chore!: audit fixes (#2764)

<!--
Please read and fill out this form before submitting your PR.

Please make sure you have reviewed our contributors guide before
submitting your
first PR.

NOTE: PR titles should follow semantic commits:
https://www.conventionalcommits.org/en/v1.0.0/
-->

## Overview

<!-- 
Please provide an explanation of the PR, including the appropriate
context,
background, goal, and rationale. If there is an issue with this
information,
please provide a tl;dr and link the issue. 

Ex: Closes #<issue number>
-->

Author: tac0turtle

apps/evm/single/cmd/init.go

@@ -3,6 +3,8 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"os"
+	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -36,9 +38,24 @@ func InitCmd() *cobra.Command {
 				return fmt.Errorf("error validating config: %w", err)
 			}
 
-			passphrase, err := cmd.Flags().GetString(rollconf.FlagSignerPassphrase)
+			// Get passphrase file path
+			passphraseFile, err := cmd.Flags().GetString(rollconf.FlagSignerPassphraseFile)
 			if err != nil {
-				return fmt.Errorf("error reading passphrase flag: %w", err)
+				return fmt.Errorf("failed to get '%s' flag: %w", rollconf.FlagSignerPassphraseFile, err)
+			}
+
+			var passphrase string
+			if passphraseFile != "" {
+				// Read passphrase from file
+				passphraseBytes, err := os.ReadFile(passphraseFile)
+				if err != nil {
+					return fmt.Errorf("failed to read passphrase from file '%s': %w", passphraseFile, err)
+				}
+				passphrase = strings.TrimSpace(string(passphraseBytes))
+
+				if passphrase == "" {
+					return fmt.Errorf("passphrase file '%s' is empty", passphraseFile)
+				}
 			}
 
 			proposerAddress, err := rollcmd.CreateSigner(&cfg, homePath, passphrase)

apps/evm/single/cmd/run.go

@@ -1,8 +1,10 @@
 package cmd
 
 import (
+	"bytes"
 	"context"
 	"fmt"
+	"os"
 	"path/filepath"
 
 	"github.com/evstack/ev-node/core/da"
@@ -119,10 +121,28 @@ func createExecutionClient(cmd *cobra.Command) (execution.Executor, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to get '%s' flag: %w", evm.FlagEvmEngineURL, err)
 	}
-	jwtSecret, err := cmd.Flags().GetString(evm.FlagEvmJWTSecret)
+
+	// Get JWT secret file path
+	jwtSecretFile, err := cmd.Flags().GetString(evm.FlagEvmJWTSecretFile)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get '%s' flag: %w", evm.FlagEvmJWTSecret, err)
+		return nil, fmt.Errorf("failed to get '%s' flag: %w", evm.FlagEvmJWTSecretFile, err)
+	}
+
+	if jwtSecretFile == "" {
+		return nil, fmt.Errorf("JWT secret file must be provided via --evm.jwt-secret-file")
 	}
+
+	// Read JWT secret from file
+	secretBytes, err := os.ReadFile(jwtSecretFile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read JWT secret from file '%s': %w", jwtSecretFile, err)
+	}
+	jwtSecret := string(bytes.TrimSpace(secretBytes))
+
+	if jwtSecret == "" {
+		return nil, fmt.Errorf("JWT secret file '%s' is empty", jwtSecretFile)
+	}
+
 	genesisHashStr, err := cmd.Flags().GetString(evm.FlagEvmGenesisHash)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get '%s' flag: %w", evm.FlagEvmGenesisHash, err)
@@ -143,7 +163,7 @@ func createExecutionClient(cmd *cobra.Command) (execution.Executor, error) {
 func addFlags(cmd *cobra.Command) {
 	cmd.Flags().String(evm.FlagEvmEthURL, "http://localhost:8545", "URL of the Ethereum JSON-RPC endpoint")
 	cmd.Flags().String(evm.FlagEvmEngineURL, "http://localhost:8551", "URL of the Engine API endpoint")
-	cmd.Flags().String(evm.FlagEvmJWTSecret, "", "The JWT secret for authentication with the execution client")
+	cmd.Flags().String(evm.FlagEvmJWTSecretFile, "", "Path to file containing the JWT secret for authentication")
 	cmd.Flags().String(evm.FlagEvmGenesisHash, "", "Hash of the genesis block")
 	cmd.Flags().String(evm.FlagEvmFeeRecipient, "", "Address that will receive transaction fees")
 }

apps/grpc/single/cmd/init.go

@@ -3,6 +3,8 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"os"
+	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -38,9 +40,24 @@ This will create the necessary configuration structure in the specified root dir
 				return fmt.Errorf("error validating config: %w", err)
 			}
 
