sponsord logs the full RPC URL (and its API key) in chain errors #38

Component

sponsord (signing daemon), sponsord-core (library)

Version

main @ f86ef7e (sponsord 0.1.0)

Operating system

Any. Observed on Ubuntu 24.04 x86_64, deployed by decdn/devops.

Steps to reproduce

1. Configure SPONSORD_RPC_URL with a provider endpoint that has the key in its path, e.g. https://<provider>/v2/<api-key>.
2. Make it unreachable or have it return an error (or point it at http://127.0.0.1:9/).
3. Start sponsord, or wait for a keeper tick.

Expected behavior

No log line or exit error contains the RPC URL. It often carries a provider API key. decdn-node already behaves this way: decdn/decdn#954 (fixed in #958) sends every chain-RPC error through decdn_common::redact::{sanitize_err_chain, sanitize_rpc_display}, which strip the URL and keep the failure class (timeout, connection refused, DNS, TLS).

Actual behavior

reqwest's Display tail, for url (<url>), is forwarded verbatim by alloy's transport error, so the full URL lands in:

• the exit error. main() returns anyhow::Result, so a failure in Sponsor::connect prints the raw Error: … / Caused by: … chain (crates/sponsord/src/main.rs);
• tracing::warn!/error! sites that format {e} from chain calls:
  • crates/sponsord-core/src/keeper.rs:108 ("pool remaining read failed") and :135 ("pool top-up failed");
  • crates/sponsord/src/http.rs:143 ("signer authorization read failed") and :147 ("capability signing failed").

Wherever those logs go (the journal, and from there any log shipper), the key goes too. decdn/devops#84 found this in the Grafana Cloud Loki pipeline.

Logs

Error: read PaymentPool.usdc(): error sending request for url (http://127.0.0.1:9/)

Proposed fix

Do what decdn-node does. sponsord already depends on decdn crates by git (decdn-client, decdn-incentive), so adding decdn-common and reusing decdn_common::redact is cheap:

• main(): catch the error and print sanitize_err_chain(&e) instead of returning anyhow::Result (see decdn/crates/node/src/main.rs).
• Each chain-error log site: sanitize_rpc_display(e) (or sanitize_err_chain for an anyhow::Error).
• Add a regression test like decdn's a_chain_read_warning_does_not_log_the_rpc_url / setup_redacts_rpc_error.rs: an unreachable http://127.0.0.1:<port>/v3/<FAKE_KEY> must not appear in stderr or the logs.

Context

decdn/devops#85 adds a redaction stage to its Alloy journald pipeline. That is defense in depth only: it catches URL-shaped text on the way to Loki, and nothing else (stderr, other log shippers, journalctl on the box).