fix(shielded-invites): zeroize the one-time bearer spending key end-to-end (dashpay#4204)

Reviewer (thepastaclaw) key-hygiene blocker: the one-time Orchard bearer
spending key was copied into several plain, unsanitized buffers on both the
claim and generate paths.

Claim path — carry the key through `Zeroizing` from the FFI copy down through
the wallet layers instead of leaking a plain `[u8; 32]` at each hop:
- rs-platform-wallet-ffi: the `[u8; 32]` claim-key copy is now
  `Zeroizing<[u8; 32]>` and moves (not copies) into the wallet layer.
- platform-wallet `identity_create_from_one_time_key` (both the
  PlatformWallet method and the operations fn) now take
  `Zeroizing<[u8; 32]>`; the key is scrubbed on drop, dereferenced only at
  the single `SpendingKey::from_bytes` consumption point.

Generate path — wipe the transient native and JVM copies after handoff:
- rs-platform-wallet-ffi: explicitly zeroize the native `sk` after copying
  it into the caller's `out_sk_32`.
- rs-unified-sdk-jni: hold the JNI `sk` and the combined 75-byte `out` blob
  in `Zeroizing` buffers so both scrub on drop, including early returns.
- kotlin-sdk `generateOneTimeOrchardKey`: wipe the 75-byte JVM blob in a
  `finally` once the two owned arrays have been sliced out.

Validated: cargo build + cargo test -p platform-wallet (493 pass) + cargo fmt;
:sdk:compileDebugKotlin succeeds.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bfoss765

packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/wallet/PlatformWalletManager.kt

@@ -2278,11 +2278,17 @@ data class OneTimeOrchardKey(
  */
 fun generateOneTimeOrchardKey(): OneTimeOrchardKey {
     val blob = mapNativeErrors { FundingNative.generateOneTimeOrchardKey() }
-    require(blob.size == 75) { "expected a 75-byte sk||address blob, got ${blob.size}" }
-    return OneTimeOrchardKey(
-        spendingKey = blob.copyOfRange(0, 32),
-        address = blob.copyOfRange(32, 75),
-    )
+    // The blob's first 32 bytes are bearer spend authority; wipe the transient
+    // JVM copy once the two owned arrays have been sliced out (#4204 key-hygiene).
+    try {
+        require(blob.size == 75) { "expected a 75-byte sk||address blob, got ${blob.size}" }
+        return OneTimeOrchardKey(
+            spendingKey = blob.copyOfRange(0, 32),
+            address = blob.copyOfRange(32, 75),
+        )
+    } finally {
+        blob.fill(0)
+    }
 }
 
 /**

packages/rs-platform-wallet-ffi/src/shielded_send.rs

@@ -895,7 +895,10 @@ pub unsafe extern "C" fn platform_wallet_manager_shielded_identity_create_from_o
 
     // Copy the one-time spending key (32 bytes; the caller's safety contract
     // guarantees the length — no companion length arg crosses the C ABI).
-    let mut one_time_sk = [0u8; 32];
+    // Bearer spend authority: hold this FFI-layer copy in a `Zeroizing` buffer so
+    // it is scrubbed on drop. It is moved into the wallet layer, which likewise
+    // carries it in `Zeroizing` (#4204 key-hygiene).
+    let mut one_time_sk = zeroize::Zeroizing::new([0u8; 32]);
     std::ptr::copy_nonoverlapping(one_time_sk_bytes, one_time_sk.as_mut_ptr(), 32);
 
     // Decode the claimer's own 43-byte default Orchard change address.
@@ -1589,7 +1592,7 @@ pub unsafe extern "C" fn platform_wallet_generate_one_time_orchard_key(
     // this is a `#[no_mangle] extern "C"` export, so a panic would abort the
     // process across the C ABI before any JNI panic guard could convert it —
     // an OS RNG failure must surface as a normal error, never a hard abort.
-    let (sk, address) = match generate_one_time_orchard_key() {
+    let (mut sk, address) = match generate_one_time_orchard_key() {
         Ok(pair) => pair,
         Err(e) => {
             return PlatformWalletFFIResult::err(
@@ -1600,6 +1603,9 @@ pub unsafe extern "C" fn platform_wallet_generate_one_time_orchard_key(
     };
     std::ptr::copy_nonoverlapping(sk.as_ptr(), out_sk_32, 32);
     std::ptr::copy_nonoverlapping(address.as_ptr(), out_address_43, 43);
+    // Wipe this native copy of the one-time spending key now that it has been
+    // handed to the caller's `out_sk_32` buffer (#4204 key-hygiene).
+    zeroize::Zeroize::zeroize(&mut sk);
     PlatformWalletFFIResult::ok()
 }
 

