evstack / evstack/ev-node

p2p: allowed_peers list propagated network-wide instead of being local to the node

Open
#3,254 0 comments 0 reactions 0 assignees View on GitHub
C:p2p
Dominant language
Go
Stars
361
Forks
280
Avg merge
2d 14h
Merged PRs (30d)
10

Description

Sequencer version : `v1.1.0-rc.1`

## Description

When running a sequencer node with `--allowed_peers=fullnode-1,fullnode-2`, the allowed peers list appears to be propagated to the rest of the network. As a result, other fullnodes that try to connect via P2P to `fullnode-1` or `fullnode-2` are rejected, even though those fullnodes never set `allowed_peers` themselves.

## Expected Behavior

The `allowed_peers` configuration should be **local** to the node that runs the argument. It should only restrict which peers *that specific node* accepts connections from. It must not be advertised or enforced on other nodes in the network.

## Actual Behavior

The `allowed_peers` list set on the sequencer is propagated across the network. Nodes that did not set `allowed_peers` still refuse connections from nodes not on the sequencer's list.

## Network Topology

The following diagram illustrates the affected network and the expected isolation of the `allowed_peers` constraint:

```
Eden Testnet Network
┌─────────────────────────────────────────────────────────────────────┐
│ │
│ ┌───────────────────────────────┐ │
│ │ Sequencer │ │
│ │ allowed_peers=fullnode-1, │ │
│ │ fullnode-2 │ │
│ └──────────────┬────────────────┘ │
│ │ P2P │
│ ┌────────┴────────┐ │
│ │ │ │
│ ┌─────▼──────┐ ┌──────▼─────┐ │
│ │ fullnode-1 │ │ fullnode-2 │ │
│ └─────┬──────┘ └──────┬─────┘ │
│ │ │ │
│ │ P2P (EXPECTED) │ P2P (EXPECTED) │
│ │ │ │
│ ┌─────▼─────────────────▼─────┐ │
│ │ new-fullnode-N ... │ │
│ │ (unable to connect — BUG) │ │
│ └─────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘

Legend:
──► P2P connection (established / expected)
BUG: new-fullnode-N cannot connect to fullnode-1 or fullnode-2
because the sequencer's allowed_peers list is enforced there
```

### Intended behavior (allowed_peers should be local)

```
Sequencer ←──(only accepts fullnode-1, fullnode-2)──► fullnode-1
──► fullnode-2

fullnode-1 ←──(no restriction; accepts any peer)──► new-fullnode-N
fullnode-2 ←──(no restriction; accepts any peer)──► new-fullnode-N
```

## Steps to Reproduce

1. Start a network with: sequencer, fullnode-1, fullnode-2.
2. Run the sequencer with `--allowed_peers=fullnode-1,fullnode-2`.
3. Attempt to join a new fullnode that connects via P2P to fullnode-1 or fullnode-2.
4. Observe: the new fullnode is rejected by fullnode-1/fullnode-2 despite them not having `allowed_peers` set.

## Environment

- Network: eden-testnet
- Observed: week of 2026-04-14

## Impact

Any new node attempting to sync via fullnode-1 or fullnode-2 is silently blocked, making fullnode only syncing through DA unless modifying the sequencer's `allowed_peers` list.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.