fix: cleanse generated BLS secret candidate

[PastaPastaPasta]

Issue being fixed or feature implemented

CBLSSecretKey::MakeNewKey() retains the accepted 32-byte random candidate in
its stack buffer after constructing the secret key. The candidate is private
key material and should not remain recoverable from the stack longer than
necessary.

This is an existing issue in random BLS generation, including the bls generate RPC. It is intentionally split from #7594 because the
wallet-derived operator-key path does not call MakeNewKey().

What was done?

Cleanse the candidate buffer immediately after the key-generation retry loop,
before publishing the resulting key as valid.

How Has This Been Tested?

• make -C src -j6 test/test_dash
• src/test/test_dash --run_test=bls_tests (20 cases passed)
• test/lint/lint-includes.py
• test/lint/lint-whitespace.py
• git clang-format --diff upstream/develop -- src/bls/bls.cpp
• git diff --check

Tested on macOS 15/Apple Silicon using the repository depends toolchain.

Breaking Changes

None.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation
• I have assigned this pull request to a milestone

This pull request was created by Codex.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ff74a7f4-09cd-4d14-98c2-6b783e931843

📥 Commits

Reviewing files that changed from the base of the PR and between b3e5295 and 9c3f4ff.

📒 Files selected for processing (1)

• src/bls/bls.cpp

---

Walkthrough

The BLS implementation adds the memory_cleanse dependency. CBLSSecretKey::MakeNewKey now clears its temporary random-byte buffer after key generation attempts complete.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Mergeability Score: ⚪ Minimal · up to 9c3f4

This localized change cleanses the generated secret candidate after key generation; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• dashpay/dash#7594: Both changes cleanse temporary private-key buffers in src/bls/bls.cpp after BLS key generation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description clearly explains the BLS secret-candidate cleansing change and its testing.
Title check	✅ Passed	The title clearly and concisely describes the secret-candidate cleansing fix.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit 9c3f4ff)

[thepastaclaw]

Final validation — Codex/Sol only (Phase 2 disabled)

At exact head 9c3f4ff, the change correctly cleanses the temporary 32-byte BLS secret candidate after successful key construction and before publishing the key as valid. The new include is guarded consistently with MakeNewKey(), and no in-scope defects or actionable findings were identified.
Source: reviewer backend model gpt-5.6-sol; final verifier backend model gpt-5.6-sol. openclaw-agent/cliproxy/gpt-5.6-sol is orchestration-only and is not reviewer evidence.

Validated zero-blocker Codex/Sol precheck evidence was promoted to final because Phase 2 (Sonnet/Opus) is temporarily disabled. This is Codex/Sol-only final validation, not Codex + Sonnet/Opus coverage.

Review provenance

• Codex reviewers: gpt-5.6-sol — general (completed)
• Verifier: gpt-5.6-sol — verifier
• Sonnet/Opus: not run (Phase 2 disabled — temporary Codex/Sol-only final)
• Secondary pass: disabled (temporary_phase2_sonnet_disable)

[PastaPastaPasta]

LGTM