# \[ghost-eye\] Malformed RPC responses panic the app; crash loop on restart via the per-tick block-range fetch
**URL:** https://ghostforum.org/t/ghost-eye-malformed-rpc-responses-panic-the-app-crash-loop-on-restart-via-the-per-tick-block-range-fetch/175
**Category:** Submitted
**Tags:** ghost-eye
**Created:** [October 9, 2026, 2:50am UTC](https://ghostforum.org/t/ghost-eye-malformed-rpc-responses-panic-the-app-crash-loop-on-restart-via-the-per-tick-block-range-fetch/175 "2026-10-09T02:50:59Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Rusdiwireng](https://ghostforum.org/u/Rusdiwireng)
#### Post date: [October 9, 2026, 2:50am UTC](https://ghostforum.org/t/ghost-eye-malformed-rpc-responses-panic-the-app-crash-loop-on-restart-via-the-per-tick-block-range-fetch/175/1 "2026-10-09T02:50:59Z")
**Component:** `ghost-eye` @ `ee23e6b`, `src/network/legacy_rpc_calls.rs:157,191,264`, `src/network/predefined_txs.rs:121-141`, `src/errors.rs:43`.
**Description:** `app.rs` fires `Action::GetBlockRange` on every node tick. The handler chain parses node-controlled strings with `.expect`/`.unwrap`/fixed slices: `get_block_range` (`legacy_rpc_calls.rs:157`) runs `hex::decode(&hex_string[2..]).expect("Invalid hex string")` on the `offchain_localStorageGet` result, then `u64::decode(&mut cursor).expect("first valid")`; a node returning `"0x"`, `"0"`, `"0xzz"`, or a short hex string panics. The same pattern appears in `get_rate_limit_delay` (`:191`), `get_stored_rpc_endpoints` (`:264`, `.unwrap()`), and `set_keys` (`predefined_txs.rs:121-141`, fixed slices on the `author_rotateKeys` result). The custom panic hook in `errors.rs:43` ends in `std::process::exit(libc::EXIT_FAILURE)`, so any of these panics terminates the entire application immediately. The block-range path needs zero user interaction and re-fires every tick, so the app crash-loops on restart until the endpoint is changed.
**Threat model:** the tool is documented for localhost RPC, but `--rpc-endpoint` accepts any URL with no warning and the default transport is unencrypted `ws://`. A malicious public endpoint (or a ws MITM) can crash every connected ghost-eye at will, timed for example to a validator’s session-key rotation.
**Impact:** Availability-only on a local operator tool. No fund loss, no remote code execution.
**Reproduction:** Read the four sites above; mirror the parse logic locally and feed `"0x"`, `"0xzz"`, short hex, and 322-char non-hex inputs; observe panics. End-to-end over a live malicious node was not executed (outside local-only rules).
**Severity: Low.** Reason: availability-only impact on a local operator tool; requires the operator to point at a malicious endpoint (or a MITM on unencrypted ws).
**Recommendation:** Replace every `.expect`/`.unwrap`/fixed-slice on RPC-derived data with fallible parsing that logs an error and keeps the previous value. The codebase already does this correctly in most other RPC handlers (for example `get_system_health`).
**Verification:** VERIFIED (code read plus local parse-logic reproduction).
---
### Author:  [@VoidDragon](https://ghostforum.org/u/VoidDragon)
#### Post date: [October 11, 2026, 3:17pm UTC](https://ghostforum.org/t/ghost-eye-malformed-rpc-responses-panic-the-app-crash-loop-on-restart-via-the-per-tick-block-range-fetch/175/2 "2026-10-11T15:17:45Z")
Thank you for your report!
`ghost-eye` was intended to work only with `localhost`, but you’re right that it could be used in the way you describe. I believe this could be fixed in an upcoming release.
---
### Author:  [@system](https://ghostforum.org/u/system)
#### Post date: [October 14, 2026, 3:17pm UTC](https://ghostforum.org/t/ghost-eye-malformed-rpc-responses-panic-the-app-crash-loop-on-restart-via-the-per-tick-block-range-fetch/175/3 "2026-10-14T15:17:53Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.