kuny0707 · Oct 12, 2026 · Aug 17, 2026 · Aug 17, 2026 · Aug 17, 2026 · Aug 17, 2026
diff --git a/common/src/main/java/org/tron/common/parameter/CommonParameter.java b/common/src/main/java/org/tron/common/parameter/CommonParameter.java
@@ -175,12 +175,6 @@ public class CommonParameter {
   @Setter
   public boolean solidityNode = false;
 
-  // If you are running KeystoreFactory,
-  // this flag is set to true
-  @Getter
-  @Setter
-  public boolean keystoreFactory = false;
-
   // -- RPC / HTTP --
   @Getter
   @Setter

diff --git a/crypto/src/main/java/org/tron/keystore/WalletUtils.java b/crypto/src/main/java/org/tron/keystore/WalletUtils.java
@@ -201,13 +201,10 @@ public static boolean passwordValid(String password) {
 
   /**
    * Lazily-initialized Scanner shared across successive
-   * {@link #inputPassword()} calls on the non-TTY path so that
-   * {@link #inputPassword2Twice()} can read two lines in sequence
-   * without losing data. Each call to {@code new Scanner(System.in)}
-   * internally buffers bytes from the underlying {@link BufferedReader};
-   * constructing a second Scanner after the first has been discarded
-   * drops any buffered bytes the first pulled from stdin, causing
-   * {@code NoSuchElementException}.
+   * {@link #inputPassword()} calls on the non-TTY path. Each call to
+   * {@code new Scanner(System.in)} buffers ahead from stdin; constructing
+   * a second Scanner after the first has been discarded drops any bytes
+   * the first pulled, causing {@code NoSuchElementException}.
    */
   private static Scanner sharedStdinScanner;
 
@@ -250,18 +247,4 @@ public static String inputPassword() {
     }
   }
 
-  public static String inputPassword2Twice() {
-    String password0;
-    while (true) {
-      System.out.println("Please input password.");
-      password0 = inputPassword();
-      System.out.println("Please input password again.");
-      String password1 = inputPassword();
-      if (password0.equals(password1)) {
-        break;
-      }
-      System.out.println("Two passwords do not match, please input again.");
-    }
-    return password0;
-  }
 }
diff --git a/framework/src/main/java/org/tron/core/config/args/Args.java b/framework/src/main/java/org/tron/core/config/args/Args.java
@@ -159,6 +159,7 @@ public static void setParam(final String[] args, final String confFileName) {
       Args.printHelp(jc);
       exit(0);
     }
+    cmd.validateRemovedOptions();
 
     // Resolve config file path
     configFilePath = StringUtils.isNoneBlank(cmd.shellConfFileName)
@@ -856,9 +857,6 @@ private static void applyCLIParams(CLIParameter cmd, JCommander jc) {
     if (assigned.contains("--solidity")) {
       PARAMETER.solidityNode = cmd.solidityNode;
     }
-    if (assigned.contains("--keystore-factory")) {
-      PARAMETER.keystoreFactory = cmd.keystoreFactory;
-    }
     if (assigned.contains("--rpc-thread")) {
       PARAMETER.rpcThreadNum = cmd.rpcThreadNum;
     }
@@ -1290,7 +1288,7 @@ private static String getCommitIdAbbrev() {
 
   private static Map<String, String[]> getOptionGroup() {
     String[] tronOption = new String[] {"version", "help", "shellConfFileName", "logbackPath",
-        "eventSubscribe", "solidityNode", "keystoreFactory"};
+        "eventSubscribe", "solidityNode"};
     String[] dbOption = new String[] {"outputDirectory"};
     String[] witnessOption = new String[] {"witness", "privateKey"};
     String[] vmOption = new String[] {"debug"};

diff --git a/framework/src/main/java/org/tron/core/config/args/CLIParameter.java b/framework/src/main/java/org/tron/core/config/args/CLIParameter.java
@@ -4,6 +4,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import lombok.NoArgsConstructor;
+import org.tron.core.exception.TronError;
 
 /**
  * CLI parameter definitions parsed by JCommander.
@@ -50,8 +51,15 @@ public class CLIParameter {
   @Parameter(names = {"--solidity"}, description = "running a solidity node for java tron")
   public boolean solidityNode;
 
-  @Parameter(names = {"--keystore-factory"}, description = "running KeystoreFactory")
-  public boolean keystoreFactory;
+  /**
+   * Tombstone for the removed --keystore-factory, rejected by {@link #validateRemovedOptions()}.
+   * Keep declared — undeclared, JCommander parses the flag into seedNodes. Boxed so null means
+   * absent: JCommander toggles arity-0 booleans per occurrence, so a repeated flag parses back
+   * to false.
+   */
+  @Deprecated
+  @Parameter(names = {"--keystore-factory"}, description = "removed; use Toolkit.jar keystore")
+  public Boolean keystoreFactory;
 
