Called out in RFC-27's Impact section (tracker: #4194). Independent of the rest of the work.
check_accesspass looks up the AccessPass PDA at (client_ip, payer) only. A holder of a wildcard pass — stored at 0.0.0.0, including the EdgeSeat passes from the shred-oracle — has no pass at their specific IP, so the pre-flight check reports no valid AccessPass and connect bails before it ever reaches the program, which would have accepted them.
Two copies exist and the comment on each says to keep them in sync:
smartcontract/cli/src/requirements.rs:87crates/doublezero-daemon-cli/src/connect.rs:147
What
Fall back to the Ipv4Addr::UNSPECIFIED PDA when the specific-IP lookup misses, applying the same epoch validity check. Consider collapsing the two copies into one shared helper while touching both.
Acceptance
- Tests: specific-IP pass found; no specific pass but a valid dynamic pass; neither; dynamic pass present but epoch-expired.
Called out in RFC-27's Impact section (tracker: #4194). Independent of the rest of the work.
check_accesspasslooks up the AccessPass PDA at(client_ip, payer)only. A holder of a wildcard pass — stored at0.0.0.0, including theEdgeSeatpasses from the shred-oracle — has no pass at their specific IP, so the pre-flight check reports no valid AccessPass andconnectbails before it ever reaches the program, which would have accepted them.Two copies exist and the comment on each says to keep them in sync:
smartcontract/cli/src/requirements.rs:87crates/doublezero-daemon-cli/src/connect.rs:147What
Fall back to the
Ipv4Addr::UNSPECIFIEDPDA when the specific-IP lookup misses, applying the same epoch validity check. Consider collapsing the two copies into one shared helper while touching both.Acceptance