-			passphrase, err := cmd.Flags().GetString(rollconf.FlagSignerPassphrase)
+			// Get passphrase file path
+			passphraseFile, err := cmd.Flags().GetString(rollconf.FlagSignerPassphraseFile)
 			if err != nil {
-				return fmt.Errorf("error reading passphrase flag: %w", err)
+				return fmt.Errorf("failed to get '%s' flag: %w", rollconf.FlagSignerPassphraseFile, err)
+			}
+
+			var passphrase string
+			if passphraseFile != "" {
+				// Read passphrase from file
+				passphraseBytes, err := os.ReadFile(passphraseFile)
+				if err != nil {
+					return fmt.Errorf("failed to read passphrase from file '%s': %w", passphraseFile, err)
+				}
+				passphrase = strings.TrimSpace(string(passphraseBytes))
+
+				if passphrase == "" {
+					return fmt.Errorf("passphrase file '%s' is empty", passphraseFile)
+				}
 			}
 
 			proposerAddress, err := rollcmd.CreateSigner(&cfg, homePath, passphrase)

apps/testapp/cmd/init.go

@@ -3,6 +3,8 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"os"
+	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -36,9 +38,24 @@ func InitCmd() *cobra.Command {
 				return fmt.Errorf("error validating config: %w", err)
 			}
 
-			passphrase, err := cmd.Flags().GetString(rollconf.FlagSignerPassphrase)
+			// Get passphrase file path
+			passphraseFile, err := cmd.Flags().GetString(rollconf.FlagSignerPassphraseFile)
 			if err != nil {
-				return fmt.Errorf("error reading passphrase flag: %w", err)
+				return fmt.Errorf("failed to get '%s' flag: %w", rollconf.FlagSignerPassphraseFile, err)
+			}
+
+			var passphrase string
+			if passphraseFile != "" {
+				// Read passphrase from file
+				passphraseBytes, err := os.ReadFile(passphraseFile)
+				if err != nil {
+					return fmt.Errorf("failed to read passphrase from file '%s': %w", passphraseFile, err)
+				}
+				passphrase = strings.TrimSpace(string(passphraseBytes))
+
+				if passphrase == "" {
+					return fmt.Errorf("passphrase file '%s' is empty", passphraseFile)
+				}
 			}
 
 			proposerAddress, err := rollcmd.CreateSigner(&cfg, homePath, passphrase)

apps/testapp/cmd/init_test.go

@@ -42,8 +42,12 @@ func TestInitCommand(t *testing.T) {
 	// Register all persistent flags from root command
 	rollconf.AddGlobalFlags(cmd, "testapp")
 
+	// Create passphrase file
+	passphraseFile := filepath.Join(dir, "passphrase")
+	require.NoError(t, os.WriteFile(passphraseFile, []byte("test"), 0600))
+
 	// Set home flag to the test directory
-	cmd.SetArgs([]string{"init", "--home", dir, "--rollkit.node.aggregator", "--rollkit.signer.passphrase", "test"})
+	cmd.SetArgs([]string{"init", "--home", dir, "--evnode.node.aggregator", "--evnode.signer.passphrase_file", passphraseFile})
 
