Hi team
Finding: ghost-eye hardcodes the stash-key path, creates the wallet-keys file and the stash-key file with File::create at default permissions, and writes both as plaintext 0x hex. It then auto-imports both seeds into the single wallet file. There is no chmod 0600, no encryption, no passphrase and no zeroize anywhere in the tree.
Reproduction: I transcribed the exact creation call sequences into a std-only replica with fixed test seeds, because the full cargo build is blocked on network dependencies. Measured results: under umask 022 both files land at mode 644 with plaintext contents confirmed in both; under umask 007 both land at 660, proving the code sets no permission floor of its own. Malformed files panic with a byte-index-out-of-bounds.
umask 022 -> wallet-keys 644 plaintext, stash-key 644 plaintext
umask 007 -> wallet-keys 660, stash-key 660 (no floor set by the code)
Precondition, stated honestly: this needs a local file read, so shared host, backup exfiltration or co-tenant read. No remote attacker. With that precondition it is total stash compromise.
Suggested fix: create both files at mode 600 and refuse to operate on loosely permissioned key files, or encrypt at rest.
Shahmeer