fix: network-selection safety — flag chimera, anchor sanity gate, per-network gateway, t-address prefix - #145
Merged
Merged
Conversation
… per-network gateway + address prefix Four related footguns found while standing up a calibration node on the cluster (2026-07-23): 1. CLI flag chimera: daemon/beacon/auth use --network for the FILECOIN network, but init/doctor used --network for the F3 wire name. 'lantern init --network calibration' produced a mainnet data dir + mainnet bootstrap sources + a 'calibration' F3 protocol name, and wrote a WRONG-NETWORK trust anchor claiming success. init/doctor now interpret filecoin-network values passed via --network as --filecoin-network (resolveNetworkFlags, shared). 2. No anchor sanity gate: the chimera above anchored to an F3 cert ~392k epochs (~136 days) behind the wall-clock expected head and still declared quorum success. Filecoin epochs are wall-clock scheduled, so the expected epoch is computable from genesis time alone: init now refuses to write an anchor >2880 epochs (24h) from expected (--allow-stale-anchor overrides). build.Network gains GenesisUnix() + ExpectedHeadEpoch() with a unit test pinned to live observations from both networks. 3. Wrong-network gateway poisoning: the daemon raced the MAINNET gateway into the fetch chain on every network. On calibration each cold-block fetch burned the gateway's full race timeout before a correct source was tried, starving state reads (WalletBalance timed out >60s live). Calibration now disables the default gateway (explicit --gateway still honored) and the fetch chain skips the gateway source when unset. 4. Address prefix: address.CurrentNetwork was never set, so calibration nodes printed f-prefixed addresses. Faucets/explorers on calibration expect t-prefix. daemon + init now set the prefix from the network (matching lotus).
This was referenced Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found live while standing up a calibration node (2026-07-23). Full story in the commit message; short version:
1.
init --network calibrationbuilt a mainnet/calibration chimerainit/doctor's
--networkmeant F3 wire name, while daemon/beacon/auth's--networkmeans Filecoin network. The obvious command produced: mainnet data dir + mainnet bootstrap sources +/f3/certexch/get/1/calibrationprotocol probes + f-prefixed wallet + a wrong-network trust anchor written with '✓ Quorum reached'. Filecoin-network values via--networkare now interpreted as--filecoin-network(sharedresolveNetworkFlags).2. Anchor sanity gate (the scary one)
The chimera anchored to an F3 cert 392k epochs (~136 days) behind wall-clock and still claimed success. Epochs are wall-clock scheduled, so expected-head is computable from genesis alone. init now refuses anchors >2880 epochs from expected (
--allow-stale-anchorto override). Newbuild.Network.GenesisUnix()/.ExpectedHeadEpoch()+ test pinned to live head observations from both networks.3. Wrong-network gateway poisoned the calibration fetch chain
The MAINNET gateway was raced into every network's fetch chain. On calibration each cold fetch burned the gateway's race timeout first: live effect was
WalletBalancetiming out >60s on a synced node. Calibration now disables the default gateway (explicit--gatewayhonored); fetch chain skips the source when unset.4. f-prefix addresses on calibration
address.CurrentNetworkwas never set. Calibration wallets printedf3...; faucets/explorers expectt3.... daemon + init now set the prefix per network (lotus behavior).Evidence
data/calibration/bootstrap-anchor.jsonat epoch 3916341 (live calibration head)go build ./... && go vet && go test -short ./cmd/lantern ./buildgreen