Component: ghost-eye @ ee23e6b, src/network/legacy_rpc_calls.rs:157,191,264, src/network/predefined_txs.rs:121-141, src/errors.rs:43.
Description: app.rs fires Action::GetBlockRange on every node tick. The handler chain parses node-controlled strings with .expect/.unwrap/fixed slices: get_block_range (legacy_rpc_calls.rs:157) runs hex::decode(&hex_string[2..]).expect("Invalid hex string") on the offchain_localStorageGet result, then u64::decode(&mut cursor).expect("first valid"); a node returning "0x", "0", "0xzz", or a short hex string panics. The same pattern appears in get_rate_limit_delay (:191), get_stored_rpc_endpoints (:264, .unwrap()), and set_keys (predefined_txs.rs:121-141, fixed slices on the author_rotateKeys result). The custom panic hook in errors.rs:43 ends in std::process::exit(libc::EXIT_FAILURE), so any of these panics terminates the entire application immediately. The block-range path needs zero user interaction and re-fires every tick, so the app crash-loops on restart until the endpoint is changed.
Threat model: the tool is documented for localhost RPC, but --rpc-endpoint accepts any URL with no warning and the default transport is unencrypted ws://. A malicious public endpoint (or a ws MITM) can crash every connected ghost-eye at will, timed for example to a validator’s session-key rotation.
Impact: Availability-only on a local operator tool. No fund loss, no remote code execution.
Reproduction: Read the four sites above; mirror the parse logic locally and feed "0x", "0xzz", short hex, and 322-char non-hex inputs; observe panics. End-to-end over a live malicious node was not executed (outside local-only rules).
Severity: Low. Reason: availability-only impact on a local operator tool; requires the operator to point at a malicious endpoint (or a MITM on unencrypted ws).
Recommendation: Replace every .expect/.unwrap/fixed-slice on RPC-derived data with fallible parsing that logs an error and keeps the previous value. The codebase already does this correctly in most other RPC handlers (for example get_system_health).
Verification: VERIFIED (code read plus local parse-logic reproduction).