   @Deprecated
   @Parameter(names = {"--fast-forward"})
@@ -181,4 +189,23 @@ public class CLIParameter {
   @Deprecated
   @Parameter(names = {"--history-balance-lookup"})
   public boolean historyBalanceLookup;
+
+  /**
+   * Rejects removed options before config loading. A removed option keeps a nullable tombstone
+   * field and adds one line here.
+   */
+  public void validateRemovedOptions() {
+    rejectIfPresent(keystoreFactory, "--keystore-factory",
+        "Use: java -jar Toolkit.jar keystore <new|import|list|update>");
+  }
+
+  private void rejectIfPresent(Object value, String option, String migration) {
+    if (value == null) {
+      return;
+    }
+    // stderr, not logger: the default logback config has no console appender
+    System.err.println(option + " was removed.");
+    System.err.println(migration);
+    throw new TronError(option + " was removed. " + migration, TronError.ErrCode.PARAMETER_INIT);
+  }
 }
diff --git a/framework/src/main/java/org/tron/core/config/args/WitnessInitializer.java b/framework/src/main/java/org/tron/core/config/args/WitnessInitializer.java
@@ -94,8 +94,8 @@ public static LocalWitnesses initFromKeystore(
             "Tip: keystores created via `FullNode.jar --keystore-factory` in "
                 + "non-TTY mode were encrypted with only the first "
                 + "whitespace-separated word of the password. Try restarting "
-                + "with only that first word as `-p`, then reset the password "
-                + "via `java -jar Toolkit.jar keystore update`.");
+                + "with only that first word as the password, then reset the "
+                + "password via `java -jar Toolkit.jar keystore update`.");
       }
       throw new TronError(e, TronError.ErrCode.WITNESS_KEYSTORE_LOAD);
     }

diff --git a/framework/src/main/java/org/tron/program/FullNode.java b/framework/src/main/java/org/tron/program/FullNode.java
@@ -29,10 +29,6 @@ public static void main(String[] args) {
 
     LogService.load(parameter.getLogbackPath());
 
-    if (parameter.isKeystoreFactory()) {
-      KeystoreFactory.start();
-      return;
-    }
     if (parameter.isSolidityNode()) {
       logger.info("Solidity node is running.");
       if (StringUtils.isEmpty(parameter.getTrustNodeAddr())) {

diff --git a/framework/src/main/java/org/tron/program/KeystoreFactory.java b/framework/src/main/java/org/tron/program/KeystoreFactory.java
diff --git a/framework/src/test/java/org/tron/core/config/args/ArgsTest.java b/framework/src/test/java/org/tron/core/config/args/ArgsTest.java
@@ -24,13 +24,16 @@
 import com.typesafe.config.ConfigFactory;
 import io.grpc.internal.GrpcUtil;
 import io.grpc.netty.NettyServerBuilder;
+import java.io.ByteArrayOutputStream;
+import java.io.PrintStream;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.net.InetAddress;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 import lombok.extern.slf4j.Slf4j;
+import org.junit.After;
 import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
@@ -53,9 +56,53 @@ public class ArgsTest {
   @Rule
   public ExpectedException thrown = ExpectedException.none();
 
+  @After
+  public void tearDown() {
+    Args.clearParam();
+  }
+
+  @Test
+  public void testRemovedKeystoreFactoryExitsWithMigrationGuidance() throws Exception {
+    ByteArrayOutputStream errorOutput = new ByteArrayOutputStream();
+    PrintStream capturedError = new PrintStream(errorOutput, true, "UTF-8");
+    PrintStream originalError = System.err;
+
+    try {
+      System.setErr(capturedError);
+
+      TronError exception = Assert.assertThrows(TronError.class,
+          () -> Args.setParam(new String[] {"--keystore-factory"}, TestConstants.TEST_CONF));
+
+      Assert.assertEquals(TronError.ErrCode.PARAMETER_INIT, exception.getErrCode());
+    } finally {
+      System.setErr(originalError);
+      capturedError.close();
+    }
+
+    String errorMessage = errorOutput.toString("UTF-8");
+    Assert.assertTrue(errorMessage.contains("--keystore-factory was removed."));
+    Assert.assertTrue(errorMessage.contains("Toolkit.jar keystore <new|import|list|update>"));
+  }
+
+  @Test
+  public void testRemovedKeystoreFactoryRepeatedFlagStillExits() {
+    Assert.assertThrows(TronError.class,
+        () -> Args.setParam(new String[] {"--keystore-factory", "--keystore-factory"},
+            TestConstants.TEST_CONF));
+  }
+
+  @Test
+  public void testRemovedKeystoreFactoryTakesPrecedenceOverInvalidConfig() {
+    TronError exception = Assert.assertThrows(TronError.class,
+        () -> Args.setParam(new String[] {"--keystore-factory", "-c", "no-such-file.conf"},
+            TestConstants.TEST_CONF));
+
+    Assert.assertEquals(TronError.ErrCode.PARAMETER_INIT, exception.getErrCode());
+  }
+
   @Test
   public void get() {
-    Args.setParam(new String[] {"--keystore-factory"}, TestConstants.TEST_CONF);
+    Args.setParam(new String[] {}, TestConstants.TEST_CONF);
 
     CommonParameter parameter = Args.getInstance();
 
@@ -127,8 +174,6 @@ public void get() {
     Assert.assertEquals(address,
         ByteArray.toHexString(Args.getLocalWitnesses()
             .getWitnessAccountAddress()));
-
-    Assert.assertTrue(parameter.isKeystoreFactory());
   }
 
   @Test