From 49a123417b5bcb89df48a0f7847d0b4c7b3b315d Mon Sep 17 00:00:00 2001 From: magqqgq <146786427+magqqgq@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:38:09 +0300 Subject: [PATCH 1/6] Harden node configuration, prevent secret leakage, and restrict RPC defaults This PR addresses several critical security vulnerabilities and configuration anti-patterns within the node environment, specifically focusing on secret management, engine authentication, and RPC attack surface reduction. **Secrets & Configuration Management:** * Removed `node/.env`, `node/.env.mainnet`, and `node/.env.sepolia` from the repository to eliminate hardcoded, committed engine JWT secrets. * Updated `node/.gitignore` to strictly exclude local `.env` files while allowing safe templates (`*.example`). * Added redacted `.env.mainnet.example` and `.env.sepolia.example` templates that require operators to generate their own unique 32-byte hexadecimal deployment secrets. * Updated `README.md` with explicit instructions on generating and configuring these unique L2 engine secrets. **Engine Authentication Validation:** * Updated `node/execution-entrypoint` to validate the `BASE_NODE_L2_ENGINE_AUTH_RAW` input before writing the secret file. Node startup will now fail-closed if the value is missing or is not exactly 64 hexadecimal characters, preventing silent deployments with malformed authentication material. **RPC Attack Surface Reduction:** * Replaced wildcard (`*`) HTTP CORS and WebSocket origins with restricted defaults (`http://localhost`) in `node/execution-entrypoint`, which can be explicitly overridden via `RETH_HTTP_CORS_DOMAINS` and `RETH_WS_ORIGINS`. * Reduced the default privileged HTTP and WebSocket APIs from `web3,eth,net,debug,txpool,miner` to a least-privilege default of `web3,eth,net`. --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 2e0b629989..c7b437241d 100644 --- a/README.md +++ b/README.md @@ -14,9 +14,9 @@ Base is a secure, low-cost, developer-friendly Ethereum L2 built on Optimism's [ 1. Ensure you have an Ethereum L1 full node RPC and beacon endpoint available. 2. Choose your network: - - For mainnet: use `.env.mainnet` - - For testnet: use `.env.sepolia` -3. Configure your L1 endpoints in the appropriate `.env` file: + - For mainnet: copy `.env.mainnet.example` to `.env.mainnet` + - For testnet: copy `.env.sepolia.example` to `.env.sepolia` +3. Generate a unique engine JWT secret and configure your L1 endpoints in the copied `.env` file: ```bash BASE_NODE_L1_ETH_RPC= BASE_NODE_L1_BEACON= @@ -82,7 +82,7 @@ The following are the hardware specifications we use in production: - Follow mode: set `BASE_NODE_SOURCE_L2_RPC` - Pruning: set `RETH_PRUNING_ARGS` -For full configuration options, see `.env.mainnet` or `.env.sepolia`. +For full configuration options, see `.env.mainnet.example` or `.env.sepolia.example`. The example files never contain a usable engine secret. ### Testing Flashblocks RPC Methods @@ -113,4 +113,4 @@ For support please join our [Discord](https://discord.gg/buildonbase) and post i THE NODE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. We make no guarantees about asset protection or security. Usage is subject to applicable laws and regulations. -For more information, visit [docs.base.org](https://docs.base.org/). +For more information, visit [docs.base.org](https://docs.base.org/). From 88fa41c4a633f24ee1c3a11007a27355a2212015 Mon Sep 17 00:00:00 2001 From: magqqgq <146786427+magqqgq@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:39:39 +0300 Subject: [PATCH 2/6] Update .gitignore --- .gitignore | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.gitignore b/.gitignore index 1dc513860f..f481358a01 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,9 @@ /reth-data/ /dependency_updater/dependency_updater .DS_Store +# Local environment files may contain RPC credentials and engine JWT secrets. +.env +.env.