 	// Execute the command
 	err = cmd.Execute()

block/internal/common/consts.go

@@ -0,0 +1,3 @@
+package common
+
+const DefaultMaxBlobSize = 1.5 * 1024 * 1024 // 1.5MB fallback blob size limit

block/internal/common/errors.go

@@ -17,4 +17,7 @@ var (
 
 	// ErrHeightFromFutureStr is the error message for height from future returned by da
 	ErrHeightFromFutureStr = errors.New("given height is from the future")
+
+	// ErrOversizedItem is an unrecoverable error indicating a single item exceeds DA blob size limit
+	ErrOversizedItem = errors.New("single item exceeds DA blob size limit")
 )

block/internal/executing/executor.go

@@ -389,6 +389,7 @@ func (e *Executor) produceBlock() error {
 
 	if err := e.validateBlock(currentState, header, data); err != nil {
 		e.sendCriticalError(fmt.Errorf("failed to validate block: %w", err))
+		e.logger.Error().Err(err).Msg("CRITICAL: Permanent block validation error - halting block production")
 		return fmt.Errorf("failed to validate block: %w", err)
 	}
 
@@ -439,7 +440,8 @@ func (e *Executor) produceBlock() error {
 // retrieveBatch gets the next batch of transactions from the sequencer
 func (e *Executor) retrieveBatch(ctx context.Context) (*BatchData, error) {
 	req := coresequencer.GetNextBatchRequest{
-		Id: []byte(e.genesis.ChainID),
+		Id:       []byte(e.genesis.ChainID),
+		MaxBytes: common.DefaultMaxBlobSize,
 	}
 
 	res, err := e.sequencer.GetNextBatch(ctx, req)

block/internal/reaping/reaper.go

@@ -19,8 +19,14 @@ import (
 	"github.com/evstack/ev-node/pkg/store"
 )
 
-// DefaultInterval is the default reaper interval
-const DefaultInterval = 1 * time.Second
+const (
+	// DefaultInterval is the default reaper interval
+	DefaultInterval = 1 * time.Second
+	// MaxBackoffInterval is the maximum backoff interval for retries
+	MaxBackoffInterval = 30 * time.Second
+	// BackoffMultiplier is the multiplier for exponential backoff
+	BackoffMultiplier = 2
+)
 
 // Reaper is responsible for periodically retrieving transactions from the executor,
 // filtering out already seen transactions, and submitting new transactions to the sequencer.
@@ -76,7 +82,7 @@ func NewReaper(
 func (r *Reaper) Start(ctx context.Context) error {
 	r.ctx, r.cancel = context.WithCancel(ctx)
 
-	// Start repear loop
+	// Start reaper loop
 	r.wg.Add(1)
 	go func() {
 		defer r.wg.Done()
@@ -91,12 +97,35 @@ func (r *Reaper) reaperLoop() {
 	ticker := time.NewTicker(r.interval)
 	defer ticker.Stop()
 
+	consecutiveFailures := 0
+
 	for {
 		select {
 		case <-r.ctx.Done():
 			return
 		case <-ticker.C:
-			r.SubmitTxs()
+			err := r.SubmitTxs()
+			if err != nil {
+				// Increment failure counter and apply exponential backoff
+				consecutiveFailures++
+				backoff := r.interval * time.Duration(1<<min(consecutiveFailures, 5)) // Cap at 2^5 = 32x
+				backoff = min(backoff, MaxBackoffInterval)
+				r.logger.Warn().
+					Err(err).
+					Int("consecutive_failures", consecutiveFailures).
+					Dur("next_retry_in", backoff).
+					Msg("reaper encountered error, applying backoff")
+
+				// Reset ticker with backoff interval
+				ticker.Reset(backoff)
+			} else {
+				// Reset failure counter and backoff on success
+				if consecutiveFailures > 0 {
+					r.logger.Info().Msg("reaper recovered from errors, resetting backoff")
+					consecutiveFailures = 0
+					ticker.Reset(r.interval)
+				}
+			}
 		}
 	}
 }
@@ -113,34 +142,42 @@ func (r *Reaper) Stop() error {
 }
 