packages/rs-platform-wallet/src/wallet/platform_wallet.rs

@@ -1129,7 +1129,9 @@ impl PlatformWallet {
     pub async fn identity_create_from_one_time_key<P, IS>(
         &self,
         coordinator: &Arc<crate::wallet::shielded::NetworkShieldedCoordinator>,
-        one_time_sk: [u8; 32],
+        // Bearer spend authority carried in a `Zeroizing` buffer so this layer's copy
+        // of the one-time spending key is scrubbed on drop (#4204 key-hygiene).
+        one_time_sk: zeroize::Zeroizing<[u8; 32]>,
         funding_birth_height: Option<u32>,
         change_address: dpp::address_funds::OrchardAddress,
         identity_index: u32,

packages/rs-platform-wallet/src/wallet/shielded/operations.rs

@@ -1578,7 +1578,9 @@ where
 pub async fn identity_create_from_one_time_key<S, P, IS>(
     sdk: &Arc<dash_sdk::Sdk>,
     store: &Arc<RwLock<S>>,
-    one_time_sk: [u8; 32],
+    // Bearer spend authority: carried in a `Zeroizing` buffer so every wallet-layer
+    // copy of the one-time spending key is scrubbed on drop (#4204 key-hygiene).
+    one_time_sk: zeroize::Zeroizing<[u8; 32]>,
     funding_birth_height: Option<u32>,
     change_address: &OrchardAddress,
     public_keys: Vec<(IdentityPublicKey, IdentityPublicKeyInCreation)>,
@@ -1603,7 +1605,7 @@ where
     // Derive the Orchard key material from the one-time spending key. `from_bytes`
     // returns a `CtOption`; an invalid scalar means the caller handed us a
     // non-key, which is a hard input error.
-    let sk: SpendingKey = Option::from(SpendingKey::from_bytes(one_time_sk)).ok_or_else(|| {
+    let sk: SpendingKey = Option::from(SpendingKey::from_bytes(*one_time_sk)).ok_or_else(|| {
         PlatformWalletError::ShieldedKeyDerivation(
             "one-time spending key is not a valid Orchard SpendingKey".to_string(),
         )

packages/rs-unified-sdk-jni/src/funding.rs

@@ -986,7 +986,10 @@ pub extern "system" fn Java_org_dashfoundation_dashsdk_ffi_FundingNative_generat
     _class: JClass,
 ) -> jni::sys::jbyteArray {
     guard(&mut env, ptr::null_mut(), |env| {
-        let mut sk = [0u8; 32];
+        // Bearer spend authority: hold the native `sk` and the combined `out`
+        // blob (its first 32 bytes are the spending key) in `Zeroizing` buffers so
+        // both are scrubbed on drop, including any early return (#4204 key-hygiene).
+        let mut sk = zeroize::Zeroizing::new([0u8; 32]);
         let mut addr = [0u8; 43];
         let result = unsafe {
             platform_wallet_ffi::platform_wallet_generate_one_time_orchard_key(
@@ -998,10 +1001,10 @@ pub extern "system" fn Java_org_dashfoundation_dashsdk_ffi_FundingNative_generat
             return ptr::null_mut();
         }
         // sk ‖ addr — a 75-byte blob the Kotlin side slices into (sk32, addr43).
-        let mut out = [0u8; 75];
-        out[..32].copy_from_slice(&sk);
+        let mut out = zeroize::Zeroizing::new([0u8; 75]);
+        out[..32].copy_from_slice(&sk[..]);
         out[32..].copy_from_slice(&addr);
-        env.byte_array_from_slice(&out)
+        env.byte_array_from_slice(&out[..])
             .map(|a| a.into_raw())
             .unwrap_or(ptr::null_mut())
     })