Summary
The TON core fift binary always creates wallet private-key files with mode 0600 (-rw-------) via an explicit mode parameter in FileFd::open. The two Python import paths in mytonctrl use open(path, 'wb') with no chmod, which produces mode 0644 (-rw-r--r--) under the standard umask 0022. Any local user account on the host can read the raw Ed25519 seed of every imported wallet.
Inconsistency
fift (tdutils/td/utils/port/FileFd.h): mode = 0600 — files are always 0600 regardless of umask ✅
import_wallet_with_version (mytoncore/mytoncore.py:1677–1679) and do_import_wallet (modules/wallet.py:87–92): bare open(path, 'wb') with no subsequent os.chmod — produces 0644 under umask 0022 ❌
The wallets/ directory (mytoncore.py:56) is also created without mode=, yielding 0755. modules/btc_teleport.py:84 already handles this correctly with mode=0o700.
Fix
Three lines: mode=0o700 on the makedirs, os.chmod(path, 0o600) after each Python import write, and optionally UMask=0077 in the systemd unit template as defence-in-depth.
Summary
The TON core fift binary always creates wallet private-key files with mode 0600 (-rw-------) via an explicit mode parameter in FileFd::open. The two Python import paths in mytonctrl use open(path, 'wb') with no chmod, which produces mode 0644 (-rw-r--r--) under the standard umask 0022. Any local user account on the host can read the raw Ed25519 seed of every imported wallet.
Inconsistency
fift (tdutils/td/utils/port/FileFd.h): mode = 0600 — files are always 0600 regardless of umask ✅
import_wallet_with_version (mytoncore/mytoncore.py:1677–1679) and do_import_wallet (modules/wallet.py:87–92): bare open(path, 'wb') with no subsequent os.chmod — produces 0644 under umask 0022 ❌
The wallets/ directory (mytoncore.py:56) is also created without mode=, yielding 0755. modules/btc_teleport.py:84 already handles this correctly with mode=0o700.
Fix
Three lines: mode=0o700 on the makedirs, os.chmod(path, 0o600) after each Python import write, and optionally UMask=0077 in the systemd unit template as defence-in-depth.