Security (EVM-08): No HTTPS validation on BSC_RPC_URLS or TERRA_LCD_URL

Brouie commented

2026-04-21 08:14:12 +00:00

(Migrated from gitlab.com)

@PlasticDigits finding from security review on #5.

Severity

Medium. MITM risk if HTTP URL accidentally configured.

Description

oracle-service/src/config.rs Config::from_env accepts BSC_RPC_URLS and TERRA_LCD_URL as arbitrary strings. No scheme validation.

let bsc_rpc_urls = crate::evm_rpc::parse_comma_separated_rpc_urls(&bsc_raw);
...
terra_lcd_url: std::env::var("TERRA_LCD_URL").map_err(|_| eyre!("TERRA_LCD_URL is required"))?,

Nothing rejects http:// URLs.

Why this matters

An HTTP RPC is trivially man-in-the-middleable by any network-adjacent attacker. They can:

Forge exchangeRateStored responses from BSC (rate manipulation, pairs with EVM-01/EVM-03)
Forge StateResponse from Terra LCD (policy bypass — service thinks last update was hours ago when it wasn't, or current rate is different)
Swallow the broadcast response and hide tx failure

With the CL8Y bridge incident this month (VPS cryptominer via exposed postgres) demonstrating the reality of infrastructure compromise, defensive config validation is worth the one-line check.

Recommendation

Add scheme validation in Config::from_env:

for url in &bsc_rpc_urls {
    if !url.starts_with("https://") {
        return Err(eyre!("BSC_RPC_URLS must use https://: {}", url));
    }
}
if !terra_lcd_url.starts_with("https://") {
    return Err(eyre!("TERRA_LCD_URL must use https://"));
}

Optionally allow http://localhost / http://127.0.0.1 for local development, gated behind a DEV_ALLOW_HTTP=1 env flag.

Review parent: #5

@PlasticDigits finding from security review on #5. ## Severity Medium. MITM risk if HTTP URL accidentally configured. ## Description `oracle-service/src/config.rs` `Config::from_env` accepts `BSC_RPC_URLS` and `TERRA_LCD_URL` as arbitrary strings. No scheme validation. ```rust let bsc_rpc_urls = crate::evm_rpc::parse_comma_separated_rpc_urls(&bsc_raw); ... terra_lcd_url: std::env::var("TERRA_LCD_URL").map_err(|_| eyre!("TERRA_LCD_URL is required"))?, ``` Nothing rejects `http://` URLs. ## Why this matters An HTTP RPC is trivially man-in-the-middleable by any network-adjacent attacker. They can: - Forge `exchangeRateStored` responses from BSC (rate manipulation, pairs with EVM-01/EVM-03) - Forge `StateResponse` from Terra LCD (policy bypass — service thinks last update was hours ago when it wasn't, or current rate is different) - Swallow the broadcast response and hide tx failure With the CL8Y bridge incident this month (VPS cryptominer via exposed postgres) demonstrating the reality of infrastructure compromise, defensive config validation is worth the one-line check. ## Recommendation Add scheme validation in `Config::from_env`: ```rust for url in &bsc_rpc_urls { if !url.starts_with("https://") { return Err(eyre!("BSC_RPC_URLS must use https://: {}", url)); } } if !terra_lcd_url.starts_with("https://") { return Err(eyre!("TERRA_LCD_URL must use https://")); } ``` Optionally allow `http://localhost` / `http://127.0.0.1` for local development, gated behind a `DEV_ALLOW_HTTP=1` env flag. ## Related - Review parent: #5

Brouie commented

2026-04-21 08:17:08 +00:00

(Migrated from gitlab.com)

mentioned in issue #5

PlasticDigits commented

2026-04-21 13:48:44 +00:00

(Migrated from gitlab.com)

Resolution

This is addressed on main (commit 673ac745, part of the oracle-service hardening that landed with mnemonic-safe Debug for Config).

What changed

Config::from_env parses each BSC_RPC_URLS entry and TERRA_LCD_URL with the url crate and requires scheme https.
Optional local dev: set DEV_ALLOW_HTTP to 1, true, or yes to allow http:// only for hosts localhost, 127.0.0.1, or ::1 (avoids MITM in production while keeping Anvil/local LCD workflows).

Files

oracle-service/src/config.rs — validate_https_url, dev_allow_http
oracle-service/Cargo.toml — url dependency

Workspace tests: cargo test -p ust1-oracle-service passes.

