support QA deploy

[buddh0]

just for see the diff between main and QA_env

[hashdit-bot]

Pull Request Review

This PR adds QA deployment support for a BSC cluster by introducing a new qa-env-resource/ bundle (service files, startup scripts, config, machine metadata template, and upgrade scripts) and extending bsc_cluster.sh with remote lifecycle commands (remote_reset, remote_reset_config, remote_upgrade). It also switches cluster sizing to IP-based metadata from machines_meta.sh, enables sentry/fullnode/registration/whitelist flags by default in .env, and updates init-network arguments to use explicit node IP lists and QA config. Additionally, it adjusts local genesis/setup flow (Python invocation, config edits, port remapping) to support validator/sentry/fullnode topologies in QA.

Sensitive Content

Blockchain Address:

• 0xf7698afa5461438ff438c2322d6d29a5f7abdffd (Ethereum address) in qa-env-resource/config.toml — MEV builder address
• 0x04d63aBCd2b9b1baa327f2Dda0f873F197ccd186 (Ethereum address) in .env — INIT_HOLDER default

Security Issues

No serious security issues detected.

---

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

[hashdit-bot]

Pull Request Review

This PR adds QA deployment automation for a BSC/EVM cluster, including remote provisioning and upgrades through AWS SSM, QA systemd services, node configuration, and validator/sentry/full-node startup scripts. It also enables sentry, full-node, node-registration, and whitelist features by default and updates the hard-fork schedule to activate Jenner after Pasteur.

Sensitive Content

Blockchain Address:

• 0xf7698afa5461438ff438c2322d6d29a5f7abdffd (Ethereum MEV builder address) in qa-env-resource/config.toml — Configured as an allowed MEV builder address.

Security Issues

🟠 [HIGH] Unlocked validator account exposed through unauthenticated network RPC

File: qa-env-resource/chaind.sh

The newly added startup command unlocks the validator account while enabling insecure unlock and unprotected transactions. HTTP and WebSocket RPC are bound to the machine's network interface, permissive CORS is enabled, and sensitive modules including eth and miner are exposed without authentication. Any party able to reach this QA network endpoint may be able to submit transactions using the unlocked validator account, interfere with validator operations, or drain its funds.

Recommendation: Do not expose RPC from a process holding an unlocked validator key. Bind HTTP and WebSocket to localhost or a tightly isolated management interface, enforce firewall and authenticated-proxy controls, restrict CORS and RPC modules, remove --allow-insecure-unlock and --rpc.allow-unprotected-txs, and use an external signer or otherwise narrowly scoped signing mechanism.

---

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

[hashdit-bot]

Pull Request Review

This PR adds QA deployment automation for a BSC/EVM blockchain cluster, including remote provisioning and upgrades through AWS SSM, machine-specific topology configuration, and systemd services for validator, sentry, and full nodes. It also enables sentry/full-node and EVN registration features, changes fork timing, and adds a QA geth configuration with MEV support.

Sensitive Content

Blockchain Address:

• 0xf7698afa5461438ff438c2322d6d29a5f7abdffd (Ethereum MEV builder address) in qa-env-resource/config.toml — Configured as the MEV builder address under Eth.Miner.Mev.Builders.

Security Issues

🟠 [HIGH] Unlocked validator account exposed through network RPC interfaces

File: qa-env-resource/chaind.sh

The new service starts validator nodes with an unlocked account while enabling --allow-insecure-unlock, binding HTTP and WebSocket RPC to the machine's network IP, and allowing CORS from any origin. An attacker able to reach these ports can submit RPC requests using a forged Host: localhost header and may cause the unlocked validator account to sign transactions, potentially compromising validator funds or privileged chain operations.

Recommendation: Do not expose an unlocked validator account through HTTP or WebSocket RPC. Bind RPC to loopback or a tightly isolated management interface, enforce firewall and authenticated-proxy restrictions, remove --allow-insecure-unlock, restrict CORS and virtual hosts, and use a dedicated signer or hardware-backed signing mechanism with narrowly scoped authorization.

---

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.