Skip to content

op-devstack: use file-based sequencer key loading for kona #18528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
DenseDenise wants to merge 1 commit into from
Closed

op-devstack: use file-based sequencer key loading for kona #18528

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions op-devstack/sysgo/l2_cl_kona.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,11 +240,11 @@ func WithKonaNode(l2CLID stack.L2CLNodeID, l1CLID stack.L1CLNodeID, l1ELID stack
p2pKey, err := orch.keys.Secret(devkeys.SequencerP2PRole.Key(l2CLID.ChainID().ToBig()))
require.NoError(err, "need p2p key for sequencer")
p2pKeyHex := "0x" + hex.EncodeToString(crypto.FromECDSA(p2pKey))
// TODO: Kona should support loading keys from a file
//tempSeqKeyPath := filepath.Join(tempKonaDir, "p2p-sequencer.txt")
//p.Require().NoError(err, os.WriteFile(tempSeqKeyPath, []byte(p2pKeyHex), 0o644))
// Write sequencer key to file (supported since kona PR #2871)
tempSeqKeyPath := filepath.Join(tempKonaDir, "p2p-sequencer.txt")
p.Require().NoError(os.WriteFile(tempSeqKeyPath, []byte(p2pKeyHex), 0o644))
Copy link
Contributor

@almanax-ai almanax-ai bot Dec 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Low Severity severity

Access Control: Insecure file permissions for sequencer P2P key in WriteFile

The sequencer P2P private key is written to a file with 0o644 permissions (world-readable), while other sensitive keys in the codebase (JWT secrets, P2P node keys) are correctly written with 0o600 permissions (owner read/write only). This exposes the sequencer's private key to any user on the system who can read the temp directory.

Change the file permissions from 0o644 to 0o600 to match the security pattern used elsewhere in the codebase (e.g., op_rbuilder.go:163, orchestrator.go:136).

Suggested change
p.Require().NoError(os.WriteFile(tempSeqKeyPath, []byte(p2pKeyHex), 0o644))
p.Require().NoError(os.WriteFile(tempSeqKeyPath, []byte(p2pKeyHex), 0o600))

Don't like this finding? Reply "dismiss" and it won't appear again in future scans.

If it's acknowledged or addressed, reply "resolve" to mark it resolved.

envVars = append(envVars,
"KONA_NODE_P2P_SEQUENCER_KEY="+p2pKeyHex,
"KONA_NODE_P2P_SEQUENCER_KEY_PATH="+tempSeqKeyPath,
"KONA_NODE_SEQUENCER_L1_CONFS=2",
"KONA_NODE_MODE=Sequencer",
)
Expand Down