If anything is still missing for your deployment docs or CI env samples, say what to update.

## Resolution This is addressed on `main` (commit `673ac745`, part of the oracle-service hardening that landed with mnemonic-safe `Debug` for `Config`). ### What changed - `Config::from_env` parses each `BSC_RPC_URLS` entry and `TERRA_LCD_URL` with the `url` crate and requires scheme `https`. - Optional local dev: set `DEV_ALLOW_HTTP` to `1`, `true`, or `yes` to allow `http://` only for hosts `localhost`, `127.0.0.1`, or `::1` (avoids MITM in production while keeping Anvil/local LCD workflows). ### Files - `oracle-service/src/config.rs` — `validate_https_url`, `dev_allow_http` - `oracle-service/Cargo.toml` — `url` dependency Workspace tests: `cargo test -p ust1-oracle-service` passes. If anything is still missing for your deployment docs or CI env samples, say what to update.

PlasticDigits commented

2026-04-21 13:49:58 +00:00

(Migrated from gitlab.com)

@Brouie Could you verify that the HTTPS / DEV_ALLOW_HTTP behavior in oracle-service/src/config.rs matches what you had in mind for EVM-08 (#10)? If anything should be tightened or documented differently for operators, let us know.

@Brouie Could you verify that the HTTPS / `DEV_ALLOW_HTTP` behavior in `oracle-service/src/config.rs` matches what you had in mind for EVM-08 (#10)? If anything should be tightened or documented differently for operators, let us know.

PlasticDigits commented

2026-04-21 13:54:45 +00:00

(Migrated from gitlab.com)

Resolved on main: oracle-service/src/config.rs validates BSC_RPC_URLS and TERRA_LCD_URL with Url::parse + validate_https_url; DEV_ALLOW_HTTP allows http:// only for localhost / 127.0.0.1 / ::1. Supersedes topic branch fix/issue-10-https-validation (same intent; current main has additional oracle hardening).

PlasticDigits commented

2026-04-21 13:55:30 +00:00

(Migrated from gitlab.com)

assigned to @Brouie

PlasticDigits commented

2026-04-21 13:55:31 +00:00

(Migrated from gitlab.com)

@brouie Please verify the HTTPS validation on main in oracle-service/src/config.rs (validate_https_url, DEV_ALLOW_HTTP for loopback). I had closed this as implemented; leaving the issue open until you confirm it meets EVM-08.

@brouie Please verify the HTTPS validation on `main` in `oracle-service/src/config.rs` (`validate_https_url`, `DEV_ALLOW_HTTP` for loopback). I had closed this as implemented; leaving the issue open until you confirm it meets EVM-08.

Brouie commented

2026-04-22 00:35:35 +00:00

(Migrated from gitlab.com)

@PlasticDigits verified fix in the same config.rs overhaul (affects both BSC_RPC_URLS and TERRA_LCD_URL).

validate_https_url in oracle-service/src/config.rs:

HTTPS required by default
DEV_ALLOW_HTTP=1 env flag gates HTTP exception
HTTP only permitted for loopback hosts (localhost, 127.0.0.1, ::1) even when DEV_ALLOW_HTTP is set
url::Url parse validation catches malformed URLs before scheme check
Applied to every BSC_RPC_URLS entry + the TERRA_LCD_URL
Clear error messages with field name + actual value

Exactly matches the recommendation, including the DEV_ALLOW_HTTP loopback escape hatch. Closing.

@PlasticDigits verified fix in the same config.rs overhaul (affects both BSC_RPC_URLS and TERRA_LCD_URL). `validate_https_url` in `oracle-service/src/config.rs`: - HTTPS required by default - `DEV_ALLOW_HTTP=1` env flag gates HTTP exception - HTTP only permitted for loopback hosts (`localhost`, `127.0.0.1`, `::1`) even when DEV_ALLOW_HTTP is set - `url::Url` parse validation catches malformed URLs before scheme check - Applied to every BSC_RPC_URLS entry + the TERRA_LCD_URL - Clear error messages with field name + actual value Exactly matches the recommendation, including the DEV_ALLOW_HTTP loopback escape hatch. Closing.

Brouie (Migrated from gitlab.com) closed this issue

2026-04-22 00:35:38 +00:00

Rows
Columns

Security (EVM-08): No HTTPS validation on BSC_RPC_URLS or TERRA_LCD_URL #10

Severity

Description

Why this matters

Recommendation

Related

Resolution

What changed

Files