payload-guardian

SOLVED

• Announcing Etherlink 6.6: a security hardening kernel upgrade proposal
• The Etherlink 6.6 security hardening upgrade proposal was successfully activated on block 48571992

The problem

The Etherlink change_sequencer_key precompile accepts a bad signature (Ok(false) is treated as success), so anyone can schedule a sequencer-key change to a key they control. On the master kernel that change sits pending for 24h before activating, and a fresh submission overwrites any pending one (no "already pending" guard, no replay binding on the signed payload).

How this fixes it

A small watchdog that exploits the same overwrite behavior defensively: it polls the EVM node for the precompile's ChangeSequencerKeyEvent logs (eth_getLogs), and the moment the latest one targets an unexpected key, it resubmits the legitimate pre-signed payload, overwriting the malicious one before it can activate. Since every overwrite resets the 24h clock, the attacker's key never activates while the guardian is running.

It can also run in detect-and-alert-only mode (no submissions). This is a mitigation while the kernel is patched (require Ok(true) + replay binding), not a replacement for the fix.

Build

make            # builds and copies the binary to ./payload-guardian

Use

1. Create the config:

   cp config.example.toml config.toml

   Set evm_node_url, expected_sequencer_key, and (to enable overriding) the [override] section — see comments in config.example.toml.

2. Run it:

   make run                      # daemon, polls on config.toml
   make check                    # one-shot check then exit (for cron)
   make run CONFIG=/etc/guardian.toml   # custom config path

When the [override] section is present, a detected malicious change always submits the override transaction (the tx hash is logged). Omit the [override] section for detect-and-alert only.

Make targets

Target	Action
make / make release	build optimized binary
make run	run daemon against CONFIG (default config.toml)
make check	single check and exit
make fmt / make clippy / make test	format / lint / test
make clean	remove build artifacts