chore(release): v0.123 RC fixes (#1765, #1715, #1773, #1789)

backend/database_handler/accounts_manager.py

@@ -75,12 +75,19 @@ def create_new_account_with_address(
     def is_valid_address(self, address: str) -> bool:
         return is_address(address)
 
-    def get_account(self, account_address: str) -> CurrentState | None:
-        """Private method to retrieve an account from the data base"""
+    @staticmethod
+    def _normalize_address(account_address: str) -> str:
+        """Normalize to the checksum form used as the primary key, matching
+        get_account()/create_new_account_with_address(). Falls back to the
+        original value if checksumming fails."""
         try:
-            normalized = to_checksum_address(account_address)
+            return to_checksum_address(account_address)
         except Exception:
-            normalized = account_address
+            return account_address
+
+    def get_account(self, account_address: str) -> CurrentState | None:
+        """Private method to retrieve an account from the data base"""
+        normalized = self._normalize_address(account_address)
         account = (
             self.session.query(CurrentState)
             .filter(CurrentState.id == normalized)
@@ -114,27 +121,20 @@ def debit_account_balance(self, account_address: str, amount: int) -> bool:
         """Atomic conditional debit. Returns False if insufficient balance."""
         if amount <= 0:
             return True
-        try:
-            account_address = to_checksum_address(account_address)
-        except Exception:
-            pass
         result = self.session.execute(
             text(
                 "UPDATE current_state SET balance = balance - :amount "
                 "WHERE id = :addr AND balance >= :amount"
             ),
-            {"amount": amount, "addr": account_address},
+            {"amount": amount, "addr": self._normalize_address(account_address)},
         )
         return result.rowcount > 0
 
     def credit_account_balance(self, account_address: str, amount: int):
         """Atomic credit. Creates account if it doesn't exist."""
         if amount <= 0:
             return
-        try:
-            account_address = to_checksum_address(account_address)
-        except Exception:
-            pass
+        account_address = self._normalize_address(account_address)
         self.session.execute(
             text(
                 "INSERT INTO current_state (id, data, balance) "
@@ -158,6 +158,7 @@ def credit_tx_value_once(
         Sets value_credited=true atomically. Returns True if credit was applied."""
         if amount <= 0:
             return False
+        target_address = self._normalize_address(target_address)
         # Ensure target account exists
         self.session.execute(
             text(

backend/protocol_rpc/endpoints.py

@@ -17,6 +17,9 @@
     NotFoundError,
     QueueDepthExceeded,
 )
+from backend.protocol_rpc.redaction import (
+    sanitize_rpc_private_keys as _sanitize_rpc_private_keys,
+)
 from backend.protocol_rpc.contract_storage_quota import (
     enforce_contract_storage_quota,
     live_state_column_size,
@@ -167,40 +170,6 @@ def __init__(
 _gen_call_singleflight_lock = asyncio.Lock()
 
 
-def _show_validator_private_keys_in_rpc() -> bool:
-    return os.getenv("SHOW_VALIDATOR_PRIVATE_KEYS_IN_RPC", "").strip().lower() in {
-        "1",
-        "true",
-        "yes",
-        "on",
-    }
-
-
-def _is_private_key_field(key: Any) -> bool:
-    if not isinstance(key, str):
-        return False
-    normalized = key.replace("_", "").replace("-", "").lower()
-    return normalized == "privatekey" or normalized.endswith("privatekey")
-
-
-def _sanitize_rpc_private_keys(value: Any) -> Any:
-    """Return RPC data with private-key fields removed unless explicitly enabled."""
-    if _show_validator_private_keys_in_rpc():
-        return value
-
-    if isinstance(value, dict):
-        return {
-            key: _sanitize_rpc_private_keys(item)
-            for key, item in value.items()
-            if not _is_private_key_field(key)
-        }
-    if isinstance(value, list):
-        return [_sanitize_rpc_private_keys(item) for item in value]
-    if isinstance(value, tuple):
-        return tuple(_sanitize_rpc_private_keys(item) for item in value)
-    return value
-
-
 def _check_rate_limit(address: str) -> None:
     """Reject if address exceeds rate limit. Prunes old entries."""
     now = time.monotonic()
@@ -575,6 +544,8 @@ def fund_account(
     if normalized_amount <= 0:
         raise InvalidParams(message="amount must be a positive integer")
 
