Enforce the epoch admin lever's loopback binding and settle its authentication #34

New issue

Closed

opened 2026-10-09 13:24:27 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-10-09 13:24:27 +01:00

Collaborator

Make the epoch admin listener's loopback-only binding and its lack of authentication explicit and enforced, rather than conventions that a config typo can silently undo.

Primary goals:

Binding is enforced, not conventional — a non-loopback admin_addr is refused at startup instead of quietly exposing epoch rotation to the network.
One source of truth for the port — just rotate-epoch reads the configured address rather than carrying its own copy.
The authentication decision is recorded — either the lever requires a credential, or the code states why loopback-only is considered sufficient.

Current state and specifics

The mint binds the epoch admin listener to 127.0.0.1:3339 by default and just rotate-epoch posts to that address. Two problems follow from this being convention rather than a rule.

Nothing validates the configured address. Setting it to 0.0.0.0 in config/mint.config.toml makes the rotation lever reachable from the network, and the lever is unauthenticated, so anyone who can reach it can close the current epoch and open the next. Rotation is not destructive in itself, but it decides which currency unit new mining rewards are denominated in, so an attacker who can rotate at will can fragment every miner's rewards across units at no cost.

just rotate-epoch also hardcodes the port and ignores the configured value, so the two can disagree without anything reporting it. An operator who moves the port gets a recipe that silently targets the wrong place.

Scope

In scope: validate the configured admin address at startup and refuse a non-loopback bind unless something explicit opts in; make the justfile recipe read the configured address; and decide the authentication question one way or the other, recording the decision where the listener is set up.

Out of scope: any change to what the lever does, and the automatic reward trigger of vnprc/hashpool#18, which will drive rotation without the lever.

Validation

Start the mint with a non-loopback admin_addr and confirm it refuses to start, with a message naming the setting. Change the configured port and confirm just rotate-epoch still reaches the lever without being edited. If authentication is added, confirm an unauthenticated request is refused and that just rotate-epoch still works.

Make the epoch admin listener's loopback-only binding and its lack of authentication explicit and enforced, rather than conventions that a config typo can silently undo. Primary goals: - **Binding is enforced, not conventional** — a non-loopback `admin_addr` is refused at startup instead of quietly exposing epoch rotation to the network. - **One source of truth for the port** — `just rotate-epoch` reads the configured address rather than carrying its own copy. - **The authentication decision is recorded** — either the lever requires a credential, or the code states why loopback-only is considered sufficient. ### Current state and specifics The mint binds the epoch admin listener to `127.0.0.1:3339` by default and `just rotate-epoch` posts to that address. Two problems follow from this being convention rather than a rule. Nothing validates the configured address. Setting it to `0.0.0.0` in `config/mint.config.toml` makes the rotation lever reachable from the network, and the lever is unauthenticated, so anyone who can reach it can close the current epoch and open the next. Rotation is not destructive in itself, but it decides which currency unit new mining rewards are denominated in, so an attacker who can rotate at will can fragment every miner's rewards across units at no cost. `just rotate-epoch` also hardcodes the port and ignores the configured value, so the two can disagree without anything reporting it. An operator who moves the port gets a recipe that silently targets the wrong place. ### Scope In scope: validate the configured admin address at startup and refuse a non-loopback bind unless something explicit opts in; make the justfile recipe read the configured address; and decide the authentication question one way or the other, recording the decision where the listener is set up. Out of scope: any change to what the lever does, and the automatic reward trigger of vnprc/hashpool#18, which will drive rotation without the lever. ### Validation Start the mint with a non-loopback `admin_addr` and confirm it refuses to start, with a message naming the setting. Change the configured port and confirm `just rotate-epoch` still reaches the lever without being edited. If authentication is added, confirm an unauthenticated request is refused and that `just rotate-epoch` still works.

vnprc-agent referenced this issue

2026-10-09 13:27:05 +01:00

Mint epoch mechanics: height-named units, records, manual rotation lever #16

vnprc-agent referenced this issue from a commit

2026-10-09 15:49:30 +01:00

mint: enforce loopback-only epoch admin bind, make the no-auth decision explicit

vnprc-agent referenced this issue from a commit

2026-10-09 23:11:37 +01:00

mint: enforce loopback-only epoch admin bind, make the no-auth decision explicit

vnprc-agent referenced this issue from a commit

2026-10-11 15:29:24 +01:00

mint: enforce loopback-only epoch admin bind and add the rotate-epoch recipe