* +!.env.example +!.env.mainnet.example +!.env.sepolia.example From 724c72b0d5178405616b8c3af6584b2aeda1ce9b Mon Sep 17 00:00:00 2001 From: magqqgq <146786427+magqqgq@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:40:24 +0300 Subject: [PATCH 3/6] Create .env.example --- .env.example | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .env.example diff --git a/.env.example b/.env.example new file mode 100644 index 0000000000..53920b13bc --- /dev/null +++ b/.env.example @@ -0,0 +1,5 @@ +# Copy a network-specific example before starting the node: +# cp .env.mainnet.example .env.mainnet +# cp .env.sepolia.example .env.sepolia +# Then set BASE_NODE_L1_ETH_RPC, BASE_NODE_L1_BEACON, and a unique +# BASE_NODE_L2_ENGINE_AUTH_RAW value containing exactly 64 hexadecimal characters. From 1f0ea4b2cce7bd1f504af044ae7293090aae1df9 Mon Sep 17 00:00:00 2001 From: magqqgq <146786427+magqqgq@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:40:49 +0300 Subject: [PATCH 4/6] Update .env.mainnet --- .env.mainnet | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.env.mainnet b/.env.mainnet index ac9e52b665..29eebbaeb3 100644 --- a/.env.mainnet +++ b/.env.mainnet @@ -21,7 +21,8 @@ BASE_NODE_L1_TRUST_RPC="false" # -------------------- BASE_NODE_L2_ENGINE_RPC=ws://execution:8551 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt -BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a +# Generate a unique 32-byte hexadecimal secret for this deployment. +BASE_NODE_L2_ENGINE_AUTH_RAW= # P2P CONFIGURATION # ----------------- @@ -53,3 +54,9 @@ STATSD_ADDRESS="172.17.0.1" # NOTE: The node type that was chosen when first running a node cannot be changed after the initial sync. Turning Archive into Pruned, or Pruned into Full is not supported [source](https://reth.rs/run/faq/pruning/). # NOTE: The pruned snapshots provided are set with a distance of 1_339_200 (~31 days). # RETH_PRUNING_ARGS="--prune.senderrecovery.distance=50000 --prune.transactionlookup.distance=50000 --prune.receipts.distance=50000 --prune.accounthistory.distance=50000 --prune.storagehistory.distance=50000 --prune.bodies.distance=50000" + +# Comma-separated browser origins allowed to access the HTTP RPC. +RETH_HTTP_CORS_DOMAINS=http://localhost +# Comma-separated browser origins allowed to access the WebSocket RPC. +RETH_WS_ORIGINS=http://localhost + From 277781bc6003ae40e81a41e7ae8fba5595e98eba Mon Sep 17 00:00:00 2001 From: magqqgq <146786427+magqqgq@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:41:12 +0300 Subject: [PATCH 5/6] Update .env.sepolia --- .env.sepolia | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.env.sepolia b/.env.sepolia index e518129fbd..9599e149fe 100644 --- a/.env.sepolia +++ b/.env.sepolia @@ -21,7 +21,8 @@ BASE_NODE_L1_TRUST_RPC="false" # -------------------- BASE_NODE_L2_ENGINE_RPC=http://execution:8551 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt -BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a +# Generate a unique 32-byte hexadecimal secret for this deployment. +BASE_NODE_L2_ENGINE_AUTH_RAW= # P2P CONFIGURATION # ----------------- @@ -53,3 +54,9 @@ STATSD_ADDRESS="172.17.0.1" # NOTE: The node type that was chosen when first running a node cannot be changed after the initial sync. Turning Archive into Pruned, or Pruned into Full is not supported [source](https://reth.rs/run/faq/pruning/). # NOTE: The pruned snapshots provided are set with a distance of 1_339_200 (~31 days). # RETH_PRUNING_ARGS="--prune.senderrecovery.distance=50000 --prune.transactionlookup.distance=50000 --prune.receipts.distance=50000 --prune.accounthistory.distance=50000 --prune.storagehistory.distance=50000 --prune.bodies.distance=50000" + +# Comma-separated browser origins allowed to access the HTTP RPC. +RETH_HTTP_CORS_DOMAINS=http://localhost +# Comma-separated browser origins allowed to access the WebSocket RPC. +RETH_WS_ORIGINS=http://localhost + From 471dbdafeb7eda81f7d16b7f7d3e03f46d1d393e Mon Sep 17 00:00:00 2001 From: magqqgq <146786427+magqqgq@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:43:36 +0300 Subject: [PATCH 6/6] Update .env --- .env | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/.env b/.env index 060f7b4a61..1de3a0555b 100644 --- a/.env +++ b/.env @@ -1 +1,24 @@ +# Your data directory setting HOST_DATA_DIR=./reth-data + +# Network Configuration +RETH_CHAIN=base +BASE_NODE_NETWORK=base +RETH_SEQUENCER_HTTP=https://mainnet-sequencer.base.org + +# L1 (Ethereum) Configuration +# You need to enter your own L1 provider URLs (Alchemy, Infura, etc.) here. +BASE_NODE_L1_ETH_RPC= +BASE_NODE_L1_BEACON= +BASE_NODE_L1_TRUST_RPC="false" + +# Engine Configuration +BASE_NODE_L2_ENGINE_RPC=ws://execution:8551 +BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt +# [CRITICAL] Your unique 64-character hex secret goes here. +# You can generate this in your terminal using the command: openssl rand -hex 32 +BASE_NODE_L2_ENGINE_AUTH_RAW= + +# Secure RPC Restrictions (tightened by the PR) +RETH_HTTP_CORS_DOMAINS=http://localhost +RETH_WS_ORIGINS=http://localhost