhat-test-keys
Cry tears of joy when it catches that one variable your teammate forgot to change:
text
🔍 Analyzing contracts...
Found 1 vulnerabilities:[High] CRITICAL: Hardhat test address detected in variable 'admin'
(Pro tip: Add --json results.json to easily plug this into your GitHub Actions CI/CD pipeline!)
🎯 Final Thoughts
Security isn't just about finding complex mathematical flaws in zero-knowledge proofs. Sometimes, it's about stopping someone from copy-pasting a tutorial into production.
This detector is now part of v0.2.0 of the slither-cex-detector, which also catches hardcoded API keys, missing signature verifications, and plaintext credentials in CEX interfaces.
If you found this useful, please consider:
⭐ Starring the repo on GitHub (it fuels my open-source soul).
🐦 Following me on Twitter @DinRid56379 where I post about Web3 security, AI agents, and occasional dev humor.
🐛 Opening an issue if you find a false positive (or a cool new pattern we should detect!).
Stay safe, and may your private keys never see the light of a public repository. 🛡️
P.S. If you're reading this and you currently have a Hardhat key in your mainnet contract... go fix it. I'll wait. ⏱️
tags: web3,,security,,ethereum,,python
Top comments (0)