+    account_address = eth_utils.to_checksum_address(account_address)
+
     import secrets
 
     nonce = transactions_processor.get_transaction_count(None)
@@ -1616,7 +1587,9 @@ async def sim_call(
             genvm_manager,
             params,
         )
-    return TransactionsProcessor._json_safe_numbers(receipt.to_dict())
+    return TransactionsProcessor._json_safe_numbers(
+        _sanitize_rpc_private_keys(receipt.to_dict())
+    )
 
 
 async def sim_estimate_transaction_fees(
@@ -1920,7 +1893,10 @@ async def execute(active_fee_accounting):
         raise JSONRPCError(
             code=-32000,
             message="execution failed",
-            data={"receipt": receipt.to_dict(), "params": params},
+            data={
+                "receipt": _sanitize_rpc_private_keys(receipt.to_dict()),
+                "params": params,
+            },
         )
 
     return receipt
@@ -2474,7 +2450,9 @@ async def eth_call(
 
     if receipt.execution_result != ExecutionResultStatus.SUCCESS:
         raise JSONRPCError(
-            code=-32000, message="execution failed", data={"receipt": receipt.to_dict()}
+            code=-32000,
+            message="execution failed",
+            data={"receipt": _sanitize_rpc_private_keys(receipt.to_dict())},
         )
     return eth_utils.hexadecimal.encode_hex(receipt.result[1:])
 

backend/protocol_rpc/explorer/queries.py

@@ -16,6 +16,7 @@
     TransactionStatus,
     Validators,
 )
+from backend.protocol_rpc.redaction import sanitize_rpc_private_keys
 
 
 def _serialize_tx(
@@ -30,7 +31,7 @@ def _serialize_tx(
         "to_address": tx.to_address,
         "input_data": tx.input_data,
         "data": tx.data,
-        "consensus_data": tx.consensus_data,
+        "consensus_data": sanitize_rpc_private_keys(tx.consensus_data),
         "nonce": tx.nonce,
         "value": tx.value,
         "type": tx.type,
@@ -42,14 +43,16 @@ def _serialize_tx(
         "s": tx.s,
         "v": tx.v,
         "appeal_failed": tx.appeal_failed,
-        "consensus_history": tx.consensus_history,
+        "consensus_history": sanitize_rpc_private_keys(tx.consensus_history),
         "timestamp_appeal": tx.timestamp_appeal,
         "appeal_processing_time": tx.appeal_processing_time,
         "config_rotation_rounds": tx.config_rotation_rounds,
         "num_of_initial_validators": tx.num_of_initial_validators,
         "last_vote_timestamp": tx.last_vote_timestamp,
         "rotation_count": tx.rotation_count,
-        "leader_timeout_validators": tx.leader_timeout_validators,
+        "leader_timeout_validators": sanitize_rpc_private_keys(
+            tx.leader_timeout_validators
+        ),
         "sim_config": tx.sim_config,
         "triggered_by_hash": tx.triggered_by_hash,
         "triggered_on": tx.triggered_on,

backend/protocol_rpc/redaction.py

@@ -0,0 +1,44 @@
+"""Redaction of validator private keys from RPC-facing payloads.
+
+Receipts carry the executing validator's ``node_config`` (including its
+``private_key``); anything that returns a receipt to a client must pass
+through :func:`sanitize_rpc_private_keys`. Shared by the JSON-RPC endpoints and
+the explorer REST API.
+"""
+
+import os
+from typing import Any
+
+
+def show_validator_private_keys_in_rpc() -> bool:
+    return os.getenv("SHOW_VALIDATOR_PRIVATE_KEYS_IN_RPC", "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+        "on",
+    }
+
+
+def is_private_key_field(key: Any) -> bool:
+    if not isinstance(key, str):
+        return False
+    normalized = key.replace("_", "").replace("-", "").lower()
+    return normalized == "privatekey" or normalized.endswith("privatekey")
+
+
+def sanitize_rpc_private_keys(value: Any) -> Any:
+    """Return RPC data with private-key fields removed unless explicitly enabled."""
+    if show_validator_private_keys_in_rpc():
+        return value
+
+    if isinstance(value, dict):
+        return {
+            key: sanitize_rpc_private_keys(item)
+            for key, item in value.items()
+            if not is_private_key_field(key)
+        }
+    if isinstance(value, list):
+        return [sanitize_rpc_private_keys(item) for item in value]
+    if isinstance(value, tuple):
+        return tuple(sanitize_rpc_private_keys(item) for item in value)
+    return value

docker-compose.yml

@@ -257,7 +257,7 @@ services:
     profiles: ["ollama"]
     image: ollama/ollama:0.17.6
     ports:
-      - 11434:11434
+      - "127.0.0.1:11434:11434"
     volumes:
       - ./.ollama:/root/.ollama
     container_name: ollama
@@ -275,7 +275,7 @@ services:
     image: postgres:16-alpine
     command: sh -c "if [ \"$REMOTE_DATABASE\" = \"true\" ]; then echo 'Postgres disabled in hosted environment' && exec tail -f /dev/null; else exec docker-entrypoint.sh postgres; fi"
     ports:
-      - "${DBHOSTPORT:-5432}:5432"
+      - "127.0.0.1:${DBHOSTPORT:-5432}:5432"
     environment:
       - POSTGRES_USER=${DBUSER}
       - POSTGRES_PASSWORD=${DBPASSWORD}
@@ -429,7 +429,7 @@ services:
   redis:
     image: redis:8-alpine
     ports:
-      - "${REDISPORT:-6379}:6379"
+      - "127.0.0.1:${REDISPORT:-6379}:6379"
     volumes:
       - redis_data:/data
     healthcheck: