Security: remove internal-tx-pool API exposure and restrict faucet nginx proxy

[Copilot]

Two high-severity security issues: archive nodes expose the pending tx pool to the public internet, enabling MEV attacks; the faucet nginx config acts as an open proxy to all backend /api/* paths.

Changes

• Remove internal-tx-pool from eth-apis in both archive node config.json files
  • Prevents external callers from inspecting mempool state for front-running/sandwich attacks
  • Affected chains: 2PDRxzc6jMbZSTLb3sufkVszgQc2jtDnYZGtDTAAfom1CTwPsE, 2oo5UvYgFQikM7KBsMXFQE3RQv3xAFFc8JY2GEBNBF1tp4JaeZ

"eth-apis": ["eth", "eth-filter", "net", "web3",
             "internal-eth", "internal-blockchain",
             "internal-transaction", "debug-tracer"]

• Restrict faucet nginx proxy to exact path (faucet/default)
  • Replaces the wildcard location /api/ prefix match with an exact-match location = /api/claim, blocking unintended forwarding of /api/admin, /api/debug, etc.

# Before
location /api/ { proxy_pass http://faucet; }

# After
location = /api/claim { proxy_pass http://faucet; }

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Security][High] Internal-tx-pool API exposure enables MEV attacks; faucet nginx open proxy risk</issue_title>
<issue_description>## Summary

Two high-severity security findings related to API surface exposure:

1. internal-tx-pool API exposed on archive nodes enables transaction front-running

Files:

• avalanchego/configs/chains/2PDRxzc6jMbZSTLb3sufkVszgQc2jtDnYZGtDTAAfom1CTwPsE/config.json (line 12)
• avalanchego/configs/chains/2oo5UvYgFQikM7KBsMXFQE3RQv3xAFFc8JY2GEBNBF1tp4JaeZ/config.json (line 12)

Both archive node configurations expose internal-tx-pool in the eth-apis list. This is distinct from the debug-tracer API covered by #125. The internal-tx-pool API exposes the pending transaction pool state, enabling:

• MEV (Maximal Extractable Value) attacks: Front-running, sandwich attacks, and transaction censorship
• Combined with --http-host=0.0.0.0 and --http-allowed-hosts="*" (documented in README), any external user can query the mempool

Fix: Remove "internal-tx-pool" from the eth-apis list in both archive node config.json files. If needed for internal tooling, place behind an authenticated proxy.

2. Faucet nginx /api/ proxy lacks path restriction

File: faucet/default (lines 127-129)

The faucet nginx configuration uses proxy_pass http://faucet; without path restrictions. The location /api/ block proxies ALL requests under /api/ to the upstream faucet server. This means /api/admin, /api/debug, /api/config or any other paths are forwarded to the backend.

Fix: Add explicit path restrictions to only proxy known faucet API routes. Use location = /api/claim or a whitelist approach for allowed API paths.

Impact

• MEV risk: Attackers can inspect pending transactions and front-run or sandwich them
• Open proxy: If the faucet backend exposes admin endpoints, they become publicly accessible

Suggested Fix

// config.json - remove "internal-tx-pool" from eth-apis
"eth-apis": [
    "eth",
    "eth-filter",
    "net",
    "web3",
    "debug-tracer",  // also being addressed by numbersprotocol/numbers-network#125
    // REMOVE: "internal-tx-pool"
    "internal-blockchain",
    "internal-transaction"
]

# faucet/default - restrict /api/ proxy paths
location = /api/claim {
    proxy_pass http://faucet;
}

Generated by Health Monitor with Omni</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Security][High] Internal-tx-pool API exposure enables MEV attacks; faucet nginx open proxy risk #129

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.