 // SubmitTxs retrieves transactions from the executor and submits them to the sequencer.
-func (r *Reaper) SubmitTxs() {
+// Returns an error if any critical operation fails.
+func (r *Reaper) SubmitTxs() error {
 	txs, err := r.exec.GetTxs(r.ctx)
 	if err != nil {
 		r.logger.Error().Err(err).Msg("failed to get txs from executor")
-		return
+		return fmt.Errorf("failed to get txs from executor: %w", err)
 	}
 	if len(txs) == 0 {
 		r.logger.Debug().Msg("no new txs")
-		return
+		return nil
 	}
 
 	var newTxs [][]byte
+	var seenStoreErrors int
 	for _, tx := range txs {
 		txHash := hashTx(tx)
 		key := ds.NewKey(txHash)
 		has, err := r.seenStore.Has(r.ctx, key)
 		if err != nil {
 			r.logger.Error().Err(err).Msg("failed to check seenStore")
+			seenStoreErrors++
 			continue
 		}
 		if !has {
 			newTxs = append(newTxs, tx)
 		}
 	}
 
+	// If all transactions failed seenStore check, return error
+	if seenStoreErrors > 0 && len(newTxs) == 0 {
+		return fmt.Errorf("failed to check seenStore for all %d transactions", seenStoreErrors)
+	}
+
 	if len(newTxs) == 0 {
 		r.logger.Debug().Msg("no new txs to submit")
-		return
+		return nil
 	}
 
 	r.logger.Debug().Int("txCount", len(newTxs)).Msg("submitting txs to sequencer")
@@ -150,14 +187,14 @@ func (r *Reaper) SubmitTxs() {
 		Batch: &coresequencer.Batch{Transactions: newTxs},
 	})
 	if err != nil {
-		r.logger.Error().Err(err).Msg("failed to submit txs to sequencer")
-		return
+		return fmt.Errorf("failed to submit txs to sequencer: %w", err)
 	}
 
 	for _, tx := range newTxs {
 		txHash := hashTx(tx)
 		key := ds.NewKey(txHash)
 		if err := r.seenStore.Put(r.ctx, key, []byte{1}); err != nil {
+			// Log but don't fail on persistence errors
 			r.logger.Error().Err(err).Str("txHash", txHash).Msg("failed to persist seen tx")
 		}
 	}
@@ -169,6 +206,7 @@ func (r *Reaper) SubmitTxs() {
 	}
 
 	r.logger.Debug().Msg("successfully submitted txs")
+	return nil
 }
 
 // SeenStore returns the datastore used to track seen transactions.

block/internal/reaping/reaper_test.go

@@ -95,7 +95,7 @@ func TestReaper_SubmitTxs_NewTxs_SubmitsAndPersistsAndNotifies(t *testing.T) {
 	r := newTestReaper(t, "chain-A", mockExec, mockSeq, e)
 	store := r.SeenStore()
 
-	r.SubmitTxs()
+	assert.NoError(t, r.SubmitTxs())
 
 	// Seen keys persisted
 	has1, err := store.Has(context.Background(), ds.NewKey(hashTx(tx1)))
@@ -128,7 +128,7 @@ func TestReaper_SubmitTxs_AllSeen_NoSubmit(t *testing.T) {
 	mockExec.EXPECT().GetTxs(mock.Anything).Return([][]byte{tx1, tx2}, nil).Once()
 	// No SubmitBatchTxs expected
 
-	r.SubmitTxs()
+	assert.NoError(t, r.SubmitTxs())
 
 	// Ensure no notification occurred
 	if e.HasPendingTxNotification() {
@@ -158,7 +158,7 @@ func TestReaper_SubmitTxs_PartialSeen_FiltersAndPersists(t *testing.T) {
 			return &coresequencer.SubmitBatchTxsResponse{}, nil
 		}).Once()
 
-	r.SubmitTxs()
+	assert.NoError(t, r.SubmitTxs())
 
 	// Both should be seen after successful submit
 	hasOld, err := store.Has(context.Background(), ds.NewKey(hashTx(txOld)))
@@ -186,7 +186,7 @@ func TestReaper_SubmitTxs_SequencerError_NoPersistence_NoNotify(t *testing.T) {
 	e := newTestExecutor(t)
 	r := newTestReaper(t, "chain-D", mockExec, mockSeq, e)
 
-	r.SubmitTxs()
+	assert.Error(t, r.SubmitTxs())
 
 	// Should not be marked seen
 	store := r.SeenStore()